opencode-polkit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 opencode-polkit contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,43 @@
+# opencode-polkit
+
+Redirect `sudo`/`doas` to `pkexec` in [OpenCode](https://opencode.ai).
+Triggers the system's native polkit authentication dialog (KDE, GNOME, etc.)
+instead of requiring a terminal for password input.
+
+When polkit is unavailable, privilege escalation commands are blocked with a
+clear error message.
+
+## Install
+
+```sh
+opencode plugin opencode-polkit
+```
+
+Or add to `opencode.json` / `~/.config/opencode/opencode.jsonc`:
+
+```json
+{
+  "plugin": ["opencode-polkit"]
+}
+```
+
+## Behavior
+
+| Command         | polkit available               | polkit unavailable   |
+|-----------------|--------------------------------|----------------------|
+| `sudo xxx`      | redirects to `pkexec xxx`      | blocked with error   |
+| `doas xxx`      | redirects to `pkexec xxx`      | blocked with error   |
+| `pkexec xxx`    | passes through                 | blocked with error   |
+| `sudoedit`      | blocked                        | blocked              |
+| `visudo`        | blocked                        | blocked              |
+
+## i18n
+
+Messages adapt to `$LC_MESSAGES` / `$LANG`. Currently supports:
+en, zh, ja, ko, de, fr, es, pt, ru, tr, uk.
+
+PRs welcome for additional translations.
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from "@opencode-ai/plugin";
+export declare const PolkitPlugin: Plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAA;AA+G9D,eAAO,MAAM,YAAY,EAAE,MA0B1B,CAAA"}

package/dist/index.js

@@ -0,0 +1,123 @@
+const MATCH = /(?<![-\/.\w])(sudo|pkexec|doas|sudoedit|visudo)(?![-\/.\w])/i;
+const POLKIT_AGENTS = [
+    "polkit-kde-authentication-agent-1",
+    "polkit-gnome-authentication-agent-1",
+    "lxqt-policykit-agent",
+    "mate-polkit",
+    "xfce-polkit",
+    "dde-polkit-agent",
+];
+const translations = {
+    en: {
+        blocked: "Privilege escalation command blocked by plugin",
+        noPolkit: "sudo/doas blocked: no polkit agent detected, cannot escalate safely",
+        noPolkitPkexec: "pkexec unavailable: no polkit agent detected",
+    },
+    zh: {
+        blocked: "权限提升命令已被插件拦截",
+        noPolkit: "sudo/doas 已被拦截：未检测到 polkit agent，无法安全提权",
+        noPolkitPkexec: "pkexec 不可用：未检测到 polkit agent",
+    },
+    ja: {
+        blocked: "特権昇格コマンドはプラグインによりブロックされました",
+        noPolkit: "sudo/doas がブロックされました：polkit エージェントが見つからないため、安全に昇格できません",
+        noPolkitPkexec: "pkexec は利用できません：polkit エージェントが見つかりません",
+    },
+    ko: {
+        blocked: "권한 상승 명령이 플러그인에 의해 차단되었습니다",
+        noPolkit: "sudo/doas 차단됨: polkit 에이전트가 감지되지 않아 안전하게 권한 상승할 수 없습니다",
+        noPolkitPkexec: "pkexec 사용 불가: polkit 에이전트가 감지되지 않았습니다",
+    },
+    de: {
+        blocked: "Berechtigungseskalation vom Plugin blockiert",
+        noPolkit: "sudo/doas blockiert: kein polkit-Agent erkannt, sichere Eskalation nicht möglich",
+        noPolkitPkexec: "pkexec nicht verfügbar: kein polkit-Agent erkannt",
+    },
+    fr: {
+        blocked: "Commande d'élévation de privilèges bloquée par le plugin",
+        noPolkit: "sudo/doas bloqué : aucun agent polkit détecté, élévation impossible",
+        noPolkitPkexec: "pkexec indisponible : aucun agent polkit détecté",
+    },
+    es: {
+        blocked: "Comando de elevación de privilegios bloqueado por el plugin",
+        noPolkit: "sudo/doas bloqueado: no se detectó agente polkit, no se puede elevar de forma segura",
+        noPolkitPkexec: "pkexec no disponible: no se detectó agente polkit",
+    },
+    pt: {
+        blocked: "Comando de elevação de privilégios bloqueado pelo plugin",
+        noPolkit: "sudo/doas bloqueado: nenhum agente polkit detectado, não é possível elevar com segurança",
+        noPolkitPkexec: "pkexec indisponível: nenhum agente polkit detectado",
+    },
+    ru: {
+        blocked: "Команда повышения привилегий заблокирована плагином",
+        noPolkit: "sudo/doas заблокирован: не обнаружен polkit-агент, невозможно безопасно повысить привилегии",
+        noPolkitPkexec: "pkexec недоступен: не обнаружен polkit-агент",
+    },
+    tr: {
+        blocked: "Yetki yükseltme komutu eklenti tarafından engellendi",
+        noPolkit: "sudo/doas engellendi: polkit aracısı algılanmadı, güvenli şekilde yetki yükseltilemez",
+        noPolkitPkexec: "pkexec kullanılamıyor: polkit aracısı algılanmadı",
+    },
+    uk: {
