BastiandClaude Opus 5
b3028f9bd9
Backport of the plugin-add URL guard (PR #8067 by @bastidotnet, merged to
quattro as 30471bf3) onto the v4-0-1 release branch.
omarchy-plugin-add cloned a user-supplied git URL without the transport-helper
guard omarchy-theme-install already applies. That guard arrived with #7884,
which is on this branch, but it never touched plugin-add -- so the sibling
command still leaned entirely on git's own protocol.ext.allow=never to keep a
URL like ext::sh -c <cmd> from running a command at clone time.
Stock systems are unaffected: Omarchy sets no protocol.* override, so the git
default holds and there is no live exploit here. This is defense in depth --
it closes the gap #7884 left in the sibling path and drops a silent dependency
on a default the project does not control. Reject ext::/fd:: and leading-dash
forms; https, ssh, scp-style and token-auth URLs still clone, including an
scp-style IPv6 host, which carries :: of its own.
Clean cherry-pick: both files are byte-identical to quattro, so merging v4-0-1
into quattro resolves without a conflict. The guard reads the same as the one
already in bin/omarchy-theme-install on this branch. test/shell passes: 186
files, with the plugin-add suite's new cases all running here -- including the
pty-driven prompt case, which is the only path that reaches the guard's
leading-dash arm.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Omarchy
Omarchy is a beautiful, modern & opinionated Linux distribution by DHH.
Read more at omarchy.org.
The Omarchy Manual
The manual lives in manual/, which is its authoritative source. It's
mirrored to learn.omacom.io, where
its screenshots are also hosted.
The Basics
- Getting Started
- Coming From Mac or Windows
- Navigation
- The top bar
- Themes
- Hotkeys
- Unified Clipboard & History
- Reminders
- Notices
- Text Extraction & Dictation
- Screenshots & Recording
- Toggles, idle & screensaver
- Omarchy CLI
The Applications
- Terminal
- Neovim
- AI
- Development Tools
- Shell Tools
- Shell Functions
- TUIs
- GUIs
- Browsers
- Commercial apps/services
- Web Apps
- Gaming
- Filling out PDFs
- Windows VM
- Other Packages
Configuration
- Updates
- Dotfiles
- Shell plugins
- Monitors
- Keyboard, Mouse, Trackpad
- Networking
- System sleep
- Hardware authentication
- Fonts
- Backgrounds
- Prompt
- Branding
- Common tweaks
- Extra themes
- Making your own theme
The Rest
- Mac support
- Troubleshooting
- FAQ
- System snapshots
- Security
- Omarchy on...
- Dual Boot Install
- Unattended Installs
License
Omarchy is released under the MIT License.