fix(edit_secrets): guarantee a working editor (bundle nano, --wait for GUI)

edit_secrets

@@ -31,6 +31,20 @@ done
 
 if [ "$show" -eq 1 ]; then
   exec nix shell nixpkgs#sops -c sops --decrypt "$file"
-else
-  exec nix shell nixpkgs#sops -c sops "$file"
 fi
+
+# sops opens $EDITOR on a temp file and re-encrypts only if it changed.
+# Pitfalls that cause "File has not changed, exiting":
+#   - $EDITOR unset: no editor is on the `nix shell` PATH -> bundle one.
+#   - GUI editor (code/zed) forks and returns instantly -> force --wait.
+editor="${VISUAL:-${EDITOR:-}}"
+extra=()
+case "$editor" in
+  "")            editor="nano"; extra=(nixpkgs#nano) ;;   # sane default, bundled
+  code|code\ *)  editor="code --wait" ;;                   # VS Code must block
+  codium|codium\ *) editor="codium --wait" ;;
+  zed|zed\ *)    editor="zed --wait" ;;
+esac
+
+export EDITOR="$editor"
+exec nix shell nixpkgs#sops "${extra[@]}" -c sops "$file"