+        blocked: "Команду підвищення привілеїв заблоковано плагіном",
+        noPolkit: "sudo/doas заблоковано: не виявлено агента polkit, неможливо безпечно підвищити привілеї",
+        noPolkitPkexec: "pkexec недоступний: не виявлено агента polkit",
+    },
+};
+function detectLocale() {
+    const raw = process.env.LC_MESSAGES || process.env.LANG || "en";
+    const tag = raw.split(".")[0].replace(/_/g, "-").toLowerCase();
+    for (const prefix of ["zh", "ja", "ko", "de", "fr", "es", "pt", "ru", "tr", "uk"]) {
+        if (tag.startsWith(prefix))
+            return prefix;
+    }
+    return "en";
+}
+const MSG = translations[detectLocale()] ?? translations.en;
+function polkitAvailable() {
+    try {
+        if (process.env.DBUS_SESSION_BUS_ADDRESS) {
+            const proc = Bun.spawnSync(["busctl", "--user", "list"], {
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            if (proc.exitCode === 0 && /\bpolkit\b/i.test(new TextDecoder().decode(proc.stdout))) {
+                return true;
+            }
+        }
+    }
+    catch { /* fall through */ }
+    try {
+        const proc = Bun.spawnSync(["pgrep", "-x", ...POLKIT_AGENTS], {
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return proc.exitCode === 0;
+    }
+    catch {
+        return false;
+    }
+}
+const hasPolkit = polkitAvailable();
+export const PolkitPlugin = async (_input) => {
+    return {
+        "tool.execute.before": async (hookInput, hookOutput) => {
+            if (hookInput.tool !== "bash")
+                return;
+            const command = hookOutput?.args?.command ?? "";
+            if (!MATCH.test(command))
+                return;
+            if (/^pkexec(?![-\/.\w])/.test(command.trim())) {
+                if (!hasPolkit)
+                    throw new Error(MSG.noPolkitPkexec);
+                return;
+            }
+            if (/(?<![-\/.\w])(sudoedit|visudo)(?![-\/.\w])/.test(command)) {
+                throw new Error(MSG.blocked);
+            }
+            if (!hasPolkit) {
+                throw new Error(MSG.noPolkit);
+            }
+            hookOutput.args.command = command.replace(/(?<![-\/.\w])(sudo|doas)(?![-\/.\w])/, "pkexec");
+        },
+    };
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAG,8DAA8D,CAAA;AAE5E,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,qCAAqC;IACrC,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,kBAAkB;CACnB,CAAA;AAQD,MAAM,YAAY,GAA6B;IAC7C,EAAE,EAAE;QACF,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,8CAA8C;KAC/D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,yCAAyC;QACnD,cAAc,EAAE,8BAA8B;KAC/C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;KACxD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;KACxD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,kFAAkF;QAC5F,cAAc,EAAE,mDAAmD;KACpE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,kDAAkD;KACnE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,sFAAsF;QAChG,cAAc,EAAE,mDAAmD;KACpE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,0FAA0F;QACpG,cAAc,EAAE,qDAAqD;KACtE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,6FAA6F;QACvG,cAAc,EAAE,8CAA8C;KAC/D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,uFAAuF;QACjG,cAAc,EAAE,mDAAmD;KACpE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,yFAAyF;QACnG,cAAc,EAAE,+CAA+C;KAChE;CACF,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,GAAG,GAAa,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAA;AAErE,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrF,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE;YAC5D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAW,KAAK,EAAE,MAAmB,EAAE,EAAE;IAChE,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CACvC,sCAAsC,EACtC,QAAQ,CACT,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "opencode-polkit",
+  "version": "0.1.0",
+  "description": "Redirect sudo/doas to pkexec in OpenCode — uses system polkit agent for native auth dialogs",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "opencode": ">=1.0.0"
+  },
+  "peerDependencies": {
+    "@opencode-ai/plugin": ">=1.0.0"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "^1.0.0",
+    "bun-types": "^1.2.0",
+    "typescript": "^5.5.0"
+  },
+  "keywords": ["opencode-plugin", "sudo", "pkexec", "polkit", "security"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lenitain/opencode-polkit.git"
+  },
+  "bugs": {
+    "url": "https://github.com/lenitain/opencode-polkit/issues"
+  }
+}