fix: use sudo -n for lsof retry in preflight to avoid password prompt by cv · Pull Request #1227 · NVIDIA/NemoClaw

cv · 2026-04-01T04:31:19Z

Problem

The port-availability preflight check in checkPortAvailable retries with sudo lsof to detect root-owned listeners when unprivileged lsof returns empty output. Without -n (non-interactive mode), sudo blocks on a Password: prompt, stalling non-interactive installs:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
nemoclaw onboard --non-interactive
NEMOCLAW_NON_INTERACTIVE=1
CI pipelines

Fix

Use sudo -n so it fails immediately when passwordless sudo is unavailable, falling through to the TCP bind probe instead of hanging.

This is the only sudo call in the codebase that should degrade gracefully — the other sudo calls (swap creation) intentionally require elevated privileges to succeed.

Summary by CodeRabbit

Bug Fixes
- Improved preflight setup process by enabling non-interactive mode for privilege elevation checks, preventing unexpected password prompts during port availability verification.

The port-availability check in checkPortAvailable retries with sudo lsof to detect root-owned listeners. Without -n (non-interactive), sudo blocks on a Password: prompt, stalling non-interactive installs (curl | bash, --non-interactive, NEMOCLAW_NON_INTERACTIVE=1, CI). Switch to sudo -n so it fails immediately when passwordless sudo is unavailable, falling through to the TCP bind probe instead of hanging.

coderabbitai · 2026-04-01T04:31:33Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4e5b0d7a-5cbe-4be9-a535-3617ebc5c97e

📥 Commits

Reviewing files that changed from the base of the PR and between 39e9b1f and 5ab08f6.

📒 Files selected for processing (1)

bin/lib/preflight.js

📝 Walkthrough

Walkthrough

A single line modification in the port availability check function updates the sudo invocation to use non-interactive mode (-n flag) when retrying with elevated privileges after initial lsof output is empty.

Changes

Cohort / File(s)	Summary
Port Availability Check `bin/lib/preflight.js`	Modified `checkPortAvailable` to use `sudo -n` (non-interactive mode) instead of `sudo` when retrying `lsof` command with elevated privileges, preventing password prompts.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 With -n flag in hand so proud,
No passwords asked, no prompts loud,
The sudo dance runs silent, clean,
Non-interactive, smooth, serene!
A tiny tweak, but oh so keen! 🚀

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: using `sudo -n` flag in the lsof retry within the preflight check to avoid password prompts.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/sudo-n-lsof-preflight

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

ericksoa

No regression risk. The -n flag prevents a surprise password prompt during preflight — if sudo needs a password, it fails silently into the existing ignoreError: true fallback path.

Convert bin/lib/preflight.js (357 lines) to src/lib/preflight.ts with full type definitions for all opts objects and return types. The old file becomes a thin re-export shim so existing consumers are unaffected. Changes: - Typed interfaces: PortProbeResult, MemoryInfo, SwapResult, and all opts types (CheckPortOpts, GetMemoryInfoOpts, EnsureSwapOpts) - Extract parseLsofLines helper to reduce duplication in checkPortAvailable - Incorporate #1227 fix: sudo -> sudo -n (non-interactive) for lsof retry - Co-locate tests: test/preflight.test.js -> src/lib/preflight.test.ts converted to expect-style with type narrowing - Add real net probe tests (EADDRINUSE detection on occupied ports) - Fix co-located test imports to go through dist/ for coverage attribution - Add targeted dashboard and validation branch tests for ratchet 612 CLI tests pass. Coverage ratchet passes. No user-facing behavior changes. Relates to #924 (shell consolidation). Supersedes #1227. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Convert `bin/lib/preflight.js` (357 lines) to `src/lib/preflight.ts` with full type definitions - Typed interfaces for all opts objects and return types: `PortProbeResult`, `MemoryInfo`, `SwapResult`, `CheckPortOpts`, `GetMemoryInfoOpts`, `EnsureSwapOpts` - Extract `parseLsofLines` helper to reduce duplication in `checkPortAvailable` - Incorporate #1227 fix: `sudo` → `sudo -n` (non-interactive) for lsof retry - `bin/lib/preflight.js` becomes a thin re-export shim — existing consumers unaffected - Co-locate tests: `test/preflight.test.js` → `src/lib/preflight.test.ts` - Add real net probe tests (EADDRINUSE detection on occupied ports) - Fix all co-located test imports to use `dist/` paths for coverage attribution - Add targeted dashboard/validation branch tests to maintain ratchet Stacked on #1240. Not touched by any #924 blocker PR. ## Test plan - [x] 612 CLI tests pass (601 existing + 11 new) - [x] `tsc -p tsconfig.src.json` compiles cleanly - [x] `tsc -p tsconfig.cli.json` type-checks cleanly - [x] `tsc -p jsconfig.json` type-checks cleanly (the pre-push check that caught the union issue) - [x] Coverage ratchet passes Relates to #924 (shell consolidation). Supersedes #1227. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…#1227) ## Problem The port-availability preflight check in `checkPortAvailable` retries with `sudo lsof` to detect root-owned listeners when unprivileged `lsof` returns empty output. Without `-n` (non-interactive mode), `sudo` blocks on a `Password:` prompt, stalling non-interactive installs: - `curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash` - `nemoclaw onboard --non-interactive` - `NEMOCLAW_NON_INTERACTIVE=1` - CI pipelines ## Fix Use `sudo -n` so it fails immediately when passwordless sudo is unavailable, falling through to the TCP bind probe instead of hanging. This is the only `sudo` call in the codebase that should degrade gracefully — the other `sudo` calls (swap creation) intentionally require elevated privileges to succeed.

…NVIDIA#1227) ## Problem The port-availability preflight check in `checkPortAvailable` retries with `sudo lsof` to detect root-owned listeners when unprivileged `lsof` returns empty output. Without `-n` (non-interactive mode), `sudo` blocks on a `Password:` prompt, stalling non-interactive installs: - `curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash` - `nemoclaw onboard --non-interactive` - `NEMOCLAW_NON_INTERACTIVE=1` - CI pipelines ## Fix Use `sudo -n` so it fails immediately when passwordless sudo is unavailable, falling through to the TCP bind probe instead of hanging. This is the only `sudo` call in the codebase that should degrade gracefully — the other `sudo` calls (swap creation) intentionally require elevated privileges to succeed.

cv enabled auto-merge (squash) April 1, 2026 04:33

Merge branch 'main' into fix/sudo-n-lsof-preflight

c1ed17c

ericksoa approved these changes Apr 1, 2026

View reviewed changes

cv merged commit ce88542 into main Apr 1, 2026
4 checks passed

cv mentioned this pull request Apr 1, 2026

refactor(cli): migrate preflight.js to TypeScript #1262

Merged

5 tasks

cv deleted the fix/sudo-n-lsof-preflight branch April 1, 2026 17:35

wscurran added the bug-fix PR fixes a bug or regression label Jun 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: use sudo -n for lsof retry in preflight to avoid password prompt#1227

fix: use sudo -n for lsof retry in preflight to avoid password prompt#1227
cv merged 2 commits into
mainfrom
fix/sudo-n-lsof-preflight

cv commented Apr 1, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 1, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

ericksoa left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

cv commented Apr 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

ericksoa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cv commented Apr 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 1, 2026 •

edited

Loading