Merge pull request #9467 from AFOliveira/codex/om-sec-12-update-inhibitor-identity

[codex] OM-SEC-12: Bind update inhibitor cleanup to process identity

Reported-by: Afonso "AFOliveira" Oliveira

default/agents/skills/omarchy/hooks.md

@@ -14,8 +14,8 @@ file first, if one exists.
 ├── battery-low.d/          # Low battery (percentage in $1)
 ├── font-set.d/             # After font change (font name in $1)
 ├── post-boot.d/            # After the desktop starts
-├── post-update.d/          # During `omarchy update`, after system packages and migrations
-├── pre-refresh-pacman.d/   # Before `omarchy refresh pacman` re-syncs packages
+├── post-update.d/          # At the end of `omarchy update`, after privileged work
+├── pre-refresh-pacman.d/   # After `omarchy refresh pacman` re-syncs the package config, before it updates packages
 └── theme-set.d/            # After theme change (theme slug in $1)
 ```
 
@@ -26,3 +26,5 @@ THEME_NAME=$1
 echo "Theme changed to: $THEME_NAME"
 # Add custom actions here
 ```
+
+Update-related hooks run as your user after Omarchy invalidates its sudo timestamp, behind the no-update wrapper. A hook that invokes `sudo` must therefore request its own explicit authorization, and Omarchy revokes the timestamp again before continuing. `post-update` runs after every sudo-capable update stage. `pre-refresh-pacman` runs after `omarchy refresh pacman` re-syncs the package config and before the package transaction, so custom repositories and `IgnorePkg` entries shape that transaction; every later privileged command still authenticates without publishing a reusable timestamp, so a detached child left behind by the hook has nothing to wait for.

default/libalpm/hooks/05-omarchy-passwordless-revoke.hook

@@ -0,0 +1,12 @@
+[Trigger]
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = omarchy-settings
+Target = omarchy-settings-dev
+
+[Action]
+Description = Revoking temporary Omarchy sudo grants before settings changes...
+When = PreTransaction
+Exec = /usr/bin/omarchy-sudo-passwordless __package-removing
+AbortOnFail

default/omarchy/sudo-no-update/sudo

@@ -0,0 +1,20 @@
+#!/bin/bash -p
+
+# Preserve sudo options while preventing authentication from refreshing the
+# credential cache. Timestamp maintenance and informational modes stand alone.
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup for the sudo boundary." >&2
+  exit 126
+fi
+security_entrypoint=$(/usr/bin/readlink -e -- "${BASH_SOURCE[0]}") || exit 126
+source "${security_entrypoint%/*}/../../../bin/omarchy-security-functions" || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
+
+if (( $# == 1 )); then
+  case "$1" in
+    -k|--reset-timestamp|-K|--remove-timestamp|-h|--help|-V|--version)
+      exec /usr/bin/sudo "$@"
+      ;;
+  esac
+fi
+exec /usr/bin/sudo -N "$@"