diff --git a/README.md b/README.md
index 19188f7a..93c3971d 100644
--- a/README.md
+++ b/README.md
@@ -33,11 +33,11 @@ USAGE
 * [`codify plugins`](#codify-plugins)
 * [`codify plugins:install PLUGIN...`](#codify-pluginsinstall-plugin)
 * [`codify plugins:inspect PLUGIN...`](#codify-pluginsinspect-plugin)
-* [`codify plugins:install PLUGIN...`](#codify-pluginsinstall-plugin-1)
+* [`codify plugins:install PLUGIN...`](#codify-pluginsinstall-plugin)
 * [`codify plugins:link PLUGIN`](#codify-pluginslink-plugin)
 * [`codify plugins:uninstall PLUGIN...`](#codify-pluginsuninstall-plugin)
-* [`codify plugins:uninstall PLUGIN...`](#codify-pluginsuninstall-plugin-1)
-* [`codify plugins:uninstall PLUGIN...`](#codify-pluginsuninstall-plugin-2)
+* [`codify plugins:uninstall PLUGIN...`](#codify-pluginsuninstall-plugin)
+* [`codify plugins:uninstall PLUGIN...`](#codify-pluginsuninstall-plugin)
 * [`codify plugins update`](#codify-plugins-update)
 * [`codify uninstall`](#codify-uninstall)
 
@@ -47,7 +47,7 @@ describe the command here
 
 ```
 USAGE
-  $ codify apply [FILE] [--json] [-o plain|default|debug|json] [--debug] [-p <value>]
+  $ codify apply [FILE] [--json] [--debug] [-o plain|default|debug|json] [-s] [-p <value>]
 
 ARGUMENTS
   FILE  file to read
@@ -56,6 +56,7 @@ FLAGS
   -o, --output=<option>  [default: default]
                          <options: plain|default|debug|json>
   -p, --path=<value>     path to project
+  -s, --secure
   --debug
 
 GLOBAL FLAGS
@@ -97,7 +98,7 @@ describe the command here
 
 ```
 USAGE
-  $ codify plan [FILE] [--json] [-o plain|default|debug|json] [--debug] [-f] [-n <value>] [-p <value>]
+  $ codify plan [FILE] [--json] [--debug] [-o plain|default|debug|json] [-s] [-f] [-n <value>] [-p <value>]
 
 ARGUMENTS
   FILE  file to read
@@ -108,6 +109,7 @@ FLAGS
   -o, --output=<option>  [default: default]
                          <options: plain|default|debug|json>
   -p, --path=<value>     path to project
+  -s, --secure
   --debug
 
 GLOBAL FLAGS
@@ -143,7 +145,7 @@ EXAMPLES
   $ codify plugins
 ```
 
-_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.9.4/src/commands/plugins/index.ts)_
+_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.10.1/src/commands/plugins/index.ts)_
 
 ## `codify plugins:install PLUGIN...`
 
@@ -208,7 +210,8 @@ EXAMPLES
   $ codify plugins:inspect myplugin
 ```
 
-_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.9.4/src/commands/plugins/inspect.ts)_
+_See
+code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.10.1/src/commands/plugins/inspect.ts)_
 
 ## `codify plugins:install PLUGIN...`
 
@@ -248,7 +251,8 @@ EXAMPLES
   $ codify plugins:install someuser/someplugin
 ```
 
-_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.9.4/src/commands/plugins/install.ts)_
+_See
+code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.10.1/src/commands/plugins/install.ts)_
 
 ## `codify plugins:link PLUGIN`
 
@@ -278,7 +282,7 @@ EXAMPLES
   $ codify plugins:link myplugin
 ```
 
-_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.9.4/src/commands/plugins/link.ts)_
+_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.10.1/src/commands/plugins/link.ts)_
 
 ## `codify plugins:uninstall PLUGIN...`
 
@@ -327,7 +331,7 @@ ALIASES
 ```
 
 _See
-code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.9.4/src/commands/plugins/uninstall.ts)_
+code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.10.1/src/commands/plugins/uninstall.ts)_
 
 ## `codify plugins:uninstall PLUGIN...`
 
@@ -368,7 +372,7 @@ DESCRIPTION
   Update installed plugins.
