opencode-polkit 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +37 -0
- package/README.md +78 -20
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/shims.js +4 -3
- package/dist/shims.js.map +1 -1
- package/package.json +4 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,43 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.4.1] - 2026-11-07
|
|
9
|
+
|
|
10
|
+
### Added
|
|
11
|
+
|
|
12
|
+
- `test/shims.test.ts`: behaviour tests for the generated shims. They stub
|
|
13
|
+
`pkexec`, `pkcheck` and `pkaction` on `PATH`, so they need neither polkit, a
|
|
14
|
+
desktop agent nor root; `npm test` runs them with Node's test runner.
|
|
15
|
+
- README: account-lockout section. Where the `polkit-1` PAM service includes
|
|
16
|
+
`pam_faillock`, a wrong or empty password submitted in the dialog adds a
|
|
17
|
+
record shared with terminal sudo and login; dismissing the dialog adds none,
|
|
18
|
+
an agent may allow several attempts in one dialog (each retry starts a new PAM
|
|
19
|
+
helper), and a locked account rejects even the correct password for
|
|
20
|
+
`unlock_time`. Documents how to inspect and reset the tally, and why retrying
|
|
21
|
+
does not help.
|
|
22
|
+
- README limitation: `-n`, `-v` and `-l` check
|
|
23
|
+
`org.freedesktop.policykit.exec` itself, while pkexec may select another
|
|
24
|
+
action installed with `org.freedesktop.policykit.exec.path`/`argv1`
|
|
25
|
+
annotations.
|
|
26
|
+
|
|
27
|
+
### Changed
|
|
28
|
+
|
|
29
|
+
- The shell tool's description now asks the model to consult the user before
|
|
30
|
+
retrying a dismissed or failed dialog, because failed or empty password
|
|
31
|
+
submissions count toward a system-wide `pam_faillock` lockout while a dismissal
|
|
32
|
+
does not.
|
|
33
|
+
- README: `sudoers` and the `sudo` PAM stack are not consulted; polkit policy and
|
|
34
|
+
the `polkit-1` PAM service decide, so sudo-only modules such as a fingerprint
|
|
35
|
+
reader or a second factor do not run in OpenCode.
|
|
36
|
+
- README now describes agent caching and retry behaviour generically instead of
|
|
37
|
+
attributing it to one desktop agent.
|
|
38
|
+
- `sudo -v` reports an interactive failure as "polkit did not authorize" instead
|
|
39
|
+
of "polkit denies", since the check can fail after the password is rejected.
|
|
40
|
+
- The shim's action comment now records that pkexec may select a custom action by
|
|
41
|
+
annotation, which the checks do not see.
|
|
42
|
+
- `npm run check` now also type-checks `test/`, and CI runs check, test and
|
|
43
|
+
build.
|
|
44
|
+
|
|
8
45
|
## [0.4.0] - 2026-11-05
|
|
9
46
|
|
|
10
47
|
### Added
|
package/README.md
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
# opencode-polkit
|
|
2
2
|
|
|
3
3
|
Redirects `sudo`, `doas` and `su -c` to `pkexec` inside OpenCode, so
|
|
4
|
-
authorisation goes through the desktop's polkit agent
|
|
5
|
-
|
|
6
|
-
|
|
4
|
+
authorisation goes through the desktop's polkit agent instead of a terminal the
|
|
5
|
+
shell tool does not have. Applies to commands run by the shell tool; `sudo` in
|
|
6
|
+
other terminals is unchanged.
|
|
7
7
|
|
|
8
8
|
## Scope
|
|
9
9
|
|
|
@@ -49,7 +49,7 @@ For a local checkout, run `npm run build` once, then reference the directory:
|
|
|
49
49
|
| `sudo -u bob …` | as above, as `bob` |
|
|
50
50
|
| `cat x \| sudo tee y` | dialog for `tee` |
|
|
51
51
|
| `sudo -n …` | runs only if polkit would authorise without asking; otherwise exit 1 with `sudo: a password is required` |
|
|
52
|
-
| `sudo -v` |
|
|
52
|
+
| `sudo -v` | authenticates through polkit; creates no timestamp |
|
|
53
53
|
| `sudo -l` | prints the polkit policy and this session's temporary authorizations |
|
|
54
54
|
| `sudo -k`, `-K` | revokes polkit's temporary authorizations |
|
|
55
55
|
| `sudo -H`, `-N`, `-P` | accepted: pkexec already does what they ask |
|
|
@@ -82,7 +82,7 @@ The `create.before` shell hook prepends the stand-in directory to the spawned
|
|
|
82
82
|
`opencode-polkit-env`, the helper `sudo -E` uses to re-export an environment
|
|
83
83
|
pkexec stripped.
