### Summary
Add a dedicated indicator to the Omarchy status bar panel (`omarchy.indicators` in `omarchy-shell`) that displays the active status of temporary passwordless sudo (`omarchy-sudo-passwordless`), shows remaining countdown time, and provides an immediate one-click revocation killswitch or enable trigger.

---

### Motivation & Problem Statement
Omarchy provides `omarchy-sudo-passwordless`, which grants temporary passwordless sudo access (default: 15 minutes, maximum: 24 hours). This feature is particularly valuable for developer automation and AI agent workflows (e.g. running non-interactive package operations or debugging sessions).

However, granting passwordless sudo carries significant security implications: **any process** running under the user's UID gains root access without interactive authentication until the grant expires.

Currently:
1. **Lack of Visual Awareness:** There is no persistent visual indicator on screen showing whether passwordless sudo is active. A user or developer might forget that passwordless sudo is enabled, leaving their system in an elevated, vulnerable state.
2. **No Glanceable Countdown:** There is no way to see remaining time without re-running the CLI command.
3. **No Quick Revocation:** To disable it early, the user must open a terminal and execute `omarchy-sudo-passwordless`.
4. **No Unprivileged Status Query:** Currently, `omarchy-sudo-passwordless` only accepts `[MINUTES]` and requires root privilege checks for internal inspection, making it difficult for user-level desktop shell widgets to safely query status.

---

### Proposed Solution

#### 1. New Bar Indicator (`PasswordlessSudo.qml`)
Integrate a new indicator into `shell/plugins/bar/indicators/` (alongside `StayAwake`, `NightLight`, `Dnd`, `ScreenRecording`, etc.):

- **Inactive State:**
  - Icon: Subtle / dim shield/lock icon (e.g., `󰌾` / `󰒃` / `󱅞` from Nerd Fonts).
  - Visibility: Hidden by default (consistent with Omarchy indicator behavior), revealed on bar hover or if `alwaysShow` is configured in `shell.json`.
  - Tooltip: `"Passwordless Sudo: Inactive"`
  - Left-Click Action: Launches the enable workflow (e.g., opens a terminal running `omarchy-sudo-passwordless` or prompts via `gum` / `omarchy-menu`).

- **Active State:**
  - Icon: Prominent warning/active icon (e.g., unlocked shield `󰌿` / warning shield `󰒃`) highlighted with theme accent / warning color (amber/yellow/red).
  - Visibility: Always visible while active in the center indicator strip (`omarchy.indicators`).
  - Tooltip: `"Passwordless Sudo: ACTIVE (Xm remaining) — Click to revoke immediately"`
  - Left-Click Action: Immediate killswitch — executes early revocation/disable, restoring normal sudo authentication instantly.

#### 2. CLI & Privilege Boundary Enhancements (`omarchy-sudo-passwordless`)
To support the indicator safely without running privileged commands inside the desktop shell UI:

1. **Unprivileged Status Command:**
   Add `omarchy-sudo-passwordless status [--json]` to report:
   ```json
   {
     "active": true,
     "remaining_seconds": 742,
     "deadline": "2026-10-07T08:25:00Z"
   }
   ```
2. **Session Runtime State File:**
   When `omarchy-sudo-passwordless __enable` succeeds, write a lightweight, unprivileged readable state file to `$XDG_RUNTIME_DIR/omarchy-sudo-passwordless.json` (or `/run/user/$UID/omarchy-sudo-passwordless.json`), and remove it upon expiration or `__disable`.
   - *Benefit:* Allows `omarchy-shell` / Quickshell to read status instantaneously or via file watch without running child subprocesses or polling with sudo.
3. **Explicit Revoke Command:**
   Add `omarchy-sudo-passwordless disable` (or `revoke`) as a clean non-interactive CLI target.

---

### Technical Design Outline

```
+-------------------------------------------------------------+
|                        omarchy-shell                        |
|                                                             |
|   [ omarchy.indicators ]                                    |
|   └── PasswordlessSudo.qml (BarIndicator)                   |
|       ├── State: Active (󰌿 12m) / Inactive                 |
|       ├── Watcher: /run/user/$UID/sudo-passwordless.json    |
|       └── Click: omarchy-sudo-passwordless disable / launch |
+------------------------------+------------------------------+
                               │
                               ▼
+-------------------------------------------------------------+
|                 omarchy-sudo-passwordless                   |
|                                                             |
|   ├── Writes /etc/sudoers.d/99-omarchy-nopasswd-<UID>       |
|   ├── Arms systemd-run timer for auto-expiration            |
|   └── Publishes unprivileged runtime status file            |
+-------------------------------------------------------------+
```

#### Proposed File Changes:
- `bin/omarchy-sudo-passwordless`: Add `status` and `disable` subcommands; manage the unprivileged runtime state file in `$XDG_RUNTIME_DIR`.
- `shell/plugins/bar/indicators/PasswordlessSudo.qml`: Implement `BarIndicator` subclass following existing patterns (`StayAwake.qml`, `ScreenRecording.qml`).
- `shell/plugins/bar/widgets/Indicators.qml`: Register `"PasswordlessSudo"` in `defaultIndicatorEntries`.

---

### Security Considerations
- **Privilege Separation:** The shell process (`omarchy-shell` / Quickshell) runs as the unprivileged user. It should never invoke elevated privileges simply to inspect state.
- **Fail-safe:** If the runtime status file is missing or desynchronized, the indicator fails closed (showing inactive).
- **Killswitch Priority:** Revoking should not require answering interactive prompts—clicking the active indicator should cleanly and immediately tear down the temporary sudoers rule.

---

*This proposal was made with agy cli.*