Security review findings P2-6 + P2-7:
- The sudoers whitelist listed `systemctl enable traefik.service`, but
the code calls `enable --now traefik.service` (and `disable --now`),
and `is-active vps.service` vs the real `is-active --quiet`. sudo
matches argv exactly, so every one of those calls was rejected at
runtime: traefik could never be started by the panel and `vps config
set` could never restart the panel. The whitelist now mirrors the
actual invocations.
- Removed dead whitelist entries with no code call (start/stop/is-active
traefik.service, route replace, neigh add proxy, addr replace/del) —
narrower surface, nothing functional lost.
- ensureVPSUser/ensureSudoers swallowed every error and even skipped
installing the whitelist on failure, leaving a panel that looked
healthy but failed all privileged ops. Both now return errors and
abort `vps install`.
- scripts/00-check.sh now installs sudo (with visudo) as a hard
dependency.
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
