internal/system/runner_test.go (1)

98-107: Cover the new stdin-handling modes too.

This only checks argv prefixing. The new behavior is in internal/system/local.go for PasswordInputMethodStdin and PasswordInputMethodNone, so a regression there would still pass this test.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/system/runner_test.go` around lines 98 - 107, The current
TestBuildShellWrapper_WithRootElevation only verifies argv prefixing; extend it
to also exercise the stdin-handling modes defined in internal/system/local.go by
adding sub-tests for PasswordInputMethodStdin and PasswordInputMethodNone using
the same RootElevator and NewCommand/AsRoot flow: for PasswordInputMethodStdin
assert the resulting wrapped command is configured to read from stdin (e.g.,
expects a pipe or includes the stdin flag/marker your wrapper uses), and for
PasswordInputMethodNone assert it does not require stdin and that no stdin
piping/marker is present; reference the RootElevator struct,
PasswordInputMethodStdin, PasswordInputMethodNone, NewCommand, AsRoot and the
TestBuildShellWrapper_WithRootElevation test to locate and add these assertions.

internal/settings/settings.go (1)

91-97: Consider adding UnmarshalText for PasswordInputMethod for robust parsing.

Unlike DiffTool and ConfirmationPromptBehavior which have UnmarshalText methods, PasswordInputMethod relies on direct string assignment. Invalid values like "invalid" would be silently accepted during config parsing.

🔧 Add UnmarshalText for validation

func (p *PasswordInputMethod) UnmarshalText(text []byte) error {
	v := PasswordInputMethod(text)
	switch v {
	case PasswordInputMethodStdin, PasswordInputMethodTTY, PasswordInputMethodNone:
		*p = v
		return nil
	default:
		return fmt.Errorf("invalid value for password_method '%s'", text)
	}
}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/settings/settings.go` around lines 91 - 97, Add an UnmarshalText
method to PasswordInputMethod to validate parsed values instead of accepting
arbitrary strings: implement func (p *PasswordInputMethod) UnmarshalText(text
[]byte) error that converts text to PasswordInputMethod, checks it against the
allowed constants PasswordInputMethodStdin, PasswordInputMethodTTY, and
PasswordInputMethodNone, sets *p on success, and returns a descriptive error
(e.g. "invalid value for password_method '%s'") for any other value so config
parsing fails on invalid inputs.

internal/system/elevator.go (2)

81-107: Consider zeroing the password after use for defense in depth.

The CachedPasswordProvider stores the password as a plain string in memory. While this is often acceptable for short-lived CLI tools, zeroing the password after the process completes could reduce the window for memory scraping attacks.

This is a low-priority security hardening suggestion given the CLI's typical usage pattern.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/system/elevator.go` around lines 81 - 107, CachedPasswordProvider
currently retains the password in memory; add a Clear (or Dispose) method on
CachedPasswordProvider that securely zeroes the stored password (convert the
string to a byte slice, overwrite bytes with zeros, then set p.password = "" and
p.set = false) and ensure callers that finish using the password invoke this
Clear method; update any code paths that call GetPassword/PromptForPassword to
call Clear after elevation completes to reduce exposure time.

---

71-75: Consider logging the error from GetUsername() for debugging.

The error from utils.GetUsername() is silently discarded. While the fallback prompt is reasonable, logging at debug level would help troubleshoot issues.

🔧 Suggested improvement

-	if currentUser, _ := utils.GetUsername(); currentUser != "" {
+	if currentUser, err := utils.GetUsername(); err == nil && currentUser != "" {
 		prompt = fmt.Sprintf("[%s] password for %s: ", e.Command, currentUser)
 	} else {
+		// Debug log: failed to get username, using generic prompt
 		prompt = fmt.Sprintf("[%s] enter password: ", e.Command)
 	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/system/elevator.go` around lines 71 - 75, Capture and check the
error returned from utils.GetUsername() instead of discarding it, and log it at
debug level for troubleshooting; modify the block using utils.GetUsername()
(where currentUser is assigned and prompt is set) to use "currentUser, err :=
utils.GetUsername()" and if err != nil call the elevator's logger (e.g.,
e.Logger.Debugf("utils.GetUsername error: %v", err)) before falling back to the
existing prompt logic that uses e.Command and prompt.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes