Agent-friendly sudo prompt alert

[Jackman3005]

Hey all, I found that switching from Mac to Omarchy for a lot of my development projects that Claude Code often wants to run sudo commands for things. I've adjusted my allowlist to include a number of reasonable readonly things, but I still want to allow it to install things with permission. By default it appears to be blocked by not having a TTY to accept a password (I think even when you have a FIDO key). I created a little utility that has been quite nice to have. When an agent performs a command with sudo it shows this nice alert that indicates what command is intended to be run (with shell syntax highlighting) and allows you to cancel (block) or allow with password or just by tapping your fido key if you use one. This is similar to the experience when typing sudo manually to perform an action, but a bit more agent friendly. It queues up multiple to ensure you only are allowing the one that is shown at the time and does a nice little overlay with focus on the alert when it pops up.

It's straight vibe-coded and should likely be cleaned up a bit or improved, but it's working really well for me and I thought I'd share it. I'm not sure if this is something that omarchy would like to include as an option by default or not. There is a bit of config outside of just the alert utility that is necessary to get the full experience. e.g. updating global agent context file with info about how to use AGENT_SUDO_REASON to show a comment in the alert dialog for the reason of the sudo command. But also some hyprland config and a sudo shim in your bashrc for no-tty sessions (so technically useful outside of just an agent flow I suppose).

Let me know what you folks think if this is something useful!

inb4: why didn't you use ssh-askpass or similar. I actually started with that, it does allow note via env var and I used it to show the sudo command being authorized, but fido wasn't working how I'd hoped and I found that a simple self-made GUI provides a much more beautiful experience.

https://github.com/Jackman3005/sudo-touch-dialog

[piotrsynowiec]

I have now built and tested a native Omarchy Shell version of this idea on a real Intel/T2 MacBook Pro installation. It reuses the visual language of the built-in omarchy.polkit dialog, so the sudo prompt has the same centered input and blurred background as the rest of Omarchy rather than looking like a separate utility.

The implementation is exposed as a standard SUDO_ASKPASS helper for non-interactive commands such as sudo -A. The password is passed only through a per-request FIFO under $XDG_RUNTIME_DIR: the request directory is mode 0700, the FIFO is 0600, requests are serialized with flock, cancellation returns an empty response, and a timeout prevents a dead Shell plugin from blocking sudo indefinitely. The password is never placed in argv or an environment variable. We also tested repeated prompts and fixed a short second “Checking…” flash caused by overlapping request/close state.

This is useful in a slightly different way from pkexec: Polkit remains the right fit for applications designed around Polkit actions, while sudo -A lets existing sudo-based commands and coding agents authenticate through the native Shell and populate/reuse the normal sudo timestamp. It does not require NOPASSWD.

For my own machine I separately opted into timestamp_type=global with a 60-minute timeout. I would not propose that as an Omarchy default because it is a user-specific security tradeoff. If Omarchy wanted to expose it at all, I think it should be an explicit, clearly warned-about security setup option and a separate change from the askpass integration.

The native askpass portion is working reliably locally. If this direction fits Omarchy, I would be happy to clean it into a focused PR against the stock omarchy.polkit plugin, with the local clone/update-watcher machinery removed and regression coverage added.