Problem: sudo
prompts can fail or corrupt input when there is no controlling TTY
(e.g., tools running in raw mode inside Codex CLI).
Solution: run privileged work via self-elevating pkexec
scripts so the desktop's
Polkit agent collects credentials via GUI—no /dev/tty
, no raw-mode surprises.