anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

feat: Support for sudo and password-requiring commands in Bash tool #7063

New Issue
Open
opened 2026-02-16 18:06:03 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:06:03 -05:00
Owner
Copy Link
Copy Source

Originally created by @bernatfp on GitHub (Jan 21, 2026).

Originally assigned to: @thdxr on GitHub.

Problem

The Bash tool currently runs with stdio: ["ignore", "pipe", "pipe"], meaning stdin is disconnected. This breaks any command requiring interactive password input:

  • sudo apt install ...
  • ansible-playbook -K ... (ask-become-pass)
  • ssh -t user@host "sudo ..."
  • GPG passphrase prompts

Users working with system administration, deployment automation, or remote servers cannot use these common workflows through OpenCode.

Proposed Approach

Use PTY-based execution for commands that may require interactive input:

  1. Auto-detect interactive commands - Pattern match for sudo, ssh -t, ansible -K, etc.
  2. PTY execution - Spawn an ephemeral PTY for interactive commands
  3. Prompt detection - Detect password prompts via patterns ([sudo] password for, Password:, BECOME password:, etc.)
  4. SecureInput system - Event-based system that requests password from user when prompt detected
  5. Direct PTY write - Password goes directly to PTY, never stored or logged
  6. Output sanitization - Replace password prompts with [Password prompt - user input required] before sending to LLM

Security considerations

  • Password never logged or stored in memory beyond immediate use
  • Password never appears in conversation history or LLM context
  • UI uses type="password" input
  • 60s timeout, max 3 retry attempts

Why it belongs in OpenCode

This is a common pain point for DevOps/sysadmin workflows. The PTY infrastructure already exists for the terminal feature, so this leverages existing code. It's also how Claude Code handles similar scenarios.

Happy to share implementation details if there's interest.

Originally created by @bernatfp on GitHub (Jan 21, 2026). Originally assigned to: @thdxr on GitHub. ## Problem The Bash tool currently runs with `stdio: ["ignore", "pipe", "pipe"]`, meaning stdin is disconnected. This breaks any command requiring interactive password input: - `sudo apt install ...` - `ansible-playbook -K ...` (ask-become-pass) - `ssh -t user@host "sudo ..."` - GPG passphrase prompts Users working with system administration, deployment automation, or remote servers cannot use these common workflows through OpenCode. ## Proposed Approach Use PTY-based execution for commands that may require interactive input: 1. **Auto-detect interactive commands** - Pattern match for `sudo`, `ssh -t`, `ansible -K`, etc. 2. **PTY execution** - Spawn an ephemeral PTY for interactive commands 3. **Prompt detection** - Detect password prompts via patterns (`[sudo] password for`, `Password:`, `BECOME password:`, etc.) 4. **SecureInput system** - Event-based system that requests password from user when prompt detected 5. **Direct PTY write** - Password goes directly to PTY, never stored or logged 6. **Output sanitization** - Replace password prompts with `[Password prompt - user input required]` before sending to LLM ### Security considerations - Password never logged or stored in memory beyond immediate use - Password never appears in conversation history or LLM context - UI uses `type="password"` input - 60s timeout, max 3 retry attempts ## Why it belongs in OpenCode This is a common pain point for DevOps/sysadmin workflows. The PTY infrastructure already exists for the terminal feature, so this leverages existing code. It's also how Claude Code handles similar scenarios. Happy to share implementation details if there's interest.
yindo commented 2026-02-16 18:06:03 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 21, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #652: App becomes unresponsive when executing commands requiring sudo password
  • #3212: Agent runs "sudo" and freezes UI when analyzing system configs (e.g. Apache)
  • #1180: Support for running commands that use raw mode stdin

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 21, 2026): This issue might be a duplicate of existing issues. Please check: - #652: App becomes unresponsive when executing commands requiring sudo password - #3212: Agent runs "sudo" and freezes UI when analyzing system configs (e.g. Apache) - #1180: Support for running commands that use raw mode stdin Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7063
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?