 ```
 
-_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.9.4/src/commands/plugins/update.ts)_
+_See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/v3.10.1/src/commands/plugins/update.ts)_
 
 ## `codify uninstall`
 
@@ -376,11 +380,12 @@ describe the command here
 
 ```
 USAGE
-  $ codify uninstall [--json] [-o plain|default|debug|json] [--debug]
+  $ codify uninstall [--json] [--debug] [-o plain|default|debug|json] [-s]
 
 FLAGS
   -o, --output=<option>  [default: default]
                          <options: plain|default|debug|json>
+  -s, --secure
   --debug
 
 GLOBAL FLAGS
diff --git a/package.json b/package.json
index c7a6e3c1..e59b0fec 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,7 @@
     "ajv": "^8.12.0",
     "ajv-formats": "^3.0.1",
     "chalk": "^5.3.0",
-    "codify-schemas": "1.0.37",
+    "codify-schemas": "1.0.38",
     "debug": "^4.3.4",
     "ink": "^4.4.1",
     "parse-json": "^8.1.0",
diff --git a/src/commands/apply/index.ts b/src/commands/apply/index.ts
index 37de1eb7..490892c7 100644
--- a/src/commands/apply/index.ts
+++ b/src/commands/apply/index.ts
@@ -31,7 +31,7 @@ export default class Apply extends BaseCommand {
 
     const resolvedPath = path.resolve(flags.path ?? '.');
 
-    const planResult = await PlanOrchestrator.run(resolvedPath);
+    const planResult = await PlanOrchestrator.run(resolvedPath, flags.secure);
     this.reporter.displayPlan(planResult.plan);
 
     // Short circuit and exit if every change is NOOP
diff --git a/src/commands/plan/index.ts b/src/commands/plan/index.ts
index fece5a04..265af22e 100644
--- a/src/commands/plan/index.ts
+++ b/src/commands/plan/index.ts
@@ -33,7 +33,7 @@ export default class Plan extends BaseCommand {
 
     const resolvedPath = path.resolve(flags.path ?? '.');
 
-    const { plan } = await PlanOrchestrator.run(resolvedPath);
+    const { plan } = await PlanOrchestrator.run(resolvedPath, flags.secure);
     this.reporter.displayPlan(plan);
 
     process.exit(0);
diff --git a/src/commands/uninstall.ts b/src/commands/uninstall.ts
index 4e226fa5..b821f31f 100644
--- a/src/commands/uninstall.ts
+++ b/src/commands/uninstall.ts
@@ -1,5 +1,5 @@
-import { UninstallOrchestrator } from '../orchestrators/uninstall.js';
 import { BaseCommand } from '../common/base-command.js';
+import { UninstallOrchestrator } from '../orchestrators/uninstall.js';
 
 export default class Uninstall extends BaseCommand {
   static description = 'describe the command here'
@@ -8,12 +8,10 @@ export default class Uninstall extends BaseCommand {
     '<%= config.bin %> <%= command.id %>',
   ]
 
-  static flags = {}
-
   static strict = false;
 
   public async run(): Promise<void> {
-    const { raw } = await this.parse(Uninstall)
+    const { flags, raw } = await this.parse(Uninstall)
 
     const args = raw
       .filter((r) => r.type === 'arg')
@@ -23,7 +21,7 @@ export default class Uninstall extends BaseCommand {
       throw new Error('A resource id must be specified for uninstall. Ex: "codify uninstall homebrew"')
     }
 
-    await UninstallOrchestrator.run(args);
+    await UninstallOrchestrator.run(args, flags.secure);
 
     process.exit(0);
   }
diff --git a/src/common/base-command.ts b/src/common/base-command.ts
index a7d5ead6..97a7c190 100644
--- a/src/common/base-command.ts
+++ b/src/common/base-command.ts
@@ -1,6 +1,7 @@
 import { Command, Flags } from '@oclif/core';
 import { FlagOutput } from '@oclif/core/lib/interfaces/parser.js';
 import chalk from 'chalk';
+import { SudoRequestData } from 'codify-schemas';
 import createDebug from 'debug';
 
 import { ctx, Event } from '../events/context.js';
@@ -15,7 +16,11 @@ export abstract class BaseCommand extends Command {
       char: 'o',
       default: 'default',
       options: ['plain', 'default', 'debug', 'json'],
-    })()
+    })(),
+    'secure': Flags.boolean({
+      char: 's',
+      default: false,
+    })
   }
 
   protected reporter!: Reporter;
@@ -31,9 +36,19 @@ export abstract class BaseCommand extends Command {
     const reporterType = this.getReporterType(flags);
     this.reporter = ReporterFactory.create(reporterType)
 
-    ctx.on(Event.SUDO_REQUEST, async (pluginName: string, command: string) => {
-      await this.reporter.promptSudo(pluginName, command);
-      ctx.sudoRequestGranted(pluginName);
+    if (flags.secure) {
+      console.log(chalk.blue('Running Codify in secure mode. Sudo will be prompted every time'));
+    }
+
+    ctx.on(Event.SUDO_REQUEST, async (pluginName: string, data: SudoRequestData) => {
+      try {
+        const result = await this.reporter.promptSudo(pluginName, data, flags.secure);
+        ctx.sudoRequestGranted(pluginName, result);
+
+        // This listener is outside of the base-command callstack. We have to manually catch the error.
