Never escalate for optional apt packages outside Tauri mode

The optional bypass sat inside the TAURI_MODE branch, so a plain curl | sh
install on a non-root Debian or Ubuntu box still fell through to the
escalation branch and showed the default-yes permission prompt for cmake,
GCC and the libcurl headers. That is exactly the toolchain this change set
declared unnecessary on the consumer path, so the prompt asked for a
password to install packages nothing here uses, and a headless run failed
the same way instead of falling through to prebuilt llama.cpp.

Move the check above the mode split so optional callers return 2 in both
modes. Required packages such as curl still escalate unchanged.

Author: danielhanchen

install.sh

@@ -778,14 +778,17 @@ _smart_apt_install() {
         return 0
     fi
 
+    # Optional callers never elevate, in any mode: nothing on the consumer path
+    # builds anything, so neither the terminal sudo prompt below nor the Tauri
+    # NEED_SUDO dialog (whose Cancel leaves the user not installed) may gate the
+    # run over unused tools. The caller falls through to prebuilt llama.cpp.
+    # Required packages such as curl still escalate.
+    if [ "${_SMART_APT_OPTIONAL:-false}" = true ]; then
+        return 2
+    fi
+
     if [ "$TAURI_MODE" = true ]; then
-        # Optional callers never elevate: NEED_SUDO raises a mandatory desktop
-        # permission dialog whose Cancel leaves the user not installed, over tools
-        # nothing needs. The caller falls through to prebuilt llama.cpp.
-        if [ "${_SMART_APT_OPTIONAL:-false}" = true ]; then
-            return 2
-        fi
-        # Otherwise report needed packages and exit — Rust handles elevation.
+        # Report needed packages and exit — Rust handles elevation.
         tauri_log "NEED_SUDO" "$_STILL_MISSING"
         exit 2
     fi
@@ -2089,8 +2092,8 @@ _check_linux_deps() {
     if [ -n "$_optional_missing" ] && command -v apt-get >/dev/null 2>&1; then
         step "deps" "installing optional build tools: $_optional_missing" "$C_DIM"
         # Subshell because _smart_apt_install exits rather than returns, so `|| true`
-        # alone would not catch it. _SMART_APT_OPTIONAL suppresses the NEED_SUDO
-        # handshake, so no install hinges on a prompt for tools nothing here needs.
+        # alone would not catch it. _SMART_APT_OPTIONAL suppresses every escalation
+        # path, so no install hinges on a prompt for tools nothing here needs.
         ( _SMART_APT_OPTIONAL=true; _smart_apt_install $_optional_missing ) || true
         _optional_missing=""
         command -v cmake       >/dev/null 2>&1 || _optional_missing="$_optional_missing cmake"

tests/sh/test_linux_deps_gate.sh

@@ -163,6 +163,47 @@ _mk git 'exit 0'
 _out="$(_run_gate true)"
 assert_contains "install proceeds"                       "$_out" "RC=0"
 
+echo "=== optional apt packages never ask for elevation, in any mode ==="
+# Regression: the optional bypass sat inside the TAURI_MODE branch, so a plain
+# `curl | sh` on a non-root Debian box still hit the sudo prompt (default yes) and
+# installed cmake, GCC and dev headers that nothing on the consumer path uses.
+_APT_FN=$(mktemp)
+{
+    sed -n '/^_is_pkg_installed()/,/^}$/p'       "$INSTALL_SH"
+    sed -n '/^_apt_distro_description()/,/^}$/p' "$INSTALL_SH"
+    sed -n '/^_can_read_tty()/,/^}$/p'           "$INSTALL_SH"
+    sed -n '/^_smart_apt_install()/,/^}$/p'      "$INSTALL_SH"
+} > "$_APT_FN"
+
+_run_apt() {
+    # $1 = TAURI_MODE, $2 = _SMART_APT_OPTIONAL. apt-get always fails, as it does
+    # for a non-root user, so the function reaches its escalation decision.
+    rm -f "$_BIN"/*
+    _mk apt-get 'exit 100'
+    _mk sudo 'echo "ELEVATION_ATTEMPTED: $*"; exit 1'
+    ln -sf "$(command -v sed)" "$_BIN/sed"   # the function trims its list with sed
+    # _APT_FN after _HARNESS so the real function replaces the recording stub.
+    ( PATH="$_BIN"; export PATH
+      "$_SH" -c ". '$_HARNESS'; . '$_APT_FN'; TAURI_MODE=$1; _SMART_APT_OPTIONAL=$2
+                ( _smart_apt_install unsloth_absent_pkg ); echo \"RC=\$?\"" 2>&1 )
+}
+
+_out="$(_run_apt false true)"
+assert_contains "optional: returns 2 so the caller can continue" "$_out" "RC=2"
+assert_not_contains "optional: no sudo prompt"                   "$_out" "elevated permissions"
+assert_not_contains "optional: sudo never invoked"               "$_out" "ELEVATION_ATTEMPTED"
+
+_out="$(_run_apt true true)"
+assert_contains "optional in Tauri: returns 2"                   "$_out" "RC=2"
+assert_not_contains "optional in Tauri: no NEED_SUDO dialog"     "$_out" "NEED_SUDO"
+
+_out="$(_run_apt false false)"
+assert_contains "required: still escalates"                      "$_out" "ELEVATION_ATTEMPTED"
+
+_out="$(_run_apt true false)"
+assert_contains "required in Tauri: still asks Rust to elevate"  "$_out" "NEED_SUDO"
+
+rm -f "$_APT_FN"
 rm -rf "$_BIN" "$_FN_FILE" "$_HARNESS"
 echo ""
 echo "=== $PASS passed, $FAIL failed ==="