swadhinbiswas fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal · 8/27/2026
4aa0eee