ef6d9e6605
* Stop an installed theme from shipping code `omarchy theme install <url>` clones a stranger's git repository into ~/.config/omarchy/themes, and omarchy-theme-set then copied that whole directory into the staged theme. Most of the files in a staged theme are code rather than colour: Hyprland requires hyprland.lua and gum_env.lua from it at login, Neovim loads neovim.lua at startup, and alacritty.toml, kitty.conf, foot.ini and ghostty.conf each name the program the terminal launches. Installing a theme was the same act as running its author's code, and nothing on disk distinguishes an installed theme from one the user wrote. Stage only what a theme needs in order to be a theme: colors.toml, light.mode, the preview and unlock images, and image files under backgrounds/. Everything else is ignored, named on stderr, and generated from default/themed/*.tpl instead. Symlinks are never followed, because in an untrusted theme they point wherever the author chose. A theme older than colors.toml keeps its palette: its alacritty.toml is read for colours in a scratch directory and only the resulting colors.toml is staged, so the terminal config never lands. The filter belongs in omarchy-theme-set rather than in omarchy-theme-install because staging is the choke point. It also covers themes installed before this change, themes copied in by hand, and files a theme gains later through `omarchy theme update`. First-party themes under $OMARCHY_PATH/themes are unaffected. Per-theme overrides of a generated file are no longer available to user themes; the template at ~/.config/omarchy/themed/<file>.tpl replaces that, and icons.theme is the one setting with no replacement. 🤖 Generated by Opus 5 in Claude Code. * Stop a theme URL or name being read as an option or a path Three paths in the theme commands took an attacker-shaped string straight into git, into basename, or into rm. `git clone "$REPO_URL"` passes the URL as the first positional argument, so a URL beginning with a dash is parsed as an option instead and the destination path becomes what git tries to clone. Pass `--` before the URL so a URL is always a URL. git also treats `<helper>::<address>` as a remote helper to run; git's own protocol.allow default already refuses `ext::`, so rejecting that shape here is a second line rather than the fix, and it keeps holding if that default ever moves. The helper name is a bare word at the very start of the URL, which is what the guard matches: an scp-style IPv6 host such as git@[2001:db8::1]:org/repo.git carries `::` of its own and still clones. `basename "$REPO_PATH" .git` has the same problem one step later, after the scp-style prefix has been stripped: `host:-s/foo.git` leaves basename reading `-s` as an option and returning `.git` as the theme name. Take the name with `--`. That name is then joined into a path that is about to be `rm -rf`'d, so a repo whose basename came out as `..` would take ~/.config/omarchy with it. omarchy-theme-remove had the same shape from its own argument, and omarchy-theme-set's sed/tr normalization does not stop a name containing a slash. Reject empty, anything starting with a dot, and anything containing `/` in all three, before the name reaches a path. 🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh. Co-Authored-By: Codex XHigh <codex@openai.com> * Re-stage the current theme for installs that already applied one Dropping a theme's code at staging time only takes effect the next time a theme is staged. An install that already applied an extra theme keeps that theme's hyprland.lua, gum_env.lua, neovim.lua and terminal configs in ~/.local/state/omarchy/current/theme, which Hyprland requires at login and the terminals include at launch, and nothing forces a theme change — so for those installs the fix would arrive whenever the user next happened to switch themes, which may be never. Re-stage once through omarchy-theme-refresh. First-party themes stage identically, so the cost for everyone else is a single retint during an update they are already running. 🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh. Co-Authored-By: Codex XHigh <codex@openai.com> * Stop a theme's unlock image republishing a file it points at omarchy-plymouth-set-by-theme reads unlock.png straight out of ~/.config/omarchy/themes, which is an installed theme's own directory and outside the staging filter, and hands the path to omarchy-plymouth-set. That