Run notification click actions as argv, not shell strings

The click action of a notification was a free-form shell string run through
`bash -lc`, safe only when every sender shell-quoted every interpolated value
perfectly. One slip is RCE: a hostile yt-dlp video title forged an output
record and injected an mpv option into the click command (mehmetince.net RCE,
partially addressed by #7847).

Add a parameterized transport: omarchy-notification-send gains --exec-arg
(repeatable), encoding a JSON argv into the omarchy-exec-argv hint. The shell
runs it with Quickshell.execDetached(argv) and no shell, so data an attacker
controls is only ever one argument and can never be reparsed as a command. The
shell fails closed on a malformed argv hint.

The legacy free-form --exec string is retained but honored only from Omarchy's
own omarchy-action toasts, and deprecated. Migrate all in-repo callers
(screenshot, screen recording, taildrop receive, migrate-notify, crash-watch,
yt-dlp host) to --exec-arg. Update docs and tests.

shell/plugins/notifications/NotificationLogic.js

@@ -63,10 +63,51 @@ function glyphFromHints(hints) {
 // after a shell restart clicks through exactly like a live one. A libnotify
 // action can't: its sender is still waiting on an id from a server generation
 // that no longer exists.
+//
+// This is a free-form shell string run through `bash -lc`, so it is safe only
+// when every value interpolated into it was shell-quoted perfectly. It is kept
+// for compatibility and honored only from Omarchy's own trusted toasts (see
+// Service.invokePopupDefault); new senders use --exec-arg / the argv form
+// below, which never reaches a shell.
 function execFromHints(hints) {
   return stringHint(hints, "omarchy-exec")
 }
 
+// The click action as an argv vector, sent by omarchy-notification-send
+// --exec-arg and carried as a JSON array string in the omarchy-exec-argv hint.
+// The shell runs it with Quickshell.execDetached (no shell), so a value that an
+// attacker controls — a video title, a filename, a URL — is only ever one
+// argument and can never be reparsed as a command. This is the parameterized
+// form: the "prepared statement" to execFromHints's string concatenation.
+function execArgvFromHints(hints) {
+  return stringHint(hints, "omarchy-exec-argv")
+}
+
+// Validate a persisted omarchy-exec-argv value into an argv the shell may run,
+// or null for anything that is not one. A malformed or hostile hint must fail
+// closed here rather than fall through to a shell: we require a JSON array of
+// strings, non-empty, whose first element (the program) is present and does not
+// start with "-" (which would let a forged record smuggle in a leading-dash
+// option in the program slot).
+function parseExecArgv(value) {
+  var text = String(value || "")
+  if (!text) return null
+
+  var parsed
+  try {
+    parsed = JSON.parse(text)
+  } catch (e) {
+    return null
+  }
+
+  if (!Array.isArray(parsed) || parsed.length === 0) return null
+  for (var i = 0; i < parsed.length; i++) {
+    if (typeof parsed[i] !== "string") return null
+  }
+  if (!parsed[0] || parsed[0].charAt(0) === "-") return null
+  return parsed
+}
+
 function shouldRenderCompactGlyph(glyph, iconSource, singleLineToast) {
   return String(glyph || "").length > 0 && String(iconSource || "").length === 0 && !!singleLineToast
 }
@@ -86,6 +127,7 @@ function snapshotOf(notification, timestamp) {
     image: n.image || "",
     glyph: glyphFromHints(n.hints),
     exec: execFromHints(n.hints),
+    execArgv: execArgvFromHints(n.hints),
     urgency: n.urgency,
     expireTimeout: expireTimeout,
     timestamp: timestamp === undefined ? Date.now() : timestamp
@@ -94,7 +136,7 @@ function snapshotOf(notification, timestamp) {
 
 // Everything the popup card draws, and therefore everything an in-place
 // update has to write through to the row and its file.
-var POPUP_ROLES = ["app", "appIcon", "summary", "body", "image", "glyph", "exec", "urgency", "expireTimeout"]
+var POPUP_ROLES = ["app", "appIcon", "summary", "body", "image", "glyph", "exec", "execArgv", "urgency", "expireTimeout"]
 
 function popupRoles() {
   return POPUP_ROLES
@@ -137,6 +179,7 @@ function historyEntry(value, normalUrgency) {
     image: e.image || "",
     glyph: e.glyph || "",
     exec: e.exec || "",
+    execArgv: e.execArgv || "",
     urgency: typeof e.urgency === "number" ? e.urgency : normalUrgency,
     expireTimeout: 0,
     timestamp: e.timestamp || 0
@@ -347,6 +390,8 @@ if (typeof module !== "undefined") {
     stringHint: stringHint,
     glyphFromHints: glyphFromHints,
     execFromHints: execFromHints,
+    execArgvFromHints: execArgvFromHints,
+    parseExecArgv: parseExecArgv,
     shouldRenderCompactGlyph: shouldRenderCompactGlyph,
     snapshotOf: snapshotOf,
     popupRoles: popupRoles,

shell/plugins/notifications/Service.qml

@@ -360,10 +360,25 @@ Item {
   function invokePopupDefault(index) {
     if (index < 0 || index >= popupModel.count) return
     var entry = popupModel.get(index)
+
+    // Preferred path: an argv vector run without a shell, so data an attacker
+    // controls (a video title, a filename) is only ever an argument and can
+    // never be reparsed as a command. Detached so it outlives the shell, which
+    // the installer toasts depend on: they restart the shell as their first act.
+    var argv = NotificationLogic.parseExecArgv(entry ? entry.execArgv : "")
+    if (argv) {
+      Util.execArgv(argv)
+      dismissPopup(index)
+      return
+    }
+
+    // Legacy free-form shell exec (deprecated). It runs through `bash -lc`, so
+    // it is only as safe as the sender's quoting — honored solely from
+    // Omarchy's own trusted toasts. app_name is spoofable, so this is a
+    // compatibility courtesy, not a security boundary; new callers use the argv
+    // form above.
     var command = entry ? String(entry.exec || "") : ""
-    if (command) {
-      // Detached so the launched command outlives the shell process, which the
-      // installer toasts depend on: they restart the shell as their first act.
+    if (command && String(entry.app || "") === "omarchy-action") {
       Util.execDetached(command)
       dismissPopup(index)
       return