Module sudo 

Resolve how the harness gains root to load the scheduler, and build the privileged commands. Ported from the Python harness’s setup_sudo.

Precedence:

1. already root -> run directly, no sudo
2. $SUDO_ASKPASS set -> sudo -A (use the caller’s askpass)
3. password file (from the spec via resolve(), or from $SCX_SUDO_PASSWORD_FILE) -> generate an askpass shim that prints the file’s contents and use sudo -A; the password stays in the file and never appears in argv or the process table. The shim path is exported to spawned sudo commands only (via Command::env), never to the agent’s own environment.
4. otherwise -> sudo -n (passwordless / cached credentials)

Re-exports

use std::os::unix::fs::PermissionsExt; 🔒

use std::path::Path; 🔒

use std::path::PathBuf; 🔒

use std::process::Command; 🔒

use anyhow::Context; 🔒

use anyhow::Result; 🔒

Structs

Sudo

Resolved sudo strategy: the argv prefix plus any owned askpass shim.

TempShim 🔒

A generated askpass shim, removed from disk when dropped (replaces atexit).

Functions

shell_quote 🔒

Single-quote a path for safe embedding in a /bin/sh script.