path was copied twice into world-readable /usr/share — once by the user into the Plymouth theme, and once by `sudo cp` into the SDDM theme. A symlink there was followed both times, so a theme could name a file it cannot read and have root publish it. Refuse a symlinked logo, and copy the staged logo to SDDM instead of rereading the caller's path as root. The staged copy is made by the user, so nothing privileged opens a path the caller chose. 🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh. Co-Authored-By: Codex XHigh <codex@openai.com> * Limit only what an installed theme could run Two corrections to the rule this branch introduced, both narrowing it to what it was actually for. It applied to every theme under ~/.config/omarchy/themes, which swept up themes the user wrote themselves. Their machine, their file: a theme they wrote is theirs to fill however they like, and Omarchy's own themes were never in scope. Only a theme that came from someone else needs limiting, and the repo already knows which those are — omarchy-theme-extras calls a theme with a `.git` directory an extra and a symlink someone's working copy, because that is what `omarchy theme install` leaves behind when it clones. Use the same test. It was also an allowlist, which dropped files that carry nothing but colour and left theme authors worse off for no gain. Drop only what can run: any `*.lua`, since Hyprland requires a theme's hyprland.lua and gum_env.lua at login and Neovim loads neovim.lua at startup; the four terminal configs, since each names the program the terminal launches; and vscode.json, whose extension field reaches `code --install-extension` and a VS Code extension is arbitrary JavaScript. Everything else an installed theme ships is kept, so btop.theme, chromium.theme, helix.toml, icons.theme, keyboard.rgb and shell.toml go back to being the theme's to set. Symlinks are still dropped, now at any depth rather than only where an allowlist happened to look. A denylist is wrong the moment someone adds a template and does not think about it, so the decision is forced rather than remembered: the test fails on any default/themed/*.tpl whose output is recorded as neither code nor colour, and a new terminal or a new Lua-loading editor cannot be added without classifying it. What this does not cover, and is written down in docs/theming.md rather than implied: a theme shipped as an archive and unpacked by hand looks exactly like one the user wrote. `omarchy theme install` only takes git URLs, so the supported path is always filtered, but this marks where a theme came from and is not a sandbox. 🤖 Generated by Opus 5 in Claude Code. * Fix what the review found Four things, all confirmed against the source before changing anything. The migration failed permanently when the active theme had been removed. `omarchy theme remove` deletes the directory without repointing theme.name, so the name survives, the staged copy survives, and omarchy-theme-refresh exits 1 because neither source directory exists — leaving the migration pending forever and the stale staged Lua exactly where it was, which is the one thing it existed to remove. Seed the default theme in that case: there is nothing to re-stage from, and the removal should have left a working theme behind anyway. The staging test skipped the strict-mode header that docs/testing.md makes the contract for every shell test. Adding it means the patterns that fail on purpose have to stop being bare `cmd && fail` compounds, which errexit reads as the script itself failing; the mutations were re-run afterwards to confirm the assertions still fire rather than the run dying early and looking like something else. The guards in omarchy-theme-install and omarchy-theme-remove had no coverage — they were checked by hand and left that way. theme-install-guards-test.sh stubs git and the themes directory and proves an option-shaped URL, a transport helper, and a name that would climb out all stop before git or rm runs, that a dash inside the path no longer becomes a basename option, and that an ordinary URL still clones and applies. The new docs/theming.md prose was hard-wrapped, which AGENTS.md forbids for docs/. Unwrapped. The rest of that file is wrapped from before and is left alone rather than churned through this change. 🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh and Copilot. --------- Co-authored-by: Codex XHigh <codex@openai.com>
