Omarchybot and Claude Opus 5
e713ff3166
Share the git URL check, and refuse the transports Omarchy does not clone from (backport of #8174 )
...
Backport of the shared URL check (PR #8174 , merged to quattro as 68ab12f7 ) onto
the v4-0-1 release branch, on top of the #8067 backport it follows.
omarchy-theme-install and omarchy-plugin-add both clone a URL a stranger can
choose, and each carried its own copy of the rule that refuses a git option or a
transport helper before cloning. The rule now lives in omarchy-git-url-check and
both callers ask it: two copies of a security check drift, and the second copy
arrived four months after the first only because someone went looking for it.
That rule was also enforcing half of what it described. <helper>::<address> is
one of two shapes git resolves a remote helper from -- it also runs
git-remote-<scheme> for <scheme>://<address> whenever the scheme is not one it
connects itself, so ext::sh -c id and ext://sh -c id reach the same helper while
only the first was refused. Nothing exploitable follows on a stock system:
protocol.ext.allow defaults to never, and the :// spelling hands git-remote-ext
a command name it cannot exec. But a third-party helper installed on PATH is
reachable through the scheme form alone, and a guard is worth more when it
enforces the rule it states.
The :// shape cannot be refused the way :: is, because it is also how every
legitimate URL arrives, so the scheme is checked against the transports git
still connects itself: ssh git git+ssh ssh+git http https ftp ftps file.
git+ssh and ssh+git are on that list because they are spelled like a helper and
read as plain ssh; leaving them off would refuse a URL that clones today. ext
and fd are off it deliberately. A single colon is always scp-style ssh and a
bare path is always a path, so neither needs constraining.
The check fails closed: the callers read a non-zero status as a refusal, so a
missing omarchy-git-url-check refuses the URL rather than waving it through.
Clean cherry-pick on top of the #8067 backport: every file is byte-identical to
quattro, so merging v4-0-1 into quattro resolves without a conflict. test/shell
passes: 189 files, including the one this adds. test/cli passes, so the new
command's metadata is well-formed. Exercised the check here: https, scp-style,
ssh, git+ssh and scp-style IPv6 all pass, while ext:: ext:// fd:: fd:// and a
leading-dash form are refused, as is an uppercase EXT:// spelling.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
2026-08-25 09:13:35 +02:00
..
2026-08-13 17:04:28 +02:00
2026-08-23 19:11:58 +02:00
2026-08-12 18:37:40 +02:00
2026-08-12 17:56:19 +02:00
2026-08-13 12:13:41 +02:00
2026-08-13 13:47:44 +02:00
2026-08-07 23:49:43 +02:00
2026-08-07 15:46:10 +02:00
