opencode-polkit 0.1.1 → 0.1.3

package/README.md

@@ -4,8 +4,10 @@ Redirect `sudo`/`doas` to `pkexec` in [OpenCode](https://opencode.ai).
 Triggers the system's native polkit authentication dialog (KDE, GNOME, etc.)
 instead of requiring a terminal for password input.
 
-When polkit is unavailable, privilege escalation commands are blocked with a
-clear error message.
+Like CachyOS Hello, the plugin does not check for a polkit agent up front:
+`sudo` is always redirected to `pkexec` at execution time, and polkitd routes
+the request to whatever agent is currently registered. If no agent is
+available, `pkexec` fails with its own clear error message.
 
 ## Install
 
@@ -21,15 +23,23 @@ Or add to `opencode.json` / `~/.config/opencode/opencode.jsonc`:
 }
 ```
 
+For local development, point opencode at the project directory instead:
+
+```json
+{
+  "plugin": ["/path/to/opencode-polkit"]
+}
+```
+
 ## Behavior
 
-| Command         | polkit available               | polkit unavailable   |
-|-----------------|--------------------------------|----------------------|
-| `sudo xxx`      | redirects to `pkexec xxx`      | blocked with error   |
-| `doas xxx`      | redirects to `pkexec xxx`      | blocked with error   |
-| `pkexec xxx`    | passes through                 | blocked with error   |
-| `sudoedit`      | blocked                        | blocked              |
-| `visudo`        | blocked                        | blocked              |
+| Command         | result                                     |
+|-----------------|--------------------------------------------|
+| `sudo xxx`      | redirects to `pkexec xxx`                  |
+| `doas xxx`      | redirects to `pkexec xxx`                  |
+| `pkexec xxx`    | passes through                             |
+| `sudoedit`      | blocked                                    |
+| `visudo`        | blocked                                    |
 
 When a user denies the polkit authentication dialog, a clear error message is shown.
 

package/dist/index.js

@@ -1,77 +1,47 @@
 const MATCH = /(?<![-\/.\w])(sudo|pkexec|doas|sudoedit|visudo)(?![-\/.\w])/i;
-const POLKIT_AGENTS = [
-    "polkit-kde-authentication-agent-1",
-    "polkit-gnome-authentication-agent-1",
-    "lxqt-policykit-agent",
-    "mate-polkit",
-    "xfce-polkit",
-    "dde-polkit-agent",
-];
 const translations = {
     en: {
         blocked: "Privilege escalation command blocked by plugin",
-        noPolkit: "sudo/doas blocked: no polkit agent detected, cannot escalate safely",
-        noPolkitPkexec: "pkexec unavailable: no polkit agent detected",
         polkitDenied: "Polkit authentication denied by user",
     },
     zh: {
         blocked: "权限提升命令已被插件拦截",
-        noPolkit: "sudo/doas 已被拦截：未检测到 polkit agent，无法安全提权",
-        noPolkitPkexec: "pkexec 不可用：未检测到 polkit agent",
         polkitDenied: "Polkit 认证已被用户拒绝",
     },
     ja: {
         blocked: "特権昇格コマンドはプラグインによりブロックされました",
-        noPolkit: "sudo/doas がブロックされました：polkit エージェントが見つからないため、安全に昇格できません",
-        noPolkitPkexec: "pkexec は利用できません：polkit エージェントが見つかりません",
         polkitDenied: "Polkit 認証がユーザーによって拒否されました",
     },
     ko: {
         blocked: "권한 상승 명령이 플러그인에 의해 차단되었습니다",
-        noPolkit: "sudo/doas 차단됨: polkit 에이전트가 감지되지 않아 안전하게 권한 상승할 수 없습니다",
-        noPolkitPkexec: "pkexec 사용 불가: polkit 에이전트가 감지되지 않았습니다",
         polkitDenied: "Polkit 인증이 사용자에 의해 거부되었습니다",
     },
     de: {
         blocked: "Berechtigungseskalation vom Plugin blockiert",
-        noPolkit: "sudo/doas blockiert: kein polkit-Agent erkannt, sichere Eskalation nicht möglich",
-        noPolkitPkexec: "pkexec nicht verfügbar: kein polkit-Agent erkannt",
         polkitDenied: "Polkit-Authentifizierung vom Benutzer abgelehnt",
     },
     fr: {
         blocked: "Commande d'élévation de privilèges bloquée par le plugin",
-        noPolkit: "sudo/doas bloqué : aucun agent polkit détecté, élévation impossible",
-        noPolkitPkexec: "pkexec indisponible : aucun agent polkit détecté",
         polkitDenied: "Authentification polkit refusée par l'utilisateur",
     },
     es: {
         blocked: "Comando de elevación de privilegios bloqueado por el plugin",
-        noPolkit: "sudo/doas bloqueado: no se detectó agente polkit, no se puede elevar de forma segura",
-        noPolkitPkexec: "pkexec no disponible: no se detectó agente polkit",
         polkitDenied: "Autenticación polkit denegada por el usuario",
     },
     pt: {
         blocked: "Comando de elevação de privilégios bloqueado pelo plugin",
-        noPolkit: "sudo/doas bloqueado: nenhum agente polkit detectado, não é possível elevar com segurança",
-        noPolkitPkexec: "pkexec indisponível: nenhum agente polkit detectado",
         polkitDenied: "Autenticação polkit negada pelo usuário",
     },
     ru: {
         blocked: "Команда повышения привилегий заблокирована плагином",
-        noPolkit: "sudo/doas заблокирован: не обнаружен polkit-агент, невозможно безопасно повысить привилегии",
-        noPolkitPkexec: "pkexec недоступен: не обнаружен polkit-агент",
         polkitDenied: "Аутентификация polkit отклонена пользователем",
     },
     tr: {
         blocked: "Yetki yükseltme komutu eklenti tarafından engellendi",
-        noPolkit: "sudo/doas engellendi: polkit aracısı algılanmadı, güvenli şekilde yetki yükseltilemez",
-        noPolkitPkexec: "pkexec kullanılamıyor: polkit aracısı algılanmadı",
         polkitDenied: "Polkit kimlik doğrulaması kullanıcı tarafından reddedildi",
     },
     uk: {
