Merge pull request 'fix: app-launch macros on Windows + bump to 1.1.1' (#10) from fix/app-launch-windows into main

When shell=True was removed for security, the command was parsed with
shlex.split(posix=False) on Windows, which keeps the quote characters inside
the tokens — so a quoted path like "C:\Program Files\app.exe" became an argv[0]
containing literal quotes and CreateProcess couldn't find it, so app macros
silently did nothing.

Fix: on Windows pass the command string to Popen (shell=False) and let
CreateProcess parse it (handles quoted paths, still no shell/metacharacter
chaining); on POSIX keep shlex.split. Verified a real launch works and shell
redirection stays blocked.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-windows.yml

@@ -87,9 +87,21 @@ jobs:
         run: |
           $ErrorActionPreference = 'Stop'
           [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+          # Native command failures do NOT trip $ErrorActionPreference, so check
+          # $LASTEXITCODE explicitly — otherwise a broken install ships silently.
           & $env:PYTHON -m pip install --upgrade pip
+          if ($LASTEXITCODE -ne 0) { throw "pip upgrade failed ($LASTEXITCODE)" }
           & $env:PYTHON -m pip install -e .
+          if ($LASTEXITCODE -ne 0) { throw "pip install -e . failed ($LASTEXITCODE)" }
           & $env:PYTHON -m pip install pyinstaller
+          if ($LASTEXITCODE -ne 0) { throw "pip install pyinstaller failed ($LASTEXITCODE)" }
+
+      - name: Verify runtime imports
+        shell: powershell
+        run: |
+          # Fail fast if any runtime dependency is missing before we bundle.
+          & $env:PYTHON -c "import PySide6.QtWidgets, fastapi, uvicorn, aiohttp, PIL, pystray, qrcode, pyautogui, pyperclip, websockets, multipart; print('deps OK')"
+          if ($LASTEXITCODE -ne 0) { throw "dependency import smoke test failed ($LASTEXITCODE)" }
 
       - name: Build Windows executable
         shell: powershell

.gitea/workflows/release.yml

@@ -1,159 +0,0 @@
-# =============================================================================
-# WORKFLOW DISABLED - Pending testing of v0.9.0 modernization
-# =============================================================================
-# This workflow is temporarily disabled while testing the new:
-# - PySide6 GUI (replacing Tkinter)
-# - FastAPI web server (replacing Flask)
-# - pyproject.toml build system (replacing requirements.txt)
-# - PWA web interface
-#
-# Uncomment the workflow below once builds are verified locally.
-# =============================================================================
-
-# name: Build and Release
-#
-# on:
-#   push:
-#     branches:
-#       - main
-#
-# jobs:
-#   create-release:
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Get version
-#         id: get_version
-#         run: |
-#           VERSION=$(cat version.txt)
-#           echo "VERSION=$VERSION" >> $GITHUB_ENV
-#
-#       - name: Create Release
-#         id: create_release
-#         uses: softprops/action-gh-release@v1
-#         with:
-#           tag_name: v${{ env.VERSION }}
-#           name: Release v${{ env.VERSION }}
-#           draft: false
-#           prerelease: false
-#
-#   build-windows:
-#     needs: [create-release]
-#     runs-on: windows-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Set up Python
-#         uses: actions/setup-python@v4
-#         with:
-#           python-version: '3.11'
-#
-#       - name: Install dependencies
-#         run: |
-#           python -m pip install --upgrade pip
-#           pip install pyinstaller
-#           pip install -e .
-#
-#       - name: Build executable
-#         run: |
-#           pyinstaller macropad.spec
-#
-#       - name: Upload Windows artifact
-#         uses: actions/upload-artifact@v3
-#         with:
-#           name: macropad-windows
-#           path: dist/macropad.exe
-#
-#   build-linux:
-#     needs: [create-release]
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Set up Python
-#         uses: actions/setup-python@v4
-#         with:
-#           python-version: '3.11'
-#
-#       - name: Install system dependencies
-#         run: |
-#           sudo apt-get update
-#           # PySide6 requirements
-#           sudo apt-get install -y libxcb-xinerama0 libxkbcommon-x11-0 libegl1
-#           # System tray requirements
-#           sudo apt-get install -y libgtk-3-dev python3-gi python3-gi-cairo gir1.2-gtk-3.0
-#           sudo apt-get install -y gir1.2-appindicator3-0.1
-#           sudo apt-get install -y libcairo2-dev libgirepository1.0-dev
-#
-#       - name: Install dependencies
-#         run: |
-#           python -m pip install --upgrade pip
-#           pip install pyinstaller
-#           pip install -e .
-#
-#       - name: Build executable
-#         run: |
-#           pyinstaller macropad_linux.spec
-#
-#       - name: Upload Linux artifact
-#         uses: actions/upload-artifact@v3
-#         with:
-#           name: macropad-linux
-#           path: dist/macropad
-#
-# # MacOS build - requires macos runner
-# #  build-macos:
-# #    needs: [create-release]
-# #    runs-on: macos-latest
-# #    steps:
-# #      - name: Checkout code
-# #        uses: actions/checkout@v3
-# #
-# #      - name: Set up Python
-# #        uses: actions/setup-python@v4
-# #        with:
-# #          python-version: '3.11'
-# #
-# #      - name: Install dependencies
-# #        run: |
-# #          python -m pip install --upgrade pip
-# #          pip install pyinstaller
-# #          pip install -e .
-# #
-# #      - name: Build executable
-# #        run: |
-# #          pyinstaller macropad_macos.spec
-# #
-# #      - name: Upload macOS artifact
-# #        uses: actions/upload-artifact@v3
-# #        with:
-# #          name: macropad-macos
-# #          path: dist/macropad.app
-#
-#   attach-to-release:
-#     needs: [create-release, build-windows, build-linux]
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Get version
-#         id: get_version
-#         run: |
-#           VERSION=$(cat version.txt)
-#           echo "VERSION=$VERSION" >> $GITHUB_ENV
-#
-#       - name: Download all artifacts
-#         uses: actions/download-artifact@v3
-#
-#       - name: Attach executables to release
-#         uses: softprops/action-gh-release@v1
-#         with:
-#           tag_name: v${{ env.VERSION }}
-#           files: |
-#             macropad-windows/macropad.exe
-#             macropad-linux/macropad

