Invite fingerprint setup on first run when a reader is present

Add a first-run notification, alongside the keybindings/Wi-Fi toasts, that
invites anyone with a fingerprint sensor to enable it. Clicking launches
omarchy-setup-security-fingerprint in a floating terminal.

Detection lives in a new omarchy-hw-fingerprint helper that reads sysfs
(device product descriptor plus a fingerprint-vendor allowlist), so it
works before fprintd/usbutils are installed and without nagging machines
that have no reader. The setup script reuses the same helper as an early
gate, bailing before installing any packages when no reader is found
(replacing the old post-install fprintd-list probe).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/omarchy-first-run

@@ -123,6 +123,9 @@ run_first_run_step "show welcome notification" \
 sleep 0.3
 run_first_run_step "show Wi-Fi/update notifications" \
   bash "$OMARCHY_PATH/install/user/first-run/wifi.sh"
+sleep 0.3
+run_first_run_step "invite fingerprint setup" \
+  bash "$OMARCHY_PATH/install/user/first-run/fingerprint.sh"
 
 if (( first_run_failed == 0 )); then
   omarchy-done mark "$FIRST_RUN_DONE"

bin/omarchy-hw-fingerprint

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# omarchy:summary=Returns true when a fingerprint reader is present
+# omarchy:hidden=true
+
+# Detect straight from sysfs so this works before fprintd/usbutils are
+# installed (the fingerprint setup pulls those in). USB vendor IDs listed here
+# ship fingerprint readers; multi-purpose vendors (e.g. Elan/STMicro, which
+# also make USB touchscreens) are left out to avoid nagging laptops with no
+# reader — those still match on the product string below when present.
+fingerprint_vendors=" 27c6 138a 06cb 08ff 1c7a 147e "
+
+for dev in /sys/bus/usb/devices/*; do
+  # The device's own product descriptor usually names it, e.g. "Goodix
+  # Fingerprint USB Device" — driver-independent and vendor-agnostic.
+  if [[ -r $dev/product ]]; then
+    product=$(<"$dev/product")
+    product=${product,,}
+    [[ $product == *fingerprint* || $product == *biometric* ]] && exit 0
+  fi
+
+  if [[ -r $dev/idVendor ]]; then
+    vendor=$(<"$dev/idVendor")
+    [[ $fingerprint_vendors == *" $vendor "* ]] && exit 0
+  fi
+done
+
+exit 1

bin/omarchy-setup-security-fingerprint

@@ -6,18 +6,6 @@
 set -e
 
 
-check_fingerprint_hardware() {
-  # Get fingerprint devices for the user
-  devices=$(fprintd-list "$USER" 2>/dev/null)
-
-  # Exit if no devices found
-  if [[ -z $devices ]]; then
-    echo -e "\e[31m\nNo fingerprint sensor detected.\e[0m"
-    return 1
-  fi
-  return 0
-}
-
 setup_pam_config() {
   # Configure sudo
   if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
@@ -72,6 +60,12 @@ EOF
 
 echo -e "\e[32mSetting up fingerprint scanner for authentication.\n\e[0m"
 
+# Bail before installing anything if there's no reader to talk to.
+if ! omarchy-hw-fingerprint; then
+  echo -e "\e[31mNo fingerprint sensor detected.\e[0m"
+  exit 1
+fi
+
 # Install required packages
 echo "Installing required packages..."
 
@@ -86,10 +80,6 @@ fi
 
 omarchy-pkg-add libfprint-git fprintd usbutils
 
-if ! check_fingerprint_hardware; then
-  exit 1
-fi
-
 # Configure PAM
 setup_pam_config
 

install/user/first-run/fingerprint.sh

@@ -0,0 +1,9 @@
+(
+  # Only invite when there's a reader to use and it isn't set up yet (the lock
+  # PAM file is the last thing the setup writes on success).
+  if omarchy-hw-fingerprint && [[ ! -f /etc/pam.d/omarchy-lock-fingerprint ]]; then
+    if [[ -n $(omarchy-notification-send -u critical -g 󰈷 "Setup Fingerprint" "Click to unlock login, sudo, and the lock screen with your fingerprint." -a) ]]; then
+      omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint
+    fi
+  fi
+) >/dev/null 2>&1 &