{"record":{"id":"460b8e44ad3104a3","repo":"eythaann/Seelen-UI","slug":"trying-to-execute-command-that-is-not-allowed","errorCode":null,"errorMessage":"Trying to execute command that is not allowed: \"${command}\"","messagePattern":"Trying to execute command that is not allowed: \"(.+?)\"","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/ui/svelte/fancy-toolbar/actionEvaluator.ts","lineNumber":18,"sourceCode":"import type Sandbox from \"@nyariv/sandboxjs\";\nimport { Alignment, FancyToolbarSide, type WidgetId } from \"@seelen-ui/lib/types\";\nimport { toPhysicalPixels } from \"libs/ui/react/utils/index.ts\";\nimport { invoke, SeelenCommand } from \"@seelen-ui/lib\";\nimport { settingsState } from \"./state/settings.svelte.ts\";\nimport { evalSanboxed } from \"libs/ui/svelte/utils/sandbox.ts\";\n\nconst ALLOWED_COMMANDS = [\n  SeelenCommand.SwitchWorkspace,\n  SeelenCommand.SetVolumeLevel,\n  SeelenCommand.OpenFile,\n];\n\nconst ActionsScope = {\n  SeelenCommand,\n  invoke(command: SeelenCommand, args?: any) {\n    if (!ALLOWED_COMMANDS.includes(command)) {\n      console.warn(`Trying to execute command that is not allowed: \"${command}\"`);\n      return;\n    }\n    invoke(command, args);\n  },\n  open(path: string) {\n    invoke(SeelenCommand.OpenFile, { path });\n  },\n  // trigger is added on other step but is present too\n};\n\nexport function evalActionSanboxed(\n  executor: ReturnType<Sandbox[\"compile\"]> | null,\n  scope: Record<string, any>,\n) {\n  evalSanboxed(executor, { ...scope, ...ActionsScope });\n}\n\nexport function triggerWidget(widgetId: WidgetId, itemId: string): void {","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/eythaann/Seelen-UI/blob/dee4aaa94066c5d0888ab25554864862fc47be15/src/ui/svelte/fancy-toolbar/actionEvaluator.ts#L1-L36","documentation":"The fancy-toolbar plugin sandbox exposes a restricted invoke() in ActionsScope. Commands executed by plugin/theme-supplied action expressions are checked against a hardcoded ALLOWED_COMMANDS whitelist; anything outside it is rejected with this warning and the call is dropped (the real tauri invoke is never reached). This prevents toolbar plugins from invoking arbitrary backend commands.","triggerScenarios":"A toolbar plugin or theme action calls invoke(\"SomeCommand\") where SomeCommand is not in actionEvaluator.ts's ALLOWED_COMMANDS — typically a custom command, a command renamed in a Seelen UI update, or a typo in the action config.","commonSituations":"Third-party toolbar plugin using a SeelenCommand that was never whitelisted; a Seelen UI version bump renamed/removed a command the plugin uses; plugin author referencing an internal command from another module (e.g. weg) that fancy-toolbar does not allow.","solutions":["Check the plugin's action config and change the command to one present in ALLOWED_COMMANDS in src/ui/svelte/fancy-toolbar/actionEvaluator.ts.","Update the plugin/theme to a version compatible with your Seelen UI version (command names change between releases).","If the command is legitimate for the toolbar, add it to ALLOWED_COMMANDS in actionEvaluator.ts (and to slu_commands_declaration in libs/core if new) and rebuild bindings.","Verify exact spelling/casing of the SeelenCommand enum member used in the action."],"exampleFix":"// before (plugin action)\n{ \"type\": \"invoke\", \"command\": \"OpenDevTools\" }\n\n// after — use a whitelisted command\nconst ALLOWED_COMMANDS = [SeelenCommand.OpenFile, SeelenCommand.OpenDevTools, ...];\n{ \"type\": \"invoke\", \"command\": \"OpenDevTools\" } // now in ALLOWED_COMMANDS","handlingStrategy":"validation","validationCode":"import { SeelenCommand } from \"@seelen-ui/lib\";\nconst toolbarAllowed = [/* mirror of ALLOWED_COMMANDS in actionEvaluator.ts */];\nif (!toolbarAllowed.includes(cmd)) {\n  throw new Error(`Toolbar actions cannot invoke ${cmd}; allowed: ${toolbarAllowed.join(\", \")}`);\n}","typeGuard":"function isAllowedToolbarCommand(cmd: unknown): cmd is SeelenCommand {\n  return typeof cmd === \"string\" && ALLOWED_COMMANDS.includes(cmd as SeelenCommand);\n}","tryCatchPattern":null,"preventionTips":["Consult ALLOWED_COMMANDS in src/ui/svelte/fancy-toolbar/actionEvaluator.ts before using a command in a plugin action.","Keep plugin command usage in sync with the Seelen UI version you target.","Centralize allowed commands in one shared constant to avoid per-surface drift.","Log the rejected command in dev builds to catch typos early."],"tags":["security","allowlist","plugin","toolbar","invoke"],"backgroundTag":"command-not-allowed","analyzedSha":"dee4aaa94066c5d0888ab25554864862fc47be15","analyzedAt":"2026-09-03T10:20:37.842Z","contentChangedAt":"2026-09-03T10:20:37.842Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}