fix(ssh): treat a clean sudo pre-test exit as access propagated

[GGonryun]

Problem

A --sudo SSH/SCP session first runs a sudo -nv pre-test and waits for the sudoers grant to propagate on the target host. The propagation guard decides readiness only from stderr patterns — for providers with provisionedAccessPatterns (e.g. Azure), it waits for sudo: a password is required. When the user holds passwordless (NOPASSWD) sudo, sudo -nv succeeds silently with exit code 0 and no output, so no pattern ever matches. The CLI keeps re-running the pre-test until the propagation window closes, appearing to hang before failing with "Access did not propagate ... in time" — even though access was ready the whole time.

Change

Treat a clean exit (code 0) from the pre-test probe as an unambiguous signal that access has propagated: sudo -nv returning 0 means the user already holds sudo. The check is scoped to the pre-test only, so the normal session retry path is unaffected.

Check off any of the following areas of code that are modified:

• authentication / authorization
• workflow
• lifecycle SDK
• datastore abstractions

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactoring (code changes that neither fix bugs nor add features)
• Documentation update
• Dependency update
• Performance improvement
• Security fix

Validation

Automated: added regression tests covering the NOPASSWD (exit 0) pre-test case and confirming that a still-propagating, non-sudoer probe still fails once the propagation window closes. yarn vitest run src/plugins/ssh/__tests__/index.test.ts — 9/9 passing.

Risk is limited to the pre-test path: a probe that exits non-zero still follows the existing pattern-matching and retry logic unchanged.

Tracking (optional)

CUS-801

[Copilot]

Pull request overview

Fixes a hang during --sudo SSH sessions by recognizing that a successful sudo -nv access-propagation pre-test (exit code 0, no stderr) is itself proof that sudo access has already propagated (e.g., NOPASSWD or cached sudo), even when the provider’s “provisioned” stderr pattern is never emitted.

Changes:

• Treat a clean pre-test exit (code === 0) as “access propagated” for access-propagation pre-tests.
• Reuse the computed accessPropagated result to drive both retry/timeout behavior and pre-test exit-code normalization.
• Add regression tests covering NOPASSWD sudo (exit 0, no output) vs. still-unpropagated sudo (stderr + non-zero exit).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/plugins/ssh/index.ts	Updates access-propagation classification to treat a successful sudo -nv pre-test exit as propagated, preventing unnecessary retries/timeouts.
src/plugins/ssh/tests/index.test.ts	Adds tests ensuring the sudo pre-test proceeds on exit 0 (NOPASSWD) and fails when the propagation window is already closed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4ac2e1d1-8c73-43bb-b985-a4e56d1ba3af

📥 Commits

Reviewing files that changed from the base of the PR and between d126801 and 9d82f4c.

📒 Files selected for processing (2)

• src/plugins/ssh/__tests__/index.test.ts
• src/plugins/ssh/index.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• src/plugins/ssh/index.ts
• src/plugins/ssh/tests/index.test.ts

---

Walkthrough

The SSH plugin now treats a zero-exit access-propagation pre-test as successful, including when provider pattern detection is absent. The pre-test exit handling uses the computed propagation result for success overrides. Tests add a sudo provider and verify that passwordless sudo -nv proceeds to the session, while a non-sudoer error rejects without starting the session.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: treating a clean sudo pre-test exit as propagated access.
Description check	✅ Passed	The description includes Problem, Change, Type of Change, Validation, and Tracking, and the content is specific enough.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch miguelcampos/cus-801-sudo-ssh-doesnt-acknowledge-sudo-correctly-if-we-already

---

_{Comment @coderabbitai help to get the list of available commands.}