OmaMigrate v1.1.9

Security & Hardening

• Bounded Staging Traversal & Resource Exhaustion Defense: Enforced strict aggregate limits on restored configuration files: maximum 50 files (MAX_CONFIG_FILES = 50), maximum 5 MiB total aggregate bytes (MAX_CONFIG_TOTAL_BYTES = 5 * 1024 * 1024), and maximum 2 MiB per file (MAX_SINGLE_FILE_BYTES = 2 * 1024 * 1024). Traversal immediately breaks when limits are reached, preventing CPU, memory, or disk DoS by compromised or malicious workers.
• Single-Pass Tar Streaming via Held Descriptors: Eliminated all multi-copy in-memory buffering (validated_files, BytesIO, and getvalue()). Configuration files are opened with O_RDONLY | O_NOFOLLOW, validated via fstat, and their descriptors are held open. Tar records are streamed directly from held descriptors into the sudo tar stdin pipe, maintaining minimal memory overhead and preventing staging swap / TOCTOU attacks.
• Secure & Bounded Package Metadata (missing_native_pkgs.txt): Replaced pathname reopen with O_RDONLY | O_NOFOLLOW descriptor allocation and fstat validation (regular file, current user ownership, non-executable, size capped at <= 64 KiB). Package list size is hard-capped at 250 packages.
• Archive Integrity Binding for Privileged Packages: Package names passed to privileged pacman are strictly validated and bound to either the explicit package manifest (pkg_meta/packages_explicit.txt) inside the selected archive or trusted core dependencies (CORE_ALLOWED_PKGS), rejecting any arbitrary package injections from staging workers.
• Adversarial Regression Coverage (Test 7): Added Regression Test 7 to tests/test_credential_isolation.sh simulating excessive file count flood (>50), aggregate byte flood (>5MB), oversized package metadata (>64KB), and unbound arbitrary package injection.

OmaMigrate v1.1.8

Security & Hardening

• Data/Code Decoupling & Elimination of Executable Restores: Completely purged arbitrary executable script restoration (/usr/local/bin/sing-box-node-rotate) and archive-supplied systemd units (/etc/systemd/system/*.service, *.timer). The migration bundle strictly backs up and restores passive configuration data only (/etc/sing-box/*.json, /etc/mihomo/, /etc/v2raya/, /etc/xray/, /etc/v2ray/, /etc/daed/, /etc/proxychains.conf).
• Staging Path Integrity & Trust Verification: The privileged runner strictly validates stage_ready_dir emitted by user-space workers, verifying canonical path prefixes, directory attributes (S_ISDIR), user ownership (st_uid == getuid()), non-world-writable permissions, and absence of symlinks.
• Descriptor-Based Staging Transfer (O_NOFOLLOW / In-Memory Streams): Passive configuration files in user staging are opened exclusively via os.open with O_RDONLY | O_NOFOLLOW. File descriptors are validated via fstat (regular files only S_ISREG, execute bits strictly zero not (st_mode & 0o111)), and file bytes are loaded directly into memory. In-memory tar streams are constructed and piped into root tar, completely eliminating TOCTOU staging-swap attacks and directory race conditions.
• Audited Service Activation: System services (sing-box.service, mihomo.service, etc.) are activated strictly from pacman package-managed units verified via systemctl list-unit-files, completely eliminating archive-supplied unit file deployment and root command execution.
• Adversarial Worker & Staging-Swap Regression Test: Added Regression Test 6 to tests/test_credential_isolation.sh simulating concurrent staging-swap, executable payload injection, and unit tampering, proving that all attack vectors are strictly rejected.

Generalization & Universal Configurations

• Universal Configuration Focus: Cleaned up personal tailored workflows (sing-box-node-rotate and icloud-mail-triage), generalizing systemd user unit handling and status reporting for official marketplace distribution.
• Documentation & Descriptions: Updated documentation (README.md, README.zh-CN.md, manifest.json, bin/omamigrate, and OmaMigrate.qml) to focus on universal desktop dotfiles, development environments, and security credential preservation.

OmaMigrate v1.1.7

Security & Hardening

• Prohibit Ambient Test Hooks (OMAMIGRATE_TEST_*): Completely eliminated all OMAMIGRATE_TEST_* environment variable overrides (OMAMIGRATE_TEST_SUDO, OMAMIGRATE_TEST_VERIFY, OMAMIGRATE_TEST_UNREADABLE) from production code. sudo_path is strictly hardcoded to /usr/bin/sudo with mandatory SetUID root validation, and test hooks cannot be manipulated from user space.
• Strict Immutable Allowlist Operand Derivation: Privileged tar backup operands are strictly derived from an immutable ALLOWLIST tuple (unreadable_operands = [item for item in unreadable if item in ALLOWLIST and not item.startswith("-") and ".." not in item]). Ambient or user-supplied paths can never bypass the allowlist.
• Mandatory Option Terminators (--): Inserted -- option terminators across all privileged binary invocations (sudo, tar, pacman, systemctl, chown, chmod, usermod, modprobe, tee). This strictly prevents operand-to-flag option injection attacks even if malicious filenames or package names are encountered.
• Relative Path Option Injection Defense: During system restoration, relative paths extracted from system_root starting with - or containing .. path traversals are strictly rejected before being passed to tar.
• Zero Test Variable Regression Enforcement: Added strict test assertions in tests/test_migration_fuzz.py to ensure production QML, backup, and restore scripts contain zero OMAMIGRATE_TEST_ occurrences, and updated tests/test_credential_isolation.sh with active allowlist bypass tests.