2026-08-10 14:14:57 -07:00
2026-08-10 14:14:57 -07:00
2026-08-10 14:14:57 -07:00
2026-05-16 20:34:09 +02:00
2026-05-21 11:53:48 +02:00
2026-07-24 18:25:02 -07:00
2026-07-24 18:25:02 -07:00
2026-07-24 18:25:02 -07:00
2026-07-24 18:25:02 -07:00
2026-07-24 18:25:02 -07:00
2026-05-22 13:26:26 +02:00
2026-08-07 23:43:49 +02:00
2026-08-11 11:07:14 +02:00
2026-07-08 11:49:56 -07:00
2026-05-21 15:45:36 +02:00
2026-05-01 17:40:22 +02:00
2026-07-20 16:37:33 -07:00
2026-08-10 20:27:40 +02:00
2026-08-10 20:27:40 +02:00
2026-08-01 19:55:02 -05:00
2026-08-01 19:55:02 -05:00
2026-08-01 15:35:34 -05:00
2026-06-24 13:52:37 +02:00
2026-08-01 15:35:34 -05:00
2026-06-24 13:52:37 +02:00
2026-05-02 10:24:31 +02:00
2026-08-11 13:56:09 +02:00
2026-08-10 10:17:08 -07:00
2026-08-23 19:56:59 -04:00
2026-08-13 12:23:48 +02:00
2026-08-23 19:56:59 -04:00
2026-07-15 18:23:40 -07:00
2026-08-13 12:23:48 +02:00
2026-07-26 15:27:06 -07:00
2026-06-29 11:28:32 -05:00
2026-07-23 17:05:29 -07:00
2026-07-22 17:25:28 -07:00
2026-08-23 19:56:59 -04:00
2026-07-24 12:25:20 -07:00
2026-06-29 13:45:11 -05:00
2026-07-24 12:25:20 -07:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-07-19 09:59:13 -07:00
2026-08-23 19:56:59 -04:00
2026-07-29 09:15:53 -07:00
2026-08-10 11:59:39 +02:00
2026-08-12 17:56:19 +02:00
2026-07-24 09:01:17 -07:00
2026-05-19 21:42:02 +02:00
2026-06-04 18:38:25 -04:00
2026-06-12 13:49:46 -04:00
2026-07-22 17:32:01 -07:00
2026-05-17 21:55:53 +02:00
2026-08-13 19:46:46 +02:00
2026-08-07 23:43:49 +02:00
2026-08-11 11:04:50 -04:00
2026-06-06 20:36:21 -04:00
2026-08-11 11:04:50 -04:00
2026-07-18 16:24:51 -07:00
2026-05-21 19:30:30 +02:00
2026-08-11 11:04:50 -04:00
2026-08-07 23:04:42 +02:00
2026-07-31 22:05:00 -05:00
2026-08-23 19:11:58 +02:00
2026-07-16 21:53:15 -07:00
2026-05-01 17:40:22 +02:00
2026-07-18 18:21:39 -07:00
2026-05-06 12:58:55 +02:00
2026-08-11 14:24:17 +02:00
2026-05-14 16:34:21 -04:00
2026-05-01 17:40:22 +02:00
2026-07-25 08:46:39 -07:00
2026-05-11 13:01:45 +02:00
2026-06-04 18:37:32 -04:00
2026-08-25 09:13:35 +02:00
2026-05-01 17:40:22 +02:00
2026-05-15 11:03:21 +02:00
2026-07-18 10:08:43 -07:00
2026-05-07 10:33:12 +02:00
2026-05-07 10:34:28 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-07 12:10:45 +02:00
2026-07-23 13:51:07 -07:00
2026-05-08 21:07:51 +02:00
2026-05-01 17:40:22 +02:00
2026-08-07 23:59:50 +02:00
2026-08-13 12:25:25 +02:00
2026-08-12 14:01:58 +02:00
2026-05-01 17:40:22 +02:00
2026-08-13 12:37:43 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-07-18 12:31:25 -07:00
2026-07-20 08:09:07 -07:00
2026-07-23 13:51:07 -07:00
2026-05-01 17:40:22 +02:00
2026-08-11 18:34:07 +02:00
2026-08-11 18:34:07 +02:00
2026-08-11 18:34:07 +02:00
2026-05-11 10:40:26 -04:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-08-13 12:23:48 +02:00
2026-08-13 20:28:43 +02:00
2026-08-23 19:11:58 +02:00
2026-08-11 18:25:44 +02:00
2026-05-01 17:40:22 +02:00
2026-08-01 15:35:34 -05:00
2026-07-24 12:28:55 -07:00
2026-07-24 12:28:55 -07:00
2026-07-24 12:28:55 -07:00
2026-08-11 13:26:24 +02:00
2026-08-05 08:30:12 -05:00
2026-08-11 13:26:24 +02:00
2026-08-11 13:26:24 +02:00
2026-08-11 11:29:35 +02:00
2026-05-17 19:51:29 +02:00
2026-05-11 10:40:26 -04:00
2026-05-11 10:40:26 -04:00
2026-07-16 21:19:28 -07:00
2026-05-01 17:40:22 +02:00
2026-05-11 10:40:26 -04:00
2026-05-10 11:26:59 +02:00
2026-05-29 15:59:13 +02:00
2026-05-11 10:40:26 -04:00
2026-05-23 13:37:57 +02:00
2026-07-23 21:03:43 -07:00
2026-08-12 15:56:40 +02:00
2026-08-04 12:16:54 -05:00
2026-05-14 17:43:12 -04:00
2026-08-01 12:44:40 -07:00
2026-07-22 17:25:28 -07:00
2026-05-04 13:23:27 +02:00
2026-06-04 11:15:28 +02:00
2026-05-01 17:40:22 +02:00
2026-05-04 13:23:27 +02:00
2026-08-04 12:16:54 -05:00
2026-06-09 19:48:37 -04:00
2026-08-04 12:16:54 -05:00
2026-08-04 12:16:54 -05:00
2026-05-14 17:43:12 -04:00
2026-06-24 13:31:17 +02:00
2026-05-27 11:15:21 +02:00
2026-05-27 11:15:21 +02:00
2026-08-04 12:16:54 -05:00
2026-05-04 13:23:27 +02:00
2026-07-18 12:30:54 -07:00
2026-08-04 12:16:54 -05:00
2026-05-27 11:15:21 +02:00
2026-05-27 11:15:21 +02:00
2026-08-14 12:30:32 +02:00
2026-05-25 17:29:02 +02:00
2026-07-29 22:39:55 -04:00
2026-08-05 22:57:56 +02:00
2026-05-27 10:53:30 +02:00
2026-05-25 18:19:06 +02:00
2026-05-25 18:12:40 +02:00
2026-06-04 18:37:32 -04:00
2026-07-29 22:39:55 -04:00
2026-05-15 17:44:09 +02:00
2026-06-23 16:22:27 +02:00
2026-06-23 16:22:27 +02:00
2026-07-22 16:10:45 -07:00
2026-08-13 11:32:20 +02:00
2026-05-21 19:30:30 +02:00
2026-07-29 17:15:27 -04:00
2026-05-19 17:08:14 +02:00
2026-08-11 22:26:52 +02:00
2026-08-25 09:02:57 +02:00
2026-05-22 14:24:04 +02:00
2026-07-20 09:44:48 -07:00
2026-05-14 13:15:03 +02:00
2026-05-14 11:12:25 +02:00
2026-05-11 10:40:26 -04:00
2026-08-08 11:05:05 +02:00
2026-05-01 17:40:22 +02:00
2026-08-10 11:59:39 +02:00
2026-08-12 16:42:37 +02:00
2026-05-25 18:19:06 +02:00
2026-05-25 18:12:40 +02:00
2026-05-14 10:56:10 +02:00
2026-08-10 18:44:19 +02:00
2026-05-14 10:57:44 +02:00
2026-08-08 11:05:05 +02:00
2026-05-01 17:40:22 +02:00
2026-08-10 13:33:07 -07:00
2026-05-20 14:09:09 +02:00
2026-05-20 14:12:06 +02:00
2026-05-29 15:25:21 +02:00
2026-05-19 20:54:20 +02:00
2026-08-10 18:44:19 +02:00
2026-08-13 09:58:15 +02:00
2026-05-19 20:54:20 +02:00
2026-08-11 11:35:41 +02:00
2026-08-23 19:11:58 +02:00
2026-08-07 02:38:06 -07:00
2026-08-11 14:24:17 +02:00
2026-06-29 08:51:15 -05:00
2026-07-19 10:00:46 -07:00
2026-07-26 14:53:29 -07:00
2026-08-23 19:56:59 -04:00
2026-08-23 19:11:58 +02:00
2026-08-11 18:25:44 +02:00
2026-07-30 10:11:23 -04:00
2026-07-31 17:18:42 -04:00
2026-08-07 12:50:04 +02:00
2026-07-22 15:52:58 -07:00
2026-06-28 20:11:21 -04:00
2026-05-14 12:02:53 +02:00
2026-05-20 14:24:19 +02:00
2026-08-23 19:56:59 -04:00
2026-05-14 12:02:53 +02:00
2026-07-26 14:53:29 -07:00
2026-07-07 09:18:03 -07:00
2026-07-24 16:48:14 -07:00
2026-06-04 18:35:01 -04:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-07-18 12:31:03 -07:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-08-25 09:13:35 +02:00
2026-07-29 22:39:55 -04:00
2026-08-01 13:13:39 -05:00
2026-07-29 21:34:47 -04:00
2026-07-29 22:39:55 -04:00
2026-07-29 21:34:47 -04:00
2026-07-29 22:39:55 -04:00
2026-07-29 21:34:47 -04:00
2026-07-29 21:34:47 -04:00
2026-07-24 12:19:39 -07:00
2026-07-24 12:19:39 -07:00
2026-07-18 10:08:43 -07:00
2026-07-24 12:20:04 -07:00
2026-08-23 19:12:29 +02:00
2026-07-24 12:19:39 -07:00
2026-07-24 12:19:39 -07:00
2026-06-29 10:49:43 -05:00
2026-07-19 09:33:23 -07:00
2026-07-19 21:29:15 -07:00
2026-07-19 21:29:15 -07:00
2026-08-12 17:56:19 +02:00
2026-08-24 19:58:40 +02:00
2026-08-12 18:37:40 +02:00
2026-06-04 18:37:32 -04:00
2026-08-01 12:44:40 -07:00
2026-06-22 18:30:16 +02:00
2026-08-09 13:57:36 +02:00
2026-06-16 01:25:04 -04:00
2026-05-01 17:40:22 +02:00
2026-08-09 13:17:28 +02:00
2026-06-04 18:38:25 -04:00
2026-07-18 10:08:43 -07:00
2026-07-18 10:08:43 -07:00
2026-07-16 21:15:00 -07:00
2026-05-01 17:40:22 +02:00
2026-06-04 18:37:32 -04:00
2026-06-04 18:38:25 -04:00
2026-06-04 18:38:25 -04:00
2026-05-23 18:04:21 +02:00
2026-07-24 09:01:17 -07:00
2026-05-01 17:40:22 +02:00
2026-06-29 14:49:39 -05:00
2026-07-18 10:08:43 -07:00
2026-05-04 11:18:25 +02:00
2026-05-04 10:31:06 +02:00
2026-05-04 08:57:19 +02:00
2026-07-18 12:30:54 -07:00
2026-05-04 08:57:19 +02:00
2026-05-04 09:57:13 +02:00
2026-05-27 11:15:21 +02:00
2026-07-18 10:08:43 -07:00
2026-08-14 12:30:32 +02:00
2026-05-08 20:52:29 +02:00
2026-07-26 12:31:04 -07:00
2026-07-18 16:09:03 -07:00
2026-08-25 09:02:57 +02:00
2026-05-25 17:29:02 +02:00
2026-07-29 22:39:55 -04:00
2026-05-16 13:00:30 +02:00
2026-07-29 22:39:55 -04:00
2026-05-01 17:40:22 +02:00
2026-05-22 13:26:46 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-07-20 09:44:48 -07:00
2026-05-05 12:53:51 +02:00
2026-08-09 13:57:36 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-08-23 19:11:58 +02:00
2026-05-01 17:40:22 +02:00
2026-07-23 17:40:47 -07:00
2026-05-05 14:22:03 +02:00
2026-05-21 10:19:36 +02:00
2026-07-27 09:49:15 -07:00
2026-08-10 13:59:20 +02:00
2026-08-09 13:17:28 +02:00
2026-05-08 20:52:29 +02:00
2026-08-09 21:54:01 +02:00
2026-07-24 12:25:20 -07:00
2026-08-25 09:02:57 +02:00
2026-08-11 11:07:14 +02:00
2026-07-24 12:16:51 -07:00
2026-08-24 19:58:40 +02:00
2026-06-04 18:34:04 -04:00
2026-08-08 02:31:23 -07:00
2026-05-06 13:20:34 +02:00
2026-08-25 09:02:57 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-08-10 17:41:05 +02:00
2026-08-10 17:41:05 +02:00
2026-07-25 12:35:17 -07:00
2026-08-13 11:46:45 +02:00
2026-07-24 16:48:14 -07:00
2026-07-24 16:48:14 -07:00
2026-07-24 16:48:14 -07:00
2026-07-25 12:35:17 -07:00
2026-07-29 23:21:45 -04:00
2026-05-21 11:58:43 +02:00
2026-06-22 21:48:35 +02:00
2026-08-23 19:56:59 -04:00
2026-07-26 19:07:11 -07:00
2026-06-09 19:48:37 -04:00
2026-06-09 19:48:37 -04:00
2026-06-09 19:48:37 -04:00
2026-08-01 18:13:45 -07:00
2026-06-09 19:48:37 -04:00
2026-06-09 19:48:37 -04:00
2026-08-11 12:31:52 +02:00
2026-07-18 16:24:51 -07:00
2026-07-24 12:24:09 -07:00
2026-07-24 12:19:39 -07:00
2026-08-23 19:11:58 +02:00
2026-08-25 09:13:35 +02:00
2026-07-24 12:24:09 -07:00
2026-07-03 09:06:31 -07:00
2026-06-09 19:48:37 -04:00
2026-08-23 19:12:29 +02:00
2026-08-23 19:12:29 +02:00
2026-07-19 19:05:42 -07:00
2026-08-01 13:06:19 -05:00
2026-06-09 19:48:37 -04:00
2026-07-03 09:06:31 -07:00
2026-05-06 13:20:34 +02:00
2026-08-11 12:31:52 +02:00
2026-08-11 12:31:52 +02:00
2026-06-09 19:48:37 -04:00
2026-06-09 19:48:37 -04:00
2026-07-03 09:06:31 -07:00
2026-07-15 18:13:39 -07:00
2026-08-13 19:33:22 +02:00
2026-06-09 19:48:37 -04:00
2026-08-23 19:11:58 +02:00
2026-06-04 11:14:04 +02:00
2026-06-04 11:14:04 +02:00
2026-08-13 21:26:08 +02:00
2026-05-01 17:40:22 +02:00
2026-08-13 12:22:58 +02:00
2026-07-21 15:25:49 -07:00
2026-07-24 12:18:25 -07:00
2026-07-21 16:01:49 -07:00
2026-07-19 22:46:27 -07:00
2026-07-24 12:17:16 -07:00
2026-07-24 12:17:16 -07:00
2026-07-24 12:18:25 -07:00
2026-07-24 12:18:25 -07:00
2026-07-22 16:39:00 -07:00
2026-07-02 22:09:14 -07:00
2026-06-04 18:37:32 -04:00
2026-06-28 20:46:23 -04:00
2026-07-18 10:08:43 -07:00
2026-08-14 09:08:34 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-07-23 15:28:32 -07:00
2026-08-08 02:35:44 -07:00
2026-07-23 15:28:32 -07:00
2026-05-01 17:40:22 +02:00
2026-05-08 20:48:36 +02:00
2026-07-29 20:04:49 -07:00
2026-08-08 03:12:08 -07:00
2026-06-04 18:38:25 -04:00
2026-06-04 18:38:25 -04:00
2026-08-12 11:58:25 +02:00
2026-07-29 18:47:27 -04:00
2026-08-08 01:44:56 -07:00
2026-07-29 20:04:49 -07:00
2026-08-10 03:45:49 -07:00
2026-08-14 09:08:34 +02:00
2026-08-14 00:15:07 -07:00
2026-05-01 17:40:22 +02:00
2026-06-04 18:38:25 -04:00
2026-08-24 19:54:01 +02:00
2026-07-18 10:08:43 -07:00
2026-07-29 09:15:53 -07:00
2026-06-04 18:38:25 -04:00
2026-06-29 11:28:32 -05:00
2026-05-01 17:40:22 +02:00
2026-05-29 14:36:26 -04:00
2026-07-22 21:39:15 -07:00
2026-05-14 16:33:51 -04:00
2026-07-22 21:39:15 -07:00
2026-05-16 21:01:09 +02:00
2026-08-05 17:43:14 +02:00
2026-07-16 14:46:56 -07:00
2026-07-16 14:46:56 -07:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-07-22 17:02:52 -07:00
2026-06-28 20:46:23 -04:00
2026-07-18 10:08:43 -07:00
2026-08-25 09:02:57 +02:00