# fix\(notifications\): keep notification body text literal \(\#343\) · lucenx/codexbar-plasma

[View on GitCafe](https://git.cafe/lucenx/codexbar-plasma/commit/101fae935dad6ba1a55b4228681fc88dfffd6468)

Repository: [lucenx/codexbar-plasma](https://git.cafe/lucenx/codexbar-plasma)

Visibility: public

Requested revision: 101fae935dad6ba1a55b4228681fc88dfffd6468

Requested commit: 101fae935dad6ba1a55b4228681fc88dfffd6468

Commit: 101fae935dad6ba1a55b4228681fc88dfffd6468

Tree: aee223839b482ebb6d7a5fe6f913e4bb45332960

Author: Simone

Committer: GitHub

## Message

```
fix(notifications): keep notification body text literal (#343)

notify-send passes the body to the notification server as markup, and
Plasma renders links, emphasis and images in it. Bodies carry CLI text
such as provider status messages and extra quota labels, so a status
message containing an anchor became a clickable link to any address,
bypassing the host-pinned status URL rule, and a literal "<" or "&"
could vanish.

NotificationCommand now escapes &, < and > in the bounded body. The
summary is plain text by specification and stays literal.

Tests: tst_notification_command covers links, images, entities, the
action and fallback sends, and the bound applied before escaping; both
cases fail on main. The real notify-send dispatcher test now expects the
escaped body.

Documentation: development and usage guides, CHANGELOG Unreleased.


Claude-Session: https://claude.ai/code/session_0118rYiu37HnKdYedpUff1cT

Co-authored-by: Claude <noreply@anthropic.com>
```

## Parents

- [85e5261d5b3219cf3ad96b6dd8009d02e8f4aa22](https://git.cafe/lucenx/codexbar-plasma/commit/85e5261d5b3219cf3ad96b6dd8009d02e8f4aa22?format=markdown)

[Source at this commit](https://git.cafe/lucenx/codexbar-plasma/tree/101fae935dad6ba1a55b4228681fc88dfffd6468?format=markdown)