`launch_session_terminal` takes an arbitrary string from the renderer and
hands it to a shell. External audits report this as arbitrary command
execution over IPC. Document it as a known, accepted risk instead of
leaving it to be re-reported every audit cycle.
The precondition for exploiting it is control over the renderer, which
already implies local code execution as the user -- at which point going
through this command grants nothing extra. The renderer is treated as a
trusted boundary, supported by four facts each verified against the tree:
- the only `dangerouslySetInnerHTML` (ProviderIcon) takes an icon *name*,
gated by `hasIcon()`, and reads the SVG from a build-time registry;
neither users nor deep links can supply markup
- no `eval` / `new Function` anywhere in the frontend
- `frontendDist` points at the bundled output, the webview loads no
remote origin, and there are no `<iframe>` / `<webview>` elements
- CSP is `script-src 'self'` -- no inline and no external scripts
The note lists what invalidates the conclusion, so the exemption is
falsifiable rather than a standing opinion: rendering network- or
config-sourced rich text, embedding a webview or navigating to a remote
origin, relaxing `script-src`, or introducing any way to execute
external code in the renderer. Any of those and this command must be
changed to accept a session identifier and rebuild the command in the
backend.
It also states explicitly that `cwd` is *not* covered. That value comes
from disk scanning and can legitimately contain `$(...)` regardless of
renderer trust, which is why it is escaped rather than exempted. Without
that sentence "the renderer is trusted" invites being read as "nothing
on this path needs handling".
- Remove terminal selector from Session Manager page
- Backend now reads terminal preference from global settings
- Add terminal name mapping (iterm2 → iterm) for compatibility
- Add WezTerm support to macOS terminal options
- Add WezTerm translations for zh/en/ja
* feat: init session manger
* feat: persist selected app to localStorage
- Save app selection when switching providers
- Restore last selected app on page load
* feat: persist current view to localStorage
- Save view selection when switching tabs
- Restore last selected view on page load
* styles: update ui
* feat: Improve macOS Terminal activation and refactor Kitty launch to use command with user's default shell.
* fix: session view
* feat: toc
* feat: Implement FlexSearch for improved session search functionality.
* feat: Redesign session manager search and filter UI for a more compact and dynamic experience.
* refactor: modularize session manager by extracting components and utility functions into dedicated files.
* feat: Enhance session terminal launching with support for iTerm2, Ghostty, WezTerm, and Alacritty, including UI and custom configuration options.
* feat: Conditionally render terminal selection and resume session buttons only on macOS.
Jason