Persist USB boot policy in Limine snapshot manifests

bin/omarchy-usb-authorization-boot

@@ -338,6 +338,75 @@ usb_authorization_rewrite_boot_cmdlines() {
   rm -f "$backup"
 }
 
+usb_authorization_rewrite_snapshot_manifest() {
+  local expected="$1" manifest="$2" temporary
+
+  [[ -e $manifest ]] || return 0
+  temporary=$(mktemp "${manifest}.omarchy-usb.XXXXXXXXXX")
+  if ! cp --preserve=mode,ownership "$manifest" "$temporary"; then
+    rm -f "$temporary"
+    return 1
+  fi
+
+  # Limine uses the cached lines when present, and structured command lines
+  # otherwise. Update both, including nested kernels and restore entries.
+  if ! jq --arg expected "$expected" --arg parameter "$kernel_parameter" '
+    def cmdline:
+      if type != "string" then error("Invalid snapshot command line") else
+        [splits("[[:space:]]+") | select(length > 0 and . != $parameter)]
+        | if $expected == "enabled" then . + [$parameter] else . end
+        | join(" ")
+      end;
+    def lines:
+      map(if test("^\\s*(cmdline|kernel_cmdline):"; "i") then
+        capture("^(?<prefix>\\s*(?:cmdline|kernel_cmdline):\\s*)(?<value>.*)$"; "i")
+        | .prefix + (.value | cmdline)
+      else . end);
+    def kernel:
+      .cmdlineDetails |= map(.cmdline |= cmdline | .snapshotCmdline |= cmdline)
+      | .allInConfig |= lines
+      | .allInSnapshotConfig |= lines
+      | .subKernels |= map(kernel);
+    if .jsonFormatVersion != "1.3.0" or (.snapshotEntries | type) != "array" then
+      error("Unsupported Limine snapshot manifest format")
+    else
+      .snapshotEntries |= map(.kernelEntries |= map(kernel))
+    end
+  ' "$manifest" >"$temporary"; then
+    rm -f "$temporary"
+    echo "Cannot update stored USB boot policy in $manifest." >&2
+    return 1
+  fi
+
+  mv -f "$temporary" "$manifest"
+}
+
+usb_authorization_sync_and_verify() (
+  local expected="$1" config="$2" esp="$3"
+  local machine_id="${4:-$(</etc/machine-id)}" manifest
+
+  # Share Limine's lock so a concurrent watcher cannot restore an old manifest
+  # while we update it. The sync wrapper must not reacquire our lock.
+  exec 9>/run/lock/boot-partition.lock
+  flock --timeout 30 9 || return 1
+
+  # Recover/upgrade the manifest first, including backups if necessary.
+  limine-snapper-sync --no-mutex --no-hooks || return 1
+  for manifest in \
+    "$esp/$machine_id/limine_history/snapshots.json" \
+    "$esp/$machine_id/limine_history/snapshots.json.old" \
+    "/var/cache/boot/$machine_id/lss/snapshots.json"; do
+    usb_authorization_rewrite_snapshot_manifest "$expected" "$manifest" || return 1
+  done
+
+  usb_authorization_rewrite_boot_cmdlines "$expected" "$config" "$machine_id" || return 1
+  # Verify the regenerated menu, so synchronization cannot mask stale stored
+  # command lines with a one-time edit to limine.conf.
+  limine-snapper-sync --no-mutex --no-hooks || return 1
+  limine-enroll-config || return 1
+  usb_authorization_verify_boot_entries "$expected" "$config" "$esp" "$machine_id"
+)
+
 main() {
   local had_drop_in=0 had_snapshot_setting=0 snapshot_status temporary
 
@@ -377,8 +446,7 @@ main() {
   fi
 
   if ! limine-mkinitcpio ||
-    ! usb_authorization_rewrite_boot_cmdlines enabled "$limine_conf" ||
-    ! usb_authorization_verify_boot_entries enabled "$limine_conf" "$boot_path"; then
+    ! usb_authorization_sync_and_verify enabled "$limine_conf" "$boot_path"; then
     echo "Boot-time USB authorization remains configured in $drop_in; rerun this command after fixing the boot-image error." >&2
     exit 1
   fi
@@ -401,14 +469,11 @@ main() {
     fi
     had_drop_in=1
     rm -f "$drop_in"
-  elif (( ! had_snapshot_setting )) && usb_authorization_verify_boot_entries disabled "$limine_conf" "$boot_path"; then
-    exit 0
   fi
 
   usb_authorization_disable_snapshot_setting "$limine_defaults"
   if ! limine-mkinitcpio ||
-    ! usb_authorization_rewrite_boot_cmdlines disabled "$limine_conf" ||
-    ! usb_authorization_verify_boot_entries disabled "$limine_conf" "$boot_path"; then
+    ! usb_authorization_sync_and_verify disabled "$limine_conf" "$boot_path"; then
     if (( had_drop_in )); then
       printf '%s\n' "$setting" >"$drop_in"
       chmod 644 "$drop_in"