opencode-polkit 0.1.3 → 0.1.5

package/README.md

@@ -6,8 +6,12 @@ instead of requiring a terminal for password input.
 
 Like CachyOS Hello, the plugin does not check for a polkit agent up front:
 `sudo` is always redirected to `pkexec` at execution time, and polkitd routes
-the request to whatever agent is currently registered. If no agent is
-available, `pkexec` fails with its own clear error message.
+the request to whatever agent is currently registered. Without an agent,
+`pkexec` fails fast with `Error creating textual authentication agent`
+(no TTY); the plugin reports that as a clear denial. A hang (dialog never
+appears) is bounded by the bash tool's own timeout (default 2 min,
+configurable up to 10 min) and left untranslated — it cannot be told
+apart from a long-running command.
 
 ## Install
 
@@ -33,15 +37,44 @@ For local development, point opencode at the project directory instead:
 
 ## Behavior
 
-| Command         | result                                     |
-|-----------------|--------------------------------------------|
-| `sudo xxx`      | redirects to `pkexec xxx`                  |
-| `doas xxx`      | redirects to `pkexec xxx`                  |
-| `pkexec xxx`    | passes through                             |
-| `sudoedit`      | blocked                                    |
-| `visudo`        | blocked                                    |
-
-When a user denies the polkit authentication dialog, a clear error message is shown.
+| Command               | result                                                |
+|-----------------------|-------------------------------------------------------|
+| `sudo xxx`            | redirects to `pkexec xxx`                             |
+| `doas xxx`            | redirects to `pkexec xxx`                             |
+| `sudo -n xxx`         | blocked: pkexec has no short options (unclear failure)|
+| `cat x \| sudo tee y` | redirects to `cat x \| pkexec tee y` (mid-command)    |
+| `pkexec xxx`          | passes through                                        |
+| `sudoedit` / `visudo` | blocked                                               |
+
+### Minimal intervention
+
+The command is rewritten **only** by replacing `sudo`/`doas` with
+`pkexec` — its shape is otherwise untouched, so the agent always sees a
+command that behaves like the one it wrote. Privilege keywords are found
+by a lexical scanner (quote/escape/heredoc aware): `sudo` inside string
+literals, comments or heredocs is ignored; `sudo` in any executable
+position (leading, after `&&`/`||`/`|`, in `$(...)` or subshells, after
+an env assignment like `FOO=1 sudo x`) is rewritten, while the same word
+in argument position (`--name sudo bash`) is left alone. `sudo a && sudo b`
+rewrites both.
+
+### Failures
+
+Unambiguous authentication failures are reported as clear errors and the
+command is remembered so a retry is rejected without prompting again
+(cleared when opencode restarts): `Not authorized`, `Error executing
+command as another user`, `Error creating textual authentication agent`
+(no polkit agent + no TTY). A hang (dialog never appears) is bounded by
+the bash tool's own timeout (default 2 min, configurable up to 10 min)
+and is left untranslated — it cannot be told apart from a long-running
+command.
+
+Options pkexec does not accept (all short options, plus any long option
+outside `--user`, `--keep-cwd`, `--disable-internal-agent`, `--help`,
+`--version`) are rejected before execution with a clear message, since
+the rewrite would otherwise surface pkexec's own confusing
+`Cannot run program -n` error. `sudo --` and options after the program
+name are left alone.
 
 ## i18n
 

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from "@opencode-ai/plugin";
+export declare const PolkitPlugin: Plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAA;AA2H9D,eAAO,MAAM,YAAY,EAAE,MAgD1B,CAAA"}

