opencode-polkit 0.1.4 → 0.2.0

package/README.md

@@ -9,29 +9,33 @@ Like CachyOS Hello, the plugin does not check for a polkit agent up front:
 the request to whatever agent is currently registered. Without an agent,
 `pkexec` fails fast with `Error creating textual authentication agent`
 (no TTY); the plugin reports that as a clear denial. A hang (dialog never
-appears) is bounded by the bash tool's own timeout (default 2 min,
-configurable up to 10 min) and left untranslated — it cannot be told
+appears) is bounded by the shell tool's own timeout (default 2 min,
+configurable per call) and left untranslated — it cannot be told
 apart from a long-running command.
 
+Requires OpenCode >= 2.0 (the plugin uses the `@opencode/plugin` v2 API and
+is skipped by older versions).
+
 ## Install
 
 ```sh
-opencode plugin opencode-polkit
+opencode plugin add opencode-polkit
 ```
 
 Or add to `opencode.json` / `~/.config/opencode/opencode.jsonc`:
 
 ```json
 {
-  "plugin": ["opencode-polkit"]
+  "plugins": ["opencode-polkit"]
 }
 ```
 
-For local development, point opencode at the project directory instead:
+For local development, build once (`npm run build` — the local entrypoint
+re-exports `dist/`) and point opencode at the project directory instead:
 
 ```json
 {
-  "plugin": ["/path/to/opencode-polkit"]
+  "plugins": ["/path/to/opencode-polkit"]
 }
 ```
 
@@ -41,6 +45,7 @@ For local development, point opencode at the project directory instead:
 |-----------------------|-------------------------------------------------------|
 | `sudo xxx`            | redirects to `pkexec xxx`                             |
 | `doas xxx`            | redirects to `pkexec xxx`                             |
+| `sudo -n xxx`         | blocked: pkexec has no short options (unclear failure)|
 | `cat x \| sudo tee y` | redirects to `cat x \| pkexec tee y` (mid-command)    |
 | `pkexec xxx`          | passes through                                        |
 | `sudoedit` / `visudo` | blocked                                               |
@@ -52,8 +57,10 @@ The command is rewritten **only** by replacing `sudo`/`doas` with
 command that behaves like the one it wrote. Privilege keywords are found
 by a lexical scanner (quote/escape/heredoc aware): `sudo` inside string
 literals, comments or heredocs is ignored; `sudo` in any executable
-position (leading, after `&&`/`||`/`|`, in `$(...)` or subshells) is
-rewritten. `sudo a && sudo b` rewrites both.
+position (leading, after `&&`/`||`/`|`, in `$(...)` or subshells, after
+an env assignment like `FOO=1 sudo x`) is rewritten, while the same word
+in argument position (`--name sudo bash`) is left alone. `sudo a && sudo b`
+rewrites both.
 
 ### Failures
 
@@ -62,10 +69,17 @@ command is remembered so a retry is rejected without prompting again
 (cleared when opencode restarts): `Not authorized`, `Error executing
 command as another user`, `Error creating textual authentication agent`
 (no polkit agent + no TTY). A hang (dialog never appears) is bounded by
-the bash tool's own timeout (default 2 min, configurable up to 10 min)
+the shell tool's own timeout (default 2 min, configurable per call)
 and is left untranslated — it cannot be told apart from a long-running
 command.
 
+Options pkexec does not accept (all short options, plus any long option
+outside `--user`, `--keep-cwd`, `--disable-internal-agent`, `--help`,
+`--version`) are rejected before execution with a clear message, since
+the rewrite would otherwise surface pkexec's own confusing
+`Cannot run program -n` error. `sudo --` and options after the program
+name are left alone.
+
 ## i18n
 
 Messages adapt to `$LC_MESSAGES` / `$LANG`. Currently supports:

