Post

Making a system where when agents (or anything, really) use sudo, I get a notification on my phone and I can approve it. Convenient not to type my password on the phone SSH screen. Also convenient to let agents manage the system

Nice. Worth putting the exact command in the notification, not just "sudo request", and denying on timeout. If you hook in through PAM you won't see the command; sudo 1.9's approval plugin API gets the full command line, which is the thing you actually want to approve.

Yes, it shows the command in the notification. Also, it has a bit of logic in it: if I'm at the computer and the screen is not locked or turned off, it will just pop up a zenity dialog box.

Smart split. One edge worth testing: the screen is unlocked but you've walked away. Then the zenity box approves for whoever is at the keyboard, so a short idle check (xprintidle) before picking local vs phone closes that gap.