+      } catch (error) {
+        this.catch(error as Error);
+      }
     });
   }
 
diff --git a/src/common/orchestrator.ts b/src/common/orchestrator.ts
index f99ce442..cd1b098b 100644
--- a/src/common/orchestrator.ts
+++ b/src/common/orchestrator.ts
@@ -3,13 +3,13 @@ import { ctx, SubProcessName } from '../events/context.js';
 import { DependencyMap, PluginCollection } from '../plugins/plugin-collection.js';
 
 export const CommonOrchestrator = {
-  async initializePlugins(project?: Project): Promise<{
+  async initializePlugins(project?: Project, secureMode = false): Promise<{
     dependencyMap: DependencyMap
     pluginCollection: PluginCollection,
   }> {
     ctx.subprocessStarted(SubProcessName.INITIALIZE_PLUGINS)
     const pluginCollection = new PluginCollection();
-    const dependencyMap = await pluginCollection.initialize(project);
+    const dependencyMap = await pluginCollection.initialize(project, secureMode);
     ctx.subprocessFinished(SubProcessName.INITIALIZE_PLUGINS)
 
     return { dependencyMap, pluginCollection };
diff --git a/src/events/context.ts b/src/events/context.ts
index fb8fa816..d41b7d54 100644
--- a/src/events/context.ts
+++ b/src/events/context.ts
@@ -1,32 +1,34 @@
+import type { SudoRequestData, SudoRequestResponseData } from 'codify-schemas';
+
 import { EventEmitter } from 'node:events';
 
 export enum Event {
-  STDOUT = 'stdout',
-  STDERR = 'stderr',
-  PLUGIN_STDOUT = 'plugin_stdout',
-  PLUGIN_STDERR = 'plugin_stderr',
   DEBUG = 'debug',
   OUTPUT = 'output',
-  PROCESS_START = 'process_start',
+  PLUGIN_STDERR = 'plugin_stderr',
+  PLUGIN_STDOUT = 'plugin_stdout',
   PROCESS_FINISH = 'process_finish',
-  SUB_PROCESS_START = 'sub_process_start',
+  PROCESS_START = 'process_start',
+  STDERR = 'stderr',
+  STDOUT = 'stdout',
   SUB_PROCESS_FINISH = 'sub_process_finish',
+  SUB_PROCESS_START = 'sub_process_start',
   SUDO_REQUEST = 'sudo_request',
   SUDO_REQUEST_GRANTED = 'sudo_request_granted',
 }
 
 export enum ProcessName {
-  PLAN = 'plan',
   APPLY = 'apply',
+  PLAN = 'plan',
   UNINSTALL = 'uninstall',
 }
 
 export enum SubProcessName {
-  PARSE = 'parse',
+  APPLYING_RESOURCE = 'apply_resource',
+  GENERATE_PLAN = 'generate_plan',
   INITIALIZE_PLUGINS = 'initialize_plugins',
+  PARSE = 'parse',
   VALIDATE = 'validate',
-  GENERATE_PLAN = 'generate_plan',
-  APPLYING_RESOURCE = 'apply_resource',
 }
 
 export const ctx = new class {
@@ -79,12 +81,12 @@ export const ctx = new class {
     this.emitter.emit(Event.SUB_PROCESS_FINISH, name, additionalName);
   }
 
-  sudoRequested(pluginName: string, command: string) {
-    this.emitter.emit(Event.SUDO_REQUEST, pluginName, command);
+  sudoRequested(pluginName: string, data: SudoRequestData) {
+    this.emitter.emit(Event.SUDO_REQUEST, pluginName, data);
   }
 
-  sudoRequestGranted(pluginName: string) {
-    this.emitter.emit(Event.SUDO_REQUEST_GRANTED, pluginName);
+  sudoRequestGranted(pluginName: string, data: SudoRequestResponseData) {
+    this.emitter.emit(Event.SUDO_REQUEST_GRANTED, pluginName, data);
   }
 
   async subprocess<T>(name: string, run: () => Promise<T>): Promise<T> {
diff --git a/src/orchestrators/plan.ts b/src/orchestrators/plan.ts
index 69638ba3..430062ac 100644
--- a/src/orchestrators/plan.ts
+++ b/src/orchestrators/plan.ts
@@ -14,7 +14,7 @@ export interface PlanOrchestratorResponse {
 }
 
 export const PlanOrchestrator = {
-  async run(path: string): Promise<PlanOrchestratorResponse> {
+  async run(path: string, secureMode: boolean): Promise<PlanOrchestratorResponse> {
     ctx.processStarted(ProcessName.PLAN)
 
     ctx.subprocessStarted(SubProcessName.PARSE);
@@ -24,7 +24,7 @@ export const PlanOrchestrator = {
     project.addXCodeToolsConfig();
     ctx.subprocessFinished(SubProcessName.PARSE);
 
-    const { dependencyMap, pluginCollection } = await CommonOrchestrator.initializePlugins(project);
+    const { dependencyMap, pluginCollection } = await CommonOrchestrator.initializePlugins(project, secureMode);
