omarchycn/bin/omarchy-notification-send

#!/bin/bash

# omarchy:summary=Send an Omarchy desktop notification
# omarchy:args=[--app-name <app-name>] [-g <glyph>] [-u <low|normal|critical>] [--image <path-or-uri>] <headline> [description] [notify-send options] [--exec <program> [args...]]
# omarchy:examples=omarchy notification send "Reminder" "5 minutes are up" -g 󰢌

set -euo pipefail

headline=""
description=""
glyph=
urgency="low"
app_name="omarchy-action"
image=
exec_args=()
exec_present=0
args=()
parsed_option_args=0

parse_omarchy_option() {
  case $1 in
  -g | --glyph)
    if (($# < 2)); then
      echo "Missing value for $1" >&2
      exit 1
    fi
    glyph=$2
    parsed_option_args=2
    return 0
    ;;
  -u | --urgency)
    if (($# < 2)); then
      echo "Missing value for $1" >&2
      exit 1
    fi
    urgency="$2"
    parsed_option_args=2
    return 0
    ;;
  --app-name)
    if (($# < 2)); then
      echo "Missing value for $1" >&2
      exit 1
    fi
    app_name=$2
    parsed_option_args=2
    return 0
    ;;
  --image)
    if (($# < 2)); then
      echo "Missing value for $1" >&2
      exit 1
    fi
    image=$2
    parsed_option_args=2
    return 0
    ;;
  esac

  return 1
}

while (($# > 0)); do
  if parse_omarchy_option "$@"; then
    shift "$parsed_option_args"
  else
    break
  fi
done

if (($# < 1)); then
  echo "Usage: omarchy-notification-send [--app-name <app-name>] [-g <glyph>] [-u <low|normal|critical>] [--image <path-or-uri>] <headline> [description] [notify-send options] [--exec <program> [args...]]"
  exit 1
fi

headline=$1
shift

if (($# > 0)) && [[ $1 != -* ]]; then
  description=$1
  shift
fi

while (($# > 0)); do
  if [[ $1 == "--exec" ]]; then
    # --exec consumes the rest of the line as the click command's argv. The
    # caller's shell already tokenized those words into discrete arguments, and
    # the shell runs them as-is (never re-parsed), so untrusted data in an
    # argument is only ever one argument and can never become a command.
    # Detected only here, after the headline/description positionals are
    # captured, so an untrusted headline that is literally "--exec" is taken as
    # text and can't be mistaken for the delimiter. --exec therefore comes last.
    shift
    exec_args=("$@")
    exec_present=1
    break
  elif parse_omarchy_option "$@"; then
    shift "$parsed_option_args"
  else
    # --exec is the only door to a click command. A relayed title or filename
    # that lands here -- passthrough is the one position an untrusted value can
    # still reach notify-send as an option -- must not be able to set the hint
    # itself, which is the injection this transport exists to close.
    if [[ $1 == *omarchy-exec-argv* ]]; then
      echo "The click command hint can only be set with --exec, not passed through." >&2
      exit 1
    fi
    args+=("$1")
    shift
  fi
done

# Tag as a user-action toast so it pops through DND.
args+=("-a" "$app_name" "-u" "$urgency")

if [[ -n $glyph ]]; then
  args+=("--hint=string:omarchy-glyph:$glyph")
fi

if [[ -n $image ]]; then
  args+=("--hint=string:image-path:$image")
fi

# The click command travels with the popup as an argv hint the shell runs
# itself, so restored toasts stay clickable and senders don't block on a
# libnotify action (which dies when the shell restarts).
if ((exec_present)); then
  if ((${#exec_args[@]} == 0)); then
    echo "--exec needs a command: --exec <program> [args...]" >&2
    exit 1
  fi
  # A single word with a space is almost always a whole command passed as one
  # quoted string — which would run a program literally named that. Splitting it
  # ourselves is exactly the injection we avoid, so reject it and point at the
  # unquoted form instead.
  if ((${#exec_args[@]} == 1)) && [[ ${exec_args[0]} == *[[:space:]]* ]]; then
    echo "--exec takes the command as separate words, not one quoted string." >&2
    echo "Write:  --exec ${exec_args[0]}" >&2
    exit 1
  fi
  # NUL-delimit into jq so every byte survives as data: jq's own --args would eat
  # a bare "--", and a newline in an arg must not split the vector.
  exec_argv_json=$(printf '%s\0' "${exec_args[@]}" | jq -Rsc 'split("\u0000")[:-1]')
  args+=("--hint=string:omarchy-exec-argv:$exec_argv_json")
fi

# `--` so notify-send reads the headline and description as text. Without it a
# headline beginning with a dash is parsed as options ("-rf x" becomes -r), and
# one shaped like `--hint=string:...` sets a hint of its own.
if [[ -n $description ]]; then
  notify-send "${args[@]}" -- "$headline" "$description"
else
  notify-send "${args[@]}" -- "$headline"
fi