[anandghegde]

--use-sudo-password sets config.USE_SUDO_PASSWORD, but nothing has read that value since _use_sudo_password became _sudo_password in v3. So the flag did nothing: pyinfra always ran sudo -n first and only asked for the password after the sudo: a password is required retry kicked in.

This change checks config.USE_SUDO_PASSWORD in make_unix_command_for_host. If sudo is on and no password is known yet (no _sudo_password / SUDO_PASSWORD and nothing prompted earlier), it asks for the password before building the first command. The answer goes into prompted_sudo_password, the same place the retry path stores it, so later commands reuse it. USE_SUDO_PASSWORD is added back to ConfigDefaults so it has a typed default. Without the flag, nothing changes.

Related: #1689 also changes sudo handling in connectors/util.py, but in execute_command_with_sudo_retry, the askpass script and make_unix_command. This PR only touches make_unix_command_for_host and adds tests at the end of test_util.py, so the two shouldn't conflict.

How I tested:

• Added unit tests in tests/test_connectors/test_util.py. The prompt test fails on 3.x (it gets sudo -H -n sh -c uptime) and passes with the fix. Two more tests cover no prompt when a password is already given and no prompt without the flag.
• uv run pytest -m 'not end_to_end' (2056 passed), ruff check, ruff format --check, mypy, lint_arguments_sync.py all pass. I didn't have shellcheck installed, and this PR doesn't change any shell scripts.
• Ran it by hand in a throwaway python:3.12-slim container with a user whose sudo needs a password. The command was pyinfra -y -vv --sudo --use-sudo-password @local exec -- id, run as that user:
  • 3.x: >>> sudo -H -n sh -c id → sudo: a password is required → prompt → askpass retry
  • this branch: prompt → >>> env SUDO_ASKPASS=... sudo -H -A -k sh -c id, with no passwordless attempt first
  • this branch without --use-sudo-password: same as before (tries sudo -n, then prompts)

AI disclosure: I made this with Claude Code. It helped find the cause, write the fix and tests, and run the checks and container test above. I reviewed the change and I understand it.

Fixes #1850

• Pull request is based on the default branch (3.x at this time)
• Pull request includes tests for any new/updated operations/facts
• Pull request includes documentation for any new/updated operations/facts
• Tests pass (see scripts/dev-test.sh)
• Type checking & code style passes (see scripts/dev-lint.sh)
• Pull request title follows the
  conventional commits format

[Fizzadar]

Nice catch, thank you @anandghegde!