Decksters lab/palette creator

[decksters-lab]

Plugin

• Id: decksters-lab/palette-creator
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

External dependencies

Testing

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor: Wayfire, MangoWM
• Noctalia version tested against: 5.0.0.r5173.g3854c86e2-1
• Plugin API level: 9

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[decksters-lab]

It was tested on Hyprland, Wayfire and MangoWM. As its listed in the actual description. Sorry. This is my first pull request ever.

[ItsLemmy]

1. blocking - palette-creator/panel.luau:646

The free-form palette name is appended directly to a filesystem path and interpolated into a shell
command at palette-creator/panel.luau:654. String-form noctalia.runAsync executes through /bin/sh
-c, as confirmed at ../noctalia-shell/src/scripting/luau_host.cpp:265.

A name containing "../" can overwrite writable JSON files outside the palette directory. Shell
metacharacters can execute arbitrary commands in the user's session. Restrict names to a safe
basename and invoke runAsync with an argv table instead of a command string.

2. non-blocking - palette-creator/panel.luau:476

revertChanges and loadPaletteByName at palette-creator/panel.luau:521 reference applyPreview
before its local declaration at palette-creator/panel.luau:527. Those references resolve to the
global name, not the later local function. Resetting or loading while preview is active therefore
attempts to call nil instead of updating the preview.

Forward-declare local applyPreview before these functions, then assign its implementation at the
current declaration.

[decksters-lab]

Thank you for the detailed info on what I needed to change. I'm sorry for the mistakes, but I've updated the plugin to address both the blocking and non-blocking issues:

    Path Traversal & Shell Metacharacter Safety (panel.luau):
        Names are sanitized to safe alphanumeric basenames (sanitizeName).
        noctalia.runAsync now passes arguments in an argv array ({"noctalia", "msg", "color-scheme-set", "custom", name}) rather than interpolating shell strings.

    Function Declaration Order (panel.luau):
        Forward-declared applyPreview before revertChanges and loadPaletteByName so they resolve to the local function as intended.

also:
UI Improvements:
Replaced the dropdown selector (ui.select) with an inline scrollable list (ui.scroll) bounded to height = 260. This solves Wayland layer-shell popup focus issues and keeps the palette list cleanly contained with a scrollbar.

[ItsLemmy]

No worries. Code reviews are not accusation.
I don't see any new commit since my last comment tho, so I'm marking this back to draft until you push the new code.

[decksters-lab]

We are getting there. lol. thanks.