@nonbot/cli 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @nonbot/cli changelog
 
+## 0.10.1 (2026-09-09) — SECURITY
+
+- **Hardens the tmux theme validator; upgrade if you run `nonbot daemon`.**
+  `isSafeTmuxConf` guards a server-supplied cosmetic theme before the daemon
+  writes it to disk and hands it to `tmux source-file`, which EXECUTES it. It
+  allowlisted the tmux *directive* (`set` / `setw` / `set-option` /
+  `set-window-option`) and denylisted three option names. tmux stores HOOKS as
+  options, and `man tmux` is explicit that `set-hook` and `set-option` are
+  equivalent for them — so a theme line naming a hook used an allowlisted
+  directive, named an option the denylist did not cover, and contained none of
+  the patterns the validator screens for (`#(`, `$(`, a backtick, a backslash, a
+  `;`). It passed every check, and tmux ran the hook's command on the next
+  matching pane event.
+
+  A denylist of option names cannot be complete here: it would have to enumerate
+  every hook tmux has now and every one it adds later. The option NAME is now
+  ALLOWLISTED instead — presentational suffixes (`-style`, `-format`, `-bg`,
+  `-fg`, `-attr`, `-colour`, `-color`, `-length`) plus a short explicit set for
+  the cosmetic options that have no such suffix — which refuses every hook by
+  construction. `lock-command`, `copy-command` and `editor` joined the forbidden
+  set alongside `default-command`, `default-shell` and `command-alias`.
+
+  Themes produced by the normal generator are unaffected. +20 tests
+  (`tests/tmux-theme-allowlist.test.ts`) covering real generated output and 13
+  rejected payloads.
+
 ## 0.10.0 (2026-09-04)
 
 - At-exit transcript for fast-exit runs (memory C32, 2026-09-04): the daemon keeps a rolling

package/dist/lib/payload-validator.js

@@ -147,7 +147,22 @@ const TMUX_SAFE_DIRECTIVES = new Set([
 ]);
 const TMUX_FORBIDDEN_OPTIONS = new Set([
     'default-command', 'default-shell', 'command-alias',
+    'lock-command', 'copy-command', 'editor',
 ]);
+const TMUX_SAFE_OPTION_SUFFIXES = [
+    '-style', '-format', '-bg', '-fg', '-attr', '-colour', '-color', '-length',
+];
+const TMUX_SAFE_OPTION_NAMES = new Set([
+    'status', 'status-position', 'status-justify', 'status-interval',
+    'window-status-separator', 'pane-border-status', 'pane-border-indicators',
+]);
+function isSafeTmuxOptionName(name) {
+    if (TMUX_FORBIDDEN_OPTIONS.has(name))
+        return false;
+    if (TMUX_SAFE_OPTION_NAMES.has(name))
+        return true;
+    return TMUX_SAFE_OPTION_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
 export function isSafeTmuxConf(conf) {
     for (const rawLine of conf.split(/\r?\n/)) {
         const line = rawLine.trim();
@@ -170,6 +185,9 @@ export function isSafeTmuxConf(conf) {
                 if (TMUX_FORBIDDEN_OPTIONS.has(tok))
                     return false;
             }
+            const optionName = tokens.slice(1).find((t) => !t.startsWith('-'));
+            if (!optionName || !isSafeTmuxOptionName(optionName))
+                return false;
         }
     }
     return true;

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.10.0';
+export const VERSION = '0.10.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nonbot/cli",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "type": "module",
   "description": "The local host for non.bot ▶ Run — opens a terminal on your machine and starts the work in your linked repo.",
   "license": "UNLICENSED",