Refuse hook and state names that are paths

omarchy-hook and omarchy-state set join a name straight into a path. A name
with a slash, or a bare . or .., points outside the hooks or state directory.
Every caller in the repo passes a fixed label, so this is a footgun guard for
future callers, not a fix for anything that ships today.

Names with dots in the middle (a..b) stay allowed. omarchy-state clear is
untouched: find -name matches basenames only.

bin/omarchy-hook

@@ -11,6 +11,18 @@ if (( $# < 1 )); then
 fi
 
 HOOK=$1
+
+# Hook names are fixed labels chosen by Omarchy code (post-update, theme-set,
+# font-set). The name becomes a filename under the hooks directory. A slash
+# would turn it into directory levels, and a bare `.` or `..` would point bash
+# at the directory itself or its parent. Refuse those rather than follow them.
+# Dots inside a name (a..b) are fine; once slashes are out, only the whole
+# name being `.` or `..` can leave the directory.
+if [[ -z $HOOK || $HOOK == */* || $HOOK == "." || $HOOK == ".." ]]; then
+  echo "Invalid hook name: $HOOK" >&2
+  exit 2
+fi
+
 HOOK_PATH="$HOME/.config/omarchy/hooks/$1"
 HOOK_DIR="$HOOK_PATH.d"
 shift

bin/omarchy-state

@@ -21,6 +21,19 @@ if [[ -z $STATE_NAME ]]; then
 fi
 
 case "$COMMAND" in
-set) touch "$STATE_DIR/$STATE_NAME" ;;
+set)
+  # State names are fixed labels (reboot-required, restart-*-required). The
+  # name becomes a filename under the state directory. A slash would turn it
+  # into directory levels, and a bare `.` or `..` would touch the directory
+  # itself or its parent. Refuse those. Dots inside a name (a..b) are fine;
+  # once slashes are out, only the whole name being `.` or `..` can leave the
+  # directory. clear needs no such guard: find -name matches basenames only,
+  # so a pattern can never walk out of the directory.
+  if [[ $STATE_NAME == */* || $STATE_NAME == "." || $STATE_NAME == ".." ]]; then
+    echo "Invalid state name: $STATE_NAME" >&2
+    exit 2
+  fi
+  touch "$STATE_DIR/$STATE_NAME"
+  ;;
 clear) find "$STATE_DIR" -maxdepth 1 -type f -name "$STATE_NAME" -delete ;;
 esac