OmaMigrate v1.1.6

Security & Hardening

• Pathname Reopening Elimination: Completely removed passing user-controlled staging file paths to the privileged tar process. Privileged helper invokes /usr/bin/tar -C / -cf - streaming archive bytes directly to standard output pipe. Root never opens, reopens, or truncates any file path in user-controlled directories.
• O_NOFOLLOW | O_EXCL Safe Descriptor Allocation: Staging archives are created and held directly by the unprivileged Python process using os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW with mode 0600 and a cryptographically random 128-bit hex token (secrets.token_hex(16)). Pre-existing symlinks, collision attempts, or directory race attacks are strictly rejected by the kernel before any privileged operation is invoked.
• Stdout Pipe-to-Descriptor Streaming: Tar output is streamed from the child process's stdout pipe to the securely held file descriptor with asynchronous stderr draining, completely eliminating file descriptor exposure, pipe deadlock risks, and symlink races.
• Symlink Traversal Prevention in System Restoration: Added symlink target resolution validation when walking system_root during privileged deployment, rejecting any symlink pointing outside sys_root or using absolute/parent traversals (..).
• Symlink Traversal & Race Condition Regression Tests: Added dedicated regression test in tests/test_credential_isolation.sh and contract assertions in tests/test_migration_fuzz.py, formally proving that pre-created symlinks targeting sensitive files cannot cause root file truncation or path reopening.

OmaMigrate v1.1.5

Security & Hardening

• Two-Phase Privilege Separation Architecture: Decoupled mutable user-space worker scripts from all privileged system operations. User-space workers (export.sh and restore.sh) execute in completely unprivileged environments with standard input bound to /dev/null and zero ambient sudo credentials.
• Strict In-Memory Privileged Helper: Implemented an in-memory, integrity- and ownership-bound runner in OmaMigrate.qml with a narrow operation and argument allowlist. Privileged operations are strictly restricted to allowlisted targets (/etc/sing-box, /etc/mihomo, /etc/v2raya, /etc/xray, /etc/v2ray, /etc/daed, /etc/proxychains.conf, /usr/local/bin/sing-box-node-rotate, and systemd service units).
• Package Name Sanitization: Enforce strict character allowlists (^[a-zA-Z0-9_@.+-]+$) on all package restoration operations, preventing option injection or argument smuggling into /usr/bin/pacman.
• Immediate Credential Revocation (sudo -k): Guaranteed immediate sudo ticket revocation via sudo -k after every privileged operation in both backup and restore flows. Sudo tickets are never left active across process boundaries, completely preventing rogue worker processes or same-UID processes from consuming reusable sudo timestamps.
• Adversarial Privilege Capability Regression Tests: Added adversarial tests in tests/test_credential_isolation.sh demonstrating that substituting a worker script with a malicious payload attempting sudo -n id strictly fails with zero capability leakage.

OmaMigrate v1.1.4

Security & Hardening

• Executable Identity & Absolute System Paths: Enforce fixed absolute paths (/usr/bin/python3, /usr/bin/sudo, /usr/bin/bash) across all UI Process invocations and worker scripts. Eliminate PATH resolution vulnerability preventing user-session PATH spoofing and binary injection.
• Environment Sanitization: Applied clearEnvironment: true and restricted PATH="/usr/bin:/bin" to all privileged and shell execution processes in OmaMigrate.qml, eliminating LD_PRELOAD, SUDO_ASKPASS, and environment variable injection vectors.
• Privilege Boundary Integrity Verification: Implemented strict pre-execution integrity checks on /usr/bin/sudo, verifying root:root ownership (UID 0, GID 0), SetUID mode (04755), and preventing group/world-writable permissions before routing any credentials.
• Zero Credential Bytes to Mutable Plugin Workers: Completely eliminated exportSecret, restoreSecret, and pendingSecret properties from UI processes. Stream credentials exclusively to the isolated /usr/bin/sudo privilege boundary in a dedicated session, redirecting standard input to /dev/null prior to launching user-space worker scripts. Mutable plugin scripts never receive credential bytes, preventing TOCTOU worker substitution attacks.
• PTY Session Privilege Isolation: Utilized an authentic in-memory PTY session bridge for GUI execution. This allows Linux Sudoers under default timestamp_type = tty policies to establish valid terminal credentials and share them with non-interactive child workers (pacman, yay, modprobe) without piping raw secrets to user-side code.
• Regression Test Suite: Added automated tests verifying PATH replacement immunity and worker substitution defense (proving neither fake PATH binaries nor replaced worker scripts can intercept credentials).

