devshell: run multi-machine clan updates sequentially

Parallel updates interleave output and bury the YubiKey PIN prompts; a
clan wrapper in the dev shell loops one machine at a time instead.

flake.nix

@@ -59,13 +59,39 @@
 
       # Add the Clan cli tool to the dev shell.
       # Use "nix develop" to enter the dev shell.
-      devShells = forAllSystems (system: {
-        default = (pkgsFor system).mkShell {
-          packages = [
-            clan-core.packages.${system}.clan-cli
-            (treefmtFor system).config.build.wrapper
-          ];
-        };
-      });
+      devShells = forAllSystems (
+        system:
+        let
+          clanCli = clan-core.packages.${system}.clan-cli;
+          # `clan machines update a b c` normally runs machines in parallel,
+          # which interleaves their output and buries the YubiKey PIN prompts.
+          # This wrapper (first in PATH) runs them one at a time instead; any
+          # flags fall through to the real CLI untouched.
+          clanSequential = (pkgsFor system).writeShellScriptBin "clan" ''
+            if [ "$#" -gt 3 ] && [ "$1" = machines ] && [ "$2" = update ]; then
+              shift 2
+              for arg in "$@"; do
+                case "$arg" in
+                  -*) exec ${clanCli}/bin/clan machines update "$@" ;;
+                esac
+              done
+              for machine in "$@"; do
+                ${clanCli}/bin/clan machines update "$machine" || exit
+              done
+              exit 0
+            fi
+            exec ${clanCli}/bin/clan "$@"
+          '';
+        in
+        {
+          default = (pkgsFor system).mkShell {
+            packages = [
+              clanSequential
+              clanCli
+              (treefmtFor system).config.build.wrapper
+            ];
+          };
+        }
+      );
     };
 }