WIP

hosts/terra/home.nix

@@ -1,6 +1,53 @@
 { pkgs, unstable, inputs, ... }:
 let
   tome = pkgs.callPackage ../../pkgs/tome.nix { src = inputs.tome; };
+
+  # SUDO_ASKPASS helper: renders sudo's password prompt in the quickshell
+  # shell (HyprChrome/Widgets/Askpass) instead of on the terminal.
+  #
+  # sudo does NOT speak polkit — it is setuid + PAM reading the tty, and no
+  # sudoers option bridges the two — so this is the askpass mechanism, a
+  # separate path that happens to reuse the polkit dialog's look. `run0` is the
+  # polkit-native alternative if you want the agent itself.
+  #
+  # A package rather than a file in dotfiles/quickshell because SUDO_ASKPASS
+  # must point at something EXECUTABLE, and xdg.configFile copies keep their
+  # store mode — which is why open_launcher.sh has to be invoked as
+  # `bash <path>` rather than run directly.
+  #
+  # The secret comes back over a 0600 fifo, never in argv or the environment,
+  # so it is not visible in /proc to anything. Cancelling closes the fifo
+  # without writing: `cat` reads nothing, this exits non-zero, and sudo aborts
+  # instead of burning a retry on an empty password.
+  qs-askpass = pkgs.writeShellApplication {
+    name = "qs-askpass";
+    runtimeInputs = [ pkgs.quickshell pkgs.coreutils ];
+    text = ''
+      runtime="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+      fifo="$(mktemp -u "$runtime/qs-askpass.XXXXXXXX")"
+      mkfifo -m 600 "$fifo"
+      trap 'rm -f "$fifo"' EXIT
+
+      # Returns immediately; the dialog is asynchronous and we block on the
+      # fifo, not on the IPC call.
+      if ! qs ipc call askpass prompt "''${1:-Password:}" "$fifo" >/dev/null 2>&1; then
+        echo "qs-askpass: quickshell is not running or has no askpass handler" >&2
+        exit 1
+      fi
+
+      # Bounded, so a prompt nobody answers fails instead of wedging sudo for
+      # good. On timeout take the dialog down too, or it would sit there with
+      # nothing listening.
+      if ! secret="$(timeout 120 cat "$fifo")"; then
+        qs ipc call askpass cancel >/dev/null 2>&1 || true
+        echo "qs-askpass: timed out waiting for the prompt" >&2
+        exit 1
+      fi
+
+      [ -n "$secret" ] || exit 1
+      printf '%s\n' "$secret"
+    '';
+  };
 in
 {
   # home.stateVersion, programs.home-manager.enable, programs.zsh.enable all
@@ -34,6 +81,12 @@ in
   # it instead of the root /var/run/docker.sock.
   home.sessionVariables.DOCKER_HOST = "unix:///run/user/1000/podman/podman.sock";
 
+  # Only sets WHICH helper sudo uses; it still only calls it when asked with
+  # `sudo -A` (or when there is no tty at all). Plain `sudo` keeps prompting on
+  # the terminal, deliberately: aliasing it wholesale would break every sudo in
+  # a TTY or over ssh, where there is no shell to draw the dialog.
+  home.sessionVariables.SUDO_ASKPASS = "${qs-askpass}/bin/qs-askpass";
+
   xdg.userDirs = {
     enable = true;
   };
@@ -46,13 +99,14 @@ in
     (pkgs.writeTextDir "share/mime/packages/application-x-ms-sln.xml"
       (builtins.readFile ../../dotfiles/mime/application-x-ms-sln.xml))
     unstable.claude-code
+    unstable.codex
     pkgs.opencode
     pkgs.quickshell
+    qs-askpass
     pkgs.github-cli
     pkgs.tea
     pkgs.docker-compose
     pkgs.hyprcursor
-    pkgs.bibata-cursors
     pkgs.papirus-icon-theme
   ];