Yay fixes and stuff

features/lauretta/emacs/config.org

@@ -198,10 +198,7 @@ it syncs elfeed's feed list and read/unread state with the Nextcloud
 News app instead of just reading a local feed list one-way.
 
 Reuses the same =zakobar.com= pass entry as the CalDAV sync above,
-since it's the same Nextcloud account. =shell-command-to-string=
+since it's the same Nextcloud account.
-merges stderr into its return value, so stderr is redirected away to
-keep a stray gpg/pass warning from getting concatenated onto the
-password.
 
 As of elfeed-protocol 1.0.0 (paired with elfeed >= 4.0.0), the
 credentials go directly on =elfeed-feeds= — the older
@@ -210,17 +207,37 @@ deprecation warning, and =elfeed-feeds= ends up with the bare URL
 and no =:password=, so requests silently authenticate with an empty
 password and nothing ever lands in the db.
 
+This =:config= block runs synchronously the first time =elfeed= is
+loaded (i.e. the first =M-x elfeed= of the session), with no user
+keypress behind it the way =azos/caldav-sync= has. Fetching the
+password with =shell-command-to-string= there used to deadlock
+Emacs whenever the GPG PIN cache had expired: that call blocks
+Emacs's single thread on the =pass|gpg= subprocess, but
+=pinentry-emacs= (see the GPG Pinentry section above) needs Emacs's
+command loop running to answer its loopback prompt — so Emacs waits
+on gpg-agent while gpg-agent waits on Emacs. Fetching the password
+with =make-process= instead keeps the command loop alive, so
+=pinentry-emacs= can prompt normally; =elfeed-feeds= and
+=elfeed-protocol-enable= are only set once the process sentinel
+fires. Same stderr-redirect reasoning as before, to keep a stray
+gpg/pass warning off the captured password.
+
 #+begin_src emacs-lisp
 (use-package elfeed-protocol
   :after elfeed
   :config
+  (setq elfeed-protocol-enabled-protocols '(owncloud))
+  (make-process
+   :name "elfeed-protocol-pass"
+   :command '("sh" "-c" "pass zakobar.com 2>/dev/null | head -1")
+   :noquery t
+   :filter (lambda (proc chunk)
+             (process-put proc 'output (concat (or (process-get proc 'output) "") chunk)))
+   :sentinel (lambda (proc _event)
                (setq elfeed-feeds
                      `(("owncloud+https://aner@nextcloud.zakobar.com"
-           :password ,(string-trim
+                        :password ,(string-trim (process-get proc 'output)))))
-                       (shell-command-to-string
+               (elfeed-protocol-enable))))
-                        "pass zakobar.com 2>/dev/null | head -1")))))
-  (setq elfeed-protocol-enabled-protocols '(owncloud))
-  (elfeed-protocol-enable))
 #+end_src
 
 ** Elfeed Full Article Fetch
@@ -440,11 +457,20 @@ With prefix ARG, prompt for a pattern then select from matches."
 
 ** Roam Backup
 
+=roam-backup= signs its commit with gpg, which can prompt for the YubiKey PIN
+via pinentry. =async-shell-command= spawns the process with =TERM=dumb= and
+no real controlling tty, so pinentry's curses fallback fails with
+\"Inappropriate ioctl for device\" whenever the PIN cache has expired. Run it
+in a =vterm= instead, which gives pinentry a real pty to prompt on.
+
 #+begin_src emacs-lisp
 (defun azos/roam/backup ()
   "Commit and push ~/roam to the remote git repo."
   (interactive)
-  (async-shell-command "roam-backup" "*roam-backup*"))
+  (let ((vterm-buffer-name "*roam-backup*"))
+    (with-current-buffer (vterm-other-window)
+      (vterm-send-string "roam-backup")
+      (vterm-send-return))))
 
 (define-key azos/roam-keymap (kbd "B") #'azos/roam/backup)
 #+end_src

shells/default.nix

@@ -1,5 +1,3 @@
 {pkgs} @ args: {
-  #TODO since I do not pass along packages, this cannot work
-  # debugTex = import ./debugTex args;
   default = import ./defaultShell.nix args;
 }

shells/defaultShell.nix

@@ -2,9 +2,10 @@
 pkgs.mkShell {
   buildInputs = with pkgs; [
     alejandra
+    nh
     (pkgs.writeShellScriptBin
       "azos-lauretta-update"
-      "sudo nixos-rebuild switch --flake '.?submodules=1#lauretta'")
+      "nh os switch '.?submodules=1#lauretta'")
     (pkgs.writeShellScriptBin
       "azos-update-azos-core"
       "nix flake update --flake '.?submodules=1' azos-core")