Conversation
Add Starship shell prompt customization to context menu: - New SHELL_CUSTOMIZATION tool category - Starship definition with curl install script - Detection paths including ~/.cargo/bin/starship - New ShellCustomizationMenuProvider with: - Install + Learn More (when not installed) - Edit Config, Apply Preset, Shell Setup (when installed) - 7 preset themes (Nerd Font, Plain Text, Pastel Powerline, etc.) - Shell setup commands for Bash, Zsh, Fish - Documentation links Menu structure: Shell > Starship > Configuration / Presets / Shell Setup / Help 🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Add getOhMyZshInstallCommand() to AIAssistantLauncher - Add Oh My Zsh definition to BUILTIN with SHELL_CUSTOMIZATION category - Extend ShellCustomizationMenuProvider with Oh My Zsh detection and menu: - Detection: Check ~/.oh-my-zsh directory exists - Not installed: Install + Learn More submenu - Installed: Themes (popular presets), Plugins, Maintenance options - Update status holders in TabbedTerminal and EmbeddableTerminal 🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Starship: Removes binary via `rm $(which starship)` - Oh My Zsh: Uses built-in `uninstall_oh_my_zsh` command 🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Add detection for zsh and bash installation status - Add platform-aware install commands (brew/apt/dnf/pacman) - Zsh menu: version, set as default, edit .zshrc, reload config - Bash menu: version, set as default, edit .bashrc/.bash_profile, reload - Add "Shells" section separator in menu - Update status holders to track zsh/bash installation 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Starship is typically installed in /usr/local/bin which requires root permissions to modify. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Removes starship init lines from: - ~/.bashrc - ~/.zshrc - ~/.config/fish/config.fish 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Adds `exec $SHELL` to restart the shell and clear the cached prompt hooks that were trying to call the removed starship binary. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Both Starship and Oh My Zsh uninstall actions now use the same dialog flow as install, allowing users to review the command before execution. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Shell setup commands now automatically source the config file after adding the starship init line, so users don't need to manually reload. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
The onInstallRequest callback now strips "-uninstall" suffix to find the base tool ID (e.g., "starship-uninstall" -> "starship") so the dialog can show properly for uninstall actions. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Remove init lines from shell configs before deleting the binary, so prompt hooks don't try to call missing starship during the uninstall process. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
The `uninstall_oh_my_zsh` function may not be available if OMZ isn't properly sourced. Use the script directly instead: sh ~/.oh-my-zsh/tools/uninstall.sh 🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Add detection for fish installation status - Add platform-aware install command (brew/apt/dnf/pacman) - Fish menu options: version, set as default, edit config.fish, reload config, web config (GUI) - Update status holders to track fish installation 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Oh My Zsh requires Zsh to be installed, so the menu option is now only shown when Zsh is detected on the system. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Add detection for Prezto (check ~/.zprezto directory) - Only show when Zsh is installed (like Oh My Zsh) - Menu options: modules, themes, update, reload, edit configs - Install via git clone with automatic symlink setup - Uninstall removes ~/.zprezto and related config files 🤖 Generated with [Claude Code](https://claude.com/claude-code)
When installing Starship, Oh My Zsh, or Prezto, conflicting tools are automatically uninstalled first: - Starship: Uninstalls Oh My Zsh/Prezto only when $SHELL is Zsh - Oh My Zsh: Uninstalls Prezto + Starship (if configured for Zsh) - Prezto: Uninstalls Oh My Zsh + Starship (if configured for Zsh) Added helpers: - getDefaultShell(): Detects user's default shell from $SHELL - isStarshipConfiguredForZsh(): Checks ~/.zshrc for starship init - buildInstallWithUninstall(): Combines uninstall + install commands - Extracted uninstall commands as reusable methods 🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Add Install + Learn More submenu pattern for Zsh, Bash, Fish - Add Prezto, Zsh, Bash, Fish to AIAssistants registry - Starship install now auto-adds init to shell config and restarts shell - Starship uninstall properly removes init lines and restarts shell - Set as Default Shell shows "Log out and log back in" message - Fix default shell fallback: use /bin/sh (POSIX standard) - Fix npm check for Gemini/Codex (was bypassing Node.js auto-install) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Pull Request Review: Shell Customization MenuSummaryThis PR adds comprehensive shell customization support with Starship, Oh My Zsh, Prezto, and shell installations. Well-structured implementation following existing patterns. StrengthsArchitecture: Consistent pattern, proper separation of concerns, good documentation, reusable components Feature Design: Well-implemented mutual exclusivity, platform awareness, dependency management, rich configuration options User Experience: Install/Learn More pattern, auto shell reload, logical menu organization CRITICAL Issues1. Security: Sudo rm without confirmationProblem: Line 136 uses sudo rm without adequate user confirmation 2. Dangerous Prezto UninstallProblem: Line 151 - rm -rf deletes ~/.zshrc which may have user customizations 3. Code DuplicationProblem: Lines 854-888 duplicate install command logic from AIAssistantLauncher Other Issues
