From f80ed5863e864708f360cc5e6381a3fdcf903f2e Mon Sep 17 00:00:00 2001
From: Aner Zakobar <aner@zakobar.com>
Date: Mon, 5 Oct 2026 09:33:01 +0300
Subject: [PATCH] Yay fixes and stuff

---
 azos-core                          |  2 +-
 features/lauretta/emacs/config.org | 48 +++++++++++++++++++++++-------
 shells/default.nix                 |  2 --
 shells/defaultShell.nix            |  3 +-
 4 files changed, 40 insertions(+), 15 deletions(-)

diff --git a/azos-core b/azos-core
index 544f432..5450612 160000
--- a/azos-core
+++ b/azos-core
@@ -1 +1 @@
-Subproject commit 544f432cb6ac7ea7076213716ad886c87132c19d
+Subproject commit 5450612860da0d54177815cb3ba1cb2df1c5aa05
diff --git a/features/lauretta/emacs/config.org b/features/lauretta/emacs/config.org
index 5508bf6..d5937f4 100644
--- a/features/lauretta/emacs/config.org
+++ b/features/lauretta/emacs/config.org
@@ -198,10 +198,7 @@ it syncs elfeed's feed list and read/unread state with the Nextcloud
 News app instead of just reading a local feed list one-way.
 
 Reuses the same =zakobar.com= pass entry as the CalDAV sync above,
-since it's the same Nextcloud account. =shell-command-to-string=
-merges stderr into its return value, so stderr is redirected away to
-keep a stray gpg/pass warning from getting concatenated onto the
-password.
+since it's the same Nextcloud account.
 
 As of elfeed-protocol 1.0.0 (paired with elfeed >= 4.0.0), the
 credentials go directly on =elfeed-feeds= — the older
@@ -210,17 +207,37 @@ deprecation warning, and =elfeed-feeds= ends up with the bare URL
 and no =:password=, so requests silently authenticate with an empty
 password and nothing ever lands in the db.
 
+This =:config= block runs synchronously the first time =elfeed= is
+loaded (i.e. the first =M-x elfeed= of the session), with no user
+keypress behind it the way =azos/caldav-sync= has. Fetching the
+password with =shell-command-to-string= there used to deadlock
+Emacs whenever the GPG PIN cache had expired: that call blocks
+Emacs's single thread on the =pass|gpg= subprocess, but
+=pinentry-emacs= (see the GPG Pinentry section above) needs Emacs's
+command loop running to answer its loopback prompt — so Emacs waits
+on gpg-agent while gpg-agent waits on Emacs. Fetching the password
+with =make-process= instead keeps the command loop alive, so
+=pinentry-emacs= can prompt normally; =elfeed-feeds= and
+=elfeed-protocol-enable= are only set once the process sentinel
+fires. Same stderr-redirect reasoning as before, to keep a stray
+gpg/pass warning off the captured password.
+
 #+begin_src emacs-lisp
 (use-package elfeed-protocol
   :after elfeed
   :config
-  (setq elfeed-feeds
-        `(("owncloud+https://aner@nextcloud.zakobar.com"
-           :password ,(string-trim
-                       (shell-command-to-string
-                        "pass zakobar.com 2>/dev/null | head -1")))))
   (setq elfeed-protocol-enabled-protocols '(owncloud))
-  (elfeed-protocol-enable))
+  (make-process
+   :name "elfeed-protocol-pass"
+   :command '("sh" "-c" "pass zakobar.com 2>/dev/null | head -1")
+   :noquery t
+   :filter (lambda (proc chunk)
+             (process-put proc 'output (concat (or (process-get proc 'output) "") chunk)))
+   :sentinel (lambda (proc _event)
+               (setq elfeed-feeds
+                     `(("owncloud+https://aner@nextcloud.zakobar.com"
+                        :password ,(string-trim (process-get proc 'output)))))
+               (elfeed-protocol-enable))))
 #+end_src
 
 ** Elfeed Full Article Fetch
@@ -440,11 +457,20 @@ With prefix ARG, prompt for a pattern then select from matches."
 
 ** Roam Backup
 
+=roam-backup= signs its commit with gpg, which can prompt for the YubiKey PIN
+via pinentry. =async-shell-command= spawns the process with =TERM=dumb= and
+no real controlling tty, so pinentry's curses fallback fails with
+\"Inappropriate ioctl for device\" whenever the PIN cache has expired. Run it
+in a =vterm= instead, which gives pinentry a real pty to prompt on.
+
 #+begin_src emacs-lisp
 (defun azos/roam/backup ()
   "Commit and push ~/roam to the remote git repo."
   (interactive)
-  (async-shell-command "roam-backup" "*roam-backup*"))
+  (let ((vterm-buffer-name "*roam-backup*"))
+    (with-current-buffer (vterm-other-window)
+      (vterm-send-string "roam-backup")
+      (vterm-send-return))))
 
 (define-key azos/roam-keymap (kbd "B") #'azos/roam/backup)
 #+end_src
diff --git a/shells/default.nix b/shells/default.nix
index 56a107d..cc38e4b 100755
--- a/shells/default.nix
+++ b/shells/default.nix
@@ -1,5 +1,3 @@
 {pkgs} @ args: {
-  #TODO since I do not pass along packages, this cannot work
-  # debugTex = import ./debugTex args;
   default = import ./defaultShell.nix args;
 }
diff --git a/shells/defaultShell.nix b/shells/defaultShell.nix
index 0529f3a..b79ae39 100644
--- a/shells/defaultShell.nix
+++ b/shells/defaultShell.nix
@@ -2,9 +2,10 @@
 pkgs.mkShell {
   buildInputs = with pkgs; [
     alejandra
+    nh
     (pkgs.writeShellScriptBin
       "azos-lauretta-update"
-      "sudo nixos-rebuild switch --flake '.?submodules=1#lauretta'")
+      "nh os switch '.?submodules=1#lauretta'")
     (pkgs.writeShellScriptBin
       "azos-update-azos-core"
       "nix flake update --flake '.?submodules=1' azos-core")