package/dist/index.js

@@ -1,48 +1,227 @@
-const MATCH = /(?<![-\/.\w])(sudo|pkexec|doas|sudoedit|visudo)(?![-\/.\w])/i;
+/** Long options pkexec accepts (all of them; pkexec has no short options). */
+const PKEXEC_OPTIONS = new Set([
+    "--version",
+    "--help",
+    "--disable-internal-agent",
+    "--keep-cwd",
+    "--user",
+]);
+/**
+ * Lexical scan for privilege-escalation keywords OUTSIDE quotes.
+ *
+ * Shell commands may contain `sudo` anywhere a command starts (pipes,
+ * `&&`/`||`, subshells, command substitution), and string literals /
+ * comments may contain the same words spuriously. A plain regex cannot
+ * tell those apart; this scanner tracks quote state (' " and backslash
+ * escapes) and only reports keywords in executable position.
+ *
+ * - `node -e "…sudo…"`        → no hit (inside quotes)
+ * - `cat x | sudo tee y`       → hit at index 8 (command boundary)
+ * - `cd /tmp && sudo ./x`      → hit (after `&&`)
+ * - `--name sudo bash`         → no hit (argument position)
+ * - `echo x; # sudo y`         → no hit (comment)
+ */
+function scanPrivileged(command) {
+    const hits = [];
+    let inSingle = false;
+    let inDouble = false;
+    let escaped = false;
+    // True right after a command boundary (`;`, `&&`, `||`, `|`, `(`, start).
+    let atCommandStart = true;
+    // Heredoc delimiters waiting to close (stack; multiple << are legal).
+    const heredocs = [];
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        // Inside a heredoc body: only a line consisting of the delimiter ends
+        // it. Content there is a string literal, never a command. Pop the
+        // matching delimiter (nested heredocs close in any order).
+        if (heredocs.length > 0) {
+            const lineEnd = command.indexOf("\n", i);
+            const line = lineEnd === -1 ? command.slice(i) : command.slice(i, lineEnd);
+            const idx = heredocs.lastIndexOf(line);
+            if (idx !== -1) {
+                heredocs.splice(idx);
+                // The line after the delimiter starts a new command position.
+                atCommandStart = true;
+            }
+            i = lineEnd === -1 ? command.length : lineEnd;
+            continue;
+        }
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\" && !inSingle) {
+            escaped = true;
+            continue;
+        }
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (ch === '"' && !inDouble) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        // Heredoc start: `<<[-]DELIM` (delim may be quoted or unquoted).
+        if (ch === "<" && command[i + 1] === "<") {
+            let j = i + 2;
+            if (command[j] === "-")
+                j++;
+            while (j < command.length && /\s/.test(command[j]))
+                j++;
+            if (j < command.length && (command[j] === "'" || command[j] === '"')) {
+                const q = command[j];
+                const end = command.indexOf(q, j + 1);
+                if (end !== -1) {
+                    heredocs.push(command.slice(j + 1, end));
+                    i = end;
+                    continue;
+                }
+            }
+            else {
+                const m = /^[^\s|;&<>()]+/.exec(command.slice(j));
+                if (m) {
+                    heredocs.push(m[0]);
+                    i = j + m[0].length - 1;
+                    continue;
+                }
+            }
+        }
+        // Command boundaries open a new executable position.
+        if (ch === ";" || ch === "|" || ch === "&" || ch === "(" || ch === "\n") {
+            atCommandStart = true;
+            continue;
+        }
+        // `#` at a word start begins a comment that runs to end of line.
+        if (ch === "#") {
+            const prev = command[i - 1] ?? "";
+            if (i === 0 || /\s/.test(prev) || /[;|&(]/.test(prev)) {
+                const nl = command.indexOf("\n", i);
+                i = nl === -1 ? command.length : nl;
+                continue;
+            }
+        }
+        if (/\s/.test(ch))
+            continue;
+        // An env assignment (`FOO=1 sudo x`) still starts a command; any other
+        // word in argument position (`--name sudo`) does not.
+        let isCommandPos = atCommandStart;
+        if (!isCommandPos) {
+            let j = i - 1;
+            while (j >= 0 && /\s/.test(command[j]))
+                j--;
+            while (j >= 0 && !/[\s;|&()]/.test(command[j]))
+                j--;
+            const token = command.slice(j + 1, i);
+            if (token.includes("="))
+                isCommandPos = true;
+        }
+        atCommandStart = false;
+        if (!isCommandPos)
+            continue;
+        for (const kw of ["sudoedit", "visudo", "sudo", "doas", "pkexec"]) {
+            if (command.startsWith(kw, i)) {
+                const next = command[i + kw.length] ?? "";
+                if (!/[-\/.\w]/.test(next)) {
+                    hits.push({ index: i, kw });
+                    i += kw.length - 1;
+                    break;
+                }
+            }
+        }
+    }
+    return hits;
+}
+/**
+ * First option token after a privilege keyword that pkexec does not
+ * accept, or null when the command's options are pkexec-compatible.
+ * Scanning stops at the program name (`--` also terminates options, as
+ * in sudo); tokens after it belong to the program, not to pkexec.
+ *
+ * - `sudo -n true`             → `-n` (pkexec has no short options)
+ * - `sudo --non-interactive x` → `--non-interactive`
+ * - `sudo --user root x`       → null (compatible)
+ * - `sudo -- x -n`             → null (`--` ends sudo options)
+ */
+function findBadOption(command, hit) {
+    let i = hit.index + hit.kw.length;
+    while (i < command.length && /\s/.test(command[i]))
+        i++;
+    while (i < command.length && command[i] === "-") {
+        let end = i + 1;
+        while (end < command.length && !/\s/.test(command[end]) && !/[;|&()]/.test(command[end]))
+            end++;
+        const token = command.slice(i, end);
+        if (token === "--")
+            break;
+        if (!token.startsWith("--"))
+            return token;
+        if (!PKEXEC_OPTIONS.has(token.split("=")[0]))
+            return token;
+        i = end;
+        while (i < command.length && /\s/.test(command[i]))
+            i++;
+    }
+    return null;
+}
 const translations = {
     en: {
         blocked: "Privilege escalation command blocked by plugin",
         polkitDenied: "Polkit authentication denied by user",
+        badOption: 'Option "{opt}" is not supported by pkexec. Remove it or use a pkexec-compatible one (--user, --keep-cwd, --disable-internal-agent).',
     },
     zh: {
         blocked: "权限提升命令已被插件拦截",
         polkitDenied: "Polkit 认证已被用户拒绝",
