diff options
Diffstat (limited to 'modules/org-agenda-frame.el')
| -rw-r--r-- | modules/org-agenda-frame.el | 64 |
1 files changed, 60 insertions, 4 deletions
diff --git a/modules/org-agenda-frame.el b/modules/org-agenda-frame.el index 35e77912..f0de99ce 100644 --- a/modules/org-agenda-frame.el +++ b/modules/org-agenda-frame.el @@ -31,6 +31,7 @@ ;; `with-eval-after-load' so a batch test-load runs no org-agenda side effects. (defvar org-agenda-custom-commands) (defvar org-agenda-finalize-hook) +(defvar org-agenda-mode-map) (defvar org-agenda-sticky) (defvar org-agenda-window-setup) (declare-function cj/build-org-agenda-list "org-agenda-config" (&optional force-rebuild)) @@ -44,10 +45,12 @@ (declare-function org-get-at-bol "org" (property)) (declare-function org-fold-show-context "org-fold" (&optional key)) (declare-function org-agenda "org-agenda" (&optional arg org-keys restriction)) -;; Forward references: defined later in this file (Phase 2 for -safe-redo, -;; the lifecycle block for -delete). -(declare-function cj/--agenda-frame-safe-redo "org-agenda-frame" ()) -(declare-function cj/--agenda-frame-delete "org-agenda-frame" ()) +;; No declare-function for -safe-redo / -delete: they are defined later in THIS +;; file, and the byte-compiler resolves same-file forward references at end of +;; compilation. A declare-function for a same-file function instead counts as a +;; second definition ("defined multiple times") and, worse, its declared arglist +;; overrides the real one for arg-count checking -- the empty () shadowed +;; -safe-redo's actual (&optional frame), disabling that check. (defconst cj/--agenda-frame-parameter 'cj/agenda-frame "Frame parameter marking the dedicated agenda frame. @@ -318,6 +321,53 @@ of contract." :lighter " AgendaFrame" :keymap cj/agenda-frame-mode-map) +(defun cj/--agenda-frame-shadow-mutations (&optional source-map prefix) + "Deny every SOURCE-MAP key sequence not on the frame map's allowlist. +Walk SOURCE-MAP (default `org-agenda-mode-map') recursively. For each +sequence it binds to a command, if `cj/agenda-frame-mode-map' doesn't already +bind that sequence to a command or manage it as a prefix, add an explicit +read-only deny. + +This closes the default-deny hole: a keymap's `[t]' default never shadows an +explicit binding in a lower-priority map, so a single `[t]' catch-all denies +only keys that are unbound everywhere. Every key `org-agenda-mode-map' binds +\(t, I, k, z, s, ., the C-c mutators, C-x C-s, ...) would otherwise sail +through the catch-all and mutate source files from the read-only frame. +Explicitly denying each non-allowlisted sequence makes the catch-all's intent +actually hold. + +PREFIX is the accumulated key vector during recursion (internal). Idempotent: +re-running rebinds the same denials. Runs from `with-eval-after-load' once +`org-agenda-mode-map' exists." + (let ((source (or source-map org-agenda-mode-map)) + (prefix (or prefix []))) + (map-keymap + (lambda (event binding) + (unless (or (eq event t) (eq event 'menu-bar) (eq event 'remap) + (consp event)) + (let ((seq (vconcat prefix (vector event)))) + (cond + ((keymapp binding) + (cj/--agenda-frame-shadow-mutations binding seq)) + ((commandp binding) + (let ((ours (lookup-key cj/agenda-frame-mode-map seq))) + ;; A command we allowlisted or a prefix we manage: leave it. + ;; Anything else (only the `[t]' default, or unbound under a + ;; shared prefix) escapes to org's command -- deny it here. + (unless (or (commandp ours) (keymapp ours)) + (define-key cj/agenda-frame-mode-map seq + #'cj/--agenda-frame-denied-readonly)))))))) + source))) + +;; The shadow walk is installed at the END of this file, not here: it reads +;; `commandp' on each allowlisted binding to decide whether to keep it, and the +;; view/redo handlers (day-view, week-view, safe-redo) are defined further down. +;; If org-agenda is already loaded when this file loads (the normal startup order, +;; and every reload), `with-eval-after-load' fires immediately -- so the walk must +;; not run until those defuns exist, or it reads them as undefined, fails the +;; commandp guard, and denies the very keys the allowlist grants. See the bottom +;; of the file. + (defun cj/--agenda-frame-maybe-enable-mode () "Re-enable `cj/agenda-frame-mode' after an agenda build in the agenda frame. Added to `org-agenda-finalize-hook'. `org-agenda-redo' rebuilds through @@ -787,5 +837,11 @@ force-refresh idea in the F8 family." ;; The public gesture appears only now that the feature is complete and live. (cj/--agenda-frame-install-keys) +;; Install the read-only shadow now that every allowlist handler above is +;; defined, so the walk's `commandp' guard recognizes them and preserves the +;; allowlist regardless of whether org-agenda loaded before or after this file. +(with-eval-after-load 'org-agenda + (cj/--agenda-frame-shadow-mutations)) + (provide 'org-agenda-frame) ;;; org-agenda-frame.el ends here |