eythaann/Seelen-UI · warning
Trying to execute command that is not allowed: "${command}"
Error message
Trying to execute command that is not allowed: "${command}" What it means
The weg (widget bar) plugin sandbox in pluginEval.svelte.ts exposes the same restricted ActionsScope.invoke as the fancy-toolbar. Plugin-supplied expressions may only execute commands in this file's ALLOWED_COMMANDS whitelist; anything else is warned and silently ignored so plugins cannot invoke arbitrary Tauri backend commands.
Source
Thrown at src/ui/svelte/weg/pluginEval.svelte.ts:17
import type Sandbox from "@nyariv/sandboxjs";
import { Alignment, SeelenWegSide, type WidgetId } from "@seelen-ui/lib/types";
import { invoke, SeelenCommand } from "@seelen-ui/lib";
import { settingsState } from "./state/settings.svelte.ts";
import { evalSanboxed } from "libs/ui/svelte/utils/sandbox.ts";
const ALLOWED_COMMANDS: SeelenCommand[] = [
SeelenCommand.OpenFile,
SeelenCommand.ShowDesktop,
SeelenCommand.ShowStartMenu,
];
const ActionsScope = {
SeelenCommand,
invoke(command: SeelenCommand, args?: any) {
if (!ALLOWED_COMMANDS.includes(command)) {
console.warn(`Trying to execute command that is not allowed: "${command}"`);
return;
}
invoke(command, args);
},
};
export function evalActionSanboxed(
executor: ReturnType<Sandbox["compile"]> | null,
scope: Record<string, any>,
): void {
evalSanboxed(executor, { ...scope, ...ActionsScope });
}
export function triggerWidget(widgetId: WidgetId, itemId: string): void {
if (typeof widgetId !== "string") {
return;
}
View on GitHub (pinned to dee4aaa940)
Solutions
- Change the plugin action to use a command present in ALLOWED_COMMANDS in src/ui/svelte/weg/pluginEval.svelte.ts.
- If the command is legitimately needed in the widget bar, add it to that file's ALLOWED_COMMANDS array (declared as SeelenCommand[]) and rebuild.
- Update the plugin to match your Seelen UI version's command names.
- Remember the allowlists are per-surface: a command allowed in fancy-toolbar may not be allowed in weg — check the right file.
Example fix
// before const ALLOWED_COMMANDS: SeelenCommand[] = [SeelenCommand.OpenFile, SeelenCommand.Quit]; // plugin calls invoke(SeelenCommand.RunProgram) -> rejected // after const ALLOWED_COMMANDS: SeelenCommand[] = [SeelenCommand.OpenFile, SeelenCommand.Quit, SeelenCommand.RunProgram];
Defensive patterns
Strategy: validation
Validate before calling
const wegAllowed = [/* mirror of ALLOWED_COMMANDS in pluginEval.svelte.ts */];
if (!wegAllowed.includes(cmd)) {
throw new Error(`Weg plugin actions cannot invoke ${cmd}`);
} Type guard
function isAllowedWegCommand(cmd: unknown): cmd is SeelenCommand {
return typeof cmd === "string" && ALLOWED_COMMANDS.includes(cmd as SeelenCommand);
} Prevention
- Each sandbox has its own whitelist — check pluginEval.svelte.ts specifically for weg plugins.
- Do not assume a command whitelisted for the toolbar is allowed in the widget bar.
- Re-test plugins after Seelen UI upgrades since command names may change.
- Add new commands to ALLOWED_COMMANDS deliberately, reviewing the security implication.
When it happens
Trigger: A weg widget/plugin action or menu handler (launchItem, handleBarMenuClick, triggerWidget, etc.) evaluates an expression calling invoke(command) with a command not present in pluginEval.svelte.ts's ALLOWED_COMMANDS — e.g. a new backend command, a renamed command after an update, or a typo.
Common situations: Custom weg plugin invoking a SeelenCommand only whitelisted for the toolbar (the two files have separate lists); plugin built against an older/newer Seelen UI where the command name changed; plugin author expecting all SeelenCommands to be available inside the bar sandbox.
Related errors
AI-assisted analysis of eythaann/Seelen-UI@dee4aaa940 (2026-09-03).
Data as JSON: /api/errors/0e831f5598be896c.
Report an issue: GitHub.