[codex] OM-SEC-19: Protect migration and SSH setup authorization

AGENTS.md

@@ -28,7 +28,7 @@ Three documentation trees, split by genre and audience:
 - Prefer `(( ))` over numeric operators inside `[[ ]]` (e.g., `(( count < 50 ))`, not `[[ $count -lt 50 ]]`)
 - Prefer a full `if`/`else` conditional for simple two-path control flow; don't rely on `exec` or `exit` in one branch to make following statements unreachable
 - For strings/paths with spaces, quote them instead of escaping spaces with `\ ` (e.g., `"$APP_DIR/Disk Usage.desktop"`, not `$APP_DIR/Disk\ Usage.desktop`)
-- Shebangs must use `#!/bin/bash` consistently (never `#!/usr/bin/env bash`)
+- Shebangs must use `#!/bin/bash` consistently (never `#!/usr/bin/env bash`). A security-sensitive entrypoint may use the exact `#!/bin/bash -p` form only when it must suppress `BASH_ENV` and exported-function startup injection before its first command; that exception must be explained at the boundary and covered by a regression that rejects an ordinary Bash launch with a decoy `-p` argument.
 - Scripts under `install/` and `migrations/` may be sourced and intentionally omit shebangs
 
 # Command Naming

bin/omarchy-channel-set

@@ -1,10 +1,23 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # omarchy:summary=Set the Omarchy package channel.
 # omarchy:args=<stable|rc|edge|dev>
 # omarchy:requires-sudo=true
 
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup for channel switching." >&2
+  exit 126
+fi
+security_entrypoint=$(/usr/bin/readlink -e -- "${BASH_SOURCE[0]}") || exit 126
+source "${security_entrypoint%/*}/omarchy-security-functions" || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
 set -euo pipefail
+omarchy_security_sanitize_bash_environment "$0" "$@"
+omarchy_security_require_source_root "$0"
+user_path=$PATH
+omarchy_security_revoke_sudo_timestamp || exit 1
+omarchy_security_install_sudo_cleanup_traps
+omarchy_security_enable_no_update_sudo
 
 usage() { echo "Usage: omarchy-channel-set [stable|rc|edge|dev]"; }
 fail() { echo "Error: $*" >&2; exit 1; }
@@ -33,9 +46,18 @@ validate_dev_checkout() {
 }
 
 link_dev_checkout() {
-  local checkout="$1"
+  local checkout="$1" required
   [[ -d $checkout/.git ]] || git clone https://github.com/basecamp/omarchy.git "$checkout"
 
+  # Check the destination before changing /etc/omarchy.conf or sudo's path.
+  # An existing checkout is not pulled automatically and may predate this policy.
+  for required in bin/omarchy-security-functions bin/omarchy-update bin/omarchy-refresh-pacman default/omarchy/sudo-no-update/sudo; do
+    if [[ ! -f $checkout/$required || ! -r $checkout/$required ||
+      ( $required != "bin/omarchy-security-functions" && ! -x $checkout/$required ) ]]; then
+      fail "Update the checkout before switching to dev; missing required update support in $required."
+    fi
+  done
+
   omarchy-dev-link "$checkout" --no-reboot
 }
 
@@ -79,21 +101,27 @@ fi
 if [[ -n $dev_checkout ]]; then
   link_dev_checkout "$dev_checkout"
   export OMARCHY_PATH="$dev_checkout"
-  export PATH="$OMARCHY_PATH/bin:$PATH"
+  omarchy_security_enable_no_update_sudo
   omarchy-state set reboot-required
 fi
 
-omarchy-refresh-pacman "$pacman_channel"
+omarchy-refresh-pacman "$pacman_channel" defer-hook
 # --ask 4 accepts omarchy <-> omarchy-dev replacement prompts without file overwrites.
 sudo env OMARCHY_UPDATE_PACMAN=1 pacman -S --needed --noconfirm --ask 4 "${packages[@]}"
 
 if [[ -z $dev_checkout ]]; then
   omarchy-dev-unlink --no-reboot
   export OMARCHY_PATH=/usr/share/omarchy
+  omarchy_security_enable_no_update_sudo
 
   if (( leaving_dev )); then
     omarchy-state set reboot-required
   fi
 fi
 
-omarchy-update -y
+OMARCHY_UPDATE_USER_PATH="$user_path" "$OMARCHY_PATH/bin/omarchy-update" -y
+
+# No channel-owned privileged work follows the historical refresh hook.
+omarchy_security_revoke_sudo_timestamp
+PATH="$OMARCHY_PATH/default/omarchy/sudo-no-update:$user_path" \
+  "$OMARCHY_PATH/bin/omarchy-refresh-pacman" "$pacman_channel" run-deferred

bin/omarchy-migrate

@@ -1,10 +1,29 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # omarchy:summary=Run pending Omarchy migrations.
 # omarchy:args=[--pending]
 
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup for Omarchy migrations." >&2
+  exit 126
+fi
+
+security_entrypoint=$(/usr/bin/readlink -e -- "${BASH_SOURCE[0]}") || exit 126
+source "${security_entrypoint%/*}/omarchy-security-functions" || exit 126
+
+if ! omarchy_security_require_privileged_bash_startup; then
+  echo "Refusing an unsafe Bash startup for Omarchy migrations." >&2
+  exit 126
+fi
+
 set -euo pipefail
 
+omarchy_security_sanitize_bash_environment "$0" "$@"
+omarchy_security_require_source_root "$0"
+
+PATH="$OMARCHY_PATH/bin:/usr/bin:/usr/sbin:/bin:/sbin"
+export PATH
+
 mode="run"
 
 usage() {
@@ -28,7 +47,6 @@ while (($#)); do
   esac
 done
 
-OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
 STATE_DIR="${OMARCHY_MIGRATION_STATE:-$HOME/.local/state/omarchy/migrations}"
 MIGRATIONS_DIR="$OMARCHY_PATH/migrations"
 
@@ -80,22 +98,36 @@ wait_for_pacman_transaction() {
   exit 0
 }
 
+# Revoke before waiting or touching state. Every exit, including failed and
+# interrupted migrations, must revoke again before returning to user code.
+omarchy_security_revoke_sudo_timestamp || exit 1
+omarchy_security_install_sudo_cleanup_traps
+omarchy_security_enable_no_update_sudo
+
 wait_for_pacman_transaction
 
 mkdir -p "$STATE_DIR"
 [[ -d $MIGRATIONS_DIR ]] || exit 0
 
+# Migrations are strictly ordered and may mix user-controlled code (mise,
+# themes, AUR builds) with later privileged repairs. Start cold and force every
+# migration sudo through -N so authentication authorizes only that command and
+# never creates a timestamp a detached earlier child can reuse.
+
 while IFS=$'\t' read -r name file marker <&3; do
   [[ -n $name ]] || continue
 
   if [[ ! -f $marker ]]; then
     echo -e "\e[32m\nRunning migration (${name%.sh})\e[0m"
-    OMARCHY_PATH="$OMARCHY_PATH" bash -euo pipefail "$file" 3<&-
+    OMARCHY_PATH="$OMARCHY_PATH" /usr/bin/bash -p -euo pipefail "$file" 3<&-
+    omarchy_security_revoke_sudo_timestamp || exit 1
     mkdir -p "$(dirname "$marker")"
     touch "$marker"
   fi
 done 3< <(migration_entries)
 
+omarchy_security_revoke_sudo_timestamp || exit 1
+
 # Clear a login-time notification the user left sitting there and then resolved
 # by running migrations some other way. The substring matches both the current
 # and legacy notification titles.