229 lines
8.6 KiB
Bash
Executable File
229 lines
8.6 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
# A theme installed with `omarchy theme install` is a stranger's git repo, so
|
|
# omarchy-theme-set drops the files that would run its code -- Lua, terminal
|
|
# configs, vscode.json -- and keeps the colour. A theme the user wrote themselves
|
|
# is not filtered at all.
|
|
|
|
source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
|
|
|
|
test_tmp=$(mktemp -d)
|
|
trap 'rm -rf "$test_tmp"' EXIT
|
|
|
|
home="$test_tmp/home"
|
|
state="$home/.local/state/omarchy/current"
|
|
themes="$home/.config/omarchy/themes"
|
|
mkdir -p "$state" "$themes"
|
|
|
|
marker="omarchy-theme-staging-marker"
|
|
|
|
set_theme() {
|
|
HOME="$home" OMARCHY_PATH="$ROOT" PATH="$ROOT/bin:$PATH" \
|
|
OMARCHY_THEME_HEADLESS=1 OMARCHY_THEME_SKIP_BACKGROUND=1 \
|
|
XDG_RUNTIME_DIR="$test_tmp" \
|
|
bash "$ROOT/bin/omarchy-theme-set" "$1" 2>"$test_tmp/stderr" || return $?
|
|
}
|
|
|
|
staged() {
|
|
printf '%s' "$state/theme/$1"
|
|
}
|
|
|
|
assert_staged() {
|
|
[[ -f $(staged "$1") ]] || fail "$2"
|
|
}
|
|
|
|
assert_not_staged() {
|
|
[[ ! -e $(staged "$1") ]] || fail "$2"
|
|
}
|
|
|
|
assert_no_marker() {
|
|
! grep -q "$marker" "$(staged "$1")" || fail "$2"
|
|
}
|
|
|
|
write_colors() {
|
|
cat >"$1" <<TOML
|
|
mode = "light"
|
|
|
|
accent = "#7aa2f7"
|
|
selection = "#292e42"
|
|
muted = "#414868"
|
|
|
|
background = "#1a1b26"
|
|
foreground = "#a9b1d6"
|
|
|
|
color0 = "#1a1b26"
|
|
color1 = "#f7768e"
|
|
color2 = "#9ece6a"
|
|
color3 = "#e0af68"
|
|
color4 = "#7aa2f7"
|
|
color5 = "#bb9af7"
|
|
color6 = "#7dcfff"
|
|
color7 = "#a9b1d6"
|
|
TOML
|
|
}
|
|
|
|
# A theme that ships everything it is not allowed to ship.
|
|
hostile="$themes/hostile"
|
|
mkdir -p "$hostile/backgrounds" "$hostile/.git"
|
|
write_colors "$hostile/colors.toml"
|
|
touch "$hostile/light.mode"
|
|
printf 'os.execute("%s")\n' "$marker" >"$hostile/hyprland.lua"
|
|
printf 'vim.cmd("%s")\n' "$marker" >"$hostile/neovim.lua"
|
|
printf 'shell %s\n' "$marker" >"$hostile/kitty.conf"
|
|
printf '[terminal.shell]\nprogram = "%s"\n' "$marker" >"$hostile/alacritty.toml"
|
|
printf 'shell = "%s"\n' "$marker" >"$hostile/foot.ini"
|
|
printf 'command = "%s"\n' "$marker" >"$hostile/ghostty.conf"
|
|
printf 'hl.env("GUM_INPUT_PROMPT", "%s")\n' "$marker" >"$hostile/gum_env.lua"
|
|
printf '[bar]\nbackground = "#%s"\n' "000000" >"$hostile/shell.toml"
|
|
printf '{}\n' >"$hostile/vscode.json"
|
|
printf 'Yaru-red\n' >"$hostile/icons.theme"
|
|
printf 'theme[main_bg]="#000000"\n' >"$hostile/btop.theme"
|
|
printf 'png\n' >"$hostile/preview.png"
|
|
printf 'png\n' >"$hostile/backgrounds/1-real.png"
|
|
printf '%s\n' "$marker" >"$hostile/backgrounds/payload.sh"
|
|
printf '# notes\n' >"$hostile/README.md"
|
|
ln -s /etc/hostname "$hostile/unlock.png"
|
|
|
|
set_theme hostile || fail "omarchy-theme-set applies a theme that ships disallowed files"
|
|
|
|
assert_staged colors.toml "the theme's colors.toml is staged"
|
|
grep -q '#7aa2f7' "$(staged colors.toml)" || fail "the staged colors.toml is the theme's palette"
|
|
assert_staged light.mode "the light mode marker is staged"
|
|
assert_staged preview.png "the theme's preview image is staged"
|
|
assert_staged backgrounds/1-real.png "an image in backgrounds/ is staged"
|
|
|
|
assert_not_staged unlock.png "a symlink is not followed out of the theme"
|
|
assert_not_staged vscode.json "vscode.json names an extension to install and is not staged"
|
|
|
|
assert_staged icons.theme "the theme's icon set name is staged"
|
|
grep -q 'Yaru-red' "$(staged icons.theme)" || fail "the staged icons.theme is the theme's"
|
|
assert_staged btop.theme "the theme's btop colours are staged"
|
|
grep -q 'main_bg' "$(staged btop.theme)" || fail "the staged btop.theme is the theme's"
|
|
assert_not_staged .git "the clone's own git directory is never staged"
