# Install Oc Sudo Hook

> Installs a sudo safety plugin for OpenCode that intercepts all sudo commands and blocks them until credentials are cached. Use this skill whenever the user wants to control sudo access in OpenCode sessions, set up sudo gating, prevent OpenCode from running sudo without permission, or install the agentsudo plugin.

- Skill: `animadverto-mundum/install-oc-sudo-hook` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add animadverto-mundum/install-oc-sudo-hook`
- Raw SKILL.md: https://api.skillmd.com/api/skills/animadverto-mundum/install-oc-sudo-hook/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Animadverto-mundum (https://skillmd.com/u/animadverto-mundum)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/animadverto-mundum/install-oc-sudo-hook

---


# Install OpenCode Sudo Hook

This skill installs a `tool.execute.before` plugin that intercepts every `sudo` command OpenCode tries to run. OpenCode cannot proceed with any `sudo` call until you explicitly cache credentials via `sudo -v` in another terminal — giving you full control over privileged operations.

**Two gates are installed:**
1. OpenCode's built-in permission dialog fires before every `sudo` command (you can approve or deny per-command)
2. A TypeScript plugin checks for cached credentials and blocks + polls up to 30s if none are found

The plugin script is bundled with this skill at `scripts/opencode-sudo-check.ts` — copy it from there, don't recreate it.

## Step 1: Explain and ask for confirmation

Tell the user the following, then wait for their choice before doing anything:

> **install-oc-sudo-hook** will:
> - Install a TypeScript plugin (`opencode-sudo-check.ts`) that blocks `sudo` when credentials aren't cached
> - Add a permission rule so you're prompted before every `sudo` command
>
> Where should it be installed?
> - **User-level** — active in all OpenCode sessions (`~/.config/opencode/`)
> - **Project-level** — active only in this project (`.opencode/` in current working dir)
> - **Cancel** — do nothing

## Step 2: Install based on choice

### User-level

- Plugin destination: `~/.config/opencode/plugins/opencode-sudo-check.ts`
- Config file: `~/.config/opencode/opencode.json`

Steps:
1. `mkdir -p ~/.config/opencode/plugins`
2. Copy `scripts/opencode-sudo-check.ts` from this skill's base directory to `~/.config/opencode/plugins/opencode-sudo-check.ts`
3. Merge the following into `~/.config/opencode/opencode.json`:

```json
{
  "permission": {
    "bash": {
      "sudo *": "ask"
    }
  }
}
```

### Project-level

- Plugin destination: `.opencode/plugins/opencode-sudo-check.ts` (inside current working dir)
- Config file: `opencode.json` (in current working dir)

Steps:
1. `mkdir -p .opencode/plugins`
2. Copy `scripts/opencode-sudo-check.ts` from this skill's base directory to `.opencode/plugins/opencode-sudo-check.ts`
3. Merge the same permission JSON structure above into `opencode.json`.

### Merging opencode.json

Always read the existing `opencode.json` first and merge — never overwrite. Preserve any existing `plugin`, `permission`, or other entries. If `permission` or `permission.bash` already exists, add `"sudo *": "ask"` to it rather than replacing it.

## Step 3: Tell the user about the manual sudoers step

After files are in place and config is updated, tell the user:

> **One manual step required** — run this in your terminal to enable cross-session credential caching (so `sudo -v` in one terminal is visible to OpenCode's non-TTY session):
>
> ```bash
> echo 'Defaults timestamp_type=global' | sudo tee /etc/sudoers.d/timestamp-global
> ```
>
> **How it works after setup:**
> 1. OpenCode tries a `sudo` command → you see a permission prompt (approve/deny)
> 2. If approved but no credentials cached → plugin blocks it and asks you to run `sudo -v` in another terminal
> 3. You run `sudo -v` → plugin detects cached credentials within 30s and OpenCode proceeds automatically