Claude Opus 5 (1M context)andCodex XHigh 1b15120d27 Keep relayed text out of notify-send's option parser
The argv click command closed injection through the hint's value, but the
sender still handed the headline and description to notify-send bare. A
value beginning with a dash is parsed there as flags, and one shaped like
`--hint=string:omarchy-exec-argv:[...]` is read as a hint of its own --
libnotify keys hints in a hash table, so the later of two replaces the
earlier and a forged headline outranks the vector --exec built.

That is reachable without any --exec in sight: omarchy-tailscale-send
passes a single file's basename verbatim as the description, so a file
named like the hint gives its click action to whoever chose the name.

Put the headline and description behind a `--` so notify-send reads them
as text, and refuse any pass-through word carrying omarchy-exec-argv --
--exec is the only thing that may build a click command.

Co-Authored-By: Codex XHigh <noreply@openai.com>
2026-08-23 21:44:06 +02:00
2025-11-03 10:50:54 +01:00
2026-08-22 14:12:14 +02:00
2026-08-17 06:11:02 -04:00
2025-10-07 18:17:47 +02:00
2026-05-11 10:39:22 -04:00
2025-06-30 16:42:09 -07:00
2025-07-28 09:32:44 +02:00
2025-07-26 10:02:29 -07:00
2026-05-14 11:34:55 +02:00
S
Description
OmarchyCN — China-native, AI-first Omarchy downstream distribution (based on basecamp/omarchy, quattro baseline)
Readme MIT
239 MiB
Languages
Shell 57.3%
QML 31.2%
JavaScript 4.1%
Python 2.9%
Go Template 2.5%
Other 2%