[P2] Add allowlisted script-based metadata adapters #34

New issue

Closed

opened 2026-07-18 00:03:30 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-18 00:03:30 +00:00

(Migrated from github.com)

Goal

Support window managers and desktop tools that expose metadata through user-supplied scripts without creating an arbitrary command-execution surface.

Requirements

Scripts must be explicitly configured by absolute path and owner-only permissions.
Fixed argument templates; no shell execution or interpolation.
Timeouts, output-size limits, environment allowlist, and sanitized working directory.
Strict versioned JSON output schema.
Capability declarations and source provenance.
Optional hash pinning so modified scripts are disabled until re-approved.
Failures degrade to another metadata source and never permit capture by default when policy requires the script.

Acceptance criteria

Unlisted, writable-by-others, changed, malformed, or timed-out scripts are rejected.
Captured window values cannot alter command arguments.
Output is redacted and policy checked before use.
Security tests cover command injection, path replacement, symlinks, oversized output, and hostile environment variables.

Depends on

## Goal Support window managers and desktop tools that expose metadata through user-supplied scripts without creating an arbitrary command-execution surface. ## Requirements - Scripts must be explicitly configured by absolute path and owner-only permissions. - Fixed argument templates; no shell execution or interpolation. - Timeouts, output-size limits, environment allowlist, and sanitized working directory. - Strict versioned JSON output schema. - Capability declarations and source provenance. - Optional hash pinning so modified scripts are disabled until re-approved. - Failures degrade to another metadata source and never permit capture by default when policy requires the script. ## Acceptance criteria - Unlisted, writable-by-others, changed, malformed, or timed-out scripts are rejected. - Captured window values cannot alter command arguments. - Output is redacted and policy checked before use. - Security tests cover command injection, path replacement, symlinks, oversized output, and hostile environment variables. ## Depends on - #13 - #17