ChuckBuildsandClaude Sonnet 5 7558aaab23 fix: invoke safe_pip_install.sh via explicit bash, matching sudoers rule ...

CodeRabbit caught this on review: the sudoers rule configure_web_sudo.sh
provisions is scoped to "$BASH_PATH $SAFE_PIP_INSTALL_PATH *" (matching
the existing safe_plugin_rm.sh precedent in
src/common/permission_utils.py), but _pip_install_requirements() called
`sudo -n <wrapper> <req_file>` directly, relying on the script's shebang
instead of an explicit bash prefix. sudo matches the literal command line,
so this never matched the allowlisted rule on an install with only the
specific sudoers entries this script provisions — it silently fell back
to the non-root install path every time, which is the exact bug this PR
set out to fix.

This wasn't caught by live testing on ledpi.local because that device
also has a broader, non-standard "NOPASSWD: ALL" grant which masked the
mismatch. Confirmed the fix is correct by reading sudo's documented
command-matching semantics and mirroring the already-proven-working
bash-prefix pattern from permission_utils.py's safe_plugin_rm.sh call
exactly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ

2026-07-05 20:59:55 -04:00

..

__init__.py

Plugins (#145)

2025-12-27 14:15:49 -05:00

api_v3.py

fix: invoke safe_pip_install.sh via explicit bash, matching sudoers rule

2026-07-05 20:59:55 -04:00

pages_v3.py

feat(web): add Tools tab and row address type display setting (#373)

2026-06-29 12:19:54 -04:00