From ddae74321436256064878aac32dac2877af09576 Mon Sep 17 00:00:00 2001 From: Tom Ballard Date: Fri, 4 Sep 2026 07:46:43 +0000 Subject: [PATCH 1/2] security: harden shell status execution --- packaging/arch/omachat-git/PKGBUILD | 2 +- packaging/arch/omachat/PKGBUILD | 2 +- packaging/omarchy-quattro/README.md | 11 ++++++++++- packaging/omarchy-quattro/Widget.qml | 3 ++- packaging/waybar-legacy/README.md | 4 +++- packaging/waybar-legacy/omachat-status.sh | 6 +++--- 6 files changed, 20 insertions(+), 8 deletions(-) diff --git a/packaging/arch/omachat-git/PKGBUILD b/packaging/arch/omachat-git/PKGBUILD index edcb64f..b4de8f3 100644 --- a/packaging/arch/omachat-git/PKGBUILD +++ b/packaging/arch/omachat-git/PKGBUILD @@ -6,7 +6,7 @@ pkgdesc='Tiny encrypted text collaboration for Omarchy (git)' arch=('x86_64') url='https://github.com/tcballard/OmaChat' license=('0BSD') -depends=('dbus' 'ca-certificates' 'gcc-libs' 'qrencode') +depends=('dbus' 'ca-certificates' 'coreutils' 'gcc-libs' 'qrencode') makedepends=('cargo' 'rust' 'git') provides=('omachat') conflicts=('omachat') diff --git a/packaging/arch/omachat/PKGBUILD b/packaging/arch/omachat/PKGBUILD index b6050cf..e38ee9f 100644 --- a/packaging/arch/omachat/PKGBUILD +++ b/packaging/arch/omachat/PKGBUILD @@ -6,7 +6,7 @@ pkgdesc='Tiny encrypted text collaboration for Omarchy' arch=('x86_64') url='https://github.com/tcballard/OmaChat' license=('0BSD') -depends=('dbus' 'ca-certificates' 'gcc-libs' 'qrencode') +depends=('dbus' 'ca-certificates' 'coreutils' 'gcc-libs' 'qrencode') makedepends=('cargo' 'rust') source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz") # Release automation must replace this marker with the published archive hash. diff --git a/packaging/omarchy-quattro/README.md b/packaging/omarchy-quattro/README.md index 5df74f1..dc96802 100644 --- a/packaging/omarchy-quattro/README.md +++ b/packaging/omarchy-quattro/README.md @@ -5,7 +5,16 @@ five seconds, wrapped in a one-second timeout. Daemon absence and malformed output render `OC โ€”`; they do not block the shell. The plugin has no install hook, privileges, configuration writer, or automatic enablement. -On an Omarchy v4.0.1/Quattro machine, validate before enabling: +The runtime contract is Omarchy v4.0.1's Quattro plugin API and the Quickshell +version supplied by that Omarchy release; standalone or floating Quickshell +builds are not claimed compatible. The widget requires root-owned +`/usr/bin/omachat-ctl` and GNU coreutils `/usr/bin/timeout`. It never resolves +executables through ambient `PATH`. `omachat-ctl` emits one IPC response whose +protocol line is capped at 64 KiB, bounding the complete-output collector; the +one-second wrapper remains a separate wall-clock bound. + +On an Omarchy v4.0.1/Quattro machine with the packaged OmaChat CLI installed, +validate before enabling: ```sh omarchy plugin validate ./packaging/omarchy-quattro diff --git a/packaging/omarchy-quattro/Widget.qml b/packaging/omarchy-quattro/Widget.qml index 67e15f2..c8e3955 100644 --- a/packaging/omarchy-quattro/Widget.qml +++ b/packaging/omarchy-quattro/Widget.qml @@ -11,12 +11,13 @@ Item { id: label anchors.centerIn: parent text: root.statusText + textFormat: Text.PlainText color: "#d8dee9" } Process { id: statusPoll - command: ["timeout", "1s", "omachat-ctl", "status", "--json"] + command: ["/usr/bin/timeout", "1s", "/usr/bin/omachat-ctl", "status", "--json"] stdout: StdioCollector { onStreamFinished: { try { diff --git a/packaging/waybar-legacy/README.md