     await createStartupShellScriptsIfNotExists();
 
     ctx.subprocessStarted(SubProcessName.VALIDATE)
diff --git a/src/orchestrators/uninstall.ts b/src/orchestrators/uninstall.ts
index 6a24cde4..912a9c99 100644
--- a/src/orchestrators/uninstall.ts
+++ b/src/orchestrators/uninstall.ts
@@ -1,12 +1,12 @@
 import { PlanResponseData, ResourceOperation } from 'codify-schemas';
 import { randomUUID } from 'node:crypto';
 
+import { CommonOrchestrator } from '../common/orchestrator.js';
 import { ctx, ProcessName } from '../events/context.js';
 import { createStartupShellScriptsIfNotExists } from '../utils/file.js';
-import { CommonOrchestrator } from '../common/orchestrator.js';
 
 export const UninstallOrchestrator = {
-  async run(typeIds: string[]): Promise<void> {
+  async run(typeIds: string[], secureMode: boolean): Promise<void> {
     if (typeIds.length === 0) {
       return;
     }
@@ -18,7 +18,7 @@ export const UninstallOrchestrator = {
       resourceType: type,
     } as PlanResponseData))
 
-    const { pluginCollection } = await CommonOrchestrator.initializePlugins();
+    const { pluginCollection } = await CommonOrchestrator.initializePlugins(undefined, secureMode);
     await createStartupShellScriptsIfNotExists();
 
     ctx.processStarted(ProcessName.UNINSTALL);
diff --git a/src/plugins/plugin-collection.ts b/src/plugins/plugin-collection.ts
index e2fa5b0c..9ecd274b 100644
--- a/src/plugins/plugin-collection.ts
+++ b/src/plugins/plugin-collection.ts
@@ -20,14 +20,14 @@ export class PluginCollection {
   private resourceToPluginMapping = new Map<string, string>()
   private pluginToResourceMapping = new Map<string, string[]>()
 
-  async initialize(project?: Project): Promise<Map<string, string[]>> {
+  async initialize(project?: Project, secureMode = false): Promise<Map<string, string[]>> {
     const plugins = await this.resolvePlugins(project);
 
     for (const plugin of plugins) {
       this.plugins.set(plugin.name, plugin)
     }
 
-    const dependencyMap = await this.initializePlugins(plugins);
+    const dependencyMap = await this.initializePlugins(plugins, secureMode);
     return dependencyMap;
   }
 
@@ -93,10 +93,10 @@ export class PluginCollection {
     return [...existingPlugins, ...configPlugins];
   }
 
-  private async initializePlugins(plugins: Plugin[]): Promise<Map<string, string[]>> {
+  private async initializePlugins(plugins: Plugin[], secureMode: boolean): Promise<Map<string, string[]>> {
     const responses = await Promise.all(
       plugins.map(async (p) => {
-        const initializeResult = await p.initialize();
+        const initializeResult = await p.initialize(secureMode);
         return [p.name, initializeResult.resourceDefinitions] as const
       })
     );
diff --git a/src/plugins/plugin-process.ts b/src/plugins/plugin-process.ts
index 5eb8ba71..f2c9fcaf 100644
--- a/src/plugins/plugin-process.ts
+++ b/src/plugins/plugin-process.ts
@@ -18,7 +18,7 @@ const resultFunctionName = (cmd: string) => `${cmd}_Response`;
 export class PluginProcess {
   process: ChildProcess;
 
-  static async start(pluginPath: string, name: string): Promise<PluginProcess> {
+  static async start(pluginPath: string, name: string, secureMode: boolean): Promise<PluginProcess> {
     const isTypescript = pluginPath.endsWith('.ts');
     const isTsxInstalled = PluginProcess.isTsxInstalled();
 
@@ -32,6 +32,7 @@ export class PluginProcess {
       pluginPath,
       [],
       {
+        detached: secureMode,
         env: { ...process.env, DEBUG_COLORS: '1', FORCE_COLOR: '1' },
         silent: true,
         ...(isTypescript && { execArgv: ['--import', 'tsx'] }),
@@ -43,7 +44,7 @@ export class PluginProcess {
     _process.on('exit', (code) => {
       throw new Error(`Plugin ${this.name} exited with code ${code}`);
     })
-    this.handleSudoRequests(_process);
+    PluginProcess.handleSudoRequests(_process);
 
     return new PluginProcess(_process);
   }
@@ -78,6 +79,7 @@ export class PluginProcess {
