security: harden shell status execution

packaging/arch/omachat-git/PKGBUILD

@@ -6,7 +6,7 @@ pkgdesc='Tiny encrypted text collaboration for Omarchy (git)'
 arch=('x86_64')
 url='https://github.com/tcballard/OmaChat'
 license=('0BSD')
-depends=('dbus' 'ca-certificates' 'gcc-libs' 'qrencode')
+depends=('dbus' 'ca-certificates' 'coreutils' 'gcc-libs' 'qrencode')
 makedepends=('cargo' 'rust' 'git')
 provides=('omachat')
 conflicts=('omachat')

packaging/arch/omachat/PKGBUILD

@@ -6,7 +6,7 @@ pkgdesc='Tiny encrypted text collaboration for Omarchy'
 arch=('x86_64')
 url='https://github.com/tcballard/OmaChat'
 license=('0BSD')
-depends=('dbus' 'ca-certificates' 'gcc-libs' 'qrencode')
+depends=('dbus' 'ca-certificates' 'coreutils' 'gcc-libs' 'qrencode')
 makedepends=('cargo' 'rust')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
 # Release automation must replace this marker with the published archive hash.

packaging/omarchy-quattro/README.md

@@ -5,7 +5,17 @@ five seconds, wrapped in a one-second timeout. Daemon absence and malformed
 output render `OC —`; they do not block the shell. The plugin has no install
 hook, privileges, configuration writer, or automatic enablement.
 
-On an Omarchy v4.0.1/Quattro machine, validate before enabling:
+The runtime contract is Omarchy v4.0.1's Quattro plugin API, Quickshell 0.3.1,
+and Qt 6.11.2. Those are the versions supplied by the reviewed Omarchy release;
+standalone or floating Quickshell builds are not claimed compatible. A change
+to any of these versions requires plugin revalidation. The widget requires root-owned
+`/usr/bin/omachat-ctl` and GNU coreutils `/usr/bin/timeout`. It never resolves
+executables through ambient `PATH`. `omachat-ctl` emits one IPC response whose
+protocol line is capped at 64 KiB, bounding the complete-output collector; the
+one-second wrapper remains a separate wall-clock bound.
+
+On an Omarchy v4.0.1/Quattro machine with the packaged OmaChat CLI installed,
+validate before enabling:
 
 ```sh
 omarchy plugin validate ./packaging/omarchy-quattro

packaging/omarchy-quattro/Widget.qml

@@ -11,12 +11,13 @@ Item {
         id: label
         anchors.centerIn: parent
         text: root.statusText
+        textFormat: Text.PlainText
         color: "#d8dee9"
     }
 
     Process {
         id: statusPoll
-        command: ["timeout", "1s", "omachat-ctl", "status", "--json"]
+        command: ["/usr/bin/timeout", "1s", "/usr/bin/omachat-ctl", "status", "--json"]
         stdout: StdioCollector {
             onStreamFinished: {
                 try {

packaging/omarchy-quattro/manifest.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "id": "tcballard.omachat-status",
   "name": "OmaChat status",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "author": "OmaChat contributors",
   "description": "Bounded asynchronous OmaChat daemon status indicator",
   "kinds": ["bar-widget"],

packaging/waybar-legacy/README.md

@@ -2,5 +2,7 @@
 
 This is not the Omarchy Quattro path. For older Waybar setups, add a custom
 module that executes `omachat-status.sh` every five seconds with JSON output.
-It requires `jq` and GNU `timeout`. Installation and configuration are manual;
+It requires root-owned `/usr/bin/omachat-ctl`, `/usr/bin/jq`, and GNU
+coreutils `/usr/bin/timeout`; none are resolved through ambient `PATH`.
+Installation and configuration are manual;
 the package never edits Waybar configuration.

packaging/waybar-legacy/omachat-status.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 set -eu
-if output=$(timeout 1s omachat-ctl status --json 2>/dev/null); then
-  joined=$(printf '%s\n' "$output" | jq -r '.joined_geohashes | length')
-  pending=$(printf '%s\n' "$output" | jq -r '.outbox_pending')
+if output=$(/usr/bin/timeout 1s /usr/bin/omachat-ctl status --json 2>/dev/null); then
+  joined=$(printf '%s\n' "$output" | /usr/bin/jq -r '.joined_geohashes | length')
+  pending=$(printf '%s\n' "$output" | /usr/bin/jq -r '.outbox_pending')
   printf '{"text":"OC %s ·%s","class":"online"}\n' "$joined" "$pending"
 else
   printf '{"text":"OC —","class":"offline"}\n'