eythaann/Seelen-UI · warning

Trying to execute command that is not allowed: "${command}"

Error message

Trying to execute command that is not allowed: "${command}"

What it means

The weg (widget bar) plugin sandbox in pluginEval.svelte.ts exposes the same restricted ActionsScope.invoke as the fancy-toolbar. Plugin-supplied expressions may only execute commands in this file's ALLOWED_COMMANDS whitelist; anything else is warned and silently ignored so plugins cannot invoke arbitrary Tauri backend commands.

Source

Thrown at src/ui/svelte/weg/pluginEval.svelte.ts:17

import type Sandbox from "@nyariv/sandboxjs";
import { Alignment, SeelenWegSide, type WidgetId } from "@seelen-ui/lib/types";
import { invoke, SeelenCommand } from "@seelen-ui/lib";
import { settingsState } from "./state/settings.svelte.ts";
import { evalSanboxed } from "libs/ui/svelte/utils/sandbox.ts";

const ALLOWED_COMMANDS: SeelenCommand[] = [
  SeelenCommand.OpenFile,
  SeelenCommand.ShowDesktop,
  SeelenCommand.ShowStartMenu,
];

const ActionsScope = {
  SeelenCommand,
  invoke(command: SeelenCommand, args?: any) {
    if (!ALLOWED_COMMANDS.includes(command)) {
      console.warn(`Trying to execute command that is not allowed: "${command}"`);
      return;
    }
    invoke(command, args);
  },
};

export function evalActionSanboxed(
  executor: ReturnType<Sandbox["compile"]> | null,
  scope: Record<string, any>,
): void {
  evalSanboxed(executor, { ...scope, ...ActionsScope });
}

export function triggerWidget(widgetId: WidgetId, itemId: string): void {
  if (typeof widgetId !== "string") {
    return;
  }

View on GitHub (pinned to dee4aaa940)

Solutions

  1. Change the plugin action to use a command present in ALLOWED_COMMANDS in src/ui/svelte/weg/pluginEval.svelte.ts.
  2. If the command is legitimately needed in the widget bar, add it to that file's ALLOWED_COMMANDS array (declared as SeelenCommand[]) and rebuild.
  3. Update the plugin to match your Seelen UI version's command names.
  4. Remember the allowlists are per-surface: a command allowed in fancy-toolbar may not be allowed in weg — check the right file.

Example fix

// before
const ALLOWED_COMMANDS: SeelenCommand[] = [SeelenCommand.OpenFile, SeelenCommand.Quit];
// plugin calls invoke(SeelenCommand.RunProgram) -> rejected

// after
const ALLOWED_COMMANDS: SeelenCommand[] = [SeelenCommand.OpenFile, SeelenCommand.Quit, SeelenCommand.RunProgram];
Defensive patterns

Strategy: validation

Validate before calling

const wegAllowed = [/* mirror of ALLOWED_COMMANDS in pluginEval.svelte.ts */];
if (!wegAllowed.includes(cmd)) {
  throw new Error(`Weg plugin actions cannot invoke ${cmd}`);
}

Type guard

function isAllowedWegCommand(cmd: unknown): cmd is SeelenCommand {
  return typeof cmd === "string" && ALLOWED_COMMANDS.includes(cmd as SeelenCommand);
}

Prevention

When it happens

Trigger: A weg widget/plugin action or menu handler (launchItem, handleBarMenuClick, triggerWidget, etc.) evaluates an expression calling invoke(command) with a command not present in pluginEval.svelte.ts's ALLOWED_COMMANDS — e.g. a new backend command, a renamed command after an update, or a typo.

Common situations: Custom weg plugin invoking a SeelenCommand only whitelisted for the toolbar (the two files have separate lists); plugin built against an older/newer Seelen UI where the command name changed; plugin author expecting all SeelenCommands to be available inside the bar sandbox.

Related errors


AI-assisted analysis of eythaann/Seelen-UI@dee4aaa940 (2026-09-03). Data as JSON: /api/errors/0e831f5598be896c. Report an issue: GitHub.