   }
 
   private static handleSudoRequests(process: ChildProcess) {
+    // Listen for incoming sudo incoming sudo requests
     process.on('message', (message) => {
       if (!ipcMessageValidator(message)) {
         throw new Error(`Invalid message from plugin. ${JSON.stringify(message, null, 2)}`);
@@ -89,14 +91,16 @@ export class PluginProcess {
           throw new Error(`Invalid sudo request from plugin ${this.name}. ${JSON.stringify(sudoRequestValidator.errors, null, 2)}`);
         }
 
-        ctx.sudoRequested(this.name, (data as unknown as SudoRequestData).command);
+        ctx.sudoRequested(this.name, data as unknown as SudoRequestData);
       }
     })
-    ctx.on(Event.SUDO_REQUEST_GRANTED, (pluginName) => {
+
+    // Send out sudo granted events
+    ctx.on(Event.SUDO_REQUEST_GRANTED, (pluginName, data) => {
       if (pluginName === this.name) {
         process.send({
           cmd: resultFunctionName(MessageCmd.SUDO_REQUEST),
-          data: {}
+          data
         })
       }
     })
diff --git a/src/plugins/plugin.ts b/src/plugins/plugin.ts
index 928fc8b5..0bf79d1f 100644
--- a/src/plugins/plugin.ts
+++ b/src/plugins/plugin.ts
@@ -31,8 +31,8 @@ export class Plugin {
     this.path = path;
   }
 
-  async initialize(): Promise<InitializeResponseData> {
-    this.process = await PluginProcess.start(this.path, this.name);
+  async initialize(secureMode: boolean): Promise<InitializeResponseData> {
+    this.process = await PluginProcess.start(this.path, this.name, secureMode);
 
     const initializeResponse = await this.process.sendMessageForResult({ cmd: 'initialize', data: {} });
 
diff --git a/src/ui/components/default-component.tsx b/src/ui/components/default-component.tsx
index 8a7a3b7c..266c1711 100644
--- a/src/ui/components/default-component.tsx
+++ b/src/ui/components/default-component.tsx
@@ -1,4 +1,4 @@
-import { Select } from '@inkjs/ui';
+import { PasswordInput, Select } from '@inkjs/ui';
 import chalk from 'chalk';
 import { PlanResponseData } from 'codify-schemas';
 import { Box, Static, Text } from 'ink';
@@ -16,8 +16,10 @@ export function DefaultComponent(props: {
 
   const [state, setState] = useState(RenderState.GENERATING_PLAN);
   const [progressState, setProgressState] = useState(null as ProgressState | null);
+  const [hideProgress, setHideProgress] = useState(false);
   const [plan, setPlan] = useState(null as PlanResponseData[] | null);
-  const [isCleared, setIsCleared] = useState(false);
+  const [showSudoPrompt, setShowPromptSudo] = useState(false);
+  const [sudoAttemptCount, setSudoAttemptCount] = useState(0);
 
   // Use layoutEffect runs before the first render, whereas useEffect runs after
   useLayoutEffect(() => {
@@ -41,20 +43,28 @@ export function DefaultComponent(props: {
       setProgressState(structuredClone(state));
     });
 
-    emitter.on(RenderEvent.CLEAR, () => {
-      setIsCleared(true);
+    emitter.on(RenderEvent.PROMPT_SUDO, (attemptCount) => {
+      setShowPromptSudo(true);
+      setHideProgress(true)
+      setSudoAttemptCount(attemptCount ?? 0);
     });
 
-    emitter.on(RenderEvent.UNCLEAR, () => {
-      console.log('set unclear')
-      setIsCleared(false);
+    emitter.on(RenderEvent.PROMPT_SUDO_GRANTED, () => {
+      setShowPromptSudo(false);
+      setHideProgress(false)
+      setSudoAttemptCount(0);
+    });
+
+    emitter.on(RenderEvent.PROMPT_SUDO_ERROR, () => {
+      setShowPromptSudo(false);
+      setSudoAttemptCount(0);
     });
 
   }, []);
 
   return <Box flexDirection="column">
     {
-      ([RenderState.APPLYING, RenderState.GENERATING_PLAN].includes(state)) && progressState && !isCleared && (
+      ([RenderState.APPLYING, RenderState.GENERATING_PLAN].includes(state)) && progressState && !hideProgress && (
         <ProgressDisplay progress={progressState}/>
       )
     }
@@ -74,13 +84,16 @@ export function DefaultComponent(props: {
         </Box>
       )
     }
-    {/* { */}
-    {/*   showSudoPrompt && ( */}
