9ece53cede Prove the web app name guard, and reject before the icon is fetched
The slash guard was the only thing keeping a name out of the directory structure, and nothing tested it: deleting it left the suite green, because creating the launcher directly in the applications directory already makes the redirect fail on its own, with a raw bash error instead of the message. The assertion is on the message now, alongside the traversal case the guard actually closes -- on quattro a name of `../../../../escaped` writes its launcher clean outside the applications directory.

The interactive prompt read the name, fetched the favicon, wrote it and updated the icon cache before the name was ever checked, so a URL typed into the Name field left an icon behind on every attempt. Validating as soon as the name is read covers both paths from one place.

Removing by name also scanned unconditionally, so a machine with no applications directory printed a find error where omarchy-remove-gaming-xbox-cloud does not hide stderr.

🤖 Generated by Opus 5 in Claude Code.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 19:25:25 +02:00
2025-11-03 10:50:54 +01:00
2025-10-07 18:17:47 +02:00
2026-05-11 10:39:22 -04:00
2025-06-30 16:42:09 -07:00
2025-07-28 09:32:44 +02:00
2025-07-26 10:02:29 -07:00
2026-05-14 11:34:55 +02:00
S
Description
OmarchyCN — China-native, AI-first Omarchy downstream distribution (based on basecamp/omarchy, quattro baseline)
Readme MIT
239 MiB
Languages
Shell 57.3%
QML 31.2%
JavaScript 4.1%
Python 2.9%
Go Template 2.5%
Other 2%