Make install image handling idempotent

scripts/cfw_install.sh

@@ -150,11 +150,24 @@ ldid_sign() {
     ldid "${args[@]}" "$file"
 }
 
+host_hdiutil() {
+    local rc
+    hdiutil "$@" && return 0
+    rc=$?
+
+    if sudo -n true 2>/dev/null; then
+        sudo hdiutil "$@"
+        return
+    fi
+
+    return "$rc"
+}
+
 # Detach a DMG mountpoint if currently mounted, ignore errors
 safe_detach() {
     local mnt="$1"
     if mount | grep -Fq " on $mnt "; then
-        sudo hdiutil detach -force "$mnt" 2>/dev/null || true
+        host_hdiutil detach -force "$mnt" 2>/dev/null || true
     fi
 }
 
@@ -329,9 +342,11 @@ else
     assert_mount_under_vm "$MNT_APPOS" "AppOS mountpoint"
 
     echo "  Mounting SystemOS..."
-    sudo hdiutil attach -mountpoint "$MNT_SYSOS" "$SYSOS_DMG" -nobrowse -owners off
+    host_hdiutil attach -mountpoint "$MNT_SYSOS" "$SYSOS_DMG" -nobrowse -owners off \
+        || die "Failed to mount SystemOS DMG. Run 'sudo -v' in a terminal and retry if hdiutil needs administrator privileges."
     echo "  Mounting AppOS..."
-    sudo hdiutil attach -mountpoint "$MNT_APPOS" "$APPOS_DMG" -nobrowse -owners off
+    host_hdiutil attach -mountpoint "$MNT_APPOS" "$APPOS_DMG" -nobrowse -owners off \
+        || die "Failed to mount AppOS DMG. Run 'sudo -v' in a terminal and retry if hdiutil needs administrator privileges."
 
     ssh_cmd "/bin/rm -rf /mnt1/System/Cryptexes/App /mnt1/System/Cryptexes/OS"
     ssh_cmd "/bin/mkdir -p /mnt1/System/Cryptexes/App /mnt1/System/Cryptexes/OS"

scripts/ramdisk_build.py

@@ -158,15 +158,26 @@ def run(cmd, **kwargs):
 
 
 def run_sudo(cmd, **kwargs):
-    """Run sudo command non-interactively using VPHONE_SUDO_PASSWORD."""
-    if SUDO_PASSWORD:
-        return run(
-            ["sudo", "-S", *cmd],
-            input=f"{SUDO_PASSWORD}\n",
-            text=True,
-            **kwargs,
-        )
-    return run(["sudo", *cmd], **kwargs)
+    """Run a command directly first, then retry through sudo if required."""
+    try:
+        return run(cmd, **kwargs)
+    except subprocess.CalledProcessError:
+        if SUDO_PASSWORD:
+            return run(
+                ["sudo", "-S", *cmd],
+                input=f"{SUDO_PASSWORD}\n",
+                text=True,
+                **kwargs,
+            )
+        return run(["sudo", *cmd], **kwargs)
+
+
+def detach_mountpoint(mountpoint):
+    """Best-effort detach for hdiutil mountpoints used during ramdisk builds."""
+    subprocess.run(
+        ["hdiutil", "detach", "-force", mountpoint],
+        capture_output=True,
+    )
 
 
 def ensure_path_within_vm(path, vm_dir, label):
@@ -490,6 +501,8 @@ def build_ramdisk(restore_dir, im4m_path, vm_dir, input_dir, output_dir, temp_di
 
     ensure_path_within_vm(mountpoint, vm_dir, "Ramdisk mountpoint")
     os.makedirs(mountpoint, exist_ok=True)
+    if os.path.exists(ramdisk_custom):
+        os.remove(ramdisk_custom)
 
     try:
         # Mount, create expanded copy
@@ -529,7 +542,7 @@ def build_ramdisk(restore_dir, im4m_path, vm_dir, input_dir, output_dir, temp_di
                 ramdisk_custom,
             ]
         )
-        run_sudo(["hdiutil", "detach", "-force", mountpoint])
+        detach_mountpoint(mountpoint)
 
         # Mount expanded, inject SSH
         print("  Mounting expanded ramdisk...")
@@ -606,7 +619,7 @@ def build_ramdisk(restore_dir, im4m_path, vm_dir, input_dir, output_dir, temp_di
         print(f"  [+] trustcache.img4")
 
     finally:
-        run_sudo(["hdiutil", "detach", "-force", mountpoint], capture_output=True)
+        detach_mountpoint(mountpoint)
 
     # Shrink and sign ramdisk
     run_sudo(["hdiutil", "resize", "-sectors", "min", ramdisk_custom])