Testing Recommendations
Security Review
Documentation Missing
Overall AssessmentCode Quality: 8/10 Recommendation: Request Changes - Security concerns (Issues #1 and #2) must be addressed before merge. Code duplication (#3) should also be cleaned up. Great work overall! Main concerns are around safety of uninstall operations. |
- Add multi-step onboarding wizard for new users - Shell selection (Zsh, Bash, Fish) with current shell detection - Shell customization (Starship, Oh My Zsh, Prezto) with conflict handling - Version control tools (Git, GitHub CLI) installation - AI assistants (Claude Code, Gemini CLI, Codex, OpenCode) installation - GitHub authentication step after gh installation - Embedded terminal for installation progress with password hint - Relaunch/Dismiss buttons on completion - Accessible from Help > Welcome Wizard menu - Auto-shows on first launch, persists completion state - Deduplicate Git/GitHub commands into GitUtils.kt - Add Prezto support to window menu - Remove debug println statements 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Code Review: Shell Customization Menu & Onboarding WizardThis is a comprehensive PR that adds shell customization tools and a first-run onboarding wizard. The implementation is well-structured and follows project conventions. Strengths
CRITICAL ISSUES1. Race Condition in Process Timeouts (HIGH SEVERITY) 2. Resource Leak: Unclosed ProcessBuilder Streams (MEDIUM) 3. Missing Error Handling in buildInstallCommand() (MEDIUM) MEDIUM ISSUES
MINOR ISSUES
SUMMARYBlocking Issues (must fix before merge):
Recommended (follow-up PR):
Code Quality: 8/10 - Well-architected, but needs hardening around process management Great work overall! Please address critical issues before merging. |
- Add OnboardingWizard example to tabbed-example - Create docs/onboarding.md with full API reference - Update README features list and documentation links - Example shows first-launch check and Help menu integration 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Comprehensive Code Review - PR #228This is an impressive feature addition that brings shell customization capabilities and an onboarding wizard to BossTerm. Overall, the implementation is well-structured and thoughtfully designed. Here is my detailed feedback: ✅ StrengthsArchitecture & Design
User Experience
Code Quality
|
1. Race Condition Fix (HIGH):
- Check waitFor() return before calling exitValue()
- Destroy process if timeout occurs before accessing exit value
- Affected: GitUtils.kt, OnboardingWizard.kt
2. Resource Leak Fix (MEDIUM):
- Close inputStream, errorStream, outputStream in finally blocks
- Use bufferedReader().use {} for auto-closing readers
- Affected: All ProcessBuilder usage in GitUtils.kt, OnboardingWizard.kt
3. Error Handling Fix (MEDIUM):
- Wrap buildInstallCommand() with try-catch
- Handle null System.getProperty("os.name") gracefully
- Return user-friendly error message on failure
🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Linux: Use /proc/self/cmdline - macOS: Use `ps -p PID -o command=` - Windows: Use ProcessHandle.info() with quoted arguments Extracted getRestartCommand() helper with proper error handling and resource cleanup for the ps subprocess. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Code Review: Shell Customization Menu & Onboarding WizardThis is a substantial and well-structured PR that adds comprehensive shell customization and onboarding capabilities. Overall the code quality is high, but there are several important issues to address. Critical Issues
Bugs & Logic Issues
Performance
VerdictConditional Approval - Do not merge until critical security issues and resource leaks are resolved. The onboarding wizard is a fantastic addition with excellent UX design, but command injection vulnerability and platform compatibility need immediate attention. Great work overall! |
Code Review: Shell Customization Menu & Onboarding WizardThis is a substantial and well-structured PR that adds comprehensive shell customization features and a first-time onboarding wizard. Overall, the code quality is high, but there are some important issues that should be addressed before merging. 🟢 StrengthsArchitecture & Design
Code Quality
UX/Features
🟡 Issues to Address1. Security: Command Injection Vulnerabilities
|