|
|
84
84
|
|
|
85
|
-
The shell tool's description gains
|
|
85
|
+
The shell tool's description gains a note about the redirect, so the model
|
|
86
86
|
plans privilege with the real contract instead of learning it from a failed
|
|
87
87
|
call.
|
|
88
88
|
|
|
@@ -92,20 +92,66 @@ call.
|
|
|
92
92
|
one; other actions may not, according to policy. The plugin takes no part in
|
|
93
93
|
that decision.
|
|
94
94
|
|
|
95
|
+
`sudoers` is not consulted: polkit policy decides who may run what, so per-user
|
|
96
|
+
and per-command rules, `NOPASSWD`, `secure_path` and `env_keep` do not apply.
|
|
97
|
+
Authentication runs through the `polkit-1` PAM service, not `/etc/pam.d/sudo`,
|
|
98
|
+
so a module configured only for sudo — a fingerprint reader, a second factor —
|
|
99
|
+
is not used here; the service's own stack (normally `system-auth`) decides how
|
|
100
|
+
the password is verified.
|
|
101
|
+
|
|
95
102
|
`org.freedesktop.policykit.exec` asks for administrator authentication on every
|
|
96
|
-
call, but
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
agent
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
`pkcheck
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
103
|
+
call, but an agent may keep the password it just received and answer a later
|
|
104
|
+
challenge itself. In that case a second command can run without a dialog. That
|
|
105
|
+
cache belongs to the agent: a different agent, a restarted agent or a change in
|
|
106
|
+
the agent's state can mean the next command prompts again, so do not rely on it.
|
|
107
|
+
|
|
108
|
+
With the default policy, polkit records no temporary authorization for this
|
|
109
|
+
action: after a successful `pkexec`, `pkcheck --list-temp` stays empty and a
|
|
110
|
+
non-interactive `pkcheck` still reports that authentication is required. Whether
|
|
111
|
+
a later command prompts is therefore the agent's decision, and no user-space
|
|
112
|
+
query can predict it. That is why `sudo -n` reports what the policy says rather
|
|
113
|
+
than guessing whether a dialog would appear, and why `sudo -k` can only clear
|
|
114
|
+
polkit's own record.
|
|
115
|
+
|
|
116
|
+
The plugin keeps no authorization state of its own: `sudo -v` verifies once and
|
|
117
|
+
writes nothing, `sudo -n` assumes nothing, and `sudo -k` only clears polkit's
|
|
118
|
+
record. Authorising one command therefore leaves the next one to be decided
|
|
119
|
+
again, which is the point — the person who allowed an upgrade can still refuse
|
|
120
|
+
the deletion that follows. What widens that window is the agent's password
|
|
121
|
+
cache, not this plugin, and nothing here can revoke it.
|
|
122
|
+
|
|
123
|
+
## Account lockout
|
|
124
|
+
|
|
125
|
+
When the `polkit-1` PAM service includes `pam_faillock` (Arch's default stack
|
|
126
|
+
does), the dialog shares one failure tally per user with terminal sudo, `su` and
|
|
127
|
+
the login screen:
|
|
128
|
+
|
|
129
|
+
- A wrong or empty password submitted in the dialog adds a record. Dismissing
|
|
130
|
+
the dialog, closing it or pressing Esc cancels the agent's helper before PAM
|
|
131
|
+
returns, and adds none. (An agent process that is killed instead of
|
|
132
|
+
cancelling leaves the helper at EOF, and that attempt can count.)
|
|
133
|
+
- An agent may allow several attempts in one dialog, and each retry starts a
|
|
134
|
+
new PAM helper; a dialog can therefore add several records and use up the
|
|
135
|
+
default `deny=3`.
|
|
136
|
+
- Once a user has `deny` failures within `fail_interval` (900 s by default),
|
|
137
|
+
`pam_faillock` refuses that user in every service using the stack for
|
|
138
|
+
`unlock_time` (600 s by default, measured from the newest record). A locked
|
|
139
|
+
account rejects even the correct password, because `preauth` fails and
|
|
140
|
+
`authsucc` cannot reset the tally; further attempts neither extend nor shorten
|
|
141
|
+
the lock. A successful password authentication outside a lock resets the
|
|
142
|
+
tally.
|
|
143
|
+
- `sudo -k` clears polkit's authorizations, not the tally. The locked user's own
|
|
144
|
+
authentication cannot succeed, so OpenCode cannot elevate with that user's
|
|
145
|
+
credentials to reset it: wait for the lock to expire, use a root console or
|
|
146
|
+
another administrator, or reboot (`/run` is cleared). Where the tally file is
|
|
147
|
+
readable by the user, `faillock --user "$USER"` shows the records and
|
|
148
|
+
`faillock --user "$USER" --reset` clears them without root; otherwise both
|
|
149
|
+
need root. Check readability with `ls -l /run/faillock/$USER`.