|
|
|
|
# These run code, so the theme's versions must lose to Omarchy's generated ones
|
|
# rather than merely be absent.
|
|
for generated in hyprland.lua neovim.lua gum_env.lua kitty.conf alacritty.toml foot.ini ghostty.conf; do
|
|
assert_staged "$generated" "$generated is generated from Omarchy's template"
|
|
assert_no_marker "$generated" "an installed theme cannot supply $generated"
|
|
done
|
|
|
|
# Colour is kept, including a file Omarchy would otherwise have generated.
|
|
assert_staged shell.toml "shell.toml is staged"
|
|
grep -q '000000' "$(staged shell.toml)" || fail "an installed theme's shell.toml colours are kept"
|
|
|
|
grep -q 'hyprland.lua' "$test_tmp/stderr" || fail "omarchy-theme-set names the files it ignored"
|
|
! grep -q 'README.md' "$test_tmp/stderr" || fail "omarchy-theme-set does not report a theme's documentation"
|
|
|
|
pass "an installed theme keeps its colour and loses everything that runs code"
|
|
|
|
# icons.theme is staged verbatim and handed to gsettings, so a symlinked one
|
|
# would stage a copy of whatever it points at.
|
|
linked="$themes/linked"
|
|
mkdir -p "$linked/.git"
|
|
write_colors "$linked/colors.toml"
|
|
ln -s /etc/hostname "$linked/icons.theme"
|
|
|
|
set_theme linked || fail "omarchy-theme-set applies a theme whose icons.theme is a symlink"
|
|
assert_not_staged icons.theme "a symlinked icons.theme is not followed"
|
|
|
|
pass "a symlinked icon set name is refused like any other symlink"
|
|
|
|
# A theme predating colors.toml still gets a palette, without its alacritty.toml
|
|
# reaching the staged theme.
|
|
legacy="$themes/legacy"
|
|
mkdir -p "$legacy/.git"
|
|
cat >"$legacy/alacritty.toml" <<TOML
|
|
[terminal.shell]
|
|
program = "$marker"
|
|
|
|
[colors.primary]
|
|
background = "#102030"
|
|
foreground = "#a0b0c0"
|
|
|
|
[colors.normal]
|
|
black = "#102030"
|
|
red = "#ff0000"
|
|
green = "#00ff00"
|
|
yellow = "#ffff00"
|
|
blue = "#0000ff"
|
|
magenta = "#ff00ff"
|
|
cyan = "#00ffff"
|
|
white = "#a0b0c0"
|
|
TOML
|
|
|
|
set_theme legacy || fail "omarchy-theme-set applies a theme that only ships alacritty.toml"
|
|
assert_staged colors.toml "a legacy theme's palette is recovered from its alacritty.toml"
|
|
grep -q '#102030' "$(staged colors.toml)" || fail "the recovered palette is the theme's"
|
|
assert_no_marker alacritty.toml "a legacy theme's alacritty.toml is not staged"
|
|
|
|
pass "a theme older than colors.toml keeps its palette and loses its terminal config"