- Add "Open Folder..." context menu option that opens folder picker and runs cd + ls to navigate and show contents - Simplify Window Menu > Tools to only show installed shell customization tools (Starship, Oh My Zsh, Prezto) - Simplify context menu Shell submenu to only show installed tools + default shell (removed install options for all shells) - Extract shared shell utilities to ShellCustomizationUtils.kt - Add AIAssistantIds constants to replace magic strings - Fix JFileChooser threading issue causing Compose reentry exception 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Pull Request Review: Shell Customization MenuThis is a comprehensive PR adding shell customization and onboarding features. Total Changes: +3,770 additions, -115 deletions across 22 files Strengths
HIGH PRIORITY Issues1. Command Injection Vulnerability (SECURITY)Location: GitUtils.kt:131-151, OnboardingWizard.kt:576 Issue: User-provided paths are interpolated into shell commands without sanitization. A directory like "; rm -rf /;" could execute arbitrary commands. Recommendation: Add input sanitization or use ProcessBuilder with argument arrays. 2. Race Condition in Process Timeout (RELIABILITY)Location: OnboardingWizard.kt:463, ShellCustomizationUtils.kt:43 Issue: Code may call exitValue() after timeout without checking if process completed. Recommendation: Check waitFor() return value before accessing exitValue(). 3. Missing Null Check on System.getProperty (RELIABILITY)Location: OnboardingWizard.kt:585, ShellCustomizationMenuProvider.kt:592 Issue: Some paths assume System.getProperty("os.name") never returns null. Recommendation: Use null-safe operators everywhere. MEDIUM PRIORITY Issues
LOW PRIORITY Issues
Testing RecommendationsUnit Tests Needed:
Manual Testing:
Code Quality Metrics
Final VerdictStatus: Excellent feature implementation with strong architecture. Must fix 3 high-priority security/reliability issues before merge. Estimated Fix Time: 2-3 hours for critical issues Recommendation:
Reviewed by: Claude Code (Sonnet 4.5) |
When $SHELL points to a non-existent shell (e.g., fish not installed), the terminal now falls back to /bin/bash, then /bin/sh instead of crashing with "Unable to find full path" error. Added ShellCustomizationUtils.getValidShell() that: 1. Checks if $SHELL exists and is executable 2. Falls back to /bin/bash if available 3. Ultimate fallback to /bin/sh (POSIX, always available) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Code Review for PR #228: Shell Customization MenuThis PR adds comprehensive shell customization features. Overall excellent architecture and UX, but requires security fixes before merge. ✅ Strengths
🔴 Critical Issues (Must Fix Before Merge)1. Command Injection Vulnerabilities
|
Code Review: Shell Customization Menu and Onboarding WizardThis is an impressive feature addition that brings shell customization and a first-time setup wizard to BossTerm. Here is my comprehensive review: Strengths
Critical Issues1. Security: Command Injection Vulnerabilities (HIGH PRIORITY) Location: ShellCustomizationMenuProvider.kt lines 249-264, 324-393 The context menu items directly interpolate shell commands without proper escaping. The EDITOR variable and theme names could be exploited if controlled by an attacker. Fix: Use explicit quoting or avoid environment variable expansion in user-facing commands. Validate all input that goes into shell commands. 2. Unsafe sed Usage (MEDIUM PRIORITY) Location: ShellCustomizationMenuProvider.kt lines 324-350 The Oh My Zsh theme switcher uses sed with theme names that are not validated. Special characters in theme names could break sed syntax or inject commands. Fix: Validate theme names against a whitelist or use a safer update mechanism. 3. macOS sed Compatibility Issues (MEDIUM PRIORITY) Location: ShellCustomizationUtils.kt lines 103-105 The code uses GNU sed syntax with fallback to BSD sed, but this creates backup files and the fallback pattern is fragile. Fix: Detect sed version upfront or use a platform-agnostic approach. 4. Potential Deadlock in OnboardingWizard (MEDIUM PRIORITY) Location: OnboardingWizard.kt lines 534-586 If the install command hangs or prompts for input indefinitely, the wizard gets stuck with no timeout or escape mechanism. Fix: Add a timeout or Cancel button to the Installing step. Priority Fixes (Before Merge)
Overall AssessmentCode Quality: 7/10 This is a well-designed feature with excellent UX, but the security concerns (command injection, unsafe sed usage) need to be addressed before merging to master. The onboarding wizard is polished and the context menu integration is intuitive. Recommendation: Request changes for security fixes, then approve after review. Great work overall! The feature is nearly production-ready with just a few critical security improvements needed. |
When selecting a shell in the Welcome Wizard, now runs chsh to set it as the default shell in addition to installing it. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Code Review: Shell Customization Menu & Onboarding WizardThis is an impressive feature addition! The implementation is well-structured with proper separation of concerns. ✅ StrengthsArchitecture: Excellent separation with Code Quality: Consistent patterns, proper resource cleanup in ProcessBuilder calls, defensive programming with 2s timeouts. UX: Great onboarding wizard, smart mutual exclusivity handling, context-aware menus.
