Merge upstream quattro (PHP via mise, omarchy up, leftover factory/hook guards)

[cursor]

Merges 4 new first-parent commits (7 cherry-picked non-merge commits) from omacom/omarchy quattro since last night's check (9c5482c5 / PR #25), plus the leftover #25 factory-reset / hook-state commits that never landed on quattro. Upstream HEAD is now 8675600e (upstream #12141, merged 2026-09-18).

PR #25 is still open but now CONFLICTING after today's face-scan PRs (#26–#31). This branch rebases that leftover onto current quattro and adds everything new since the 2026-09-17 cron. Fork-only Cursor work is untouched: official-tarball installer, no mise wrapper, usage collector, Cursor/Grok update steps, and the theme-set fix from #22.

PHP and Laravel now install through mise (upstream omacom#12141)

• PHP is no longer a system pacman package. Install uses mise tool-alias set php github:nunomaduro/static-php-builds and mise use --global php@latest (prebuilt, ~5s, per-project versions like Ruby/Node/Python)
• Composer global bin-dir is $HOME/.local/bin; Laravel installer runs as mise x php -- composer global require laravel/installer
• Remove still drops the old pacman PHP packages for machines that installed before the switch, uninstalls the mise PHP tool/alias, and deletes both ~/.local/bin/laravel and the old Composer laravel path (even if PHP is already gone)
• Menu install/remove guards follow the new locations: PHP is "installed" when the mise php dir exists; Laravel when ~/.local/bin/laravel is executable; remove PHP still shows if either mise or pacman PHP is present

omarchy up is an alias for omarchy update

• New # omarchy:alias=omarchy up on omarchy-update
• omarchy up --help resolves to the same help as omarchy update and lists the alias

1Password survives closing the installer terminal (upstream omacom#12402)

• omarchy-install-service-1password now launches with setsid uwsm-app -- 1password, matching Signal/Spotify so closing the installer terminal does not kill the 1Password window

Offline Node pin no longer freezes mise up (upstream omacom#11656)

• ISO/provision-owner installs unpack the bundled Node tarball and pin the exact version (required while offline)
• Right after that pin, mise config set tools.node latest rewrites it so the first networked mise up tracks new releases, same as an online install
• mise still resolves latest to the already-installed version while offline

Leftover from PR #25 (never merged; reapplied here)

Factory reset now actually erases old hashes (upstream omacom#10379, fixes omacom#10378)

• passwd --lock left the previous root hash in @factory/etc/shadow and the dash-suffixed backups, so the next owner could recover it
• Shared scrub_factory_accounts now runs on both the staged reset root and the retained @factory baseline: userdel uid≥1000 accounts, set root's password field to !, then delete the shadow-utils backups including subuid- / subgid-
• Cleanup failures abort before boot rebuild or activation; a failed baseline scrub puts @factory back to read-only

Hook and state names cannot be paths (upstream omacom#8170)

• omarchy-hook, omarchy-hook-install, and omarchy-state set refuse an empty name, a name with /, or a name that is exactly . or .. (exit 2)
• Stops omarchy-hook ../../evil from running ~/.config/evil and omarchy-state set ../../escape from creating ~/.local/escape
• Names with dots in the middle (a..b) stay allowed. omarchy-state clear is unchanged

Tests

Focused suites passed: ./test/cli (new omarchy up alias in metadata/routes), hook-state-name-guard-test.sh (19 cases), factory-reset-accounts-test.sh (both roots, repeat reset, six injected cleanup failures; ran via user namespace), mise-work-path-test.sh (runtime path still only calls mise use -g node@latest; PATH-injection migration unchanged), menu-test.sh, menu-guards-test.sh, and launch-1password-test.sh.

omarchy up --help smoke-checked: routes to omarchy-update, lists omarchy up as an alias.

  

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b2408cd3-ee1c-412f-b152-a28b77db65a0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Agentic security review found one HIGH issue in factory-reset account scrubbing: untrusted passwd login names are interpolated into a privileged rm -rf without path confinement. Other changed paths (hook/state name guards, PHP via mise, omarchy up) did not yield reportable findings.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

🔒 Agentic Security Review
Severity: HIGH

scrub_factory_accounts interpolates uid≥1000 login names from the untrusted factory snapshot /etc/passwd into a host rm -rf "${root}/home/$user" after userdel --root. Factory reset runs as root because the previous owner (and @factory) are untrusted. A planted login such as .. or ../../../../../etc is accepted by userdel --root when present in that passwd file, and the following rm is not confined to the snapshot, so it can wipe the snapshot root or delete live host paths during reset.

Impact: A previous owner can sabotage factory reset or delete arbitrary host paths as root when the new owner runs reset.

 

^{Reviewed by Cursor Security Reviewer for commit f049e1f. Configure here.}

[mark-groves]

Closing as superseded. The leftover from this sync already landed on quattro via #37.