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+import type { Plugin } from "@opencode/plugin";
+/**
+ * OpenCode 2.0 requires a default export shaped `{ id, setup }` (the loader
+ * rejects anything else). Deliberately a plain object with type-only imports:
+ * the built plugin has zero runtime dependencies.
+ */
+declare const _default: {
+    id: string;
+    setup: (ctx: Plugin.Context) => Promise<void>;
+};
+export default _default;

package/dist/index.js

@@ -1,3 +1,11 @@
+/** Long options pkexec accepts (all of them; pkexec has no short options). */
+const PKEXEC_OPTIONS = new Set([
+    "--version",
+    "--help",
+    "--disable-internal-agent",
+    "--keep-cwd",
+    "--user",
+]);
 /**
  * Lexical scan for privilege-escalation keywords OUTSIDE quotes.
  *
@@ -10,23 +18,31 @@
  * - `node -e "…sudo…"`        → no hit (inside quotes)
  * - `cat x | sudo tee y`       → hit at index 8 (command boundary)
  * - `cd /tmp && sudo ./x`      → hit (after `&&`)
+ * - `--name sudo bash`         → no hit (argument position)
+ * - `echo x; # sudo y`         → no hit (comment)
  */
 function scanPrivileged(command) {
     const hits = [];
     let inSingle = false;
     let inDouble = false;
     let escaped = false;
+    // True right after a command boundary (`;`, `&&`, `||`, `|`, `(`, start).
+    let atCommandStart = true;
     // Heredoc delimiters waiting to close (stack; multiple << are legal).
     const heredocs = [];
     for (let i = 0; i < command.length; i++) {
         const ch = command[i];
         // Inside a heredoc body: only a line consisting of the delimiter ends
-        // it. Content there is a string literal, never a command.
+        // it. Content there is a string literal, never a command. Pop the
+        // matching delimiter (nested heredocs close in any order).
         if (heredocs.length > 0) {
             const lineEnd = command.indexOf("\n", i);
             const line = lineEnd === -1 ? command.slice(i) : command.slice(i, lineEnd);
-            if (heredocs.some((d) => line === d)) {
-                heredocs.pop();
+            const idx = heredocs.lastIndexOf(line);
+            if (idx !== -1) {
+                heredocs.splice(idx);
+                // The line after the delimiter starts a new command position.
+                atCommandStart = true;
             }
             i = lineEnd === -1 ? command.length : lineEnd;
             continue;
@@ -43,7 +59,7 @@ function scanPrivileged(command) {
             inSingle = !inSingle;
             continue;
         }
-        if (ch === '"' && !inSingle) {
+        if (ch === '"' && !inDouble) {
             inDouble = !inDouble;
             continue;
         }
@@ -74,8 +90,37 @@ function scanPrivileged(command) {
                 }
             }
         }
-        const prev = i > 0 ? command[i - 1] : "";
-        if (/[-\/.\w]/.test(prev))
+        // Command boundaries open a new executable position.
+        if (ch === ";" || ch === "|" || ch === "&" || ch === "(" || ch === "\n") {
+            atCommandStart = true;
+            continue;
+        }
+        // `#` at a word start begins a comment that runs to end of line.
+        if (ch === "#") {
+            const prev = command[i - 1] ?? "";
+            if (i === 0 || /\s/.test(prev) || /[;|&(]/.test(prev)) {
+                const nl = command.indexOf("\n", i);
+                i = nl === -1 ? command.length : nl;
+                continue;
+            }
+        }
+        if (/\s/.test(ch))
+            continue;
+        // An env assignment (`FOO=1 sudo x`) still starts a command; any other
+        // word in argument position (`--name sudo`) does not.
+        let isCommandPos = atCommandStart;
+        if (!isCommandPos) {
+            let j = i - 1;
+            while (j >= 0 && /\s/.test(command[j]))
+                j--;
+            while (j >= 0 && !/[\s;|&()]/.test(command[j]))
+                j--;
+            const token = command.slice(j + 1, i);
+            if (token.includes("="))
+                isCommandPos = true;
+        }
+        atCommandStart = false;
+        if (!isCommandPos)
             continue;
         for (const kw of ["sudoedit", "visudo", "sudo", "doas", "pkexec"]) {
             if (command.startsWith(kw, i)) {
@@ -90,50 +135,93 @@ function scanPrivileged(command) {
     }
     return hits;
 }
+/**
+ * First option token after a privilege keyword that pkexec does not
+ * accept, or null when the command's options are pkexec-compatible.
+ * Scanning stops at the program name (`--` also terminates options, as
+ * in sudo); tokens after it belong to the program, not to pkexec.
+ *
+ * - `sudo -n true`             → `-n` (pkexec has no short options)
+ * - `sudo --non-interactive x` → `--non-interactive`
+ * - `sudo --user root x`       → null (compatible)
+ * - `sudo -- x -n`             → null (`--` ends sudo options)
+ */
+function findBadOption(command, hit) {
+    let i = hit.index + hit.kw.length;
+    while (i < command.length && /\s/.test(command[i]))
+        i++;
+    while (i < command.length && command[i] === "-") {
+        let end = i + 1;
+        while (end < command.length && !/\s/.test(command[end]) && !/[;|&()]/.test(command[end]))
+            end++;
+        const token = command.slice(i, end);
+        if (token === "--")
+            break;
+        if (!token.startsWith("--"))
+            return token;
+        if (!PKEXEC_OPTIONS.has(token.split("=")[0]))
+            return token;
+        i = end;
+        while (i < command.length && /\s/.test(command[i]))
+            i++;
