Address privileged cleanup review findings

migrations/1788025225.sh

@@ -2,6 +2,10 @@ echo "Remove privileged files left behind by retired Omarchy installers"
 
 sudoers_dir="${OMARCHY_SUDOERS_DIR:-/etc/sudoers.d}"
 systemd_dir="${OMARCHY_SYSTEMD_SYSTEM_DIR:-/etc/systemd/system}"
+machine_marker="${OMARCHY_RETIRED_INSTALLER_ARTIFACTS_MARKER:-/var/lib/omarchy/migrations/1788025225}"
+reload_needed_marker="$machine_marker.daemon-reload"
+
+[[ ! -e $machine_marker ]] || exit 0
 
 as_root() {
   if (( EUID == 0 )); then
@@ -226,9 +230,10 @@ plymouth_unit_runs_from_home() {
     done
 
     if [[ $word =~ $home_pattern || $word == "$HOME/.local/share/omarchy/bin/$binary" ]]; then
+      # Non-empty ExecStop= assignments append to the command list. Once a
+      # vulnerable command is present it stays live until an empty assignment
+      # explicitly resets the list; a later packaged command does not replace it.
       matched=0
-    else
-      matched=1
     fi
   done < <(active_lines systemd)
 
@@ -242,39 +247,82 @@ plymouth_unit_runs_from_home() {
 first_run_sudoers="$sudoers_dir/first-run"
 tsui_sudoers="$sudoers_dir/tsui"
 
-# Sudo cannot prompt without a terminal, and omarchy-migrate runs from places that
-# have none. Failing the elevation probe there is indistinguishable from finding
-# no files, and since bin/omarchy-migrate writes the completion marker on a zero
-# exit, a silent skip would mark this migration done forever. Exit non-zero
-# instead so the marker stays unwritten and the next run tries again.
-if [[ ! -r $sudoers_dir ]] && ! as_root true 2>/dev/null; then
-  echo "Cannot inspect $sudoers_dir without elevation; leaving it for the next run." >&2
-  exit 1
+defer_privileged_repair() {
+  echo "Cannot complete the privileged installer-artifact repair; omarchy-migrate will retry it later." >&2
+  exit 75
+}
+
+# This is a machine-wide repair with per-user migration markers. A root-owned,
+# readable marker lets later non-sudo users finish their own migration run after
+# one privileged account has inspected and repaired the machine. Until then,
+# exit 75 asks omarchy-migrate to leave this migration pending while continuing
+# with every later migration instead of wedging the whole queue.
+if ! as_root true 2>/dev/null; then
+  defer_privileged_repair
 fi
 
-# One combined probe, so the common case of neither file being present costs a
-# single elevated call rather than one per file.
-if as_root test -e "$first_run_sudoers" -o -e "$tsui_sudoers"; then
-  if as_root test -f "$first_run_sudoers" &&
-    as_root cat "$first_run_sudoers" | first_run_sudoers_is_generated; then
-    as_root rm -f "$first_run_sudoers"
+# Removing a unit and reloading systemd are one repair. Persist the second half
+# before removing the file so a failed daemon-reload cannot be forgotten on a
+# retry that now sees no unit on disk.
+if [[ -e $reload_needed_marker ]]; then
+  if ! as_root systemctl daemon-reload >/dev/null 2>&1; then
+    defer_privileged_repair
   fi
-
-  if as_root test -f "$tsui_sudoers" &&
-    as_root cat "$tsui_sudoers" | tsui_sudoers_is_generated; then
-    as_root rm -f "$tsui_sudoers"
+  if ! as_root rm -f "$reload_needed_marker"; then
+    defer_privileged_repair
   fi
 fi
 
+inspect_sudoers_file() {
+  local file="$1" predicate="$2" kind content
+
+  # Emit an explicit state from the elevated process. A bare `sudo test -f` in
+  # an if-condition makes "file missing" indistinguishable from "sudo failed",
+  # which could mark a live grant repaired without ever reading it.
+  if ! kind=$(as_root bash -c 'if [[ -f $1 ]]; then printf file; elif [[ -e $1 ]]; then printf other; else printf missing; fi' bash "$file"); then
+    defer_privileged_repair
+  fi
+
+  [[ $kind == "file" ]] || return 0
+  if ! content=$(as_root cat "$file"); then
+    defer_privileged_repair
+  fi
+
+  if "$predicate" <<<"$content"; then
+    if ! as_root rm -f "$file"; then
+      defer_privileged_repair
+    fi
+  fi
+}
+
+inspect_sudoers_file "$first_run_sudoers" first_run_sudoers_is_generated
+inspect_sudoers_file "$tsui_sudoers" tsui_sudoers_is_generated
+
 # /etc/systemd/system is 0755, so this one needs no elevation to look at.
 plymouth_unit="$systemd_dir/omarchy-plymouth-shutdown.service"
 if [[ -f $plymouth_unit ]] && plymouth_unit_runs_from_home <"$plymouth_unit"; then
   # Disable, never stop. Stopping the unit is precisely what runs ExecStop, and
   # ExecStop is the path this migration exists to keep root away from; disabling
   # only drops the multi-user.target symlink.
-  as_root systemctl disable omarchy-plymouth-shutdown.service >/dev/null 2>&1 || true
-  as_root rm -f "$plymouth_unit"
+  if ! as_root install -Dm644 /dev/null "$reload_needed_marker"; then
+    defer_privileged_repair
+  fi
+  if ! as_root systemctl disable omarchy-plymouth-shutdown.service >/dev/null 2>&1; then
+    defer_privileged_repair
+  fi
+  if ! as_root rm -f "$plymouth_unit"; then
+    defer_privileged_repair
+  fi
   # systemd keeps serving the copy it already loaded until it rereads the
   # directory, so without this the unit is still there to run at shutdown.
-  as_root systemctl daemon-reload >/dev/null 2>&1 || true
+  if ! as_root systemctl daemon-reload >/dev/null 2>&1; then
+    defer_privileged_repair
+  fi
+  if ! as_root rm -f "$reload_needed_marker"; then
+    defer_privileged_repair
+  fi
+fi
+
+if ! as_root install -Dm644 /dev/null "$machine_marker"; then
+  defer_privileged_repair
 fi