Merge claude/2

init.sh

@@ -690,16 +690,21 @@ initUsers()
 		sudo systemctl restart docker
 		isSuccessful "User $sudo_user_name created successfully."
 	fi
-	local sudoers_file="/etc/sudoers"
-	local sudo_entry="$sudo_user_name ALL=(ALL) NOPASSWD: ALL"
-	if ! grep -q "$sudo_entry" $sudoers_file; then
-		echo "" | sudo tee -a "$sudoers_file" > /dev/null
-		echo "$sudo_entry" | sudo tee -a "$sudoers_file" > /dev/null
-		sudo visudo -c > /dev/null
-		isSuccessful "Added passwordless sudo entry for user $sudo_user_name."
+	# Manager-user sudo lives in a validated /etc/sudoers.d drop-in, not appended
+	# to /etc/sudoers — a malformed line in the main file locks out sudo entirely.
+	# The grant is broad for now; this single drop-in is what gets tightened to a
+	# scoped command allowlist once the runtime no longer needs broad root.
+	local sudoers_dropin="/etc/sudoers.d/${sudo_user_name}"
+	local sudoers_tmp
+	sudoers_tmp=$(mktemp)
+	printf '%s ALL=(ALL) NOPASSWD: ALL\n' "$sudo_user_name" > "$sudoers_tmp"
+	if sudo visudo -cf "$sudoers_tmp" >/dev/null 2>&1; then
+		sudo install -m 0440 -o root -g root "$sudoers_tmp" "$sudoers_dropin"
+		isSuccessful "Configured passwordless sudo for $sudo_user_name (/etc/sudoers.d/${sudo_user_name})."
 	else
-		isSuccessful "Passwordless sudo entry already setup."
+		isError "Refusing to install an invalid sudoers drop-in for $sudo_user_name."
 	fi
+	rm -f "$sudoers_tmp"
 }
 
 initFolders()

scripts/source/files/arrays/files_source.sh

@@ -24,6 +24,7 @@ source_scripts=(
     "source/files/arrays/files_restore.sh"
     "source/files/arrays/files_setup.sh"
     "source/files/arrays/files_source.sh"
+    "source/files/arrays/files_ssh.sh"
     "source/files/arrays/files_start.sh"
     "source/files/arrays/files_update.sh"
     "source/files/arrays/files_webui.sh"