{"record":{"id":"0e831f5598be896c","repo":"eythaann/Seelen-UI","slug":"trying-to-execute-command-that-is-not-allowed-0e831f","errorCode":null,"errorMessage":"Trying to execute command that is not allowed: \"${command}\"","messagePattern":"Trying to execute command that is not allowed: \"(.+?)\"","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/ui/svelte/weg/pluginEval.svelte.ts","lineNumber":17,"sourceCode":"import type Sandbox from \"@nyariv/sandboxjs\";\nimport { Alignment, SeelenWegSide, type WidgetId } from \"@seelen-ui/lib/types\";\nimport { invoke, SeelenCommand } from \"@seelen-ui/lib\";\nimport { settingsState } from \"./state/settings.svelte.ts\";\nimport { evalSanboxed } from \"libs/ui/svelte/utils/sandbox.ts\";\n\nconst ALLOWED_COMMANDS: SeelenCommand[] = [\n  SeelenCommand.OpenFile,\n  SeelenCommand.ShowDesktop,\n  SeelenCommand.ShowStartMenu,\n];\n\nconst ActionsScope = {\n  SeelenCommand,\n  invoke(command: SeelenCommand, args?: any) {\n    if (!ALLOWED_COMMANDS.includes(command)) {\n      console.warn(`Trying to execute command that is not allowed: \"${command}\"`);\n      return;\n    }\n    invoke(command, args);\n  },\n};\n\nexport function evalActionSanboxed(\n  executor: ReturnType<Sandbox[\"compile\"]> | null,\n  scope: Record<string, any>,\n): void {\n  evalSanboxed(executor, { ...scope, ...ActionsScope });\n}\n\nexport function triggerWidget(widgetId: WidgetId, itemId: string): void {\n  if (typeof widgetId !== \"string\") {\n    return;\n  }\n","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/eythaann/Seelen-UI/blob/dee4aaa94066c5d0888ab25554864862fc47be15/src/ui/svelte/weg/pluginEval.svelte.ts#L1-L35","documentation":"The weg (widget bar) plugin sandbox in pluginEval.svelte.ts exposes the same restricted ActionsScope.invoke as the fancy-toolbar. Plugin-supplied expressions may only execute commands in this file's ALLOWED_COMMANDS whitelist; anything else is warned and silently ignored so plugins cannot invoke arbitrary Tauri backend commands.","triggerScenarios":"A weg widget/plugin action or menu handler (launchItem, handleBarMenuClick, triggerWidget, etc.) evaluates an expression calling invoke(command) with a command not present in pluginEval.svelte.ts's ALLOWED_COMMANDS — e.g. a new backend command, a renamed command after an update, or a typo.","commonSituations":"Custom weg plugin invoking a SeelenCommand only whitelisted for the toolbar (the two files have separate lists); plugin built against an older/newer Seelen UI where the command name changed; plugin author expecting all SeelenCommands to be available inside the bar sandbox.","solutions":["Change the plugin action to use a command present in ALLOWED_COMMANDS in src/ui/svelte/weg/pluginEval.svelte.ts.","If the command is legitimately needed in the widget bar, add it to that file's ALLOWED_COMMANDS array (declared as SeelenCommand[]) and rebuild.","Update the plugin to match your Seelen UI version's command names.","Remember the allowlists are per-surface: a command allowed in fancy-toolbar may not be allowed in weg — check the right file."],"exampleFix":"// before\nconst ALLOWED_COMMANDS: SeelenCommand[] = [SeelenCommand.OpenFile, SeelenCommand.Quit];\n// plugin calls invoke(SeelenCommand.RunProgram) -> rejected\n\n// after\nconst ALLOWED_COMMANDS: SeelenCommand[] = [SeelenCommand.OpenFile, SeelenCommand.Quit, SeelenCommand.RunProgram];","handlingStrategy":"validation","validationCode":"const wegAllowed = [/* mirror of ALLOWED_COMMANDS in pluginEval.svelte.ts */];\nif (!wegAllowed.includes(cmd)) {\n  throw new Error(`Weg plugin actions cannot invoke ${cmd}`);\n}","typeGuard":"function isAllowedWegCommand(cmd: unknown): cmd is SeelenCommand {\n  return typeof cmd === \"string\" && ALLOWED_COMMANDS.includes(cmd as SeelenCommand);\n}","tryCatchPattern":null,"preventionTips":["Each sandbox has its own whitelist — check pluginEval.svelte.ts specifically for weg plugins.","Do not assume a command whitelisted for the toolbar is allowed in the widget bar.","Re-test plugins after Seelen UI upgrades since command names may change.","Add new commands to ALLOWED_COMMANDS deliberately, reviewing the security implication."],"tags":["security","allowlist","plugin","weg","invoke"],"backgroundTag":"command-not-allowed","analyzedSha":"dee4aaa94066c5d0888ab25554864862fc47be15","analyzedAt":"2026-09-03T10:20:37.842Z","contentChangedAt":"2026-09-03T10:20:37.842Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}