Merge pull request #10217 from omacom/security/ocaml-removal-no-update

Isolate OCaml cleanup authorization

bin/omarchy-remove-dev-env

@@ -9,6 +9,35 @@ if [[ -z $1 ]]; then
   exit 1
 fi
 
+cleanup_ocaml_sudo_credentials() {
+  local status=$?
+  trap - EXIT HUP INT TERM
+
+  if ! /usr/bin/sudo -k >/dev/null 2>&1; then
+    echo "Failed to invalidate sudo credentials after OCaml removal." >&2
+    (( status != 0 )) || status=1
+  fi
+
+  exit "$status"
+}
+
+begin_ocaml_sudo_boundary() {
+  trap cleanup_ocaml_sudo_credentials EXIT
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+
+  /usr/bin/sudo -k >/dev/null || {
+    echo "Unable to start OCaml removal with a cold sudo credential state." >&2
+    exit 1
+  }
+
+  if ! /usr/bin/sudo -N -V >/dev/null 2>&1; then
+    echo "This sudo does not support --no-update; refusing to remove OCaml." >&2
+    exit 1
+  fi
+}
+
 remove_php() {
   mise uninstall php --all
   mise rm -g php
@@ -94,10 +123,15 @@ dotnet)
   mise rm -g dotnet
   ;;
 ocaml)
+  begin_ocaml_sudo_boundary
+
   echo -e "Removing OCaml...\n"
   opam switch remove default -y 2>/dev/null || true
   rm -rf ~/.opam 2>/dev/null || true
-  sudo rm -f /usr/local/bin/opam 2>/dev/null || true
+  if ! /usr/bin/sudo -N -- /usr/bin/rm -f /usr/local/bin/opam; then
+    echo "Failed to remove the system opam launcher." >&2
+    exit 1
+  fi
   ;;
 clojure)
   echo -e "Removing Clojure...\n"