|
Shows "🔐 Administrator password required for installation..." message before prompting for sudo password in the Welcome Wizard. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Code Review: Shell Customization Menu & Onboarding WizardThis is an impressive PR that adds significant value to BossTerm! The implementation is well-structured and follows the project's established patterns. Here's my detailed feedback: ✅ StrengthsArchitecture & Code Quality
Features
🔴 Critical Issues1. Command Injection VulnerabilitiesLocation: ShellCustomizationMenuProvider.kt lines 249-256, 323-350 Problem: User-controlled paths passed directly to shell commands without sanitization. If config file paths contain malicious content, could execute arbitrary commands. Solution: Escape shell metacharacters or use safer parameter expansion with proper quoting 2. Destructive Operations Without ConfirmationLocation: ShellCustomizationUtils.kt lines 114-124, 131-132 Problem: Uninstall commands can delete user config files without warning (e.g., line 495 deletes ~/.zshrc and other rc files) Solution: Back up files before deletion and show explicit confirmation dialogs 3. sed -i Platform InconsistencyLocation: ShellCustomizationMenuProvider.kt lines 324-350 Problem: sed -i syntax differs between Linux (GNU sed) and macOS (BSD sed). Line 324 will fail on macOS. Solution: Use the pattern from uninstall commands consistently: sed -i.bak ... 2>/dev/null || sed -i '' ... 2>/dev/null 4. ProcessBuilder Timeout InconsistencyProblem: Inconsistent timeout handling across files (2 vs 3 seconds, some missing timeouts) Solution: Standardize timeouts and ensure all ProcessBuilder calls have them to prevent hangs
|
| Category | Count |
|---|---|
| Critical | 4 |
| Important | 3 |
| Suggestions | 9 |
| Minor | 4 |
Overall Assessment: This is high-quality work with excellent architecture. The critical security issues (command injection, destructive operations) must be addressed before merging. Once fixed, this will be a fantastic addition to BossTerm!
Recommended Action:
- Fix critical security issues (feat: Terminal rendering improvements + 4 high-priority features (#2, #3, #4, #5) #1-4)
- Address important issues (🌏 Implement IME (Input Method Editor) support for CJK languages #5-7)
- Consider suggestions for next iteration
- Add test coverage for mutual exclusivity logic
Great work on this feature! The onboarding wizard will significantly improve the first-time user experience. 🎉
Files Requiring Changes:
- compose-ui/.../shell/ShellCustomizationMenuProvider.kt (command injection, sed -i)
- compose-ui/.../shell/ShellCustomizationUtils.kt (destructive operations, backups)
- compose-ui/.../onboarding/OnboardingWizard.kt (chsh validation, restart timing)
- gradle.properties (please show changes)
PR Review: Shell Customization MenuSummaryComprehensive shell customization support with approximately 3,700 lines across 22 files. Well-structured implementation. Strengths
Critical Issues1. CRITICAL: Command Injection VulnerabilityLocation: ShellCustomizationUtils.kt lines 97-133 Line 100 uses unsanitized shell interpolation. If command returns malicious path from tampered PATH, could execute arbitrary commands. Recommendation: Validate paths with regex pattern before using in shell commands. 2. Race Condition in Status CheckingLocation: EmbeddableTerminal.kt:419-427, TabbedTerminal.kt:757-766 Status values are read immediately but refreshStatus() is async, causing stale data. Recommendation: Wait for refreshStatus() completion in coroutine scope. 3. Performance IssueLocation: ShellCustomizationMenuProvider.kt:55-62 refreshStatus() runs 6+ which commands sequentially with 2s timeout each (potentially 12+ seconds total). Recommendation: Parallelize checks using async/await pattern. Medium Priority Issues
Minor Issues
Positive Patterns
RecommendationConditional Approval - Fix command injection vulnerability before merge. Other issues are medium/low priority. Priority fixes:
Overall well-architected feature. Great work on comprehensive shell customization support! |
1 participant
Summary
Add comprehensive Shell submenu to context menu with support for:
Mutual exclusivity - Installing one tool automatically uninstalls conflicting tools:
Platform-aware install commands - Support for macOS (brew), Linux (apt/dnf/pacman), Windows (winget/WSL)
Install/Uninstall dialogs - All install and uninstall actions show confirmation dialog
Auto shell reload - Shell config automatically sourced after changes
Features
which starship~/.oh-my-zshdir~/.zpreztodirwhichTest plan
🤖 Generated with Claude Code