fix(container): Improved sudo command handling and Podman simulation detection

GT-610 · GT-610 · commit 421b4e6de757 · 2026-01-29T13:12:17.000+08:00
Fix the sudo command processing logic, remove the masking of stderr to capture password errors

Override the detection logic simulated by Podman

Refactor the command building logic to support sh wrapping of multi-line commands
diff --git a/lib/core/extension/ssh_client.dart b/lib/core/extension/ssh_client.dart
@@ -108,13 +108,13 @@ extension SSHClientX on SSHClient {
     return (session, result.takeBytes().string);
   }
 
-  /// Executes a command.
+  /// Executes a command with password error detection.
   ///
   /// This method is used for executing commands where password has already been
   /// handled beforehand (e.g., via base64 pipe in container commands).
-  ///
-  /// [stderr: false] ensures only stdout is included in the returned output,
-  /// keeping it clean from sudo password prompts that appear in stderr.
+  /// It captures stderr via [onStderr] callback to detect sudo password errors
+  /// (e.g., "Sorry, try again." or "incorrect password attempt"), while
+  /// excluding stderr from the returned output via [stderr: false].
   ///
   /// Returns exitCode:
   /// - 0: success
@@ -135,7 +135,8 @@ extension SSHClientX on SSHClient {
         sess.stdin.add('$script\n'.uint8List);
         sess.stdin.close();
       },
-      onStderr: (data, session) async { // stderr is in `data`
+      onStderr: (data, session) async {
+        print('[DEBUG] stderr: $data');
         onStderr?.call(data, session);
         if (data.contains('Sorry, try again.') ||
             data.contains('incorrect password attempt')) {
@@ -144,8 +145,13 @@ extension SSHClientX on SSHClient {
       },
       onStdout: onStdout,
       entry: entry,
+      stderr: false,
     );
 
+    print('[DEBUG] output: $output');
+    print('[DEBUG] exitCode: ${session.exitCode}');
+    print('[DEBUG] hasPasswordError: $hasPasswordError');
+
     if (hasPasswordError) {
       return (2, output);
     }
diff --git a/lib/data/provider/container.dart b/lib/data/provider/container.dart
@@ -115,8 +115,18 @@ class ContainerNotifier extends _$ContainerNotifier {
     final cmd = _wrap(ContainerCmdType.execAll(state.type, sudo: sudo, includeStats: includeStats, password: password));
     int? code;
     String raw = '';
+    var isPodmanEmulation = false;
     if (client != null) {
-      (code, raw) = await client!.execWithPwd(cmd, context: context, id: hostId);
+      (code, raw) = await client!.execWithPwd(
+        cmd,
+        context: context,
+        id: hostId,
+        onStderr: (data, _) {
+          if (data.contains(_podmanEmulationMsg)) {
+            isPodmanEmulation = true;
+          }
+        },
+      );
     } else {
       state = state.copyWith(
         isBusy: false,
@@ -144,7 +154,7 @@ class ContainerNotifier extends _$ContainerNotifier {
     }
 
     /// Pre-parse Podman detection
-    if (raw.contains(_podmanEmulationMsg)) {
+    if (isPodmanEmulation) {
       state = state.copyWith(
         error: ContainerErr(
           type: ContainerErrType.podmanDetected,
@@ -349,7 +359,7 @@ const _jsonFmt = '--format "{{json .}}"';
 
 String _buildSudoCmd(String baseCmd, String password) {
   final pwdBase64 = base64Encode(utf8.encode(password));
-  return 'echo "$pwdBase64" | base64 -d | sudo -S $baseCmd 2>/dev/null'; // Discard stderr to avoid password prompt
+  return 'echo "$pwdBase64" | base64 -d | sudo -S $baseCmd';
 }
 
 enum ContainerCmdType {
@@ -389,9 +399,42 @@ enum ContainerCmdType {
   }
 
   static String execAll(ContainerType type, {bool sudo = false, bool includeStats = false, String? password}) {
-    return ContainerCmdType.values
-        .map((e) => e.exec(type, sudo: sudo, includeStats: includeStats, password: password))
+    final commands = ContainerCmdType.values
+        .map((e) => e.exec(type, sudo: false, includeStats: includeStats))
         .join('\necho ${ScriptConstants.separator}\n');
+
+    print('[DEBUG] commands: $commands');
+
+    final needsShWrapper = commands.contains('\n') || commands.contains('echo ${ScriptConstants.separator}');
+
+    if (needsShWrapper) {
+      if (sudo && password != null) {
+        final pwdBase64 = base64Encode(utf8.encode(password));
+        final cmd = 'echo "$pwdBase64" | base64 -d | sudo -S sh -c \'${commands.replaceAll("'", "'\\''")}\'';
+        print('[DEBUG] final sudo cmd (with sh): $cmd');
+        return cmd;
+      }
+      if (sudo) {
+        final cmd = 'sudo -S sh -c \'${commands.replaceAll("'", "'\\''")}\'';
+        print('[DEBUG] final sudo cmd: $cmd');
+        return cmd;
+      }
+      final cmd = 'sh -c \'${commands.replaceAll("'", "'\\''")}\'';
+      print('[DEBUG] final sh cmd: $cmd');
+      return cmd;
+    }
+
+    if (sudo && password != null) {
+      final cmd = _buildSudoCmd(commands, password);
+      print('[DEBUG] final sudo cmd: $cmd');
+      return cmd;
+    }
+    if (sudo) {
+      final cmd = 'sudo -S $commands';
+      print('[DEBUG] final sudo cmd: $cmd');
+      return cmd;
+    }
+    return commands;
   }
 
   /// Find out the required segment from [segments]
