Merge upstream quattro (factory-reset hash scrub + hook/state path guards)

[cursor]

Merges 2 new first-parent commits (4 cherry-picked non-merge commits) from omacom/omarchy quattro since last night's check (2fbac0c8 / PR #23). Upstream HEAD is now 9c5482c5 (upstream #8170, merged 2026-09-16).

This is everything new since the 2026-09-15 cron. Leftover #18 already landed this morning as PR #24. Fork-only Cursor work is untouched: official-tarball installer, no mise wrapper, usage collector, and the theme-set fix from #22.

Factory reset now actually erases old hashes (upstream omacom#10379, fixes omacom#10378)

• passwd --lock left the previous root hash in @factory/etc/shadow and the dash-suffixed backups, so the next owner could recover it
• Shared scrub_factory_accounts now runs on both the staged reset root and the retained @factory baseline: userdel uid≥1000 accounts, set root's password field to !, then delete the shadow-utils backups
• Follow-up on the same PR also deletes subuid- / subgid- (userdel left the previous owner's subordinate ID range in those backups)
• Cleanup failures abort before boot rebuild or activation; a failed baseline scrub puts @factory back to read-only
• First-boot provisioning still sets the new root password

Hook and state names cannot be paths (upstream omacom#8170)

• omarchy-hook, omarchy-hook-install, and omarchy-state set now refuse an empty name, a name with /, or a name that is exactly . or .. (exit 2)
• That stops omarchy-hook ../../evil from running ~/.config/evil and omarchy-state set ../../escape from creating ~/.local/escape
• omarchy-hook-install got the same guard so a slashed type cannot mkdir/cp under hooks/<type>.d before the runner would refuse it
• Names with dots in the middle (a..b) stay allowed. omarchy-state clear is unchanged: find -name matches basenames only
• Robustness for future callers, not a shipped-caller fix — every in-repo call still uses a fixed label

Tests

Focused suites passed: hook-state-name-guard-test.sh (19 cases), factory-reset-accounts-test.sh (both roots, repeat reset, six injected cleanup failures; ran via user namespace), and ./test/cli (metadata unchanged).

  

---

Note

High Risk
Changes factory-reset account and shadow handling on sale/handoff paths and hardens CLI utilities that write or execute under user config/state directories.

Overview
Merges upstream factory-reset credential scrubbing and hook/state path guards, with focused shell tests.

Factory reset no longer relies on passwd --lock, which left recoverable hashes in @factory and dash-suffixed shadow backups. A shared scrub_factory_accounts removes uid≥1000 users and homes, sets root’s password field to ! via usermod, and deletes passwd-/shadow-/subuid-/subgid- backups on both the staged reset root and the retained @factory baseline. Cleanup failures abort the reset (baseline is re-marked read-only on scrub failure). Tests cover normal/locked root, repeat reset, and injected userdel/usermod/rm failures.

omarchy-hook, omarchy-hook-install, and omarchy-state set now reject empty names, names containing /, or names exactly . or .. (exit 2), blocking path-style escape while still allowing dotted labels like a..b. omarchy-state clear is unchanged. New tests exercise valid names, traversal attempts, and install-side mkdir/cp guards.

^{Reviewed by Cursor Bugbot for commit 85cca3d. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1f06b9b4-c6a8-45dc-beae-02d5bbe10dbb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Agentic security review found one medium-severity path-containment issue in the new factory-reset account scrub. Hook/state name guards did not introduce a comparable residual risk.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM

scrub_factory_accounts reads uid 1000–59999 logins from $root/etc/passwd and, after userdel --root succeeds, runs rm -rf "${root}/home/$user" as root. Those names are not limited to a single path component (no /, not . or ..), unlike the hook/state name guards in this PR.

userdel --root can accept a login such as ../../OUTSIDE. The rm -rf is evaluated on the host, not inside the snapshot, so the path can leave $root. On the production layout ($TOP_MNT/@factory or $TOP_MNT/@omarchy-reset-next), that can resolve to live host paths.

Impact: A previous owner who can plant a nonstandard passwd entry in the factory snapshot can make factory reset delete files outside the snapshot while running as root.

 

^{Reviewed by Cursor Security Reviewer for commit 85cca3d. Configure here.}

[mark-groves]

Closing as superseded. The leftover from this sync already landed on quattro via #37.