|
|
|
|
# An overlay on a stock theme still repaints it, and still cannot add code.
|
|
mkdir -p "$themes/tokyo-night/.git"
|
|
write_colors "$themes/tokyo-night/colors.toml"
|
|
sed -i 's/#7aa2f7/#abcdef/' "$themes/tokyo-night/colors.toml"
|
|
printf 'os.execute("%s")\n' "$marker" >"$themes/tokyo-night/hyprland.lua"
|
|
|
|
set_theme "Tokyo Night" || fail "omarchy-theme-set applies a stock theme with a user overlay"
|
|
grep -q '#abcdef' "$(staged colors.toml)" || fail "a user overlay still replaces the stock palette"
|
|
assert_no_marker hyprland.lua "a user overlay cannot add Lua to a stock theme"
|
|
|
|
pass "an overlay on a stock theme repaints it without adding code"
|
|
|
|
# A theme the user wrote themselves has no git repo behind it and is theirs.
|
|
mine="$themes/mine"
|
|
mkdir -p "$mine"
|
|
write_colors "$mine/colors.toml"
|
|
printf 'os.execute("%s")\n' "$marker" >"$mine/hyprland.lua"
|
|
printf '{"name":"Mine","extension":"pub.ext"}\n' >"$mine/vscode.json"
|
|
|
|
set_theme mine || fail "omarchy-theme-set applies a theme the user wrote"
|
|
grep -q "$marker" "$(staged hyprland.lua)" || fail "a theme the user wrote keeps its own hyprland.lua"
|
|
assert_staged vscode.json "a theme the user wrote keeps every file it ships"
|
|
[[ ! -s $test_tmp/stderr ]] || fail "a theme the user wrote reports nothing ignored" "$(cat "$test_tmp/stderr")"
|
|
|
|
pass "a theme the user wrote is not held to the installed-theme list"
|
|
|
|
# A working copy symlinked into the themes folder is the user's own too.
|
|
ln -s "$mine" "$themes/mine-link"
|
|
set_theme mine-link || fail "omarchy-theme-set applies a symlinked working copy"
|
|
grep -q "$marker" "$(staged hyprland.lua)" || fail "a symlinked working copy is the user's own"
|
|
|
|
pass "a symlinked working copy is the user's own"
|
|
|
|
# The name is joined into paths that get removed and copied into.
|
|
for name in .. . "../../evil"; do
|
|
if set_theme "$name" >/dev/null; then
|
|
fail "omarchy-theme-set rejects the theme name '$name'"
|
|
fi
|
|
done
|
|
|
|
pass "a theme name cannot climb out of the theme directories"
|
|
|
|
# A denylist is only correct while someone adding a template classifies what it
|
|
# generates. Every generated theme file is either denied to an installed theme or
|
|
# recorded here as carrying colour, so a new template fails until it is placed.
|
|
denied=(alacritty.toml foot.ini ghostty.conf kitty.conf gum_env.lua hyprland.lua neovim.lua vscode.json)
|
|
colour_only=(btop.theme chromium.theme claude.json helix.toml hyprland-preview-share-picker.css keyboard.rgb obsidian.css pi.json shell.toml vscode-theme.json)
|
|
|
|
for tpl in "$ROOT"/default/themed/*.tpl; do
|
|
generated=$(basename "$tpl" .tpl)
|
|
classified=""
|
|
|
|
for name in "${denied[@]}" "${colour_only[@]}"; do
|
|
if [[ $generated == "$name" ]]; then
|
|
classified=1
|
|
break
|
|
fi
|
|
done
|
|
|
|
[[ -n $classified ]] ||
|
|
fail "every generated theme file is classified as code or colour" \
|
|
"$generated has a template but is in neither list in $(basename "$0"); decide whether an installed theme may ship it"
|
|
done
|
|
|
|
pass "every file Omarchy generates is classified as code or colour"
|