-    {/*     <Box flexDirection='column'> */}
-    {/*       <Text>Password:</Text> */}
-    {/*       <PasswordInput onSubmit={(value) => emitter.emit(RenderEvent.PROMPT_SUDO_RESULT, value)}/> */}
-    {/*     </Box> */}
-    {/*   ) */}
-    {/* } */}
+    {
+      showSudoPrompt && (
+        <Box flexDirection="column">
+          <Text>Password:</Text>
+          {/* Use sudoAttemptCount as a hack to reset password input between attempts */}
+          <PasswordInput key={sudoAttemptCount} onSubmit={(password) => {
+            emitter.emit(RenderEvent.PROMPT_SUDO_RESULT, password);
+          }}/>
+        </Box>
+      )
+    }
   </Box>
 }
diff --git a/src/ui/reporters/debug-reporter.ts b/src/ui/reporters/debug-reporter.ts
index 34a9c97a..c34263bc 100644
--- a/src/ui/reporters/debug-reporter.ts
+++ b/src/ui/reporters/debug-reporter.ts
@@ -1,10 +1,10 @@
 import chalk from 'chalk';
-import { PlanResponseData } from 'codify-schemas';
+import { PlanResponseData, SudoRequestData, SudoRequestResponseData } from 'codify-schemas';
 import createDebug, { Debugger } from 'debug';
-import { execSync } from 'node:child_process';
 import readline from 'node:readline';
 
 import { ctx, Event } from '../../events/context.js';
+import { SudoUtils } from '../../utils/sudo.js';
 import { Reporter } from './reporter.js';
 
 const debug = createDebug('codify');
@@ -25,9 +25,9 @@ export class DebugReporter implements Reporter {
     ctx.on(Event.SUB_PROCESS_FINISH, (name) => debug(name))
   }
 
-  async promptSudo(pluginName: string, command: string): Promise<void> {
-    console.log(chalk.blue(`Plugin: ${pluginName} requires root access to run command: '${command}'`));
-    execSync('sudo -v');
+  async promptSudo(pluginName: string, data: SudoRequestData, secureMode: boolean): Promise<SudoRequestResponseData> {
+    console.log(chalk.blue(`Plugin: ${pluginName} requires root access to run command: '${data.command}'`));
+    return SudoUtils.runCommand(data.command, data.options, secureMode, pluginName);
   }
 
   async promptApplyConfirmation(): Promise<boolean> {
@@ -43,8 +43,6 @@ export class DebugReporter implements Reporter {
   }
 
   private getDebug(name: string): Debugger {
-    const debuggerName = `plugin:${name}`;
-
     if (!this.debuggerCache.has(name)) {
       this.debuggerCache.set(name, createDebug(`plugin:${name}`));
     }
diff --git a/src/ui/reporters/default-reporter.tsx b/src/ui/reporters/default-reporter.tsx
index 3c958e80..fa827723 100644
--- a/src/ui/reporters/default-reporter.tsx
+++ b/src/ui/reporters/default-reporter.tsx
@@ -1,11 +1,11 @@
 import chalk from 'chalk';
-import { PlanResponseData } from 'codify-schemas';
+import { PlanResponseData, SudoRequestData, SudoRequestResponseData } from 'codify-schemas';
 import { render } from 'ink';
-import { execSync } from 'node:child_process';
 import { EventEmitter } from 'node:events';
 import React from 'react';
 
 import { ctx, Event, ProcessName, SubProcessName } from '../../events/context.js';
+import { SudoUtils } from '../../utils/sudo.js';
 import { DefaultComponent } from '../components/default-component.js';
 import { ProgressState, ProgressStatus } from '../components/progress/progress-display.js';
 import { DisplayPlanStateTransition, RenderEvent, RenderState, Reporter } from './reporter.js';
@@ -36,19 +36,20 @@ export class DefaultReporter implements Reporter {
     ctx.on(Event.SUB_PROCESS_FINISH, (name, additionalName) => this.onSubprocessFinishEvent(name, additionalName))
   }
 
-  async promptSudo(pluginName: string, command: string): Promise<void> {
-    console.log(chalk.blue(`Plugin: ${pluginName} requires root access to run command: '${command}'`));
+  async promptSudo(pluginName: string, data: SudoRequestData, secureMode: boolean): Promise<SudoRequestResponseData> {
+    console.log(chalk.blue(`Plugin: ${pluginName} requires root access to run command: '${data.command}'`));
 
-    // The sudo prompt and the inkjs renderer like to conflict when rendered together.