+    }
+    return null;
+}
 const translations = {
     en: {
         blocked: "Privilege escalation command blocked by plugin",
         polkitDenied: "Polkit authentication denied by user",
+        badOption: 'Option "{opt}" is not supported by pkexec. Remove it or use a pkexec-compatible one (--user, --keep-cwd, --disable-internal-agent).',
     },
     zh: {
         blocked: "权限提升命令已被插件拦截",
         polkitDenied: "Polkit 认证已被用户拒绝",
+        badOption: '选项 "{opt}" 不被 pkexec 支持,请移除或改用 pkexec 兼容选项(--user、--keep-cwd、--disable-internal-agent)。',
     },
     ja: {
         blocked: "特権昇格コマンドはプラグインによりブロックされました",
         polkitDenied: "Polkit 認証がユーザーによって拒否されました",
+        badOption: 'オプション "{opt}" は pkexec ではサポートされていません。削除するか、pkexec 互換オプション(--user、--keep-cwd、--disable-internal-agent)を使用してください。',
     },
     ko: {
         blocked: "권한 상승 명령이 플러그인에 의해 차단되었습니다",
         polkitDenied: "Polkit 인증이 사용자에 의해 거부되었습니다",
+        badOption: '옵션 "{opt}"은(는) pkexec에서 지원되지 않습니다. 제거하거나 pkexec 호환 옵션(--user, --keep-cwd, --disable-internal-agent)을 사용하세요.',
     },
     de: {
         blocked: "Berechtigungseskalation vom Plugin blockiert",
         polkitDenied: "Polkit-Authentifizierung vom Benutzer abgelehnt",
+        badOption: 'Option "{opt}" wird von pkexec nicht unterstützt. Entfernen Sie sie oder verwenden Sie eine pkexec-kompatible Option (--user, --keep-cwd, --disable-internal-agent).',
     },
     fr: {
         blocked: "Commande d'élévation de privilèges bloquée par le plugin",
         polkitDenied: "Authentification polkit refusée par l'utilisateur",
+        badOption: 'Option "{opt}" non prise en charge par pkexec. Supprimez-la ou utilisez une option compatible pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     es: {
         blocked: "Comando de elevación de privilegios bloqueado por el plugin",
         polkitDenied: "Autenticación polkit denegada por el usuario",
+        badOption: 'Opción "{opt}" no admitida por pkexec. Elimínela o use una opción compatible con pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     pt: {
         blocked: "Comando de elevação de privilégios bloqueado pelo plugin",
         polkitDenied: "Autenticação polkit negada pelo usuário",
+        badOption: 'Opção "{opt}" não suportada pelo pkexec. Remova-a ou use uma opção compatível com pkexec (--user, --keep-cwd, --disable-internal-agent).',
     },
     ru: {
         blocked: "Команда повышения привилегий заблокирована плагином",
         polkitDenied: "Аутентификация polkit отклонена пользователем",
+        badOption: 'Параметр "{opt}" не поддерживается pkexec. Удалите его или используйте совместимый параметр (--user, --keep-cwd, --disable-internal-agent).',
     },
     tr: {
         blocked: "Yetki yükseltme komutu eklenti tarafından engellendi",
         polkitDenied: "Polkit kimlik doğrulaması kullanıcı tarafından reddedildi",
+        badOption: '"{opt}" seçeneği pkexec tarafından desteklenmiyor. Kaldırın veya pkexec uyumlu bir seçenek kullanın (--user, --keep-cwd, --disable-internal-agent).',
     },
     uk: {
         blocked: "Команду підвищення привілеїв заблоковано плагіном",
         polkitDenied: "Автентифікацію polkit відхилено користувачем",
+        badOption: 'Параметр "{opt}" не підтримується pkexec. Видаліть його або використайте сумісний параметр (--user, --keep-cwd, --disable-internal-agent).',
     },
 };
 function detectLocale() {
@@ -146,63 +234,101 @@ function detectLocale() {
     return "en";
 }
 const MSG = translations[detectLocale()] ?? translations.en;
-export const PolkitPlugin = async (_input) => {
+/** The command string of a shell tool call, or "" for anything else. */
+function shellCommand(input) {
+    if (typeof input !== "object" || input === null)
+        return "";
+    const command = input.command;
+    return typeof command === "string" ? command : "";
+}
+/** Plain text of a tool result, whether content is a string or Content[]. */
+function resultText(result) {
+    const content = result.content;
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((part) => typeof part === "object" && part !== null && "type" in part && part.type === "text" && "text" in part
+        ? String(part.text)
+        : "")
+        .join("\n");
+}
+const setup = async (ctx) => {
     const deniedCommands = new Set();
-    return {
-        "tool.execute.before": async (hookInput, hookOutput) => {
-            if (hookInput.tool !== "bash")
-                return;
-            const command = hookOutput?.args?.command ?? "";
-            const hits = scanPrivileged(command);
-            if (hits.length === 0)
-                return;
-            if (deniedCommands.has(command)) {
-                throw new Error(MSG.polkitDenied);
-            }
-            if (hits.some((h) => h.kw === "sudoedit" || h.kw === "visudo")) {
-                throw new Error(MSG.blocked);
-            }
-            // Already pkexec (leading or mid-command): pass through untouched.
-            if (hits.every((h) => h.kw === "pkexec"))
-                return;
-            // Rewrite every in-command sudo/doas to pkexec (back to front so
-            // indices stay valid): `cat x | sudo tee y` -> `cat x | pkexec tee y`.
-            // No other rewriting: the command keeps its exact shape so the agent
-            // sees only the minimal change (sudo -> pkexec).
-            let rewritten = command;
-            for (const h of [...hits].reverse()) {
-                if (h.kw === "sudo" || h.kw === "doas") {
-                    rewritten =
