Retry USB approval delivery when notifications become available

bin/omarchy-usb-authorization-event

@@ -16,7 +16,7 @@ IPC.Connected)
         USBGUARD_DEVICE_ID="${BASH_REMATCH[1]}" \
         USBGUARD_DEVICE_TARGET_NEW=block \
         USBGUARD_DEVICE_RULE="${BASH_REMATCH[2]}" \
-        "$OMARCHY_PATH/bin/omarchy-usb-authorization-event"
+        "$OMARCHY_PATH/bin/omarchy-usb-authorization-event" || true
     fi
   done <<<"$blocked"
   exit 0
@@ -44,40 +44,52 @@ request="$requests/$token.json"
 # watch executes handlers concurrently. A reconnect scan and a policy event
 # can refer to the same device; publish only one pending request.
 exec 9>"$requests/.lock"
-flock 9
-[[ ! -e $request ]] || exit 0
+# Keep retrying without needing another USB event. Handlers belong to the
+# watcher service and are stopped with the graphical session.
+while true; do
+  flock 9
+  [[ ! -e $request ]] || exit 0
 
-# Discard events overtaken by another policy decision or device replacement.
-blocked=$(usbguard list-devices --blocked) || exit 1
-current=0
-while IFS= read -r line; do
-  if [[ $line == "$USBGUARD_DEVICE_ID: $USBGUARD_DEVICE_RULE" ]]; then
-    current=1
-    break
+  # Discard events overtaken by another policy decision or device replacement.
+  blocked=$(usbguard list-devices --blocked) || exit 1
+  current=0
+  while IFS= read -r line; do
+    if [[ $line == "$USBGUARD_DEVICE_ID: $USBGUARD_DEVICE_RULE" ]]; then
+      current=1
+      break
+    fi
+  done <<<"$blocked"
+  (( current )) || exit 0
+
+  # Login and shell restarts can leave D-Bus alive before notifications are ready.
+  # Bound each wait so disappeared devices are rechecked between attempts.
+  if ! omarchy-notification-wait 1; then
+    flock -u 9
+    sleep 1
+    continue
   fi
-done <<<"$blocked"
-(( current )) || exit 0
 
-temporary=$(mktemp "$requests/.request.XXXXXXXXXX")
-trap 'rm -f "$temporary"' EXIT
+  temporary=$(mktemp "$requests/.request.XXXXXXXXXX")
+  trap 'rm -f "$temporary"' EXIT
 
-jq -n \
-  --arg id "$USBGUARD_DEVICE_ID" \
-  --arg rule "$USBGUARD_DEVICE_RULE" \
-  '{id: $id, rule: $rule}' >"$temporary"
-chmod 600 "$temporary"
-mv -f "$temporary" "$request"
+  jq -n \
+    --arg id "$USBGUARD_DEVICE_ID" \
+    --arg rule "$USBGUARD_DEVICE_RULE" \
+    '{id: $id, rule: $rule}' >"$temporary"
+  chmod 600 "$temporary"
+  mv -f "$temporary" "$request"
 
-if ! omarchy-notification-send \
-  --app-name omarchy-action \
-  --urgency critical \
-  --glyph 󰖀 \
-  "USB accessory blocked" \
-  "Click to review it. Keep it blocked unless you recognize the device." \
-  --exec omarchy-launch-floating-terminal-with-presentation \
-  omarchy-usb-authorization-review "$token"; then
-  # Only a delivered notification may suppress subsequent attempts. Keep the
-  # lock until failure cleanup so another event cannot skip an unsent request.
+  if omarchy-notification-send \
+    --app-name omarchy-action \
+    --urgency critical \
+    --glyph 󰖀 \
+    "USB accessory blocked" \
+    "Click to review it. Keep it blocked unless you recognize the device." \
+    --exec omarchy-launch-floating-terminal-with-presentation \
+    omarchy-usb-authorization-review "$token"; then
+    exit 0
+  fi
   rm -f "$request"
-  exit 1
-fi
+  flock -u 9
+  sleep 1
+done