Remove predictable /tmp/omarchy-key-visualizer.json fallback that exposed
captured key combinations and allowed symlink redirection when
XDG_RUNTIME_DIR is absent. Introduce fail-closed behaviour: disable
capture if XDG_RUNTIME_DIR is missing, equals /tmp, is not absolute,
not owned or not 0700.
Add secure_write with O_NOFOLLOW mitigation (test ! -L), atomic
tmp+rename and chmod 600 to prevent world-readable leaks and TOCTOU
races. Apply same guard to QML statePath/superPath and Panel nudge
writes (umask 077, chmod 600, symlink check).
Fixes security review at 790b07c0c9:
key-visualizer.lua:15-17,141-145
The display now only updates on key-down (the combo grows as you press)
and when the last key is released (the empty payload starts the linger
with the last full combo). Intermediate releases no longer shrink the
display, so the order you let go of a shortcut doesn't matter: Ctrl+Shift+N
stays Ctrl+Shift+N whether Ctrl, Shift, or N goes up first, and the 1s
linger shows the full combo instead of a partial release state. Matches
the keybinding-tutorial use case better than keyviz, which shrinks
key-by-key on spaced releases.
felixzsh