Harden FIDO2 setup against cached sudo reuse

[ErikMelton]

Summary

• invalidate cached sudo credentials before user-process FIDO2 callbacks and when setup exits
• resolve sensitive utilities and presentation callbacks through trusted fixed paths
• preserve atomic root-owned credential staging with cleanup across failure paths

Tests

• ./test/shell.d/security-fido2-test.sh
• bash test/shell.d/floating-terminal-test.sh
• ./test/shell.d/plymouth-set-test.sh
• ./test/cli
• bash syntax checks and git diff --check

Reported-by: Sean https://github.com/shuber Huber

[Copilot]

🟡 Changes recommended

Pre-setup presentation helpers can still execute binaries from a user-controlled PATH while cached sudo credentials remain live.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Hardens FIDO2 enrollment by isolating privileged credentials and using trusted executable paths.

Changes:

• Invalidates cached sudo credentials around FIDO2 operations.
• Preserves atomic credential staging and failure cleanup.
• Adds PATH-poisoning and presentation callback tests.

File summaries

File	Description
bin/omarchy-setup-security-fido2	Hardens FIDO2 setup and credential staging.
bin/omarchy-launch-floating-terminal-with-presentation	Resolves presentation scripts through Omarchy paths.
test/shell.d/security-fido2-test.sh	Tests sudo invalidation, PATH isolation, and cleanup.
test/shell.d/floating-terminal-test.sh	Tests fixed presentation callback paths.
test/shell.d/plymouth-set-test.sh	Adapts presentation-wrapper fixtures.

Review details

• Files reviewed: 3/5 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.