GUI launch auto-update fails without passwordless sudo #16

New Issue

2026-09-04T12:00:27-05:00

eva commented

2026-09-04 12:00:27 -05:00

Problem

Desktop/GUI launch of grok-bot does not auto-update when a newer grok-bot-bin release exists, because there is no TTY for interactive sudo.

Justin confirmed: terminal bash -x $(command -v grok-bot) with a sudo password prompt did bump 0.35 → 0.39 on his PC. The GUI/menu path (Exec=grok-bot) still fails the update quietly and launches the old install.

Evidence

grok-bot-launch.sh _maybe_update does:

sudo -n pacman -U --noconfirm "$pkg" (passwordless only)
else sudo pacman -U --noconfirm "$pkg" (needs a TTY)
on failure: fail soft and exec the installed binary

Lab CT113 with NOPASSWD: sudo -n PASS → update works without a prompt.
Desktop PC GUI: no TTY → sudo -n fails → interactive sudo cannot prompt → update skipped.

Goal

When launched from the desktop (Exec=grok-bot), offer a password prompt that works without a terminal — e.g. polkit rule, pkexec, or equivalent — so pacman -U can succeed the same way a terminal sudo prompt does.

Scope

Fix GUI auto-update path in the launch shim / package packaging (.desktop, polkit policy, etc. as needed)
Keep fail-soft if the user cancels or auth fails (still launch installed binary)
Document any new polkit/pkexec dependency for CachyOS

Out of scope

Making passwordless sudo the default on Justin’s PC
Changing Gitea release CI
Applying anything on the PC (commands-only if needed later)

Acceptance

From a desktop menu launch with a newer release available, user gets a graphical auth prompt (or equivalent) and ends on the new version after success
Terminal path still works
Cancel / deny still launches the current install
PR to master, Reviewers=linus (and Blake if packaging/polkit is security-shaped), do not merge yourself

Revert

git revert. No DB.

Commit style: area: Imperative summary.

## Problem Desktop/GUI launch of `grok-bot` does not auto-update when a newer `grok-bot-bin` release exists, because there is no TTY for interactive `sudo`. Justin confirmed: terminal `bash -x $(command -v grok-bot)` with a sudo password prompt **did** bump 0.35 → 0.39 on his PC. The GUI/menu path (`Exec=grok-bot`) still fails the update quietly and launches the old install. ## Evidence `grok-bot-launch.sh` `_maybe_update` does: 1. `sudo -n pacman -U --noconfirm "$pkg"` (passwordless only) 2. else `sudo pacman -U --noconfirm "$pkg"` (needs a TTY) 3. on failure: fail soft and exec the installed binary Lab CT113 with NOPASSWD: `sudo -n` PASS → update works without a prompt. Desktop PC GUI: no TTY → `sudo -n` fails → interactive `sudo` cannot prompt → update skipped. ## Goal When launched from the desktop (`Exec=grok-bot`), offer a password prompt that works without a terminal — e.g. **polkit** rule, **pkexec**, or equivalent — so `pacman -U` can succeed the same way a terminal sudo prompt does. ## Scope - Fix GUI auto-update path in the launch shim / package packaging (`.desktop`, polkit policy, etc. as needed) - Keep fail-soft if the user cancels or auth fails (still launch installed binary) - Document any new polkit/pkexec dependency for CachyOS ## Out of scope - Making passwordless sudo the default on Justin’s PC - Changing Gitea release CI - Applying anything on the PC (commands-only if needed later) ## Acceptance - From a desktop menu launch with a newer release available, user gets a graphical auth prompt (or equivalent) and ends on the new version after success - Terminal path still works - Cancel / deny still launches the current install - PR to master, Reviewers=linus (and Blake if packaging/polkit is security-shaped), do not merge yourself ## Revert `git revert`. No DB. Commit style: `area: Imperative summary`.

ash was assigned by eva

2026-09-04 12:00:27 -05:00

ash referenced this issue from a commit

2026-09-04 12:17:06 -05:00

scripts: Prompt polkit for GUI grok-bot auto-update

ash referenced a pull request that will close this issue

2026-09-04 12:17:30 -05:00

scripts: Prompt polkit for GUI grok-bot auto-update #17

linus closed this issue

2026-09-04 12:30:10 -05:00

linus referenced this issue from a commit

2026-09-04 12:30:11 -05:00