Stop a model's words being a program

[YCistak]

"Close Spotify" ends in pkill <app>, and app is whatever the language model produced from the sentence. pkill's argument is an extended regular expression, not a literal, and nothing validated it.

Measured with pgrep, which matches the same way without killing anything:

Pattern	Matches
.	479 of 480 processes — the user's whole session
pylo.	the running pylon daemon
-x with .*	478 — so -x alone is not the fix

The self-kill guard made it worse than it looked: isSelf compares literals while pkill matches patterns, so pylo. is not equal to "pylon", passes the guard, and then matches it.

The fix is three things, because none is enough alone

• isProcessName — letters, digits, dot, dash, underscore; at least one alphanumeric; 64 characters. Removes the metacharacters that make the argument a program rather than a name.
• -x — the pattern must match the whole name.
• Dots escaped — the dot has to stay, because real names contain it (mount.ntfs-3g and python3.11 are on an ordinary desktop), and it is the one metacharacter that survives the name check. pkill -x 'pylo\.' matches nothing.

Verified against a real process table: pgrep -x 'pylo\.' → 0, pgrep -x 'pylon' → 1.

Tests drive the refusals (., .., .*, ^.*$, chrome|pylon, a b, code;rm, $(id), [a-z]+, over-long), the escaped-dot path, the self-guard evasions, and that real names still work — a guard that breaks the feature is not a fix.

Also from the same review, all smaller

• exchange put the model's currency and coin names into URLs unescaped. The host is fixed so this reached no other server, but a stray ? or & would quietly request a different endpoint of that one. url.PathEscape and url.Values now.
• OpenURL is bound to the frontend and opened any scheme it was handed. file:// hands a path to the desktop's default handler for whatever it turns out to be. http and https only; the check is split out so it is testable without a window.
• The PID file is 0600, not 0644 — on Unix it sits in /tmp beside every other user's files.

Deliberately not in here

The socket: /tmp/pylon.sock, no authentication, and no client ever checks who owns it. On a shared machine another local user can bind that name first and receive pylon secret set <name> <api-key> in plaintext. It is the larger finding and needs its own change — the socket path is duplicated in pylon-ui by design, and moving it touches both modules.

🤖 Generated with Claude Code