-    // Clear the process bar while showing sudo.
-    this.renderEmitter.emit(RenderEvent.CLEAR);
+    let password;
 
-    // We need to sleep for 200ms here to wait for ink.js to un-render the progress bar.
-    // Ink renders asynchronously so the output is not cleared right away
-    await new Promise((resolve) => setTimeout(resolve, 200));
+    // Password is only needed outside of sudo timeout. Pass password in as undefined if not needed.
+    if (secureMode || !SudoUtils.validate()) {
+      password = await this.getUserPassword();
+    }
+
+    const result = await SudoUtils.runCommand(data.command, data.options, secureMode, pluginName, password)
+    this.renderEmitter.emit(RenderEvent.PROMPT_SUDO_GRANTED);
 
-    execSync('sudo -v')
-    this.renderEmitter.emit(RenderEvent.UNCLEAR);
+    return result;
   }
 
   displayPlan(plan: PlanResponseData[]): void {
@@ -147,4 +148,38 @@ export class DefaultReporter implements Reporter {
     this.renderEmitter.emit(RenderEvent.PROGRESS_UPDATE, this.progressState);
   }
 
+  private async getUserPassword(): Promise<string> {
+    let attemptCount = 0;
+
+
+    while (attemptCount < 3) {
+      const passwordAttempt = await this.renderSudoPrompt(attemptCount);
+
+      // Validates that the password works
+      if (SudoUtils.validate(passwordAttempt)) {
+        this.renderEmitter.emit(RenderEvent.PROMPT_SUDO_GRANTED);
+        return passwordAttempt
+      }
+
+      if (attemptCount + 1 < 3) {
+        console.log('Password:')
+        console.error(chalk.red(`Sorry, try again. (${attemptCount + 1}/3)`))
+      }
+
+      attemptCount++;
+    }
+
+    this.renderEmitter.emit(RenderEvent.PROMPT_SUDO_ERROR);
+    throw new Error('sudo: 3 incorrect password attempts')
+  }
+
+  private async renderSudoPrompt(attemptCount: number): Promise<string> {
+    return new Promise((resolve) => {
+      this.renderEmitter.emit(RenderEvent.PROMPT_SUDO, attemptCount);
+      this.renderEmitter.on(RenderEvent.PROMPT_SUDO_RESULT, (password) => {
+        resolve(password)
+      })
+    })
+  }
+
 }
diff --git a/src/ui/reporters/plain-reporter.ts b/src/ui/reporters/plain-reporter.ts
index 00599612..f44a17c6 100644
--- a/src/ui/reporters/plain-reporter.ts
+++ b/src/ui/reporters/plain-reporter.ts
@@ -1,9 +1,9 @@
 import chalk from 'chalk';
-import { PlanResponseData } from 'codify-schemas';
-import { execSync } from 'node:child_process';
+import { PlanResponseData, SudoRequestData, SudoRequestResponseData } from 'codify-schemas';
 import readline from 'node:readline';
 
 import { ctx, Event } from '../../events/context.js';
+import { SudoUtils } from '../../utils/sudo.js';
 import { Reporter } from './reporter.js';
 
 export class PlainReporter implements Reporter {
@@ -17,9 +17,9 @@ export class PlainReporter implements Reporter {
     ctx.on(Event.SUB_PROCESS_FINISH, (name) => console.log(name))
   }
 
-  async promptSudo(pluginName: string, command: string): Promise<void> {
-    console.log(chalk.blue(`Plugin: ${pluginName} requires root access to run command: '${command}'`));
-    execSync('sudo -v');
+  async promptSudo(pluginName: string, data: SudoRequestData, secureMode: boolean): Promise<SudoRequestResponseData> {
+    console.log(chalk.blue(`Plugin: ${pluginName} requires root access to run command: '${data.command}'`));
+    return SudoUtils.runCommand(data.command, data.options, secureMode, pluginName);
   }
 
   async promptApplyConfirmation(): Promise<boolean> {
diff --git a/src/ui/reporters/reporter.ts b/src/ui/reporters/reporter.ts
index 72b08057..d7e762f5 100644
--- a/src/ui/reporters/reporter.ts
+++ b/src/ui/reporters/reporter.ts
@@ -1,4 +1,4 @@
-import { PlanResponseData } from 'codify-schemas';
+import { PlanResponseData, SudoRequestData, SudoRequestResponseData } from 'codify-schemas';
 
 import { DebugReporter } from './debug-reporter.js';
 import { DefaultReporter } from './default-reporter.js';
@@ -8,8 +8,10 @@ export enum RenderEvent {
   LOG = 'log',
   PROGRESS_UPDATE = 'progressUpdate',
   PROMPT_RESULT = 'promptResult',
