Limits: Handling PAM_NEW_AUTHTOK_REQD in zsh/pam
Goal In a zsh script that authenticates users via the zsh/pam module, the script must detect when the user’s password has expired and prompt for a new one, all while keeping the least-privilege model intact. Constraints & Uncertainty The module exposes the return code PAM_NEW_AUTHTOK_REQD but does not provide a built‑in UI for the password‑change convers