Stop offering fingerprint setup on machines with no reader

A Dell XPS 14 with no fingerprint reader was invited to set one up on first
run. Its Synaptics webcam bridge, 06cb:0701 "SVP7500" bound to usbio-bridge,
matched omarchy-hw-fingerprint on the bare 06cb vendor ID.

The vendor list already excludes Elan and STMicro for being multi-purpose, but
Synaptics is just as multi-purpose and was left in. Dropping 06cb is not an
option: Synaptics and Validity are among the most common real reader vendors,
and many of those readers report no product string at all, so the vendor ID is
the only signal that finds them.

The vendor guess is now qualified instead. libfprint drives every reader it
supports from userspace over libusb, so a real reader sits with no kernel
driver bound to any of its interfaces, while the bridges, touchpads and cameras
that share these vendor IDs all bind one. The guard applies only to the fuzzy
vendor-ID path; a device whose product descriptor names it a fingerprint reader
is still trusted outright, since that signal is precise enough on its own and
should not be lost to a driver that happened to claim the device.

The menu entry was a second surface for the same bug. Setup > Security >
Fingerprint carried no when clause, unlike the Remove entry beside it, so it
appeared on every machine and dead-ended in the setup script's own hardware
check. It now gates on the same detector.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017q97Rsk8KwgaPUVq5ArLgM

bin/omarchy-hw-fingerprint

@@ -10,6 +10,20 @@
 # reader — those still match on the product string below when present.
 fingerprint_vendors=" 27c6 138a 06cb 08ff 1c7a 147e "
 
+# libfprint drives every reader it supports from userspace over libusb, so a
+# real reader sits there with no kernel driver bound to any of its interfaces.
+# The other things these vendors build — Synaptics webcam bridges (usbio-bridge
+# on the Dell XPS 14), touchpads and touchscreens (usbhid), cameras (uvcvideo)
+# — all bind one. Only the vendor-ID guess needs this; a device that names
+# itself a fingerprint reader is trusted outright.
+has_kernel_driver() {
+  local intf
+  for intf in "$1"/*:*; do
+    [[ -e $intf/driver ]] && return 0
+  done
+  return 1
+}
+
 for dev in /sys/bus/usb/devices/*; do
   # The device's own product descriptor usually names it, e.g. "Goodix
   # Fingerprint USB Device" — driver-independent and vendor-agnostic.
@@ -21,7 +35,8 @@ for dev in /sys/bus/usb/devices/*; do
 
   if [[ -r $dev/idVendor ]]; then
     vendor=$(<"$dev/idVendor")
-    [[ $fingerprint_vendors == *" $vendor "* ]] && exit 0
+    [[ $fingerprint_vendors == *" $vendor "* ]] &&
+      ! has_kernel_driver "$dev" && exit 0
   fi
 done
 

default/omarchy/omarchy-menu.jsonc

@@ -147,7 +147,7 @@
   "setup.default.editor.emacs": {"icon":"","label":"Emacs","when":"omarchy-cmd-present emacs","checked":"[[ \"$(omarchy-default-editor)\" == \"emacs\" ]]","action":"omarchy-default-editor emacs"},
   "setup.security": {"icon":"","label":"Security"},
   "setup.config": {"icon":"","label":"Config"},
-  "setup.security.fingerprint": {"icon":"󰈷","label":"Fingerprint","action":"omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint"},
+  "setup.security.fingerprint": {"icon":"󰈷","label":"Fingerprint","when":"omarchy-hw-fingerprint","action":"omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint"},
   "setup.security.fido2": {"icon":"","label":"Fido2","action":"omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fido2"},
   "setup.security.sshd": {"icon":"󰣀","label":"SSHD","action":"omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-sshd"},
   "setup.security.passwordless-sudo": {"icon":"󰟵","label":"Passwordless Sudo","action":"omarchy-launch-floating-terminal-with-presentation omarchy-sudo-passwordless"},