         blocked: "Команду підвищення привілеїв заблоковано плагіном",
-        noPolkit: "sudo/doas заблоковано: не виявлено агента polkit, неможливо безпечно підвищити привілеї",
-        noPolkitPkexec: "pkexec недоступний: не виявлено агента polkit",
         polkitDenied: "Автентифікацію polkit відхилено користувачем",
     },
 };
@@ -85,30 +55,8 @@ function detectLocale() {
     return "en";
 }
 const MSG = translations[detectLocale()] ?? translations.en;
-function polkitAvailable() {
-    try {
-        if (process.env.DBUS_SESSION_BUS_ADDRESS) {
-            const proc = Bun.spawnSync(["busctl", "--user", "list"], {
-                stdio: ["ignore", "pipe", "pipe"],
-            });
-            if (proc.exitCode === 0 && /\bpolkit\b/i.test(new TextDecoder().decode(proc.stdout))) {
-                return true;
-            }
-        }
-    }
-    catch { /* fall through */ }
-    try {
-        const proc = Bun.spawnSync(["pgrep", "-x", ...POLKIT_AGENTS], {
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        return proc.exitCode === 0;
-    }
-    catch {
-        return false;
-    }
-}
-const hasPolkit = polkitAvailable();
 export const PolkitPlugin = async (_input) => {
+    const deniedCommands = new Set();
     return {
         "tool.execute.before": async (hookInput, hookOutput) => {
             if (hookInput.tool !== "bash")
@@ -116,17 +64,15 @@ export const PolkitPlugin = async (_input) => {
             const command = hookOutput?.args?.command ?? "";
             if (!MATCH.test(command))
                 return;
+            if (deniedCommands.has(command)) {
+                throw new Error(MSG.polkitDenied);
+            }
             if (/^pkexec(?![-\/.\w])/.test(command.trim())) {
-                if (!hasPolkit)
-                    throw new Error(MSG.noPolkitPkexec);
                 return;
             }
             if (/(?<![-\/.\w])(sudoedit|visudo)(?![-\/.\w])/.test(command)) {
                 throw new Error(MSG.blocked);
             }
-            if (!hasPolkit) {
-                throw new Error(MSG.noPolkit);
-            }
             hookOutput.args.command = command.replace(/(?<![-\/.\w])(sudo|doas)(?![-\/.\w])/, "pkexec");
         },
         "tool.execute.after": async (hookInput, hookOutput) => {
@@ -135,11 +81,12 @@ export const PolkitPlugin = async (_input) => {
             const command = hookInput.args?.command ?? "";
             if (!MATCH.test(command))
                 return;
+            const originalCommand = command.replace(/(?<![-\/.\w])pkexec(?![-\/.\w])/, "sudo");
             if (/\bNot authorized\b/.test(hookOutput.output) ||
                 /\bError executing command as another user\b/.test(hookOutput.output)) {
+                deniedCommands.add(originalCommand);
                 throw new Error(MSG.polkitDenied);
             }
         },
     };
 };
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-polkit",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Redirect sudo/doas to pkexec in OpenCode — uses system polkit agent for native auth dialogs",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,8 +17,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "npm run build"
+    "build": "deno task build",
+    "check": "deno task check"
   },
   "engines": {
     "opencode": ">=1.0.0"

package/dist/index.d.ts

@@ -1,3 +0,0 @@
-import type { Plugin } from "@opencode-ai/plugin";
-export declare const PolkitPlugin: Plugin;
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAA;AA2H9D,eAAO,MAAM,YAAY,EAAE,MAoC1B,CAAA"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAG,8DAA8D,CAAA;AAE5E,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,qCAAqC;IACrC,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,kBAAkB;CACnB,CAAA;AASD,MAAM,YAAY,GAA6B;IAC7C,EAAE,EAAE;QACF,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,sCAAsC;KACrD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,yCAAyC;QACnD,cAAc,EAAE,8BAA8B;QAC9C,YAAY,EAAE,iBAAiB;KAChC;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,2BAA2B;KAC1C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,4BAA4B;KAC3C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,kFAAkF;QAC5F,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,iDAAiD;KAChE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,kDAAkD;QAClE,YAAY,EAAE,mDAAmD;KAClE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,sFAAsF;QAChG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,8CAA8C;KAC7D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,0FAA0F;QACpG,cAAc,EAAE,qDAAqD;QACrE,YAAY,EAAE,yCAAyC;KACxD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,6FAA6F;QACvG,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,+CAA+C;KAC9D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,uFAAuF;QACjG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,2DAA2D;KAC1E;IACD,EAAE,EAAE;QACF,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,yFAAyF;QACnG,cAAc,EAAE,+CAA+C;QAC/D,YAAY,EAAE,8CAA8C;KAC7D;CACF,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,GAAG,GAAa,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAA;AAErE,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrF,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE;YAC5D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAW,KAAK,EAAE,MAAmB,EAAE,EAAE;IAChE,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CACvC,sCAAsC,EACtC,QAAQ,CACT,CAAA;QACH,CAAC;QACD,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC5C,6CAA6C,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}