Revoke before session cleanup and protect standalone inhibition

bin/omarchy-update

@@ -23,6 +23,10 @@ update_stay_awake_stopped=0
 cleanup_update() {
   local status=$?
   trap - EXIT HUP INT TERM
+  if ! omarchy_security_revoke_sudo_timestamp; then
+    echo "Could not invalidate sudo before update cleanup." >&2
+    omarchy_security_exit_with_revoked_sudo 1
+  fi
   if (( update_stay_awake_stopped == 0 )); then
     omarchy-update-stay-awake stop || status=1
   fi
@@ -88,6 +92,7 @@ if [[ ${1:-} == "-y" ]] || omarchy-update-confirm; then
   # Release update-owned inhibitors before offering a reboot. A confirmed
   # reboot can terminate this process before its EXIT trap gets a chance to
   # remove the persistent Stay Awake marker.
+  omarchy_security_revoke_sudo_timestamp
   omarchy-update-stay-awake stop
   update_stay_awake_stopped=1
 

bin/omarchy-update-stay-awake

@@ -1,10 +1,21 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # omarchy:summary=Manage sleep and idle inhibition during an update
 # omarchy:args=<start|stop>
 # omarchy:hidden=true
 
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup." >&2
+  exit 126
+fi
+
+source "${BASH_SOURCE[0]%/*}/omarchy-security-functions" || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
 set -e
+omarchy_security_sanitize_bash_environment "$0" "$@"
+omarchy_security_revoke_sudo_timestamp || exit 1
+omarchy_security_install_sudo_cleanup_traps
+omarchy_security_enable_no_update_sudo
 
 state_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}/omarchy-update-stay-awake"
 idle_owner_file="$state_dir/idle-owner"
@@ -106,7 +117,7 @@ start() {
     ( [[ -z ${OMARCHY_UPDATE_LOCK_FD:-} ]] || exec {OMARCHY_UPDATE_LOCK_FD}>&-
       exec "${hold_command[@]}" ) &
   elif [[ -t 0 ]]; then
-    sudo -N -b -- "${hold_command[@]}"
+    /usr/bin/sudo -N -b -- "${hold_command[@]}"
   else
     ( [[ -z ${OMARCHY_UPDATE_LOCK_FD:-} ]] || exec {OMARCHY_UPDATE_LOCK_FD}>&-
       exec pkexec "${hold_command[@]}" ) &