Install Cc Sudo Hook

Install Claude Code Sudo Hook

This skill installs a PreToolUse hook that intercepts every sudo command Claude tries to run. Claude cannot proceed with any sudo call until you explicitly cache credentials via sudo -v in another terminal — giving you full control over privileged operations.

Two gates are installed:

1. Claude Code's built-in permission dialog fires before every sudo command (you can approve or deny per-command)
2. A shell hook checks for cached credentials and blocks + waits up to 30s if none are found

The hook script is bundled with this skill at scripts/claude-sudo-check.sh — copy it from there, don't recreate it.

Step 1: Explain and ask for confirmation

Tell the user the following, then wait for their choice before doing anything:

install-cc-sudo-hook will:

• Install a shell script (claude-sudo-check.sh) that blocks sudo when credentials aren't cached
• Register it as a PreToolUse hook in Claude Code settings
• Add a permission rule so you're prompted before every sudo command

Where should it be installed?

• User-level — active in all Claude Code sessions (~/.claude/)
• Project-level — active only in this project (.claude/ in current working dir)
• Cancel — do nothing

Step 2: Install based on choice

User-level

• Hook script destination: ~/.claude/user_hooks/claude-sudo-check.sh
• Settings file: ~/.claude/settings.json

Steps:

1. mkdir -p ~/.claude/user_hooks
2. Copy scripts/claude-sudo-check.sh from this skill's base directory to ~/.claude/user_hooks/claude-sudo-check.sh
3. chmod +x ~/.claude/user_hooks/claude-sudo-check.sh
4. Merge the following into ~/.claude/settings.json (resolve ~ to the real home path):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "/home/<username>/.claude/user_hooks/claude-sudo-check.sh"
          }
        ]
      }
    ]
  },
  "permissions": {
    "ask": ["Bash(sudo *)"]
  }
}

Project-level

• Hook script destination: .claude/user_hooks/claude-sudo-check.sh (inside current working dir)
• Settings file: .claude/settings.json

Steps:

1. mkdir -p .claude/user_hooks
2. Copy scripts/claude-sudo-check.sh from this skill's base directory to .claude/user_hooks/claude-sudo-check.sh
3. chmod +x .claude/user_hooks/claude-sudo-check.sh
4. Merge the same JSON structure above into .claude/settings.json, using the resolved absolute path to the script.

Merging settings.json

Always read the existing settings.json first and merge — never overwrite. Preserve any existing hooks, permissions, or env entries. If a PreToolUse array already exists, append to it rather than replacing it.

Step 3: Tell the user about the manual sudoers step

After files are in place and settings are updated, tell the user:

One manual step required — run this in your terminal to enable cross-session credential caching (so sudo -v in one terminal is visible to Claude's non-TTY session):

echo 'Defaults timestamp_type=global' | sudo tee /etc/sudoers.d/timestamp-global

How it works after setup:

1. Claude tries a sudo command → you see a permission prompt (approve/deny)
2. If approved but no credentials cached → hook blocks it and asks you to run sudo -v in another terminal
3. You run sudo -v → hook detects cached credentials within 30s and Claude proceeds automatically