Bell not working with fingerprint

[MrSom3body]

Describe the bug
I'm trying to use the bell flag to automatically play a sound when authentication is required. However, it doesn't work as expected with fingerprint authentication. The sound only plays after three failed fingerprint attempts, when the system falls back to asking for the password.

To Reproduce
Steps to reproduce the behavior:

1. Run sudo -B echo hey
2. Bug occurs

Expected behavior
It should play a bell if sudo asks for a fingerprint too.

Environment (please complete the following information):

• Linux distribution: NixOS 25.11 (Xantusia)
• sudo-rs commit hash: 17ead4e

[bjorn3]

We currently only emit a bell for PAM_PROMPT_ECHO_OFF which is what is used for asking for a password. Should be fine to do the same for PAM_PROMPT_ECHO_ON (which matches og-sudo). That would amount to copying

sudo-rs/src/pam/converse.rs

Lines 128 to 130 in 2f78c34

	if self.bell && !self.use_stdin {
	tty.bell()?;
	}

to right after

sudo-rs/src/pam/converse.rs

Line 121 in 2f78c34

let mut tty = self.open()?;

Edit: Actually that PAM module probably doesn't even use PAM_PROMPT_ECHO_ON (which makes you type in something), but rather PAM_TEXT_INFO. Having a bell on every PAM_TEXT_INFO is not what og sudo does either. And it can be annoying with eg pam_pkcs11 which emits several of those after you enter your pin to indicate how far along the verification process is.

[squell]

To see if a fix is possible we should also probably have a bit more info such as what the PAM module is that provides the fingerprint and what kind of prompts it actually sends. (The first bit of info can be gleaned from /etc/pam.d/common-auth, I presume).

[MrSom3body]

The PAM module I'm using is the one provided by fprintd

[squell]

One idea might me to ring a bell the first time PAM shows something to the user (instead of at the prompt), and then set a flag to not ring that bell again for the current session. I.e. a kind of debounce.