OmaMigrate v1.1.3

Fixed

• Restore Engine Hang & Yay Infinite Loop: Removed --sudoloop from the yay AUR package installation routine in lib/restore.sh. Yay's upstream --sudoloop enters an unthrottled infinite retry loop when sudo -v fails in non-terminal environments (sudo: a terminal is required to read the password). Restore routines already maintain their own background keepalive loop, rendering yay's --sudoloop redundant.
• Fail-Fast AUR Package Installation: Added --sudoflags "-n" and standard input redirection (< /dev/null) to yay, ensuring package manager elevation operates strictly non-interactively and fails fast without blocking or looping when terminal input is unavailable.
• Archive Extraction Input Guard: Redirected standard input to /dev/null during tar archive extraction in bin/omamigrate to guarantee stdin credentials stream cleanly to the restore engine without premature consumption.

Added

• Top-Right Force Close Button: Added an independent ✕ close button in the top-right corner of the OmaMigrate modal card (z: 1000), positioned above the processing shield. Users can now forcibly terminate active background processes (backup, restore, authorization, or scanning) and immediately close the window with a mouse click at any time.

v1.1.2

Fixed

• GUI Process Privilege Elevation: Fix non-TTY sudo privilege elevation where sudo child processes inside subshells could not access Quickshell's parent process credentials under standard timestamp_type = tty / ppid policies.
• Pipeline Stdin Credential Delivery: Directly forward validated credentials via standard input pipe into export.sh and restore.sh, authenticating within the execution process tree with immediate zeroing of secrets from memory, maintaining full compliance with process isolation rules (no argv, no environ, no disk artifacts).
• Interactive Terminal Sudo Prompt: Explicitly prompt with sudo -v in interactive terminal sessions before running protected archive pipelines to ensure seamless execution.

OmaMigrate v1.1.1

Security & Hardening

• Process Credential Isolation: Eliminate password exposure in process command-line metadata (argv) and environment variables (OMAMIGRATE_SUDO_PASS).
• Direct Stdin Authentication Streaming: Stream authentication password directly to sudo -S -p "" -v via standard input pipe using Quickshell stdinEnabled without invoking intermediate shell arguments, immediately purging memory buffers upon transmission.
• Sudo Credential Cache Re-use: Execute backup and restore routines strictly against the active sudo credential cache (sudo -n), with background keepalive loops and automatic lifecycle cleanup on process exit.
• Zero Disk Artifacts: Remove transient askpass script generation in restore routines, guaranteeing no sensitive credentials ever touch the filesystem.
• Automated Process-Level Inspection Test: Added tests/test_credential_isolation.sh to dynamically inspect spawned processes, verifying that canary secrets are strictly absent from /proc/*/cmdline and /proc/*/environ.

OmaMigrate v1.1.0

Added

• Expanded AI Developer Tool Persistence: Full credential, session, and configuration migration support for Pi, Oh My Pi (OMP) (named profiles, XDG & PI_CODING_AGENT_DIR), and OpenCode (opencode.db SQLite state, configuration, and workspace state) alongside Antigravity CLI (agy), OpenAI Codex, Claude Code, and xAI Grok.
• Dual Migration Modes (Standard vs. Complete):
  • Standard Mode: Strict allowlist of credentials and configurations, excluding conversation histories and plugins to keep backups minimal and fast.
  • Complete Mode: Full migration including session histories, conversation memories, skills, and plugins with transactionally consistent SQLite live snapshots and integrity verification (ai_manifest.sha256).
• Proxy Ecosystem Expansion: Full configuration and service restoration support for Mihoro (mihoro.toml) and user-level mihomo.service.
• Automatic Kernel TUN Module Persistence: Automatically loads and configures /etc/modules-load.d/99-omamigrate-sing-box-tun.conf for VPN/proxy requirements before service start.

Fixed

• Atomic Shell Configuration Restoration: Exclude ~/.config/omarchy/shell.json from bulk archive extractions and inject luneth90.omamigrate into the JSON structure prior to writing to disk. This prevents Quickshell's inotify watcher from detecting a transient missing state and hot-unloading OmaMigrate during active restoration.
• Active Agent Process Lock Guard: Refuse restoration while supported AI CLI agents are actively executing, preventing race conditions and database/WAL corruption.
• Package Manager Resilient Fallback: Split native packages and AUR packages during restore, preventing pacman transaction aborts when yay is absent.
• Structured Path Adaptation: Ensure old username paths in session files and configs are accurately translated to the current $HOME without altering user prompt or response content.