-                        rewritten.slice(0, h.index) + "pkexec" + rewritten.slice(h.index + h.kw.length);
-                }
+    await ctx.tool.hook("execute.before", (event) => {
+        if (event.tool !== "shell")
+            return;
+        // Mutating the input object in place rewrites the executed command;
+        // core uses `event.input` after every hook has run.
+        const args = event.input;
+        const command = shellCommand(args);
+        const hits = scanPrivileged(command);
+        if (hits.length === 0)
+            return;
+        if (deniedCommands.has(command)) {
+            throw new Error(MSG.polkitDenied);
+        }
+        if (hits.some((h) => h.kw === "sudoedit" || h.kw === "visudo")) {
+            throw new Error(MSG.blocked);
+        }
+        // Rewrite would produce `pkexec <bad option>`: fail with a clear
+        // message instead of a confusing `Cannot run program` error.
+        for (const h of hits) {
+            if (h.kw === "sudo" || h.kw === "doas" || h.kw === "pkexec") {
+                const bad = findBadOption(command, h);
+                if (bad)
+                    throw new Error(MSG.badOption.replace("{opt}", bad));
             }
-            hookOutput.args.command = rewritten;
-        },
-        "tool.execute.after": async (hookInput, hookOutput) => {
-            if (hookInput.tool !== "bash")
-                return;
-            const command = hookInput.args?.command ?? "";
-            const hits = scanPrivileged(command);
-            if (hits.length === 0)
-                return;
-            // Reconstruct the user's original command for the deny list: map
-            // pkexec back to sudo.
-            let original = command;
-            for (const h of [...scanPrivileged(original)].reverse()) {
-                if (h.kw === "pkexec") {
-                    original = original.slice(0, h.index) + "sudo" + original.slice(h.index + 6);
-                }
+        }
+        // Already pkexec (leading or mid-command): pass through untouched.
+        if (hits.every((h) => h.kw === "pkexec"))
+            return;
+        // Rewrite every in-command sudo/doas to pkexec (back to front so
+        // indices stay valid): `cat x | sudo tee y` -> `cat x | pkexec tee y`.
+        // No other rewriting: the command keeps its exact shape so the agent
+        // sees only the minimal change (sudo -> pkexec).
+        let rewritten = command;
+        for (const h of [...hits].reverse()) {
+            if (h.kw === "sudo" || h.kw === "doas") {
+                rewritten = rewritten.slice(0, h.index) + "pkexec" + rewritten.slice(h.index + h.kw.length);
             }
-            // Only unambiguous authentication failures are reported and deny
-            // listed. A hang (dialog never appears) is bounded by the bash tool's
-            // own timeout (default 2 min) and is NOT translated here: it cannot
-            // be told apart from a long-running command.
-            if (/\bNot authorized\b/.test(hookOutput.output) ||
-                /\bError executing command as another user\b/.test(hookOutput.output) ||
-                /\bError creating textual authentication agent\b/.test(hookOutput.output)) {
-                deniedCommands.add(original);
-                throw new Error(MSG.polkitDenied);
+        }
+        ;
+        args.command = rewritten;
+    });
+    await ctx.tool.hook("execute.after", (event) => {
+        if (event.tool !== "shell")
+            return;
+        // `event.input` is the (possibly rewritten) command the shell ran:
+        // map pkexec back to sudo to reconstruct the original for the deny list.
+        const command = shellCommand(event.input);
+        const hits = scanPrivileged(command);
+        if (hits.length === 0)
+            return;
+        let original = command;
+        for (const h of [...hits].reverse()) {
+            if (h.kw === "pkexec") {
+                original = original.slice(0, h.index) + "sudo" + original.slice(h.index + 6);
             }
-        },
-    };
+        }
+        const text = event.status === "completed" ? resultText(event.result) : event.status === "error" ? event.error.message : "";
+        // Only unambiguous authentication failures are reported and deny
+        // listed. A hang (dialog never appears) is bounded by the shell tool's
+        // own timeout (default 2 min) and is NOT translated here: it cannot
+        // be told apart from a long-running command.
+        if (/\bNot authorized\b/.test(text) ||
+            /\bError executing command as another user\b/.test(text) ||
+            /\bError creating textual authentication agent\b/.test(text)) {
+            deniedCommands.add(original);
+            throw new Error(MSG.polkitDenied);
+        }
+    });
 };
+/**
+ * OpenCode 2.0 requires a default export shaped `{ id, setup }` (the loader
+ * rejects anything else). Deliberately a plain object with type-only imports:
+ * the built plugin has zero runtime dependencies.
+ */
