From 4b75fbbfd5284eb456764021e4d690b1a5950c6b Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Sun, 15 Mar 2026 16:01:49 +0100
Subject: [PATCH] Add danger mode for sudoless agent work on system
 administration

---
 bin/omarchy-sudo-passwordless-toggle | 32 ++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100755 bin/omarchy-sudo-passwordless-toggle

diff --git a/bin/omarchy-sudo-passwordless-toggle b/bin/omarchy-sudo-passwordless-toggle
new file mode 100755
index 00000000..7dac33b2
--- /dev/null
+++ b/bin/omarchy-sudo-passwordless-toggle
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# Toggle passwordless sudo for the current user.
+# First run: enables passwordless sudo (after confirmation).
+# Second run: disables it.
+
+NOPASSWD_FILE="/etc/sudoers.d/99-omarchy-nopasswd-${USER}"
+
+if [ -f "$NOPASSWD_FILE" ]; then
+  sudo rm "$NOPASSWD_FILE"
+  echo "Passwordless sudo has been DISABLED. Sudo will require a password again."
+else
+  echo ""
+  echo "⚠️  WARNING: This will allow ANY process running as your user to"
+  echo "execute ANY command as root WITHOUT a password."
+  echo ""
+  echo "This is useful for AI agents that need to run sudo commands,"
+  echo "but it significantly weakens the security of your system."
+  echo "Anyone or anything with access to your user account gets full root."
+  echo ""
+  echo "Only enable this while actively using an AI agent, then run"
+  echo "this command again to disable it."
+  echo ""
+
+  if gum confirm "Enable passwordless sudo? This is a significant security risk!"; then
+    echo "${USER} ALL=(ALL) NOPASSWD: ALL" | sudo tee "$NOPASSWD_FILE" > /dev/null
+    sudo chmod 440 "$NOPASSWD_FILE"
+    echo "Passwordless sudo has been ENABLED. Run this command again to disable it."
+  else
+    echo "Aborted. No changes made."
+  fi
+fi