Agent runs "sudo" and freezes UI when analyzing system configs (e.g. Apache) #3212

What happens:
When I ask the agent something like “analyse the Apache config please”, it automatically tries to read files under /etc/apache2/ and runs a sudo command (for example sudo cat /etc/apache2/sites-enabled/...).
If the user has no sudo access, the process waits for a password prompt and the whole interface freezes — you have to hard-reset or close the terminal. (esc or Ctrl +C don't work).

Important:
This is not a security issue. The user has no sudo rights anyway. The real problem is that the interface becomes blocked, and this can happen very easily — especially:

when someone clicks “OK” too quickly in plan mode, or when a build runs automatically without supervision.

Environment:
OpenCode version: opencode v0.11.3
OS: Ubuntu 22.04
Agent : Plan claude-sonnet-4-5
User: non-sudo

Steps to reproduce:
Use a non-sudo account.
In a session, type: analyse the Apache config or similar.
The agent tries sudo cat /etc/apache2/....
Terminal freezes waiting for password.

Actual behaviour:
CLI/UI hangs indefinitely.
No keyboard control.
Must kill process or reset the terminal.
when I comeback in the session => the work going to the whereas the UI was brocken.

Expected behaviour:
The agent should detect forbidden commands (like sudo, su) before running anything.
It should fail fast and show a message instead of hanging.
This behaviour should be persistent and configurable.

Possible config example:
{
"agent": {
"allow_sudo": false,
"forbidden_commands": ["sudo", "su"],
"command_execution": {
"fail_fast_on_forbidden": true
}
}
}

Example error message:
Refused to execute command: contains forbidden token "sudo". To override, set agent.allow_sudo=true in config

Why this matters:
It can happen by accident during plan/build, especially when confirming too fast in plan.
The problem is usability, not security.

A simple pre-check would prevent interface freezes and lost sessions.

Extrat Past of screan with !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! where it crashed.

                                                                                                                                                       ┃  

┃ Shell Check cron jobs ┃
┃ ┃
┃ $ crontab -l 2>/dev/null | grep -i xxxxx || echo "No cron jobs for xxxxx" ┃
┃ No cron jobs for xxxxx ┃
┃ ┃

┃ ┃
┃ Shell Read Apache config with sudo ┃
┃ ┃
┃ $ sudo cat /etc/apache2/sites-available/xxxxx.com.conf ┃
┃ sudo: 3 incorrect password attempts ┃
===>>>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Here it crashed but as you can see the task was cotinued in another dimension ;-)
┃ ┃

┃ ┃
┃ Shell Read systemd API service ┃
┃ ┃
┃ $ sudo cat /etc/systemd/system/xxxxx-prod-api.service ┃
┃ ┃

┃ ┃
┃ Shell Read systemd frontend service ┃
┃ ┃
┃ $ sudo cat /etc/systemd/system/xxxxx-prod-frontend.service ┃
┃ ┃

┃ ┃
┃ Read xxxxx-prod-api.service ┃
┃ ┃
┃ [Unit] ┃
┃ Description=xxxxx Production API ┃
┃ After=network.target mariadb.service

📝 AMÉLIORATION DU SCRIPT BACKUP (backup_xxxxx_work.sh)

 Ajouts nécessaires :                                                                                                                                          
                                                                                                                                                               
 1. Step de confirmation :                                                                                                                                     
                                                                                                                                                               
 echo "🔄 Backup xxxxx complet"                                                                                                                             
 echo "📊 3 bases MySQL + code + configs système"                                                                                                              
 read -p "Continuer? (y/n) " -n 1 -r                                                                                                                           
 [[ ! $REPLY =~ ^[Yy]$ ]] && exit 0                                                                                                                            
                                                                                                                                                               
 2. Sauvegarder configs Apache :                                                                                                                               
                                                                                                                                                               
 # Apache configs                                                                                                                                              
 mkdir -p "$TEMP_DIR/apache"                                                                                                                                   
 cp /etc/apache2/sites-available/xxxxx.com.conf "$TEMP_DIR/apache/" 2>/dev/null                                                                             
                                                                                                                                                               
 3. Sauvegarder Logrotate :                                                                                                                                    
                                                                                                                                                               
 # Logrotate                                                                                                                                                   
 cp /etc/logrotate.d/xxxxx-logrotate "$TEMP_DIR/" 2>/dev/null                                                                                               
                                                                                                                                                               
 4. **Sauve                                                                                                                                                    
 Plan claude-sonnet-4-5-20250929 (12:25 PM)                                                                                                                    

┃ ┃
┃ Request was aborted

opencode v0.11.3 ~/apps/xxxxx:dev