-  CLEAR = 'promptSudo',
-  UNCLEAR = 'promptSudoResult',
+  PROMPT_SUDO = 'promptSudo',
+  PROMPT_SUDO_ERROR = 'propmptSudoError',
+  PROMPT_SUDO_GRANTED = 'propmptSudoGranted',
+  PROMPT_SUDO_RESULT = 'promptSudoResult',
   STATE_TRANSITION = 'stateTransition',
 }
 
@@ -36,7 +38,7 @@ export interface Reporter {
 
   promptApplyConfirmation(): Promise<boolean>
 
-  promptSudo(pluginName: string, command: string): Promise<void>;
+  promptSudo(pluginName: string, data: SudoRequestData, secureMode: boolean): Promise<SudoRequestResponseData>;
 }
 
 export enum ReporterType {
diff --git a/src/utils/sudo.ts b/src/utils/sudo.ts
new file mode 100644
index 00000000..f5e610a4
--- /dev/null
+++ b/src/utils/sudo.ts
@@ -0,0 +1,115 @@
+import { execSync, spawn, SpawnOptions } from 'node:child_process';
+
+import { ctx } from '../events/context.js';
+
+export const SudoUtils = {
+  async runCommand(command: string, options: CodifySpawnOptions, secureMode: boolean, pluginName?: string, password?: string): Promise<SpawnResult> {
+    const result = await codifySpawn(command, options, secureMode, pluginName, password);
+
+    if (result.status === SpawnStatus.ERROR && result.data.startsWith('sudo:')) {
+      throw new Error('Sudo request failed. Exiting...')
+    }
+
+    return result;
+  },
+
+  validate(password?: string): boolean {
+    try {
+      // Sudo with -SNv will not prompt if within sudo cache timeout
+      execSync(`sudo -SNv ${password ? `<<< ${password}` : ''}`, { stdio: 'ignore' })
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+};
+
+enum SpawnStatus {
+  ERROR = 'error',
+  SUCCESS = 'success',
+}
+
+interface SpawnResult {
+  data: string;
+  status: SpawnStatus,
+}
+
+type CodifySpawnOptions = {
+  cwd?: string;
+  throws?: boolean,
+} & Omit<SpawnOptions, 'detached' | 'shell' | 'stdio'>
+
+/**
+ *
+ * @param cmd Command to run. Ex: `rm -rf`
+ * @param opts Options for spawn
+ * @param secureMode Secure mode for sudo
+ * @param pluginName Optional plugin name so that stdout and stderr can be piped
+ * @param password Optional password can be directly supplied
+ *
+ * @see promiseSpawn
+ * @see spawn
+ *
+ * @returns SpawnResult { status: SUCCESS | ERROR; data: string }
+ */
+async function codifySpawn(
+  cmd: string,
+  opts: CodifySpawnOptions,
+  secureMode: boolean,
+  pluginName?: string,
+  password?: string,
+): Promise<{ data: string, status: SpawnStatus }> {
+  return new Promise((resolve) => {
+    const output: string[] = [];
+
+    const _cmd = password ?
+      secureMode
+        ? `sudo -k; sudo -SN <<< "${password}" ${cmd}`
+        : `sudo -S <<< "password" ${cmd}`
+      : secureMode
+        ? `sudo -k; sudo -N ${cmd}`
+        : `sudo ${cmd}`;
+
+    // Source start up shells to emulate a users environment vs. a non-interactive non-login shell script
+    // Ignore all stdin
+    const _process = spawn(`source ~/.zshrc; ${_cmd}`, [], {
+      ...opts,
+      shell: 'zsh',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+
+    const { stderr, stdout } = _process
+    stdout.setEncoding('utf8');
+    stderr.setEncoding('utf8');
+
+    stdout.on('data', (data) => {
+      output.push(data.toString());
+    })
+
+    stderr.on('data', (data) => {
+      output.push(data.toString());
+    })
+
+    _process.on('error', (data) => {
+    })
+
+    // please node that this is not a full replacement for 'inherit'
+    // the child process can and will detect if stdout is a pty and change output based on it
+    // the terminal context is lost & ansi information (coloring) etc will be lost
+    if (pluginName) {
+      stdout.on('data', (data) => ctx.pluginStdout(pluginName, data))
+      stderr.on('data', (data) => ctx.pluginStderr(pluginName, data))
+    } else {
+      stdout.pipe(process.stdout);
+      stderr.pipe(process.stderr);
+    }
+
+    _process.on('close', (code) => {
+      resolve({
+        data: output.join('\n'),
+        status: code === 0 ? SpawnStatus.SUCCESS : SpawnStatus.ERROR,
+      })
+    })
+  })
+}