From 0add43f9b70f54b26de0b87846d219b1cdb14e68 Mon Sep 17 00:00:00 2001
From: Afonso Oliveira <afonso.oliveira707@gmail.com>
Date: Mon, 7 Sep 2026 17:38:36 +0100
Subject: [PATCH] Check dev update support before changing the system

---
 bin/omarchy-channel-set                    | 11 ++++++++++-
 test/shell.d/channel-sudo-boundary-test.sh | 12 ++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/bin/omarchy-channel-set b/bin/omarchy-channel-set
index f1f05063..cf8e515f 100755
--- a/bin/omarchy-channel-set
+++ b/bin/omarchy-channel-set
@@ -46,9 +46,18 @@ validate_dev_checkout() {
 }
 
 link_dev_checkout() {
-  local checkout="$1"
+  local checkout="$1" required
   [[ -d $checkout/.git ]] || git clone https://github.com/basecamp/omarchy.git "$checkout"
 
+  # Check the destination before changing /etc/omarchy.conf or sudo's path.
+  # An existing checkout is not pulled automatically and may predate this policy.
+  for required in bin/omarchy-security-functions bin/omarchy-update bin/omarchy-refresh-pacman default/omarchy/sudo-no-update/sudo; do
+    if [[ ! -f $checkout/$required || ! -r $checkout/$required ||
+      ( $required != "bin/omarchy-security-functions" && ! -x $checkout/$required ) ]]; then
+      fail "Update the checkout before switching to dev; missing required update support in $required."
+    fi
+  done
+
   omarchy-dev-link "$checkout" --no-reboot
 }
 
diff --git a/test/shell.d/channel-sudo-boundary-test.sh b/test/shell.d/channel-sudo-boundary-test.sh
index a2aba440..b7fabf02 100755
--- a/test/shell.d/channel-sudo-boundary-test.sh
+++ b/test/shell.d/channel-sudo-boundary-test.sh
@@ -62,6 +62,18 @@ for channel in stable rc edge dev; do
   pass "$channel starts cold, authorizes only individual commands, defers hooks and exits cold"
 done
 
+reset_boundary
+wrapper="$SUDO_TEST_HOME/omarchy/default/omarchy/sudo-no-update/sudo"
+mv "$wrapper" "$boundary_tmp/saved-wrapper"
+if run_channel dev; then fail "an old checkout without the wrapper was accepted"; fi
+if grep -Eq '^step:omarchy-(dev-link|state)|^sudo -N ' "$SUDO_TEST_LOG"; then
+  fail "an incompatible dev checkout changed the system before rejection"
+fi
+grep -q 'Update the checkout before switching to dev' "$boundary_tmp/output" || fail "stale checkout rejection lacks recovery guidance"
+assert_boundary_cold "stale checkout"
+mv "$boundary_tmp/saved-wrapper" "$wrapper"
+pass "a stale dev checkout is rejected before linking or privileged work"
+
 reset_boundary
 OMARCHY_PATH="$SUDO_TEST_HOME/omarchy" run_channel stable || fail "leaving dev failed" "$(<"$boundary_tmp/output")"
 assert_scoped_channel "dev to stable"