opencode-polkit 0.1.4 → 0.1.5

package/README.md

@@ -41,6 +41,7 @@ For local development, point opencode at the project directory instead:
 |-----------------------|-------------------------------------------------------|
 | `sudo xxx`            | redirects to `pkexec xxx`                             |
 | `doas xxx`            | redirects to `pkexec xxx`                             |
+| `sudo -n xxx`         | blocked: pkexec has no short options (unclear failure)|
 | `cat x \| sudo tee y` | redirects to `cat x \| pkexec tee y` (mid-command)    |
 | `pkexec xxx`          | passes through                                        |
 | `sudoedit` / `visudo` | blocked                                               |
@@ -52,8 +53,10 @@ The command is rewritten **only** by replacing `sudo`/`doas` with
 command that behaves like the one it wrote. Privilege keywords are found
 by a lexical scanner (quote/escape/heredoc aware): `sudo` inside string
 literals, comments or heredocs is ignored; `sudo` in any executable
-position (leading, after `&&`/`||`/`|`, in `$(...)` or subshells) is
-rewritten. `sudo a && sudo b` rewrites both.
+position (leading, after `&&`/`||`/`|`, in `$(...)` or subshells, after
+an env assignment like `FOO=1 sudo x`) is rewritten, while the same word
+in argument position (`--name sudo bash`) is left alone. `sudo a && sudo b`
+rewrites both.
 
 ### Failures
 
@@ -66,6 +69,13 @@ the bash tool's own timeout (default 2 min, configurable up to 10 min)
 and is left untranslated — it cannot be told apart from a long-running
 command.
 
+Options pkexec does not accept (all short options, plus any long option
+outside `--user`, `--keep-cwd`, `--disable-internal-agent`, `--help`,
+`--version`) are rejected before execution with a clear message, since
+the rewrite would otherwise surface pkexec's own confusing
+`Cannot run program -n` error. `sudo --` and options after the program
+name are left alone.
+
 ## i18n
 
 Messages adapt to `$LC_MESSAGES` / `$LANG`. Currently supports:

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from "@opencode-ai/plugin";
+export declare const PolkitPlugin: Plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAA;AA2H9D,eAAO,MAAM,YAAY,EAAE,MAgD1B,CAAA"}