b/packaging/waybar-legacy/README.md index 6f0de9c..a825cfd 100644 --- a/packaging/waybar-legacy/README.md +++ b/packaging/waybar-legacy/README.md @@ -2,5 +2,7 @@ This is not the Omarchy Quattro path. For older Waybar setups, add a custom module that executes `omachat-status.sh` every five seconds with JSON output. -It requires `jq` and GNU `timeout`. Installation and configuration are manual; +It requires root-owned `/usr/bin/omachat-ctl`, `/usr/bin/jq`, and GNU +coreutils `/usr/bin/timeout`; none are resolved through ambient `PATH`. +Installation and configuration are manual; the package never edits Waybar configuration. diff --git a/packaging/waybar-legacy/omachat-status.sh b/packaging/waybar-legacy/omachat-status.sh index df72b70..d5ff904 100644 --- a/packaging/waybar-legacy/omachat-status.sh +++ b/packaging/waybar-legacy/omachat-status.sh @@ -1,8 +1,8 @@ #!/bin/sh set -eu -if output=$(timeout 1s omachat-ctl status --json 2>/dev/null); then - joined=$(printf '%s\n' "$output" | jq -r '.joined_geohashes | length') - pending=$(printf '%s\n' "$output" | jq -r '.outbox_pending') +if output=$(/usr/bin/timeout 1s /usr/bin/omachat-ctl status --json 2>/dev/null); then + joined=$(printf '%s\n' "$output" | /usr/bin/jq -r '.joined_geohashes | length') + pending=$(printf '%s\n' "$output" | /usr/bin/jq -r '.outbox_pending') printf '{"text":"OC %s ยท%s","class":"online"}\n' "$joined" "$pending" else printf '{"text":"OC โ€”","class":"offline"}\n' From 709e85ec529a6979da280c14529bd84012d7614a Mon Sep 17 00:00:00 2001 From: Tom Ballard Date: Fri, 4 Sep 2026 07:46:44 +0000 Subject: [PATCH 2/2] docs: pin widget compatibility contract --- packaging/omarchy-quattro/README.md | 7 ++++--- packaging/omarchy-quattro/manifest.json | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/packaging/omarchy-quattro/README.md b/packaging/omarchy-quattro/README.md index dc96802..d709fae 100644 --- a/packaging/omarchy-quattro/README.md +++ b/packaging/omarchy-quattro/README.md @@ -5,9 +5,10 @@ five seconds, wrapped in a one-second timeout. Daemon absence and malformed output render `OC โ€”`; they do not block the shell. The plugin has no install hook, privileges, configuration writer, or automatic enablement. -The runtime contract is Omarchy v4.0.1's Quattro plugin API and the Quickshell -version supplied by that Omarchy release; standalone or floating Quickshell -builds are not claimed compatible. The widget requires root-owned +The runtime contract is Omarchy v4.0.1's Quattro plugin API, Quickshell 0.3.1, +and Qt 6.11.2. Those are the versions supplied by the reviewed Omarchy release; +standalone or floating Quickshell builds are not claimed compatible. A change +to any of these versions requires plugin revalidation. The widget requires root-owned `/usr/bin/omachat-ctl` and GNU coreutils `/usr/bin/timeout`. It never resolves executables through ambient `PATH`. `omachat-ctl` emits one IPC response whose protocol line is capped at 64 KiB, bounding the complete-output collector; the diff --git a/packaging/omarchy-quattro/manifest.json b/packaging/omarchy-quattro/manifest.json index d0e5d19..89098bc 100644 --- a/packaging/omarchy-quattro/manifest.json +++ b/packaging/omarchy-quattro/manifest.json @@ -2,7 +2,7 @@ "schemaVersion": 1, "id": "tcballard.omachat-status", "name": "OmaChat status", - "version": "0.0.1", + "version": "0.0.2", "author": "OmaChat contributors", "description": "Bounded asynchronous OmaChat daemon status indicator", "kinds": ["bar-widget"],