sudo: add mitogen_sudo_password_prompt for custom passprompt

Mitogen's PASSWORD_PROMPT_RE matches "password" in dozens of locales,
covering any default sudo configuration. But if sudoers defines a custom
passprompt (e.g. `[sudo] %u@%h:`) that omits the word "password",
mitogen never recognizes the prompt, never sends the password, and the
sudo bootstrap hangs until connect_timeout.

Ansible's own sudo become plugin sidesteps this by always forcing -p,
but mitogen matches the prompt on the wire instead. This commit adds a
configurable regex pattern via the ansible variable
`mitogen_sudo_password_prompt`. When set, the pattern is compiled and
prepended to SetupProtocol.PARTIAL_PATTERNS, with the built-in patterns
as fallback.

Configuration (group_vars, host_vars, or play vars):

    mitogen_sudo_password_prompt: '\[sudo\] \w+@[\w.]+:'

Author: claude

ansible_mitogen/connection.py

@@ -336,18 +336,24 @@ def _connect_sudo(spec):
     """
     Return ContextService arguments for sudo as a become method.
     """
+    kwargs = {
+        'username': spec.become_user(),
+        'password': spec.become_pass(),
+        'python_path': spec.python_path(),
+        'sudo_path': spec.become_exe(),
+        'connect_timeout': spec.timeout(),
+        'sudo_args': spec.sudo_args(),
+        'remote_name': get_remote_name(spec),
+    }
+
+    password_prompt = spec.mitogen_sudo_password_prompt()
+    if password_prompt is not None:
+        kwargs['password_prompt'] = password_prompt
+
     return {
         'method': 'sudo',
         'enable_lru': True,
-        'kwargs': {
-            'username': spec.become_user(),
-            'password': spec.become_pass(),
-            'python_path': spec.python_path(),
-            'sudo_path': spec.become_exe(),
-            'connect_timeout': spec.timeout(),
-            'sudo_args': spec.sudo_args(),
-            'remote_name': get_remote_name(spec),
-        }
+        'kwargs': kwargs,
     }
 
 
@@ -390,17 +396,23 @@ def _connect_mitogen_sudo(spec):
     """
     Return ContextService arguments for sudo as a first class connection.
     """
+    kwargs = {
+        'username': spec.remote_user(),
+        'password': spec.password(),
+        'python_path': spec.python_path(),
+        'sudo_path': spec.become_exe(),
+        'connect_timeout': spec.timeout(),
+        'sudo_args': spec.sudo_args(),
+        'remote_name': get_remote_name(spec),
+    }
+
+    password_prompt = spec.mitogen_sudo_password_prompt()
+    if password_prompt is not None:
+        kwargs['password_prompt'] = password_prompt
+
     return {
         'method': 'sudo',
-        'kwargs': {
-            'username': spec.remote_user(),
-            'password': spec.password(),
-            'python_path': spec.python_path(),
-            'sudo_path': spec.become_exe(),
-            'connect_timeout': spec.timeout(),
-            'sudo_args': spec.sudo_args(),
-            'remote_name': get_remote_name(spec),
-        }
+        'kwargs': kwargs,
     }
 
 

ansible_mitogen/transport_config.py

@@ -414,6 +414,13 @@ def mitogen_ssh_compression(self):
         Whether SSH compression is enabled.
         """
 
+    @abc.abstractmethod
+    def mitogen_sudo_password_prompt(self):
+        """
+        Optional regex pattern to match the sudo password prompt.
+        Overrides the built-in PASSWORD_PROMPT_RE in mitogen.sudo.
+        """
+
     @abc.abstractmethod
     def extra_args(self):
         """
@@ -625,6 +632,9 @@ def mitogen_ssh_debug_level(self):
     def mitogen_ssh_compression(self):
         return self._connection.get_task_var('mitogen_ssh_compression')
 
+    def mitogen_sudo_password_prompt(self):
+        return self._connection.get_task_var('mitogen_sudo_password_prompt')
+
     def extra_args(self):
         return self._connection.get_extra_args()
 
@@ -876,6 +886,9 @@ def mitogen_ssh_debug_level(self):
     def mitogen_ssh_compression(self):
         return self._host_vars.get('mitogen_ssh_compression')
 
+    def mitogen_sudo_password_prompt(self):
+        return self._host_vars.get('mitogen_sudo_password_prompt')
+
     def extra_args(self):
         return []  # TODO
 

docs/ansible_detailed.rst

@@ -997,6 +997,11 @@ When used as a become method:
   Mitogen produces remote processes named like
   `"mitogen:user@controller.name:1234"`, however this may be a privacy issue in
   some circumstances.
+* ``mitogen_sudo_password_prompt``: optional regular expression pattern to
+  match a custom sudo password prompt. Mitogen's built-in pattern matches
+  "password" in dozens of locales, but custom sudoers ``passprompt`` settings
+  that omit that word will cause the connection to hang. Set this to a pattern
+  matching your prompt, e.g. ``'\[sudo\] \w+@[\w.]+:'``.
 * ansible.cfg: ``timeout``
 
