From 4cf2ea805f0abdaa07a9953b158482458005111e Mon Sep 17 00:00:00 2001
From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com>
Date: Sun, 4 Oct 2026 15:02:07 +0530
Subject: [PATCH] refactor(pm): prompt for sudo only when the repair would use
 it

The update warm-up resolved sudo on its own, so on a glibc host with no
supported package manager it still asked for a password the repair then
never used. Derive the prompt from the same _host_install_command and
_command_plan the repair runs, compute the target once, and correct the
module docstring now that there are two entry points.
---
 pm/libatomic.py                          | 18 +++++++++++++-----
 tests/fixtures/resolution_allowlist.json |  5 -----
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/pm/libatomic.py b/pm/libatomic.py
index a38bcf7d63..fa61a6c46e 100644
--- a/pm/libatomic.py
+++ b/pm/libatomic.py
@@ -1,6 +1,8 @@
 """Install the host libatomic package required by official Linux Node.
 
-This module is intentionally called only from PM's staged-install repair hook.
+Two entry points: warm_sudo_before_install() lets an interactive update cache
+a sudo ticket before PM takes its install lock, and try_install_libatomic()
+is the non-interactive repair run from Nodejs.repair_staged_verification().
 Package verification itself remains diagnostic and side-effect free.
 """
 
@@ -103,16 +105,22 @@ def warm_sudo_before_install() -> None:
         return
     if not (sys.stdin and sys.stdin.isatty() and sys.stdout and sys.stdout.isatty()):
         return
-    if current_target() in MUSL_TARGETS or current_target().endswith("-bionic"):
+    target = current_target()
+    if target in MUSL_TARGETS or target.endswith("-bionic"):
         return
     try:
         ctypes.CDLL("libatomic.so.1")
         return
     except OSError:
         pass
-    sudo = shutil.which("sudo")
-    if sudo is None or subprocess.run([sudo, "-n", "true"], stdin=subprocess.DEVNULL,
-                                      capture_output=True, check=False).returncode == 0:
+    # Prompt only when the repair would actually run sudo with the ticket.
+    command = _host_install_command()
+    argv = _command_plan(command)[0] if command else None
+    if not argv:
+        return
+    sudo = argv[0]
+    if subprocess.run([sudo, "-n", "true"], stdin=subprocess.DEVNULL,
+                      capture_output=True, check=False).returncode == 0:
         return
     print("→ Node.js needs libatomic.so.1; sudo may ask for your password to install it", flush=True)
     try:
diff --git a/tests/fixtures/resolution_allowlist.json b/tests/fixtures/resolution_allowlist.json
index 191e1b99dc..5ee87e3c17 100644
--- a/tests/fixtures/resolution_allowlist.json
+++ b/tests/fixtures/resolution_allowlist.json
@@ -439,11 +439,6 @@
     "symbol": "_host_install_command",
     "kind": "bare_which"
   },
-  {
-    "path": "pm/libatomic.py",
-    "symbol": "warm_sudo_before_install",
-    "kind": "bare_which"
-  },
   {
     "path": "pm/native_build.py",
     "symbol": "prepare_windows_environment",