+export default { id: "opencode-polkit", setup };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,8EAA8E;AAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,QAAQ;IACR,0BAA0B;IAC1B,YAAY;IACZ,QAAQ;CACT,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,GAAU,EAAE,CAAA;IACtB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,0EAA0E;IAC1E,IAAI,cAAc,GAAG,IAAI,CAAA;IACzB,sEAAsE;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;QAErB,sEAAsE;QACtE,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACxC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACpB,8DAA8D;gBAC9D,cAAc,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAC7C,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,KAAK,CAAA;YACf,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO,GAAG,IAAI,CAAA;YACd,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAA;YACpB,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAA;YACpB,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,IAAI,QAAQ;YAAE,SAAQ;QAElC,iEAAiE;QACjE,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAA;YAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAA;YACvD,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACrE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;gBACpB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;gBACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;oBACxC,CAAC,GAAG,GAAG,CAAA;oBACP,SAAQ;gBACV,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;gBACjD,IAAI,CAAC,EAAE,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;oBACnB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;oBACvB,SAAQ;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxE,cAAc,GAAG,IAAI,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,iEAAiE;QACjE,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YACjC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;gBACnC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;gBACnC,SAAQ;YACV,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAQ;QAE3B,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,YAAY,GAAG,cAAc,CAAA;QACjC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAA;YAC3C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAA;YACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,YAAY,GAAG,IAAI,CAAA;QAC9C,CAAC;QACD,cAAc,GAAG,KAAK,CAAA;QAEtB,IAAI,CAAC,YAAY;YAAE,SAAQ;QAE3B,KAAK,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAU,EAAE,CAAC;YAC3E,IAAI,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;oBAC3B,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;oBAClB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,GAAQ;IAC9C,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAA;IACjC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAA;IACvD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAChD,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACf,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,EAAE,CAAA;QAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAK;QACzB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACzC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1D,CAAC,GAAG,GAAG,CAAA;QACP,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAQD,MAAM,YAAY,GAA6B;IAC7C,EAAE,EAAE;QACF,OAAO,EAAE,gDAAgD;QACzD,YAAY,EAAE,sCAAsC;QACpD,SAAS,EACP,qIAAqI;KACxI;IACD,EAAE,EAAE;QACF,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EACP,yFAAyF;KAC5F;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,YAAY,EAAE,2BAA2B;QACzC,SAAS,EACP,iHAAiH;KACpH;IACD,EAAE,EAAE;QACF,OAAO,EAAE,4BAA4B;QACrC,YAAY,EAAE,4BAA4B;QAC1C,SAAS,EACP,6GAA6G;KAChH;IACD,EAAE,EAAE;QACF,OAAO,EAAE,8CAA8C;QACvD,YAAY,EAAE,iDAAiD;QAC/D,SAAS,EACP,sKAAsK;KACzK;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,YAAY,EAAE,mDAAmD;QACjE,SAAS,EACP,sJAAsJ;KACzJ;IACD,EAAE,EAAE;QACF,OAAO,EAAE,6DAA6D;QACtE,YAAY,EAAE,8CAA8C;QAC5D,SAAS,EACP,yIAAyI;KAC5I;IACD,EAAE,EAAE;QACF,OAAO,EAAE,0DAA0D;QACnE,YAAY,EAAE,yCAAyC;QACvD,SAAS,EACP,0IAA0I;KAC7I;IACD,EAAE,EAAE;QACF,OAAO,EAAE,qDAAqD;QAC9D,YAAY,EAAE,+CAA+C;QAC7D,SAAS,EACP,6IAA6I;KAChJ;IACD,EAAE,EAAE;QACF,OAAO,EAAE,sDAAsD;QAC/D,YAAY,EAAE,2DAA2D;QACzE,SAAS,EACP,qJAAqJ;KACxJ;IACD,EAAE,EAAE;QACF,OAAO,EAAE,mDAAmD;QAC5D,YAAY,EAAE,8CAA8C;QAC5D,SAAS,EACP,4IAA4I;KAC/I;CACF,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,GAAG,GAAa,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAA;AAKrE,wEAAwE;AACxE,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC1D,MAAM,OAAO,GAAI,KAAoB,CAAC,OAAO,CAAA;IAC7C,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;AACnD,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,MAAsC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAA;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,IAAI,IAAI;QACnG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,EAAE,CACP;SACA,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED,MAAM,KAAK,GAAG,KAAK,EAAE,GAAmB,EAAiB,EAAE;IACzD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAExC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAM;QAClC,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAA;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAE7B,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;QAED,iEAAiE;QACjE,6DAA6D;QAC7D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBACrC,IAAI,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC;YAAE,OAAM;QAEhD,iEAAiE;QACjE,uEAAuE;QACvE,qEAAqE;QACrE,iDAAiD;QACjD,IAAI,SAAS,GAAG,OAAO,CAAA;QACvB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;gBACvC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;YAC7F,CAAC;QACH,CAAC;QAED,CAAC;QAAC,IAA6B,CAAC,OAAO,GAAG,SAAS,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAM;QAClC,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAE7B,IAAI,QAAQ,GAAG,OAAO,CAAA;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GACR,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QAE/G,iEAAiE;QACjE,uEAAuE;QACvE,oEAAoE;QACpE,6CAA6C;QAC7C,IACE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC;YACxD,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5D,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACnC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACH,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAA0B,CAAA"}

