From 5925929cb6c72a8fe4de3ac297179a0020cdbcfa Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Fri, 28 Aug 2026 19:00:03 -0400
Subject: [PATCH 1/2] Stop the browser policy EXIT trap from reporting a clean
 run as failed

---
 bin/omarchy-theme-set-browser-policy    |  7 ++++++-
 test/shell.d/browser-policy-dir-test.sh | 15 +++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/bin/omarchy-theme-set-browser-policy b/bin/omarchy-theme-set-browser-policy
index 6f628f9b..ccd07722 100755
--- a/bin/omarchy-theme-set-browser-policy
+++ b/bin/omarchy-theme-set-browser-policy
@@ -76,8 +76,13 @@ require_root "$color"
 
 failed=0
 staged=""
+# Bash 5.3 makes the EXIT trap's last command decide the script's exit status,
+# so this handler must not end on a false test. Every successful run clears
+# staged, and a trailing `[[ -n $staged ]] && ...` would report that as failure.
 cleanup() {
-  [[ -n $staged ]] && rm -f "$staged"
+  if [[ -n $staged ]]; then
+    rm -f "$staged"
+  fi
 }
 trap cleanup EXIT
 
diff --git a/test/shell.d/browser-policy-dir-test.sh b/test/shell.d/browser-policy-dir-test.sh
index 20b8067c..39a87c2b 100755
--- a/test/shell.d/browser-policy-dir-test.sh
+++ b/test/shell.d/browser-policy-dir-test.sh
@@ -279,6 +279,21 @@ grep -F 'exit "$failed"' "$ROOT/bin/omarchy-theme-set-browser" >/dev/null ||
   fail "omarchy-theme-set-browser exits non-zero when a policy write fails"
 pass "omarchy-theme-set-browser exits non-zero when a policy write fails"
 
+# Bash 5.3 adopts the EXIT trap's last status as the script's exit status, so a
+# handler ending on a false test turns a clean run into a failure and aborts the
+# migration that calls this through omarchy-theme-set-browser.
+policy_cleanup=$(sed -n '/^cleanup() {/,/^}/p' "$ROOT/bin/omarchy-theme-set-browser-policy")
+[[ -n $policy_cleanup ]] || fail "omarchy-theme-set-browser-policy defines an EXIT cleanup handler"
+eval "$policy_cleanup"
+staged=""
+cleanup || fail "omarchy-theme-set-browser-policy's EXIT trap succeeds with nothing staged"
+staged=$test_tmp/staged-policy
+: >"$staged"
+cleanup || fail "omarchy-theme-set-browser-policy's EXIT trap succeeds with a staged file"
+[[ ! -e $staged ]] || fail "omarchy-theme-set-browser-policy's EXIT trap removes the staged file"
+unset -f cleanup
+pass "omarchy-theme-set-browser-policy's EXIT trap never leaks a failure status"
+
 policy_files=(
   "$ROOT/bin/omarchy-install-browser"
   "$ROOT/bin/omarchy-provision-owner"

From 6b10dbf1910f77deb3ac1082adc6e55101efe1cc Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Fri, 28 Aug 2026 19:00:03 -0400
Subject: [PATCH 2/2] Harden Firefox policy dirs even when the theme refresh
 fails

---
 migrations/1787515927.sh                | 5 ++++-
 test/shell.d/browser-policy-dir-test.sh | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/migrations/1787515927.sh b/migrations/1787515927.sh
index f1f33869..9adae003 100644
--- a/migrations/1787515927.sh
+++ b/migrations/1787515927.sh
@@ -9,8 +9,11 @@ for dir in "${BROWSER_POLICY_MANAGED_DIRS[@]}"; do
   repaired=1
 done
 
+# Repainting the policy color is cosmetic and the next theme change redoes it.
+# Under bash -euo pipefail a failure here would abort the migration before the
+# Firefox directories below are hardened, and the marker would never be written.
 if (( repaired )); then
-  omarchy-theme-set-browser
+  omarchy-theme-set-browser || true
 fi
 
 for dir in "${BROWSER_POLICY_FIREFOX_DIRS[@]}"; do
diff --git a/test/shell.d/browser-policy-dir-test.sh b/test/shell.d/browser-policy-dir-test.sh
index 39a87c2b..0d66d216 100755
--- a/test/shell.d/browser-policy-dir-test.sh
+++ b/test/shell.d/browser-policy-dir-test.sh
@@ -294,6 +294,10 @@ cleanup || fail "omarchy-theme-set-browser-policy's EXIT trap succeeds with a st
 unset -f cleanup
 pass "omarchy-theme-set-browser-policy's EXIT trap never leaks a failure status"
 
+grep -F 'omarchy-theme-set-browser || true' "$ROOT/migrations/1787515927.sh" >/dev/null ||
+  fail "the policy-directory migration hardens Firefox even when the theme refresh fails"
+pass "the policy-directory migration does not abort on a failed theme refresh"
+
 policy_files=(
   "$ROOT/bin/omarchy-install-browser"
   "$ROOT/bin/omarchy-provision-owner"