package/dist/index.js

@@ -1,3 +1,11 @@
+/** Long options pkexec accepts (all of them; pkexec has no short options). */
+const PKEXEC_OPTIONS = new Set([
+    "--version",
+    "--help",
+    "--disable-internal-agent",
+    "--keep-cwd",
+    "--user",
+]);
 /**
  * Lexical scan for privilege-escalation keywords OUTSIDE quotes.
  *
@@ -10,23 +18,31 @@
  * - `node -e "…sudo…"`        → no hit (inside quotes)
  * - `cat x | sudo tee y`       → hit at index 8 (command boundary)
  * - `cd /tmp && sudo ./x`      → hit (after `&&`)
+ * - `--name sudo bash`         → no hit (argument position)
+ * - `echo x; # sudo y`         → no hit (comment)
  */
 function scanPrivileged(command) {
     const hits = [];
     let inSingle = false;
     let inDouble = false;
     let escaped = false;
+    // True right after a command boundary (`;`, `&&`, `||`, `|`, `(`, start).
+    let atCommandStart = true;
     // Heredoc delimiters waiting to close (stack; multiple << are legal).
     const heredocs = [];
     for (let i = 0; i < command.length; i++) {
         const ch = command[i];
         // Inside a heredoc body: only a line consisting of the delimiter ends
-        // it. Content there is a string literal, never a command.
+        // it. Content there is a string literal, never a command. Pop the
+        // matching delimiter (nested heredocs close in any order).
         if (heredocs.length > 0) {
             const lineEnd = command.indexOf("\n", i);
             const line = lineEnd === -1 ? command.slice(i) : command.slice(i, lineEnd);
-            if (heredocs.some((d) => line === d)) {
-                heredocs.pop();
+            const idx = heredocs.lastIndexOf(line);
+            if (idx !== -1) {
+                heredocs.splice(idx);
+                // The line after the delimiter starts a new command position.
+                atCommandStart = true;
             }
             i = lineEnd === -1 ? command.length : lineEnd;
             continue;
@@ -43,7 +59,7 @@ function scanPrivileged(command) {
             inSingle = !inSingle;
             continue;
         }
-        if (ch === '"' && !inSingle) {
+        if (ch === '"' && !inDouble) {
             inDouble = !inDouble;
             continue;
         }
@@ -74,8 +90,37 @@ function scanPrivileged(command) {
                 }
             }
         }
-        const prev = i > 0 ? command[i - 1] : "";
-        if (/[-\/.\w]/.test(prev))
+        // Command boundaries open a new executable position.
+        if (ch === ";" || ch === "|" || ch === "&" || ch === "(" || ch === "\n") {
+            atCommandStart = true;
+            continue;
+        }
+        // `#` at a word start begins a comment that runs to end of line.
+        if (ch === "#") {
+            const prev = command[i - 1] ?? "";
+            if (i === 0 || /\s/.test(prev) || /[;|&(]/.test(prev)) {
+                const nl = command.indexOf("\n", i);
+                i = nl === -1 ? command.length : nl;
+                continue;
+            }
+        }
+        if (/\s/.test(ch))
+            continue;
+        // An env assignment (`FOO=1 sudo x`) still starts a command; any other
+        // word in argument position (`--name sudo`) does not.
+        let isCommandPos = atCommandStart;
+        if (!isCommandPos) {
+            let j = i - 1;
+            while (j >= 0 && /\s/.test(command[j]))
+                j--;
+            while (j >= 0 && !/[\s;|&()]/.test(command[j]))
+                j--;
+            const token = command.slice(j + 1, i);
+            if (token.includes("="))
+                isCommandPos = true;
+        }
+        atCommandStart = false;
+        if (!isCommandPos)
             continue;
         for (const kw of ["sudoedit", "visudo", "sudo", "doas", "pkexec"]) {
             if (command.startsWith(kw, i)) {
@@ -90,50 +135,93 @@ function scanPrivileged(command) {
     }
     return hits;
 }
+/**
+ * First option token after a privilege keyword that pkexec does not
+ * accept, or null when the command's options are pkexec-compatible.
+ * Scanning stops at the program name (`--` also terminates options, as
+ * in sudo); tokens after it belong to the program, not to pkexec.
+ *
+ * - `sudo -n true`             → `-n` (pkexec has no short options)
+ * - `sudo --non-interactive x` → `--non-interactive`
+ * - `sudo --user root x`       → null (compatible)
+ * - `sudo -- x -n`             → null (`--` ends sudo options)
+ */
+function findBadOption(command, hit) {
+    let i = hit.index + hit.kw.length;
+    while (i < command.length && /\s/.test(command[i]))
+        i++;
+    while (i < command.length && command[i] === "-") {
+        let end = i + 1;
+        while (end < command.length && !/\s/.test(command[end]) && !/[;|&()]/.test(command[end]))
+            end++;
+        const token = command.slice(i, end);
+        if (token === "--")
+            break;
+        if (!token.startsWith("--"))
+            return token;
+        if (!PKEXEC_OPTIONS.has(token.split("=")[0]))
+            return token;
+        i = end;
+        while (i < command.length && /\s/.test(command[i]))
+            i++;
+    }
+    return null;
+}
 const translations = {
     en: {
         blocked: "Privilege escalation command blocked by plugin",
         polkitDenied: "Polkit authentication denied by user",
+        badOption: 'Option "{opt}" is not supported by pkexec. Remove it or use a pkexec-compatible one (--user, --keep-cwd, --disable-internal-agent).',
     },
     zh: {
         blocked: "权限提升命令已被插件拦截",
         polkitDenied: "Polkit 认证已被用户拒绝",
+        badOption: '选项 "{opt}" 不被 pkexec 支持,请移除或改用 pkexec 兼容选项(--user、--keep-cwd、--disable-internal-agent)。',
     },
     ja: {
         blocked: "特権昇格コマンドはプラグインによりブロックされました",
         polkitDenied: "Polkit 認証がユーザーによって拒否されました",
+        badOption: 'オプション "{opt}" は pkexec ではサポートされていません。削除するか、pkexec 互換オプション(--user、--keep-cwd、--disable-internal-agent)を使用してください。',
     },
     ko: {
         blocked: "권한 상승 명령이 플러그인에 의해 차단되었습니다",
         polkitDenied: "Polkit 인증이 사용자에 의해 거부되었습니다",
+        badOption: '옵션 "{opt}"은(는) pkexec에서 지원되지 않습니다. 제거하거나 pkexec 호환 옵션(--user, --keep-cwd, --disable-internal-agent)을 사용하세요.',
     },
     de: {
         blocked: "Berechtigungseskalation vom Plugin blockiert",
         polkitDenied: "Polkit-Authentifizierung vom Benutzer abgelehnt",
+        badOption: 'Option "{opt}" wird von pkexec nicht unterstützt. Entfernen Sie sie oder verwenden Sie eine pkexec-kompatible Option (--user, --keep-cwd, --disable-internal-agent).',
     },
     fr: {
         blocked: "Commande d'élévation de privilèges bloquée par le plugin",
         polkitDenied: "Authentification polkit refusée par l'utilisateur",
+        badOption: 'Option "{opt}" non prise en charge par pkexec. Supprimez-la ou utilisez une option compatible pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     es: {
         blocked: "Comando de elevación de privilegios bloqueado por el plugin",
         polkitDenied: "Autenticación polkit denegada por el usuario",
+        badOption: 'Opción "{opt}" no admitida por pkexec. Elimínela o use una opción compatible con pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     pt: {
         blocked: "Comando de elevação de privilégios bloqueado pelo plugin",
         polkitDenied: "Autenticação polkit negada pelo usuário",
+        badOption: 'Opção "{opt}" não suportada pelo pkexec. Remova-a ou use uma opção compatível com pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     ru: {
         blocked: "Команда повышения привилегий заблокирована плагином",
         polkitDenied: "Аутентификация polkit отклонена пользователем",
+        badOption: 'Параметр "{opt}" не поддерживается pkexec. Удалите его или используйте совместимый параметр (--user, --keep-cwd, --disable-internal-agent).',
     },
     tr: {
         blocked: "Yetki yükseltme komutu eklenti tarafından engellendi",
         polkitDenied: "Polkit kimlik doğrulaması kullanıcı tarafından reddedildi",
+        badOption: '"{opt}" seçeneği pkexec tarafından desteklenmiyor. Kaldırın veya pkexec uyumlu bir seçenek kullanın (--user, --keep-cwd, --disable-internal-agent).',
     },
     uk: {
         blocked: "Команду підвищення привілеїв заблоковано плагіном",
         polkitDenied: "Автентифікацію polkit відхилено користувачем",
+        badOption: 'Параметр "{opt}" не підтримується pkexec. Видаліть його або використайте сумісний параметр (--user, --keep-cwd, --disable-internal-agent).',
     },
 };
 function detectLocale() {
@@ -162,6 +250,15 @@ export const PolkitPlugin = async (_input) => {
             if (hits.some((h) => h.kw === "sudoedit" || h.kw === "visudo")) {
                 throw new Error(MSG.blocked);
             }
+            // Rewrite would produce `pkexec <bad option>`: fail with a clear
+            // message instead of a confusing `Cannot run program` error.
+            for (const h of hits) {
+                if (h.kw === "sudo" || h.kw === "doas" || h.kw === "pkexec") {
+                    const bad = findBadOption(command, h);
+                    if (bad)
+                        throw new Error(MSG.badOption.replace("{opt}", bad));
+                }
+            }
             // Already pkexec (leading or mid-command): pass through untouched.
             if (hits.every((h) => h.kw === "pkexec"))
                 return;