README.md

@@ -39,7 +39,6 @@ A cross-platform macro management application with desktop and web interfaces. C
 - PyAutoGUI (Keyboard automation)
 - Pillow (Image processing)
 - pystray (System tray)
-- netifaces (Network detection)
 - qrcode (QR code generation)
 - aiohttp (Relay server client)
 

config.py

@@ -1,6 +1,6 @@
 # Configuration and constants for MacroPad Server
 
-VERSION = "1.0.0"
+VERSION = "1.1.1"
 DEFAULT_PORT = 40000
 SETTINGS_FILE = "settings.json"
 

gui/main_window.py

@@ -469,19 +469,39 @@ class MainWindow(QMainWindow):
         # QR/copied URL lets a LAN device authenticate against the API.
         token = self.settings_manager.get_web_auth_token()
         token_qs = f"?token={token}" if token else ""
+        ip = self._detect_lan_ip()
+        if ip:
+            self.ip_label.setText(f"http://{ip}:{DEFAULT_PORT}{token_qs}")
+            return
+        self.ip_label.setText(f"http://localhost:{DEFAULT_PORT}{token_qs}")
+
+    @staticmethod
+    def _detect_lan_ip():
+        """Best-effort primary LAN IPv4, with no third-party dependency.
+
+        Uses a UDP socket to discover which local interface would be used to
+        reach the internet (no packets are actually sent), then falls back to
+        resolving the hostname. Returns None if only loopback is available.
+        """
+        import socket
         try:
-            import netifaces
-            for iface in netifaces.interfaces():
-                addrs = netifaces.ifaddresses(iface)
-                if netifaces.AF_INET in addrs:
-                    for addr in addrs[netifaces.AF_INET]:
-                        ip = addr.get('addr', '')
-                        if ip and not ip.startswith('127.'):
-                            self.ip_label.setText(f"http://{ip}:{DEFAULT_PORT}{token_qs}")
-                            return
+            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+            try:
+                s.connect(("8.8.8.8", 80))
+                ip = s.getsockname()[0]
+            finally:
+                s.close()
+            if ip and not ip.startswith("127."):
+                return ip
         except Exception:
             pass
-        self.ip_label.setText(f"http://localhost:{DEFAULT_PORT}{token_qs}")
+        try:
+            for ip in socket.gethostbyname_ex(socket.gethostname())[2]:
+                if not ip.startswith("127."):
+                    return ip
+        except Exception:
+            pass
+        return None
 
     def copy_url_to_clipboard(self):
         """Copy the web interface URL to clipboard."""

macro_manager.py

@@ -416,15 +416,23 @@ class MacroManager:
 
         elif cmd_type == "app":
             # Launch application.
-            # SECURITY: shell=True was removed to kill shell-metacharacter
-            # injection (no ; && | $() chaining). We tokenize the command
-            # and exec the program directly without a shell.
+            # SECURITY: never use shell=True — that would allow shell-metacharacter
+            # injection (; && | $() chaining, redirection). Both branches below run
+            # without a shell, so the command can only launch a program with args.
             command = cmd.get("command", "")
             if command:
                 try:
-                    args = shlex.split(command, posix=(os.name != "nt"))
-                    if args:
-                        subprocess.Popen(args)
+                    if os.name == "nt":
+                        # Windows: pass the string so CreateProcess parses it
+                        # (correctly handling quoted paths like "C:\Program
+                        # Files\app.exe"). shell=False means no cmd.exe, so no
+                        # metacharacter chaining.
+                        subprocess.Popen(command)
+                    else:
+                        # POSIX: split into an argv list; no shell involved.
+                        args = shlex.split(command)
+                        if args:
+                            subprocess.Popen(args)
                 except Exception as e:
                     print(f"Error launching app command: {e}")
 

macropad.spec

@@ -45,7 +45,6 @@ a = Analysis(
         'pyautogui',
         'pyperclip',
         'pystray',
-        'netifaces',
         'websockets',
         'multipart',
         # Relay client (imported lazily in the GUI, so declare explicitly)

macropad_linux.spec

@@ -49,7 +49,6 @@ a = Analysis(
         'pyperclip',
         'pystray',
         'pystray._base',
-        'netifaces',
         'websockets',
         'multipart',
         # Linux system tray

macropad_macos.spec

@@ -45,7 +45,6 @@ a = Analysis(
         'pyautogui',
         'pyperclip',
         'pystray',
-        'netifaces',
         'websockets',
         'multipart',
     ],

pyproject.toml

@@ -23,8 +23,6 @@ dependencies = [
     "uvicorn>=0.24.0",
     "websockets>=12.0",
     "python-multipart>=0.0.6",  # For file uploads
-    # Network utilities
-    "netifaces>=0.11.0",
     # QR code generation
     "qrcode>=7.4.2",
     # Desktop GUI

version.txt

@@ -1 +1 @@
-1.0.0
+1.1.1