Use sudo for terminal update inhibition

bin/omarchy-update-stay-awake

@@ -83,21 +83,31 @@ stop() {
 start() {
   local inhibit_pid=""
   local inhibit_start_time=""
+  local inhibit_runner=()
   local idle_owner="$$:$RANDOM:$RANDOM"
 
   stop
   mkdir -p "$state_dir"
 
   if omarchy-cmd-present systemd-inhibit; then
+    if (( EUID != 0 )); then
+      if [[ -t 0 ]]; then
+        sudo -v
+        inhibit_runner=(sudo)
+      else
+        inhibit_runner=(pkexec)
+      fi
+    fi
+
     if [[ -n ${OMARCHY_UPDATE_LOCK_FD:-} ]]; then
-      systemd-inhibit \
+      "${inhibit_runner[@]}" systemd-inhibit \
         --what=sleep:idle \
         --who=omarchy-update \
         --why="Omarchy update in progress" \
         --mode=block \
         sleep infinity >/dev/null 2>&1 {OMARCHY_UPDATE_LOCK_FD}>&- &
     else
-      systemd-inhibit \
+      "${inhibit_runner[@]}" systemd-inhibit \
         --what=sleep:idle \
         --who=omarchy-update \
         --why="Omarchy update in progress" \

test/shell.d/update-disk-space-test.sh

@@ -65,6 +65,7 @@ exit 0'
 for command in \
   omarchy-cmd-present \
   omarchy-toggle-idle \
+  pkexec \
   systemd-inhibit \
   omarchy-update-dev \
   omarchy-update-keyring \
@@ -80,6 +81,7 @@ for command in \
   write_stub "$command" 'exit 0'
 done
 write_stub omarchy-update-available 'exit 1'
+write_stub pkexec 'exec "$@"'
 
 set +e
 TEST_AVAILABLE_BYTES=$((9 * 1024 * 1024 * 1024)) \

test/shell.d/update-lock-test.sh

@@ -33,6 +33,7 @@ SH
 
 for command in \
   omarchy-toggle-idle \
+  pkexec \
   systemd-inhibit \
   omarchy-update-dev \
   omarchy-update-keyring \
@@ -48,6 +49,7 @@ for command in \
   write_stub "$command" 'exit 0'
 done
 write_stub omarchy-update-available 'exit 1'
+write_stub pkexec 'exec "$@"'
 
 # omarchy-update should hold the lock before snapshotting, so a second update
 # cannot even enter its pre-update snapshot.
@@ -114,6 +116,28 @@ kill -0 "$inhibitor_pid" 2>/dev/null &&
   fail "update waits for its sleep inhibitor to stop before continuing"
 pass "omarchy-update waits for its sleep inhibitor to stop"
 
+if (( EUID != 0 )); then
+  sudo_log="$test_tmp/sudo.log"
+  pkexec_marker="$test_tmp/pkexec-used"
+  terminal_inhibit_pid_file="$test_tmp/terminal-inhibit-pid"
+  write_stub sudo '
+printf "%s\n" "$*" >>"$SUDO_LOG"
+if [[ $1 == "-v" ]]; then
+  exit 0
+fi
+exec "$@"'
+  write_stub pkexec 'touch "$PKEXEC_MARKER"; exec "$@"'
+
+  SUDO_LOG="$sudo_log" PKEXEC_MARKER="$pkexec_marker" INHIBIT_PID_FILE="$terminal_inhibit_pid_file" \
+    run_with_lock_env script -qefc "$ROOT/bin/omarchy-update-stay-awake start" /dev/null >/dev/null
+
+  grep -qx -- '-v' "$sudo_log" || fail "terminal sleep inhibition validates sudo in the foreground"
+  grep -q '^systemd-inhibit ' "$sudo_log" || fail "terminal sleep inhibition runs through sudo"
+  [[ ! -e $pkexec_marker ]] || fail "terminal sleep inhibition does not use pkexec"
+  run_with_lock_env "$ROOT/bin/omarchy-update-stay-awake" stop
+  pass "terminal updates use sudo instead of Polkit for sleep inhibition"
+fi
+
 # Update-owned Stay Awake state must be cleared before the restart helper can
 # reboot the machine, rather than relying on an EXIT trap during shutdown.
 write_stub omarchy-snapshot 'exit 0'