[roodboi]

Problem

On a real macOS desktop Terminal, the native candidate built from next at 63b614f ran hack-v5 doctor --fix. It showed the hack.local repair confirmation (#316), and the user answered yes. The output then printed sudo: a password is required without ever showing a password prompt. The repair then reported Repair refused (declined): The hack.local repair was not authorized; nothing changed.

Root cause

• The spinner erased the prompt. handleNativeDoctor starts one clack spinner ("Checking the active native HTTPS root...") and keeps it running through every check, including the --fix repairs. The spinner redraws every 80 ms with ESC[1G ESC[J (go to column 1, erase to the end of the screen). sudo's Password: prompt was erased within one frame. I reproduced this in a pseudo-terminal with a fake sudo on PATH: the transcript shows Password: followed at once by ESC[1G ESC[J and a new spinner frame.
• Process groups were not the cause. runWithTerminalGroup correctly made the sudo child the terminal's foreground process group: in the reproduction, tpgid == pgid for the sudo child.
• No sudo -n ran before the prompt. Every sudo -n step in the repair (resolver script, launchctl kickstart, cache flush) runs only after authorize succeeds, and its stderr is captured to files.
• Where the message came from. In sudo 1.9.17p2 (the version on m3), log_auth_failure prints a password is required for any authentication failure without FLAG_BAD_PASSWORD. That includes a first password read that was interrupted or timed out (AUTH_INTR with ntries == 0). So the user, seeing only a spinner, was left at an invisible prompt until the 120 s run timeout (or an interrupt) cancelled it. sudo then printed that line.
• Why it said "declined". authorize returned false for any non-zero sudo -v exit, and the repair mapped false to declined.

Fix

• src/lib/terminal-handoff.ts: pausableSpinner and withTerminalHandoff. A repair claims the terminal at its first prompt. The spinner is erased and stays off through the administrator prompt and every later sudo -n step, then resumes once (also on throw). Doctor uses this for both the hack.local repair and the native CA repair (extracted as repairNativeCaTrustCheck). Repairs were already run one at a time; no doctor step runs at the same time as a repair.
• src/lib/admin-authorization.ts: one shared sudo -v helper for the hack.local repair/rollback, the native CA repair and native global dns activate/deactivate. It refuses before running sudo when Hack is not the terminal's foreground job. It classifies a failure as timed-out, interrupted or rejected and never uses -n.
• The hack.local authorize dependency now returns approved | declined | authorization-failed. A new closed refusal, authorization-failed, names the cause and suggests Run "sudo -v" in this terminal first, then rerun: …. Only answering no is declined. The CA repair and DNS activation throw errors that name the cause and include the same hint, instead of "was not completed" or "was denied".
• docs/guides/native-candidate.md: documents that the spinner pauses, the new refusal reason, and the sudo message.

Validation

• Focused suites, tests/integration-ownership.test.ts, the native DNS activate/deactivate/host suites, global-command.macos, doctor-command and prerelease-plan: 229 pass, 2 skip, 0 fail.
• bun run --cwd packages/cli typecheck: clean. bun run --cwd packages/cli check: 0 errors. Its 34 warnings are all in files this PR does not touch; the changed files have no diagnostics.
• Tests inject runners, terminal-foreground state and spinners. They never run real sudo or osascript, and never touch system files or the keychain. They cover:
  • the spinner is paused before the prompt and resumed after;
  • the prompt runs before every privileged sudo -n step;
  • a failed sudo -v is authorization-failed, not declined;
  • a no at the confirmation never reaches sudo;
  • a non-interactive run declines without prompting or pausing;
  • a background run refuses before sudo.
• Mutation check: I made 13 targeted changes that each break the fix (skip the handoff in either repair, map a failure to declined, prompt for sudo before confirming, drop the foreground check, pass -n, misclassify a timeout, never resume the spinner, prepare the restart before authorizing, install after a failed prompt). The tests caught all 13.
• Manual check in a pseudo-terminal with a fake sudo (not real sudo): before the fix, the spinner wiped Password:. After the fix, Password: stays visible and the spinner resumes only after sudo exits.

Remaining gaps

• Not yet run against real sudo in a desktop Terminal. Rebuild the candidate from this branch and run doctor --fix on m3 to confirm the real prompt (or Touch ID sheet, since pam_tid is enabled there) is visible and the repair completes.
• Draft only; not merged or released.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}