sudolisted

# Desktop-authenticated privilege ## Goal Run an explicitly authorized Linux command with elevated privileges while keeping authentication in the user's desktop session. ## Input - the exact command, arguments, and target paths; - an active desktop session with an available XDG Desktop Portal broker and registered polkit authentication agent; - the `pkexec` privilege helper. ## Output Return the command's exit status and observable result. Never return, store, or log a password, token, or authentication response. ## Workflow 1. Resolve the requested executable and arguments. Separate compound shell syntax, review the target, and reduce the operation to the least privilege needed. 2. Treat `sudo` as a request for elevated privilege, not permission to collect credentials. State the exact command and expected effect before a state-changing operation. 3. Run this skill's read-only `scripts/probe.py --json` helper. It checks `pkexec`, desktop display state, and the common XDG Desktop Portal broker without requesting elevation or collecting credentials. If the probe is not ready, stop. The probe intentionally does not claim it can generically prove a registered polkit agent. 4. When the operation is not already exposed by a polkit-aware service, invoke the resolved `pkexec` with `--disable-internal-agent` and the exact executable plus arguments. This requires the session's graphical polkit agent and prevents a textual password fallback. 5. If the user specifically requires