+        badOption: '选项 "{opt}" 不被 pkexec 支持,请移除或改用 pkexec 兼容选项(--user、--keep-cwd、--disable-internal-agent)。',
     },
     ja: {
         blocked: "特権昇格コマンドはプラグインによりブロックされました",
         polkitDenied: "Polkit 認証がユーザーによって拒否されました",
+        badOption: 'オプション "{opt}" は pkexec ではサポートされていません。削除するか、pkexec 互換オプション(--user、--keep-cwd、--disable-internal-agent)を使用してください。',
     },
     ko: {
         blocked: "권한 상승 명령이 플러그인에 의해 차단되었습니다",
         polkitDenied: "Polkit 인증이 사용자에 의해 거부되었습니다",
+        badOption: '옵션 "{opt}"은(는) pkexec에서 지원되지 않습니다. 제거하거나 pkexec 호환 옵션(--user, --keep-cwd, --disable-internal-agent)을 사용하세요.',
     },
     de: {
         blocked: "Berechtigungseskalation vom Plugin blockiert",
         polkitDenied: "Polkit-Authentifizierung vom Benutzer abgelehnt",
+        badOption: 'Option "{opt}" wird von pkexec nicht unterstützt. Entfernen Sie sie oder verwenden Sie eine pkexec-kompatible Option (--user, --keep-cwd, --disable-internal-agent).',
     },
     fr: {
         blocked: "Commande d'élévation de privilèges bloquée par le plugin",
         polkitDenied: "Authentification polkit refusée par l'utilisateur",
+        badOption: 'Option "{opt}" non prise en charge par pkexec. Supprimez-la ou utilisez une option compatible pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     es: {
         blocked: "Comando de elevación de privilegios bloqueado por el plugin",
         polkitDenied: "Autenticación polkit denegada por el usuario",
+        badOption: 'Opción "{opt}" no admitida por pkexec. Elimínela o use una opción compatible con pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     pt: {
         blocked: "Comando de elevação de privilégios bloqueado pelo plugin",
         polkitDenied: "Autenticação polkit negada pelo usuário",
+        badOption: 'Opção "{opt}" não suportada pelo pkexec. Remova-a ou use uma opção compatível com pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     ru: {
         blocked: "Команда повышения привилегий заблокирована плагином",
         polkitDenied: "Аутентификация polkit отклонена пользователем",
+        badOption: 'Параметр "{opt}" не поддерживается pkexec. Удалите его или используйте совместимый параметр (--user, --keep-cwd, --disable-internal-agent).',
     },
     tr: {
         blocked: "Yetki yükseltme komutu eklenti tarafından engellendi",
         polkitDenied: "Polkit kimlik doğrulaması kullanıcı tarafından reddedildi",
+        badOption: '"{opt}" seçeneği pkexec tarafından desteklenmiyor. Kaldırın veya pkexec uyumlu bir seçenek kullanın (--user, --keep-cwd, --disable-internal-agent).',
     },
     uk: {
         blocked: "Команду підвищення привілеїв заблоковано плагіном",
         polkitDenied: "Автентифікацію polkit відхилено користувачем",
+        badOption: 'Параметр "{opt}" не підтримується pkexec. Видаліть його або використайте сумісний параметр (--user, --keep-cwd, --disable-internal-agent).',
     },
 };
 function detectLocale() {
@@ -62,29 +241,63 @@ export const PolkitPlugin = async (_input) => {
             if (hookInput.tool !== "bash")
                 return;
             const command = hookOutput?.args?.command ?? "";
-            if (!MATCH.test(command))
+            const hits = scanPrivileged(command);
+            if (hits.length === 0)
                 return;
             if (deniedCommands.has(command)) {
                 throw new Error(MSG.polkitDenied);
             }
-            if (/^pkexec(?![-\/.\w])/.test(command.trim())) {
-                return;
-            }
-            if (/(?<![-\/.\w])(sudoedit|visudo)(?![-\/.\w])/.test(command)) {
+            if (hits.some((h) => h.kw === "sudoedit" || h.kw === "visudo")) {
                 throw new Error(MSG.blocked);
             }
-            hookOutput.args.command = command.replace(/(?<![-\/.\w])(sudo|doas)(?![-\/.\w])/, "pkexec");
+            // Rewrite would produce `pkexec <bad option>`: fail with a clear
+            // message instead of a confusing `Cannot run program` error.
+            for (const h of hits) {
+                if (h.kw === "sudo" || h.kw === "doas" || h.kw === "pkexec") {
+                    const bad = findBadOption(command, h);
+                    if (bad)
+                        throw new Error(MSG.badOption.replace("{opt}", bad));
+                }
+            }
+            // Already pkexec (leading or mid-command): pass through untouched.
+            if (hits.every((h) => h.kw === "pkexec"))
+                return;
+            // Rewrite every in-command sudo/doas to pkexec (back to front so
+            // indices stay valid): `cat x | sudo tee y` -> `cat x | pkexec tee y`.
+            // No other rewriting: the command keeps its exact shape so the agent
+            // sees only the minimal change (sudo -> pkexec).
+            let rewritten = command;
+            for (const h of [...hits].reverse()) {
+                if (h.kw === "sudo" || h.kw === "doas") {
+                    rewritten =
+                        rewritten.slice(0, h.index) + "pkexec" + rewritten.slice(h.index + h.kw.length);
+                }
+            }
+            hookOutput.args.command = rewritten;
         },
         "tool.execute.after": async (hookInput, hookOutput) => {
             if (hookInput.tool !== "bash")
                 return;
             const command = hookInput.args?.command ?? "";
-            if (!MATCH.test(command))
+            const hits = scanPrivileged(command);
+            if (hits.length === 0)
                 return;
-            const originalCommand = command.replace(/(?<![-\/.\w])pkexec(?![-\/.\w])/, "sudo");
+            // Reconstruct the user's original command for the deny list: map
+            // pkexec back to sudo.
+            let original = command;
+            for (const h of [...scanPrivileged(original)].reverse()) {
+                if (h.kw === "pkexec") {
+                    original = original.slice(0, h.index) + "sudo" + original.slice(h.index + 6);
+                }
+            }
+            // Only unambiguous authentication failures are reported and deny
+            // listed. A hang (dialog never appears) is bounded by the bash tool's
+            // own timeout (default 2 min) and is NOT translated here: it cannot
+            // be told apart from a long-running command.
             if (/\bNot authorized\b/.test(hookOutput.output) ||
-                /\bError executing command as another user\b/.test(hookOutput.output)) {
-                deniedCommands.add(originalCommand);
+                /\bError executing command as another user\b/.test(hookOutput.output) ||
+                /\bError creating textual authentication agent\b/.test(hookOutput.output)) {
+                deniedCommands.add(original);
                 throw new Error(MSG.polkitDenied);
             }
         },

