Bind protected update commands to their source root

bin/omarchy-refresh-pacman

@@ -12,6 +12,7 @@ source "${BASH_SOURCE[0]%/*}/omarchy-security-functions" || exit 126
 omarchy_security_require_privileged_bash_startup || exit 126
 set -e
 omarchy_security_sanitize_bash_environment "$0" "$@"
+omarchy_security_require_source_root "$0"
 user_path=$PATH
 omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_install_sudo_cleanup_traps

bin/omarchy-security-functions

@@ -44,6 +44,20 @@ omarchy_security_sanitize_bash_environment() {
   fi
 }
 
+omarchy_security_require_source_root() {
+  local command_source command_name=${1##*/}
+  command_source=$(/usr/bin/readlink -e -- "$1") || return 1
+
+  # A runtime root selects the code used by this invocation. Accept the
+  # canonical checkout containing the entrypoint or the package's bin links.
+  if [[ $OMARCHY_PATH != /* || $(/usr/bin/realpath -e -- "$OMARCHY_PATH") != "$OMARCHY_PATH" ]] ||
+    ! { [[ $command_source == "$OMARCHY_PATH/bin/$command_name" ]] ||
+      [[ $OMARCHY_PATH == "/usr/share/omarchy" && $command_source == "/usr/bin/$command_name" ]]; }; then
+    echo "OMARCHY_PATH does not match this Omarchy command." >&2
+    return 1
+  fi
+}
+
 omarchy_security_sudo_supports_no_update() {
   local help
   help=$(LC_ALL=C /usr/bin/sudo -h 2>&1) || return 1

bin/omarchy-update

@@ -14,6 +14,7 @@ source "${BASH_SOURCE[0]%/*}/omarchy-security-functions" || exit 126
 omarchy_security_require_privileged_bash_startup || exit 126
 set -e
 omarchy_security_sanitize_bash_environment "$0" "$@"
+omarchy_security_require_source_root "$0"
 # Logging and lock acquisition re-exec this command with a sanitized PATH.
 # Preserve the caller's path only for the later unprivileged hook/mise phases.
 user_path=${OMARCHY_UPDATE_USER_PATH:-$PATH}

bin/omarchy-update-stay-awake

@@ -13,6 +13,7 @@ source "${BASH_SOURCE[0]%/*}/omarchy-security-functions" || exit 126
 omarchy_security_require_privileged_bash_startup || exit 126
 set -e
 omarchy_security_sanitize_bash_environment "$0" "$@"
+omarchy_security_require_source_root "$0"
 omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_install_sudo_cleanup_traps
 omarchy_security_enable_no_update_sudo