|
|
150
|
+
|
|
151
|
+
Retrying a failed dialog in a loop only gives the user more chances to submit a
|
|
152
|
+
wrong or empty password, and the lock applies to the whole account. The shell
|
|
153
|
+
tool's description therefore tells the model to ask before retrying, and
|
|
154
|
+
`sudo -n` remains the probe that never invokes PAM.
|
|
109
155
|
|
|
110
156
|
## Limitations
|
|
111
157
|
|
|
@@ -115,6 +161,10 @@ dialog would appear, and why `sudo -k` can only clear polkit's own record.
|
|
|
115
161
|
- `su -c … USER` authenticates an administrator (polkit), not `USER`, so an
|
|
116
162
|
account that real `su` would allow can be refused here.
|
|
117
163
|
- `su -c` runs the command with `sh -c`, not with the target user's login shell.
|
|
164
|
+
- `-n`, `-v` and `-l` check `org.freedesktop.policykit.exec` itself. pkexec may
|
|
165
|
+
select a different action installed with an
|
|
166
|
+
`org.freedesktop.policykit.exec.path` (and `argv1`) annotation, so that
|
|
167
|
+
action's rules are not reflected by these checks.
|
|
118
168
|
- `sudo -E` re-exports the environment through `pkexec`'s argument list, so the
|
|
119
169
|
values are visible in `ps` while the command starts. Exported shell functions
|
|
120
170
|
are skipped, and `PATH` loses the shim directories.
|
|
@@ -133,13 +183,21 @@ without one, `pkexec` fails instead of prompting.
|
|
|
133
183
|
|
|
134
184
|
| Status | Meaning |
|
|
135
185
|
|--------|--------------------------------------------------------|
|
|
136
|
-
| 1 | `-n` or `-v` could not be satisfied: polkit requires authentication, or
|
|
186
|
+
| 1 | `-n` or `-v` could not be satisfied: polkit requires authentication, denies it, or authentication failed |
|
|
137
187
|
| 126 | the polkit dialog was dismissed |
|
|
138
|
-
| 127 | not authorised, or the program could not run
|
|
188
|
+
| 127 | not authorised (including after failed authentication), or the program could not run |
|
|
139
189
|
| 64 | the plugin refused the invocation |
|
|
140
190
|
|
|
141
191
|
Messages are in English.
|
|
142
192
|
|
|
193
|
+
## Development
|
|
194
|
+
|
|
195
|
+
`npm install`, then `npm run check` type-checks the plugin and its tests, and
|
|
196
|
+
`npm test` runs the shim behaviour tests. The tests stub `pkexec`, `pkcheck` and
|
|
197
|
+
`pkaction` on `PATH`, so they need neither polkit, a desktop agent nor root;
|
|
198
|
+
they need Node 22.19 or later for `--experimental-strip-types`. `npm run build`
|
|
199
|
+
regenerates `dist`.
|
|
200
|
+
|
|
143
201
|
## License
|
|
144
202
|
|
|
145
203
|
MIT
|
package/dist/index.js
CHANGED
|
@@ -13,7 +13,7 @@ const CONTRACT_MARKER = "polkit redirect:";
|
|
|
13
13
|
* it knows about sudo, so the difference is stated where it reads the tool,
|
|
14
14
|
* instead of being learned from a failed call.
|
|
15
15
|
*/
|
|
16
|
-
const SHELL_TOOL_CONTRACT = `${CONTRACT_MARKER} \`sudo\`, \`doas\` and \`su -c\` run through pkexec, so a desktop polkit dialog authorises them instead of a terminal password prompt. \`sudo -n\` runs the command only if polkit would authorise it without asking, \`sudo -v\` performs
|
|
16
|
+
const SHELL_TOOL_CONTRACT = `${CONTRACT_MARKER} \`sudo\`, \`doas\` and \`su -c\` run through pkexec, so a desktop polkit dialog authorises them instead of a terminal password prompt. \`sudo -n\` runs the command only if polkit would authorise it without asking, \`sudo -v\` performs a real authentication, and \`sudo -l\` prints the polkit policy that decides. Ask the user before retrying a dismissed or failed dialog instead of looping: on systems with pam_faillock, failed or empty password submissions count toward a system-wide lockout shared with login, while dismissing the dialog does not.`;
|
|
17
17
|
/**
|
|
18
18
|
* Redirects sudo/doas/su -c to pkexec without touching the command text.
