## What happened

`omarchy-update` carries this annotation in its header:

```bash
# omarchy:summary=Update Omarchy and system packages
# omarchy:args=[-y]
# omarchy:requires-sudo=true
```

Following it, I ran `sudo omarchy update -y`. The update itself succeeded, but
`omarchy-update-mise` ran `mise up` **as root**, so mise wrote its tool
installs as root:

```
$ find ~ -xdev ! -user "$USER" | wc -l
588
```

452 of those are mise state (`~/.local/share/mise`, `~/.cache/mise`), including
`~/.local/share/mise/installs/opencode/1.18.32/` and its `latest`/`1`/`1.18`
symlinks.

## What was expected

`mise up` manages per-user tools, so `omarchy-update-mise` should either run
strictly as the invoking user, or drop privileges before calling mise.

## Why the outer `sudo` should not be needed

`omarchy-update` already escalates exactly the steps that need root, and only
those — each prompts separately:

```
[sudo] password for <user>:      # paccache -rk2
[sudo] password for <user>:      # snapper -c root create ...
[sudo] password for <user>:      # pacman -Syu --noconfirm ...
```

The per-user steps (`omarchy-update-mise`, `omarchy-update-aur-pkgs`,
`omarchy-update-dev`) are not wrapped in `sudo` at all, which means they are
*intended* to run unprivileged. An outer `sudo` silently converts them.

## Impact

Once the installs are root-owned, mise cannot update them as the user:

```
$ mise use -g opencode
mise ✗ [email protected]  3ms · failed: Permission denied (os error 13)
mise ERROR Failed to install aqua:anomalyco/opencode@latest: Permission denied (os error 13)
```

This breaks `omarchy-default-agent`, which calls `mise use -g <agent>` on every
invocation, so **Defaults -> Agent -> <name>** in the menu fails with
"Could not set <name> as the default coding agent" and launches nothing.

Confusingly, the agents themselves still run fine (already-installed binaries
are still executable), and `SUPER+SHIFT+CTRL+A` (`omarchy-agent --pick`) still
works, because that path skips `mise use -g` entirely. So it presents as a
broken menu rather than a permissions problem.

Recovery is `sudo chown -R "$USER:$USER" ~/.local/share/mise ~/.cache/mise`.

## Steps to reproduce

1. `mise install <some-tool>` as your normal user.
2. `sudo omarchy update` (any Omarchy version with a mise-managed tool that has
   an update available).
3. `find ~ -xdev ! -user "$USER"` — note the mise installs.
4. `mise use -g <some-tool>` — now fails with `Permission denied (os error 13)`.

## Possible fixes

Any one of these would close the trap:

- Drop `omarchy:requires-sudo=true` from `omarchy-update`, since the script
  escalates its own root steps.
- Re-exec `mise` as the original invoking user in `omarchy-update-mise`, e.g.
  `sudo -u "${SUDO_USER:-$USER}" MISE_MINIMUM_RELEASE_AGE=0 mise up`.
- Have `omarchy-update` drop privileges for the steps that are not annotated
  `requires-sudo`.

## System details

```
$ omarchy version --no-sudo
4.0.4-1
```

Arch Linux, Omarchy 4.0.4-1, mise 2026.9.12.

> Filed by opencode/big-pickle via opencode.