Merge upstream quattro (factory-reset hash scrub + hook/state path guards)

[cursor]

Merges 2 new first-parent commits (4 cherry-picked non-merge commits) from omacom/omarchy quattro since last night's check (2fbac0c8 / PR #23). Upstream HEAD is now 9c5482c5 (upstream #8170, merged 2026-09-16).

This is everything new since the 2026-09-15 cron. Leftover #18 already landed this morning as PR #24. Fork-only Cursor work is untouched: official-tarball installer, no mise wrapper, usage collector, and the theme-set fix from #22.

Factory reset now actually erases old hashes (upstream omacom#10379, fixes omacom#10378)

• passwd --lock left the previous root hash in @factory/etc/shadow and the dash-suffixed backups, so the next owner could recover it
• Shared scrub_factory_accounts now runs on both the staged reset root and the retained @factory baseline: userdel uid≥1000 accounts, set root's password field to !, then delete the shadow-utils backups
• Follow-up on the same PR also deletes subuid- / subgid- (userdel left the previous owner's subordinate ID range in those backups)
• Cleanup failures abort before boot rebuild or activation; a failed baseline scrub puts @factory back to read-only
• First-boot provisioning still sets the new root password

Hook and state names cannot be paths (upstream omacom#8170)

• omarchy-hook, omarchy-hook-install, and omarchy-state set now refuse an empty name, a name with /, or a name that is exactly . or .. (exit 2)
• That stops omarchy-hook ../../evil from running ~/.config/evil and omarchy-state set ../../escape from creating ~/.local/escape
• omarchy-hook-install got the same guard so a slashed type cannot mkdir/cp under hooks/<type>.d before the runner would refuse it
• Names with dots in the middle (a..b) stay allowed. omarchy-state clear is unchanged: find -name matches basenames only
• Robustness for future callers, not a shipped-caller fix — every in-repo call still uses a fixed label

Tests

Focused suites passed: hook-state-name-guard-test.sh (19 cases), factory-reset-accounts-test.sh (both roots, repeat reset, six injected cleanup failures; ran via user namespace), and ./test/cli (metadata unchanged).

  

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 13ad4c2d-ee28-4db3-a093-78ddb0d0afef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}