Install Oc Sudo Hook

Install OpenCode Sudo Hook

This skill installs a tool.execute.before plugin that intercepts every sudo command OpenCode tries to run. OpenCode cannot proceed with any sudo call until you explicitly cache credentials via sudo -v in another terminal — giving you full control over privileged operations.

Two gates are installed:

1. OpenCode's built-in permission dialog fires before every sudo command (you can approve or deny per-command)
2. A TypeScript plugin checks for cached credentials and blocks + polls up to 30s if none are found

The plugin script is bundled with this skill at scripts/opencode-sudo-check.ts — copy it from there, don't recreate it.

Step 1: Explain and ask for confirmation

Tell the user the following, then wait for their choice before doing anything:

install-oc-sudo-hook will:

• Install a TypeScript plugin (opencode-sudo-check.ts) that blocks sudo when credentials aren't cached
• Add a permission rule so you're prompted before every sudo command

Where should it be installed?

• User-level — active in all OpenCode sessions (~/.config/opencode/)
• Project-level — active only in this project (.opencode/ in current working dir)
• Cancel — do nothing

Step 2: Install based on choice

User-level

• Plugin destination: ~/.config/opencode/plugins/opencode-sudo-check.ts
• Config file: ~/.config/opencode/opencode.json

Steps:

1. mkdir -p ~/.config/opencode/plugins
2. Copy scripts/opencode-sudo-check.ts from this skill's base directory to ~/.config/opencode/plugins/opencode-sudo-check.ts
3. Merge the following into ~/.config/opencode/opencode.json:

{
  "permission": {
    "bash": {
      "sudo *": "ask"
    }
  }
}

Project-level

• Plugin destination: .opencode/plugins/opencode-sudo-check.ts (inside current working dir)
• Config file: opencode.json (in current working dir)

Steps:

1. mkdir -p .opencode/plugins
2. Copy scripts/opencode-sudo-check.ts from this skill's base directory to .opencode/plugins/opencode-sudo-check.ts
3. Merge the same permission JSON structure above into opencode.json.

Merging opencode.json

Always read the existing opencode.json first and merge — never overwrite. Preserve any existing plugin, permission, or other entries. If permission or permission.bash already exists, add "sudo *": "ask" to it rather than replacing it.

Step 3: Tell the user about the manual sudoers step

After files are in place and config is updated, tell the user:

One manual step required — run this in your terminal to enable cross-session credential caching (so sudo -v in one terminal is visible to OpenCode's non-TTY session):

echo 'Defaults timestamp_type=global' | sudo tee /etc/sudoers.d/timestamp-global

How it works after setup:

1. OpenCode tries a sudo command → you see a permission prompt (approve/deny)
2. If approved but no credentials cached → plugin blocks it and asks you to run sudo -v in another terminal
3. You run sudo -v → plugin detects cached credentials within 30s and OpenCode proceeds automatically