Remove --exec entirely; --exec-arg is the only click-command form

A free-form shell-string --exec sitting next to the safe --exec-arg is a
standing invitation for the next caller to interpolate untrusted data and
reintroduce the RCE. Remove it: omarchy-notification-send --exec now errors and
points at --exec-arg, and the shell drops the omarchy-exec string hint and its
bash -lc execution path, leaving only the argv path.

Migrate the remaining string callers (the first-run invitation hooks, wifi and
welcome prompts) to --exec-arg, and update their notification mocks. Trim the
verbose security comments added along the way.

shell/plugins/notifications/NotificationLogic.js

@@ -57,39 +57,18 @@ function glyphFromHints(hints) {
   return stringHint(hints, "omarchy-glyph")
 }
 
-// Shell command to run when the card is clicked, sent by
-// omarchy-notification-send --exec. Carrying the action as data means it
-// travels with the popup through the persistence files, so a toast restored
-// after a shell restart clicks through exactly like a live one. A libnotify
-// action can't: its sender is still waiting on an id from a server generation
-// that no longer exists.
-//
-// This is a free-form shell string run through `bash -lc`, so it is safe only
-// when every value interpolated into it was shell-quoted perfectly. It is kept
-// for compatibility and honored only from Omarchy's own trusted toasts (see
-// Service.invokePopupDefault); new senders use --exec-arg / the argv form
-// below, which never reaches a shell.
-function execFromHints(hints) {
-  return stringHint(hints, "omarchy-exec")
-}
-
-// The click action as an argv vector, sent by omarchy-notification-send
-// --exec-arg and carried as a JSON array string in the omarchy-exec-argv hint.
-// The shell runs it via Util.execArgv, which passes the arguments as bash
-// positional parameters rather than interpolating them, so a value that an
-// attacker controls — a video title, a filename, a URL — is only ever one
-// argument and can never be reparsed as a command. This is the parameterized
-// form: the "prepared statement" to execFromHints's string concatenation.
+// The click action: a JSON argv string from omarchy-notification-send
+// --exec-arg. Carried as data so a toast restored after a shell restart stays
+// clickable (a libnotify action can't — its sender is gone). Run via
+// Util.execArgv as bash positional parameters, never a shell string, so
+// attacker-controlled values (a title, a filename) can't become commands.
 function execArgvFromHints(hints) {
   return stringHint(hints, "omarchy-exec-argv")
 }
 
-// Validate a persisted omarchy-exec-argv value into an argv the shell may run,
-// or null for anything that is not one. A malformed or hostile hint must fail
-// closed here rather than fall through to a shell: we require a JSON array of
-// strings, non-empty, whose first element (the program) is present and does not
-// start with "-" (which would let a forged record smuggle in a leading-dash
-// option in the program slot).
+// Validate a persisted omarchy-exec-argv into a runnable argv, or null. Fails
+// closed so a malformed/hostile hint never reaches a shell: must be a non-empty
+// JSON array of strings whose program is present and not a leading-dash option.
 function parseExecArgv(value) {
   var text = String(value || "")
   if (!text) return null
@@ -127,7 +106,6 @@ function snapshotOf(notification, timestamp) {
     body: n.body || "",
     image: n.image || "",
     glyph: glyphFromHints(n.hints),
-    exec: execFromHints(n.hints),
     execArgv: execArgvFromHints(n.hints),
     urgency: n.urgency,
     expireTimeout: expireTimeout,
@@ -137,7 +115,7 @@ function snapshotOf(notification, timestamp) {
 
 // Everything the popup card draws, and therefore everything an in-place
 // update has to write through to the row and its file.
-var POPUP_ROLES = ["app", "appIcon", "summary", "body", "image", "glyph", "exec", "execArgv", "urgency", "expireTimeout"]
+var POPUP_ROLES = ["app", "appIcon", "summary", "body", "image", "glyph", "execArgv", "urgency", "expireTimeout"]
 
 function popupRoles() {
   return POPUP_ROLES
@@ -179,7 +157,6 @@ function historyEntry(value, normalUrgency) {
     body: e.body || "",
     image: e.image || "",
     glyph: e.glyph || "",
-    exec: e.exec || "",
     execArgv: e.execArgv || "",
     urgency: typeof e.urgency === "number" ? e.urgency : normalUrgency,
     expireTimeout: 0,
@@ -390,7 +367,6 @@ if (typeof module !== "undefined") {
     isEphemeralApp: isEphemeralApp,
     stringHint: stringHint,
     glyphFromHints: glyphFromHints,
-    execFromHints: execFromHints,
     execArgvFromHints: execArgvFromHints,
     parseExecArgv: parseExecArgv,
     shouldRenderCompactGlyph: shouldRenderCompactGlyph,

shell/plugins/notifications/Service.qml

@@ -353,37 +353,22 @@ Item {
   }
 
   // Run the popup's click action, then dismiss. Omarchy's own toasts carry the
-  // action as a command in the `exec` role (see execFromHints), which the
-  // persistence files preserve, so restored toasts stay clickable. Third-party
-  // clients register a libnotify action under the canonical identifier
-  // "default" instead; that one only works while the sender is still live.
+  // action as an argv vector in the `execArgv` role (see execArgvFromHints),
+  // which the persistence files preserve, so restored toasts stay clickable.
+  // Third-party clients register a libnotify action under the canonical
+  // identifier "default" instead; that one only works while the sender is live.
   function invokePopupDefault(index) {
     if (index < 0 || index >= popupModel.count) return
     var entry = popupModel.get(index)
 
-    // Preferred path: an argv vector whose arguments are passed as bash
-    // positional parameters (never interpolated into a command), so data an
-    // attacker controls (a video title, a filename) is only ever an argument and
-    // can never be reparsed as a command. Detached so it outlives the shell,
-    // which the installer toasts depend on: they restart it as their first act.
+    // Run the argv (via Util.execArgv, no shell interpretation). Detached so it
+    // outlives the shell, which installer toasts depend on: they restart it.
     var argv = NotificationLogic.parseExecArgv(entry ? entry.execArgv : "")
     if (argv) {
       Util.execArgv(argv)
       dismissPopup(index)
       return
     }
-
-    // Legacy free-form shell exec (deprecated). It runs through `bash -lc`, so
-    // it is only as safe as the sender's quoting — honored solely from
-    // Omarchy's own trusted toasts. app_name is spoofable, so this is a
-    // compatibility courtesy, not a security boundary; new callers use the argv
-    // form above.
-    var command = entry ? String(entry.exec || "") : ""
-    if (command && String(entry.app || "") === "omarchy-action") {
-      Util.execDetached(command)
-      dismissPopup(index)
-      return
-    }
     // Restored rows have no live actions, and looking up liveRefs by their
     // old-generation id could fire an unrelated fresh notification's action.
     var ref = entry && !isRestoredRow(entry) ? liveRefs[entry.originalId] : null
@@ -681,7 +666,7 @@ Item {
         body: row.body,
         image: row.image,
         glyph: row.glyph || "",
-        exec: row.exec || "",
+        execArgv: row.execArgv || "",
         urgency: row.urgency,
         timestamp: row.timestamp
       }, imagesDir).entry)
@@ -705,7 +690,7 @@ Item {
         body: "",
         image: "",
         glyph: "󰂚",
-        exec: "",
+        execArgv: "",
         urgency: NotificationUrgency.Low,
         expireTimeout: 0,
         timestamp: Date.now()