 When used as the ``mitogen_sudo`` connection method:
@@ -1005,6 +1010,7 @@ When used as the ``mitogen_sudo`` connection method:
 * ``ansible_user``: username to sudo as.
 * ``ansible_password``: password to sudo as.
 * ``sudo_flags``, ``become_flags``
+* ``mitogen_sudo_password_prompt``
 * ``ansible_python_interpreter``
 
 

docs/changelog.rst

@@ -31,6 +31,9 @@ In progress
   source modifier feature
 * :gh:issue:`1540` tests: Test :class:`mitogen.master.ModuleFinder` source
   override
+* :gh:issue:`1503` :mod:`ansible_mitogen`: Add ``mitogen_sudo_password_prompt``
+  variable to allow matching custom sudo password prompts that omit the word
+  "password"
 
 
 v0.3.51 (2026-07-18)

mitogen/sudo.py

@@ -133,23 +133,26 @@ class Options(mitogen.parent.Options):
     sudo_path = 'sudo'
     username = 'root'
     password = None
+    password_prompt = None
     preserve_env = False
     set_home = False
     login = False
-
     selinux_role = None
     selinux_type = None
 
     def __init__(self, username=None, sudo_path=None, password=None,
-                 preserve_env=None, set_home=None, sudo_args=None,
-                 login=None, selinux_role=None, selinux_type=None, **kwargs):
+                 password_prompt=None, preserve_env=None, set_home=None,
+                 sudo_args=None, login=None, selinux_role=None,
+                 selinux_type=None, **kwargs):
         super(Options, self).__init__(**kwargs)
         opts = parse_sudo_flags(sudo_args or [])
 
         self.username = option(self.username, username, opts.user)
         self.sudo_path = option(self.sudo_path, sudo_path)
         if password:
             self.password = mitogen.core.to_text(password)
+        if password_prompt:
+            self.password_prompt = password_prompt
         self.preserve_env = option(self.preserve_env,
             preserve_env, opts.preserve_env)
         self.set_home = option(self.set_home, set_home, opts.set_home)
@@ -196,6 +199,24 @@ class Connection(mitogen.parent.Connection):
     }
     child_is_immediate_subprocess = False
 
+    def stderr_stream_factory(self):
+        """
+        If password_prompt is configured, build a stream using a subclass of
+        SetupProtocol with the custom pattern prepended to PARTIAL_PATTERNS.
+        """
+        prompt = self.options.password_prompt
+        if not prompt:
+            return self.diag_protocol_class.build_stream()
+
+        custom_re = re.compile(prompt.encode('utf-8'), re.I)
+
+        class CustomSetupProtocol(SetupProtocol):
+            PARTIAL_PATTERNS = [
+                (custom_re, SetupProtocol._on_password_prompt),
+            ] + SetupProtocol.PARTIAL_PATTERNS
+
+        return CustomSetupProtocol.build_stream()
+
     def _get_name(self):
         return u'sudo.' + mitogen.core.to_text(self.options.username)
 

tests/sudo_test.py

@@ -108,6 +108,43 @@ def test_tty_preserved(self):
             del os.environ['PREHISTORIC_SUDO']
 
 
+class PasswordPromptPatternTest(testlib.TestCase):
+    def _make_options(self, **kwargs):
+        return mitogen.sudo.Options(
+            max_message_size=mitogen.core.CHUNK_SIZE,
+            **kwargs
+        )
+
+    def test_default_has_no_custom_prompt(self):
+        options = self._make_options()
+        self.assertIsNone(options.password_prompt)
+
+    def test_custom_prompt_stored(self):
+        options = self._make_options(
+            password_prompt=r'\[sudo\] \w+@[\w.]+:',
+        )
+        self.assertEqual(options.password_prompt, r'\[sudo\] \w+@[\w.]+:')
+
+    def test_custom_protocol_prepends_pattern(self):
+        options = self._make_options(
+            password_prompt=r'\[sudo\] \w+@[\w.]+:',
+        )
+        conn = mitogen.sudo.Connection(options, router=None)
+        stream = conn.stderr_stream_factory()
+        patterns = stream.protocol.PARTIAL_PATTERNS
+        # custom pattern first, built-in second
+        self.assertEqual(len(patterns), 2)
+        self.assertEqual(patterns[0][0].pattern, b'\\[sudo\\] \\w+@[\\w.]+:')
+        self.assertIs(patterns[1][0], mitogen.sudo.PASSWORD_PROMPT_RE)
+
+    def test_no_custom_uses_default_protocol(self):
+        options = self._make_options()
+        conn = mitogen.sudo.Connection(options, router=None)
+        stream = conn.stderr_stream_factory()
+        self.assertIsInstance(stream.protocol, mitogen.sudo.SetupProtocol)
+        self.assertEqual(len(stream.protocol.PARTIAL_PATTERNS), 1)
+
+
 class SudoMixin(testlib.DockerMixin):
     def test_password_required(self):
         ssh = self.docker_ssh(