Repository navigation
Input ownership: a line queued during a command that is not a command waits for approval (#426) - #448
Merged
Conversation
… waits for approval (#426) The documented #426 limit: a reply typed and entered before a question with no prompt exists is queued (nothing has asked yet). If that read gives up before any look sees it and the command succeeds, the entry ran as a shell command. Looks on a quiet command are seconds apart, and macOS cannot report a program's read at all, so a timed read is easily missed. Reproduced live in zsh, Bash and Fish with `sleep 2; perl -e 'alarm 1; <STDIN>'; true`: the typed "reply" ran and entered NMSh's journal (and so the shell's history and its "command not found" output). A line entered with a plain Enter while a command runs, whose first command word is not one this shell knows (alias, function, builtin, keyword, or an executable by path or on PATH, from the same classifier the highlighter uses), would only fail as a command. It now waits for approval and a note says why without repeating the text; an older session service without per-entry approval pauses the queue instead. Real commands typed ahead still run after the command, as before; Ctrl+Q stays an explicit "queue this command". The approval note for a question NMSh later sees still counts entries already waiting. Residual: a reply that is itself a command name ("yes") typed before an unseen timed read can still run; documented. Tests: inputOwnershipSecrets (residual case fails first; ordinary type-ahead unchanged), inputOwnershipSecretsLive (zsh, Bash, Fish; fails first on all three). Deterministic input, queue and paste suites 319/319.
…ead is never held (#426) CI on 1972110: commandQueueLive held `qfn() { echo "fn-$1"; }` (zsh, Bash) for approval, because the name being defined is not yet a command. A function definition, and a line with no command word at all (an assignment, a group), are the person's shell input and run as before; only a first command word the shell does not know waits for approval. The live residual test's control used the reading command too: Linux reports that read, and by design every entry typed during a command that asked waits for approval, a real command included. The control now types ahead during a command that reads nothing.
raiseCatError
force-pushed
the
fix/v022-queued-reply-approval
branch
from
October 19, 2026 12:21
31fab98 to
3d606e7
Compare
raiseCatError
added a commit
that referenced
this pull request
Oct 19, 2026
…, recorded QA, targeted retests - CHANGELOG [0.22.0]: HTML in /view (#454); Ask shell tasks and suggestions (#446); mixed NMSh/shell pastes (#450); the queue while a program waits (#452); the Markdown wrap fix; Security: a reply entered before an unseen read never runs as a command (#426) and an older session service says its protections are off. Known limitations reworded to what the code now does: the #426 residual is a reply that is itself a command name; on Fish 3 NMSh's markers are no longer lost (#449), Fish's own builtin output still can be (#443); suggestion quality depends on the model; /view's HTML subset. - docs/testing/v022-physical-qa.md: results as reported on 68c1cbb (sitting A PASS except A12 FAIL; B1, B3 PASS; B5, B8, B9, B10, C2, C7, C9, C10, D11 NOT RUN, user waived/deferred); what the reduced coverage does and does not prove; A9 steps 6-7 updated for #448; retests R1-R4 on a separate build, so 68c1cbb's QA build stays as it was. - scripts/qa/v022-retest-fixtures.sh: adds work/retest/ and nmsh2 to the existing QA folder, never changing what is there. - Ledger: findings, root causes, evidence, integration and decisions.
Owner
Author
This was referenced Oct 19, 2026
Merged
Composer: a block mixing NMSh and shell commands is reviewed, then offered one at a time (#450)
#451
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #426 (security review for v0.22 stabilization).
The residual, reproduced live: a reply typed and entered before a question with no prompt exists is queued, since nothing has asked yet. If that read gives up before any look sees it and the command succeeds, the entry ran as a shell command. Looks on a quiet command are seconds apart, and macOS can't report a program's read at all. With
sleep 2; perl -e 'alarm 1; <STDIN>'; truein zsh, Bash and Fish, the typed "reply" ran and entered NMSh's journal, which also puts it in the shell's history and its "command not found" output. A password typed this way would land on disk.Change: a line entered with a plain Enter while a command runs, whose first command word is not one this shell knows, waits for approval instead of running by itself. "Knows" means an alias, function, builtin, keyword, or an executable by path or on PATH, using the classifier the highlighter already uses. Such a line could only fail as a command anyway. The note says why without repeating the text. An older session service without per-entry approval pauses the queue instead.
Unchanged: real commands typed ahead still run after the command. Ctrl+Q stays an explicit "queue this". Entries queued before the command, Tab/Esc/Ctrl+C on held typing, and the approval rule when a question is seen all behave as before.
Residual (documented): a reply that is itself a command name (
yes) typed before an unseen timed read can still run.Tests
inputOwnershipSecrets: the residual case fails first; an ordinary type-ahead control passes before and after.inputOwnershipSecretsLive: zsh, Bash and Fish; fails first on all three, 7/7 after.Physical retest: A9 / B9 / C9 step "queued input" only (see #444).