Tool stderr leaks into message input field on bash timeout

[sn0wmann1]

Description

When a bash command times out in OpenCode's CLI (e.g., sudo credential timeout), the multi-line stderr output leaks into the message input field — the area where the user types their messages. The text blocks the input buffer and requires pressing spacebar repeatedly to clear before typing works again.

This is distinct from the lack of sudo/stdin support (tracked in #9808, #8097, #18659). Even when the command failure is expected, output should never corrupt the input area.

Steps to Reproduce

1. Run a bash command that hits the 30s sudo timeout (no cached credentials)
2. OpenCode displays the timeout message in the output area
3. The same text appears in the message input field below
4. Must press spacebar to scroll through the entire string before the input becomes usable

Expected Behavior

Tool output stays in the output area. Input field remains clear and immediately usable regardless of tool output.

Environment

• opencode: 1.16.2-1.1 (AUR)
• OS: Arch Linux (CachyOS)
• Terminal: kitty (Wayland)
• Shell: fish 4.x
• Desktop: Hyprland (Wayland)
• No plugins or custom config (stock install)

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• feat: Support for sudo and password-requiring commands in Bash tool #9808: Support for sudo and password-requiring commands in Bash tool (same root cause: stdin disconnected, sudo timeout)
• [FEATURE]: Allow interactive terminal input for commands requiring user input (sudo, passwords, others) #8097: Allow interactive terminal input for commands requiring user input (sudo, passwords, others)
• [FEATURE]: Opt-in Host-Shell Execution Mode with Full stdin Passthrough #18659: Opt-in Host-Shell Execution Mode with Full stdin Passthrough (stdin passthrough for sudo/interactive commands)

If your report is specifically about the TUI input buffer being polluted by tool stderr output (rather than just the lack of sudo support), that aspect may not be covered by the above and could be worth keeping as a separate tracking issue.

[sn0wmann1]

Correction: root cause was my own plugin at ~/.config/opencode/plugins/sudo-check.ts, not OpenCode core.

Plugin used tool.execute.before to check sudo creds before bash commands. It emitted multi-line stderr via console.error() + throw new Error() — both leaked into TUI input buffer. Regex \bsudo\b also matched file paths containing "sudo" (e.g. the plugin path itself), causing false positives.

Removed plugin. Sudo commands now fail cleanly with single-line sudo: a password is required. Broader sudo-in-OpenCode ask tracked in #9808.

TUI allowing plugin stderr into message input is separate hardening concern — lower priority but worth keeping on radar.