Nocode 96/cmd runner

[nocode-96]

Plugin

• Id: nocode-96/cmd-runner
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Command Runner adds a top-bar widget that lets users save custom CLI commands and execute them silently in the background with a single click — no terminal window pops up. Commands that require sudo store the password once at save time so subsequent runs are one-click. Completed runs show their stdout/stderr and exit code inside a collapsible log view directly in the panel.

External dependencies

• sudo: Required for executing commands with root/elevated privileges when the sudo option is enabled.
• secret-tool (part of libsecret / libsecret-tools): Required for securely storing and retrieving sudo passwords from the system keyring (GNOME Keyring, KWallet, KeePassXC, etc.) without storing credentials on disk or exposing them in process command line arguments (/proc/cmdline).

Testing

• How it was exercised:

  • Widget left-click opens/closes the panel.
  • Added, edited, and deleted commands via the Add/Edit form.
  • Ran a non-sudo command (echo hello) and verified stdout appeared in the log view.
  • Ran a sudo command and confirmed the password is cached and not re-prompted on subsequent runs.
  • Toggled show_label and show_toast settings and confirmed the widget and notifications respond correctly.
  • Verified that the sudo password field is empty (not pre-filled) when opening the Edit form for an existing command.
  • Confirmed commands.json stores passwords obfuscated (prefixed with enc:) and not as plain text.

• Tested on Niri

• Tested on Hyprland

• Tested on Sway

• Tested on another compositor:

• Noctalia version tested against: v5.0.0 (beta9-4-g7fd9f7bfa960)

• Plugin API level: 9

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the README template, documents every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - cmd-runner/commands.json:1
   The PR commits a real sudo password and ships it to every user. The second
   stored command ("hda", "sudo hda-verb /dev/snd/hwC1D0 ...") carries
   "sudoPassword":"enc:oKOYrQ==", which decrypts to "2459" using the plugin's
   own scheme. loadCommands (cmd-runner/service.luau:88) loads this file as the
   initial command list on install, so the author's stored sudo password is
   distributed in every materialized plugin directory. The "encryption" is a
   fixed-key byte-shift over a hardcoded salt, SALT =
   "noctalia_cmd_runner_salt_5f8a" (cmd-runner/service.luau:4), plus base64;
   the key is published in the same repository, so any process or plugin that
   can read commands.json recovers the password. README.md:39 and the plugin
   description call this "encrypted locally" and a "secure sudo password
   cache", which materially overstates the protection. Fix: remove
   commands.json from the repo and from the merged tree, rotate the password
   if it is real (or reused anywhere), and stop storing sudo passwords in a
   recoverable file: use the system keyring (secret-tool) or sudo credential
   caching (sudo -v) instead.

2. non-blocking - cmd-runner/service.luau:181
   The decrypted password is embedded in the shell command string:
   "printf '%s\n' '' | sudo -S -p '' -- ". runAsync passes
   this string as argv to /bin/sh -c (luau_host.cpp:267), so the password is
   readable from /proc//cmdline (ps output) by any local user while the
   command runs. Transient, but a real exposure vector independent of the
   storage scheme.

3. blocking - cmd-runner/panel.luau:110-136
   Several user-visible strings are hardcoded German while translations exist:
   "z.B. System Update", "z.B. apt update && apt upgrade -y", "[✓] Sudo (root)
   erforderlich", "Sudo-Passwort...", "Passwort gespeichert (leer lassen zum
   Behalten)", and the log status lines "Status: Success (Code 0)" /
   "Status: Failed" at panel.luau:253-255. English and other locales see
   German text in the form and logs.

4. blocking - cmd-runner/plugin.toml:9
   dependencies = [] and README states "No special system requirements", but
   the plugin shells out to "sudo" (sudo -S pattern) for sudo commands and the
   bundled demo command uses "sleep". sudo is mentioned in the PR description
   but is neither declared in the manifest nor in the README Requirements
   section.

5. blocking - cmd-runner/service.luau:85
   commands.json is read and written under noctalia.pluginDir() instead of the
   dedicated noctalia.pluginDataDir(). The plugin directory is a materialized
   checkout; storing mutable user data (commands plus stored passwords) there
   mixes it with plugin code and risks loss when the plugin updates and the
   directory is re-materialized.