eythaann/Seelen-UI · warning
Trying to execute command that is not allowed: "${command}"
Error message
Trying to execute command that is not allowed: "${command}" What it means
The fancy-toolbar plugin sandbox exposes a restricted invoke() in ActionsScope. Commands executed by plugin/theme-supplied action expressions are checked against a hardcoded ALLOWED_COMMANDS whitelist; anything outside it is rejected with this warning and the call is dropped (the real tauri invoke is never reached). This prevents toolbar plugins from invoking arbitrary backend commands.
Source
Thrown at src/ui/svelte/fancy-toolbar/actionEvaluator.ts:18
import type Sandbox from "@nyariv/sandboxjs";
import { Alignment, FancyToolbarSide, type WidgetId } from "@seelen-ui/lib/types";
import { toPhysicalPixels } from "libs/ui/react/utils/index.ts";
import { invoke, SeelenCommand } from "@seelen-ui/lib";
import { settingsState } from "./state/settings.svelte.ts";
import { evalSanboxed } from "libs/ui/svelte/utils/sandbox.ts";
const ALLOWED_COMMANDS = [
SeelenCommand.SwitchWorkspace,
SeelenCommand.SetVolumeLevel,
SeelenCommand.OpenFile,
];
const ActionsScope = {
SeelenCommand,
invoke(command: SeelenCommand, args?: any) {
if (!ALLOWED_COMMANDS.includes(command)) {
console.warn(`Trying to execute command that is not allowed: "${command}"`);
return;
}
invoke(command, args);
},
open(path: string) {
invoke(SeelenCommand.OpenFile, { path });
},
// trigger is added on other step but is present too
};
export function evalActionSanboxed(
executor: ReturnType<Sandbox["compile"]> | null,
scope: Record<string, any>,
) {
evalSanboxed(executor, { ...scope, ...ActionsScope });
}
export function triggerWidget(widgetId: WidgetId, itemId: string): void {View on GitHub (pinned to dee4aaa940)
Solutions
- Check the plugin's action config and change the command to one present in ALLOWED_COMMANDS in src/ui/svelte/fancy-toolbar/actionEvaluator.ts.
- Update the plugin/theme to a version compatible with your Seelen UI version (command names change between releases).
- If the command is legitimate for the toolbar, add it to ALLOWED_COMMANDS in actionEvaluator.ts (and to slu_commands_declaration in libs/core if new) and rebuild bindings.
- Verify exact spelling/casing of the SeelenCommand enum member used in the action.
Example fix
// before (plugin action)
{ "type": "invoke", "command": "OpenDevTools" }
// after — use a whitelisted command
const ALLOWED_COMMANDS = [SeelenCommand.OpenFile, SeelenCommand.OpenDevTools, ...];
{ "type": "invoke", "command": "OpenDevTools" } // now in ALLOWED_COMMANDS Defensive patterns
Strategy: validation
Validate before calling
import { SeelenCommand } from "@seelen-ui/lib";
const toolbarAllowed = [/* mirror of ALLOWED_COMMANDS in actionEvaluator.ts */];
if (!toolbarAllowed.includes(cmd)) {
throw new Error(`Toolbar actions cannot invoke ${cmd}; allowed: ${toolbarAllowed.join(", ")}`);
} Type guard
function isAllowedToolbarCommand(cmd: unknown): cmd is SeelenCommand {
return typeof cmd === "string" && ALLOWED_COMMANDS.includes(cmd as SeelenCommand);
} Prevention
- Consult ALLOWED_COMMANDS in src/ui/svelte/fancy-toolbar/actionEvaluator.ts before using a command in a plugin action.
- Keep plugin command usage in sync with the Seelen UI version you target.
- Centralize allowed commands in one shared constant to avoid per-surface drift.
- Log the rejected command in dev builds to catch typos early.
When it happens
Trigger: A toolbar plugin or theme action calls invoke("SomeCommand") where SomeCommand is not in actionEvaluator.ts's ALLOWED_COMMANDS — typically a custom command, a command renamed in a Seelen UI update, or a typo in the action config.
Common situations: Third-party toolbar plugin using a SeelenCommand that was never whitelisted; a Seelen UI version bump renamed/removed a command the plugin uses; plugin author referencing an internal command from another module (e.g. weg) that fancy-toolbar does not allow.
Related errors
AI-assisted analysis of eythaann/Seelen-UI@dee4aaa940 (2026-09-03).
Data as JSON: /api/errors/460b8e44ad3104a3.
Report an issue: GitHub.