scripts: Prompt polkit for GUI grok-bot auto-update #17

2026-09-04T12:17:30-05:00

ash commented

2026-09-04 12:17:30 -05:00

What

Desktop auto-update now uses a graphical polkit prompt when Exec=grok-bot has no TTY.

Privilege order in grok-bot-launch.sh:

sudo -n (lab NOPASSWD / cached credentials only — not shipped as default)
pkexec of /usr/lib/grok-bot-bin/pkexec-pacman-u when stdin is not a TTY and DISPLAY or WAYLAND_DISPLAY is set
interactive sudo when stdin is a TTY

The helper only pacman -Us a local grok-bot-bin package (filename + pacman -Qp name). Polkit action com.s1d3sw1ped.grok-bot-bin.update is auth_admin (not yes / NOPASSWD). Cancel or deny still launches the installed binary. polkit is an optdepend; README notes the CachyOS desktop agent requirement.

pkgrel 2 so the shim/helper/policy can ship without waiting on an upstream Grok Bot version bump. No Gitea release CI changes.

Why

GUI/menu launch skipped auto-update because interactive sudo needs a TTY. Terminal sudo already worked (0.35 → 0.39). Lab CT113 NOPASSWD already worked via sudo -n.

Test

Desktop menu launch with a newer release: graphical polkit prompt → new version on success
Terminal grok-bot: interactive sudo password prompt still works
Cancel / deny: current install still launches
Do not configure passwordless sudo as the default

Closes: #16

## What Desktop auto-update now uses a graphical polkit prompt when `Exec=grok-bot` has no TTY. Privilege order in `grok-bot-launch.sh`: 1. `sudo -n` (lab NOPASSWD / cached credentials only — not shipped as default) 2. `pkexec` of `/usr/lib/grok-bot-bin/pkexec-pacman-u` when stdin is not a TTY and `DISPLAY` or `WAYLAND_DISPLAY` is set 3. interactive `sudo` when stdin is a TTY The helper only `pacman -U`s a local `grok-bot-bin` package (filename + `pacman -Qp` name). Polkit action `com.s1d3sw1ped.grok-bot-bin.update` is `auth_admin` (not `yes` / NOPASSWD). Cancel or deny still launches the installed binary. `polkit` is an optdepend; README notes the CachyOS desktop agent requirement. pkgrel 2 so the shim/helper/policy can ship without waiting on an upstream Grok Bot version bump. No Gitea release CI changes. ## Why GUI/menu launch skipped auto-update because interactive sudo needs a TTY. Terminal sudo already worked (0.35 → 0.39). Lab CT113 NOPASSWD already worked via `sudo -n`. ## Test - Desktop menu launch with a newer release: graphical polkit prompt → new version on success - Terminal `grok-bot`: interactive sudo password prompt still works - Cancel / deny: current install still launches - Do not configure passwordless sudo as the default Closes: https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin/issues/16

ash added 1 commit 2026-09-04 12:17:30 -05:00

scripts: Prompt polkit for GUI grok-bot auto-update 56b6c046ef

Desktop Exec=grok-bot has no TTY, so interactive sudo cannot
prompt and auto-update is skipped. Try sudo -n, then pkexec of a
grok-bot-bin-only helper (auth_admin, not NOPASSWD), then
interactive sudo on a TTY. Cancel or deny still launches the
installed binary.

#16

ash requested review from linus 2026-09-04 12:17:30 -05:00

ash requested review from blake 2026-09-04 12:17:30 -05:00

linus merged commit 1001abba40 into master

2026-09-04 12:30:10 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: s1d3sw1ped/grok-bot-bin#17