|
|
19
19
|
*
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAElE;;;GAGG;AACH,MAAM,aAAa,GAAG,8DAA8D,CAAA;AAEpF,yEAAyE;AACzE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAErC,yFAAyF;AACzF,MAAM,eAAe,GAAG,kBAAkB,CAAA;AAE1C;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,GAAG,eAAe,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAElE;;;GAGG;AACH,MAAM,aAAa,GAAG,8DAA8D,CAAA;AAEpF,yEAAyE;AACzE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAErC,yFAAyF;AACzF,MAAM,eAAe,GAAG,kBAAkB,CAAA;AAE1C;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,GAAG,eAAe,wiBAAwiB,CAAA;AAEtlB;;;;;;;;;;;;GAYG;AACH,MAAM,KAAK,GAAG,KAAK,EAAE,GAAmB,EAA2B,EAAE;IACnE,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,CAAA;IAE5B,8EAA8E;IAC9E,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,aAAa,CAAA;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAChF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC9B,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;oBAAE,OAAM;gBACvD,KAAK,CAAC,WAAW,GAAG,GAAG,KAAK,CAAC,WAAW,OAAO,mBAAmB,EAAE,CAAA;YACtE,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;AACzC,CAAC,CAAA;AAED;;;GAGG;AACH,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAA0B,CAAA"}
|
package/dist/shims.js
CHANGED
|
@@ -28,8 +28,9 @@ command -v pkcheck >/dev/null 2>&1 || fail 'pkcheck is not installed; install po
|
|
|
28
28
|
* `polkit.result` detail are localised and addressed to humans, so parsing them
|
|
29
29
|
* would break on the next locale or polkit release.
|
|
30
30
|
*/
|
|
31
|
-
const SHIM_CHECKS = `# The action
|
|
32
|
-
#
|
|
31
|
+
const SHIM_CHECKS = `# The action checked below. pkexec uses it by default; a site can install
|
|
32
|
+
# another action selected by org.freedesktop.policykit.exec.path/argv1, whose
|
|
33
|
+
# rules these checks do not see.
|
|
33
34
|
ACTION=${POLKIT_ACTION}
|
|
34
35
|
|
|
35
36
|
# pkcheck(1) warns that a bare pid races with pid reuse, so pin the start time.
|
|
@@ -304,7 +305,7 @@ if [ "$mode" = validate ]; then
|
|
|
304
305
|
exit 0
|
|
305
306
|
;;
|
|
306
307
|
1)
|
|
307
|
-
printf 'opencode-polkit: sudo: polkit
|
|
308
|
+
printf 'opencode-polkit: sudo: polkit did not authorize %s (the policy denies it, or authentication failed)\\n' "$ACTION" >&2
|
|
308
309
|
exit 1
|
|
309
310
|
;;
|
|
310
311
|
2)
|
package/dist/shims.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"shims.js","sourceRoot":"","sources":["../src/shims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC,gFAAgF;AAChF,MAAM,aAAa,GAAG,gCAAgC,CAAA;AAEtD;;;GAGG;AACH,MAAM,YAAY,GAAG;;QAEb,eAAe;;;;;CAKtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG
|
|
1
|
+
{"version":3,"file":"shims.js","sourceRoot":"","sources":["../src/shims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC,gFAAgF;AAChF,MAAM,aAAa,GAAG,gCAAgC,CAAA;AAEtD;;;GAGG;AACH,MAAM,YAAY,GAAG;;QAEb,eAAe;;;;;CAKtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG;;;SAGX,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+DrB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,SAAS,GAAG;;;;EAIhB,YAAY;EACZ,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6SZ,CAAA;AAED,yDAAyD;AACzD,MAAM,SAAS,GAAG;;;;EAIhB,YAAY;EACZ,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,OAAO,GAAG;;;;EAId,YAAY;EACZ,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoFZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CzB,CAAA;AAGD,8EAA8E;AAC9E,MAAM,aAAa,GAAG;EACpB,YAAY;;CAEb,CAAA;AAED,qFAAqF;AACrF,MAAM,WAAW,GAAG;EAClB,YAAY;;CAEb,CAAA;AAED,+EAA+E;AAC/E,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,OAAO;IACX,QAAQ,EAAE,aAAa;IACvB,MAAM,EAAE,WAAW;IACnB,qBAAqB,EAAE,iBAAiB;CACzC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAClC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC3B,mEAAmE;QACnE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;IAC3C,OAAO,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACnF,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "opencode-polkit",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.1",
|
|
4
4
|
"description": "Redirect sudo, doas and su to pkexec in OpenCode via PATH shims, so the system polkit agent handles authentication",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -20,7 +20,9 @@
|
|
|
20
20
|
],
|
|
21
21
|
"scripts": {
|
|
22
22
|
"build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
|
|
23
|
-
"check": "tsc -p tsconfig.json --noEmit"
|
|
23
|
+
"check": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
|
|
24
|
+
"test": "node --experimental-strip-types --test test/*.test.ts",
|
|
25
|
+
"prepublishOnly": "npm run check && npm test && npm run build"
|
|
24
26
|
},
|
|
25
27
|
"engines": {
|
|
26
28
|
"opencode": ">=2.0.29"
|