# /etc/sudoers.d/ac-flash-mac — passwordless sudo for the macOS USB flasher.
# Whitelists fedac/native/scripts/flash-mac.sh as a single unit because it
# legitimately needs ~10 distinct privileged operations (sgdisk, dd,
# newfs_msdos, diskutil, mount_msdos, etc.) — granting them piecemeal
# without drift is fragile. Scoping at the script keeps the surface tight.
#
# Install with:
#   sed "s/__USER__/$USER/g" fedac/native/sudoers.d/ac-flash-mac.template \
#     | sudo tee /etc/sudoers.d/ac-flash-mac >/dev/null \
#     && sudo chmod 0440 /etc/sudoers.d/ac-flash-mac \
#     && sudo visudo -cf /etc/sudoers.d/ac-flash-mac

Cmnd_Alias AC_FLASH_USB = \
    /Users/__USER__/aesthetic-computer/fedac/native/scripts/flash-mac.sh, \
    /Users/__USER__/aesthetic-computer/fedac/native/scripts/flash-mac.sh *, \
    /Users/__USER__/aesthetic-computer/.claude/worktrees/*/fedac/native/scripts/flash-mac.sh, \
    /Users/__USER__/aesthetic-computer/.claude/worktrees/*/fedac/native/scripts/flash-mac.sh *

__USER__ ALL=(root) NOPASSWD: AC_FLASH_USB