package/index.js

@@ -0,0 +1,6 @@
+// Local-directory entrypoint for OpenCode 2.0: the loader resolves a plugin
+// directory by looking for `server`/`index` at its root (package.json "main"
+// and "exports" are only consulted for npm package names). npm installs reach
+// the real build through package.json "exports"; this shim covers
+// `"plugins": ["/path/to/opencode-polkit"]`.
+export { default } from "./dist/index.js"

package/package.json

@@ -1,34 +1,40 @@
 {
   "name": "opencode-polkit",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "Redirect sudo/doas to pkexec in OpenCode — uses system polkit agent for native auth dialogs",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
     }
   },
   "files": [
     "dist",
+    "index.js",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
-    "build": "deno task build",
-    "check": "deno task check"
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit"
   },
   "engines": {
-    "opencode": ">=1.0.0"
+    "opencode": ">=2.0.0"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": ">=1.0.0"
+    "@opencode/plugin": ">=2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@opencode/plugin": {
+      "optional": true
+    }
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "^1.0.0",
-    "bun-types": "^1.2.0",
+    "@opencode/plugin": "^2.0.12",
+    "@types/node": "^24.0.0",
     "typescript": "^5.5.0"
   },
   "keywords": ["opencode-plugin", "sudo", "pkexec", "polkit", "security"],