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAG,8DAA8D,CAAA;AAE5E,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,qCAAqC;IACrC,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,kBAAkB;CACnB,CAAA;AASD,MAAM,YAAY,GAA6B;IAC7C,EAAE,EAAE;QACF,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,sCAAsC;KACrD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,yCAAyC;QACnD,cAAc,EAAE,8BAA8B;QAC9C,YAAY,EAAE,iBAAiB;KAChC;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,2BAA2B;KAC1C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,wDAAwD;QAClE,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,4BAA4B;KAC3C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,kFAAkF;QAC5F,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,iDAAiD;KAChE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,qEAAqE;QAC/E,cAAc,EAAE,kDAAkD;QAClE,YAAY,EAAE,mDAAmD;KAClE;IACD,EAAE,EAAE;QACF,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,sFAAsF;QAChG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,8CAA8C;KAC7D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,0FAA0F;QACpG,cAAc,EAAE,qDAAqD;QACrE,YAAY,EAAE,yCAAyC;KACxD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,6FAA6F;QACvG,cAAc,EAAE,8CAA8C;QAC9D,YAAY,EAAE,+CAA+C;KAC9D;IACD,EAAE,EAAE;QACF,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,uFAAuF;QACjG,cAAc,EAAE,mDAAmD;QACnE,YAAY,EAAE,2DAA2D;KAC1E;IACD,EAAE,EAAE;QACF,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,yFAAyF;QACnG,cAAc,EAAE,+CAA+C;QAC/D,YAAY,EAAE,8CAA8C;KAC7D;CACF,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,GAAG,GAAa,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAA;AAErE,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrF,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE;YAC5D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAW,KAAK,EAAE,MAAmB,EAAE,EAAE;IAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAExC,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACnC,CAAC;YAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YAED,IAAI,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CACvC,sCAAsC,EACtC,QAAQ,CACT,CAAA;QACH,CAAC;QACD,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAM;YACrC,MAAM,OAAO,GAAW,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAA;YACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAEhC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CACrC,iCAAiC,EACjC,MAAM,CACP,CAAA;YAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC5C,6CAA6C,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBACnC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-polkit",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Redirect sudo/doas to pkexec in OpenCode — uses system polkit agent for native auth dialogs",
   "type": "module",
   "main": "./dist/index.js",