Install cleanup traps before the entry revocation and bound the bus probe

The protected entrypoints revoked the sudo timestamp before installing
their cleanup traps, so a signal or failure during that first sudo -k
exited without the cleanup path. Install the traps first.

The shell restart probed the notification bus name with busctl's
default 25 second timeout, so an unresponsive user bus could stall the
restart by that much per probe. Bound each probe to one second.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

bin/omarchy-channel-set

@@ -15,8 +15,10 @@ set -euo pipefail
 omarchy_security_sanitize_bash_environment "$0" "$@"
 omarchy_security_require_source_root "$0"
 user_path=$PATH
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 usage() { echo "Usage: omarchy-channel-set [stable|rc|edge|dev]"; }

bin/omarchy-refresh-pacman

@@ -18,8 +18,10 @@ omarchy_security_require_source_root "$0"
 # caller's original path over the same way the updater receives it.
 user_path=${OMARCHY_UPDATE_USER_PATH:-$PATH}
 unset OMARCHY_UPDATE_USER_PATH
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 channel="${1:-stable}"

bin/omarchy-restart-shell

@@ -61,8 +61,10 @@ relock_session() {
   return 1
 }
 
+# A short timeout keeps an unresponsive user bus from stalling the restart;
+# busctl would otherwise wait 25 seconds per probe.
 notifications_ready() {
-  [[ $(busctl --user call org.freedesktop.DBus /org/freedesktop/DBus \
+  [[ $(busctl --user --timeout=1s call org.freedesktop.DBus /org/freedesktop/DBus \
     org.freedesktop.DBus NameHasOwner s org.freedesktop.Notifications 2>/dev/null) == "b true" ]]
 }
 

bin/omarchy-update

@@ -20,8 +20,10 @@ omarchy_security_require_source_root "$0"
 # Preserve the caller's path only for the later unprivileged hook/mise phases.
 user_path=${OMARCHY_UPDATE_USER_PATH:-$PATH}
 unset OMARCHY_UPDATE_USER_PATH
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 update_stay_awake_stopped=0

bin/omarchy-update-stay-awake

@@ -15,8 +15,10 @@ omarchy_security_require_privileged_bash_startup || exit 126
 set -e
 omarchy_security_sanitize_bash_environment "$0" "$@"
 omarchy_security_require_source_root "$0"
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 state_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}/omarchy-update-stay-awake"