Refresh the passwordless sudo indicator on change instead of polling (#15026)

* Refresh the passwordless sudo indicator on change instead of polling

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Refresh the sudo indicator after failed changes and on a wall-clock deadline

Addresses Codex review: a rolled-back renewal skipped the refresh, the monotonic user timer paused through suspend, and default timer accuracy allowed a minute's delay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Test the sudo indicator refreshes by running the grant flows

Replace source-string checks with runs of timed, renewed, failed, permanent and disable flows against the fixture, asserting the recorded omarchy-shell refresh and wall-clock systemd-run --user timer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

bin/omarchy-sudo-passwordless

@@ -462,7 +462,34 @@ root_dispatch() {
   esac
 }
 
+# The bar indicator only probes on demand, so every grant change pushes a
+# refresh. Root's expiry timer can't reach the user's shell, so a user timer
+# refreshes once the deadline has passed. Both are best effort: a stale red
+# indicator still revokes cleanly when clicked.
+refresh_indicator() {
+  /usr/bin/omarchy-shell -q omarchy.indicators refresh >/dev/null 2>&1 || true
+}
+
+# A failed enable can still change the grant (a renewal that rolls back removes
+# the previous policy), so refresh whatever the privileged action returned.
+change_grant() {
+  local status=0
+  /usr/bin/sudo "$@" || status=$?
+  refresh_indicator
+  return "$status"
+}
+
+# A wall-clock deadline, like the sudoers rule and root's timer, so expiry
+# during suspend still refreshes on resume.
+schedule_expiry_refresh() {
+  [[ $minutes == "permanent" ]] && return 0
+  /usr/bin/systemd-run --user --quiet --collect --on-calendar="@$((EPOCHSECONDS + 10#$minutes * 60 + 2))" \
+    --timer-property=AccuracySec=1s \
+    -- /usr/bin/omarchy-shell -q omarchy.indicators refresh >/dev/null 2>&1 || true
+}
+
 show_enabled() {
+  schedule_expiry_refresh
   if [[ $minutes == "permanent" ]]; then
     echo "Passwordless sudo has been ENABLED permanently. Run this command again to disable it."
   else
@@ -542,12 +569,12 @@ else
   fi
 fi
 if (( status == 0 )) && { (($# == 0)) || [[ $minutes == "--disable" ]]; }; then
-  /usr/bin/sudo -n -N -- "$INSTALLED_SELF" __disable "$uid"
+  change_grant -n -N -- "$INSTALLED_SELF" __disable "$uid"
   echo "Passwordless sudo has been DISABLED. Sudo will require a password again."
 elif (( status == STATUS_INACTIVE )) && [[ $minutes == "--disable" ]]; then
   echo "Passwordless sudo is already DISABLED."
 elif (( status == 0 )) && [[ $minutes != "permanent" ]]; then
-  /usr/bin/sudo -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
+  change_grant -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
   show_enabled
 else
   if (( status != 0 && status != STATUS_INACTIVE )); then
@@ -587,7 +614,7 @@ else
   echo ""
 
   if /usr/bin/gum confirm "Enable passwordless sudo $duration? This is a significant security risk!"; then
-    /usr/bin/sudo -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
+    change_grant -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
     echo ""
     show_enabled
   else