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAG,8DAA8D,CAAA;AAE5E,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,qCAAqC;IACrC,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,kBAAkB;CACnB,CAAA;AASD,MAAM,YAAY,GAA6B;IAC7C,EAAE,EAAE;QACF,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,sCAAsC;KACrD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,yCAAyC;QACnD,cAAc,EAAE,8BAA8B;QAC9C,YAAY,EAAE,iBAAiB;KAChC;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,2BAA2B;KAC1C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,4BAA4B;KAC3C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,kFAAkF;QAC5F,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,iDAAiD;KAChE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,kDAAkD;QAClE,YAAY,EAAE,mDAAmD;KAClE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,sFAAsF;QAChG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,8CAA8C;KAC7D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,0FAA0F;QACpG,cAAc,EAAE,qDAAqD;QACrE,YAAY,EAAE,yCAAyC;KACxD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,6FAA6F;QACvG,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,+CAA+C;KAC9D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,uFAAuF;QACjG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,2DAA2D;KAC1E;IACD,EAAE,EAAE;QACF,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,yFAAyF;QACnG,cAAc,EAAE,+CAA+C;QAC/D,YAAY,EAAE,8CAA8C;KAC7D;CACF,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,GAAG,GAAa,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAA;AAErE,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrF,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE;YAC5D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAW,KAAK,EAAE,MAAmB,EAAE,EAAE;IAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAExC,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACnC,CAAC;YAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CACvC,sCAAsC,EACtC,QAAQ,CACT,CAAA;QACH,CAAC;QACD,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CACrC,iCAAiC,EACjC,MAAM,CACP,CAAA;YAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC5C,6CAA6C,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBACnC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-polkit",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Redirect sudo/doas to pkexec in OpenCode — uses system polkit agent for native auth dialogs",
   "type": "module",
   "main": "./dist/index.js",