Add desktoprenamer extension by gitmichaelqiu · Pull Request #24610 · raycast/extensions

gitmichaelqiu · 2026-01-17T16:31:58Z

Description

This is an extension for the app DesktopRenamer. All of the commands in this extension use only Apple Script of DesktopRenamer.

Screencast

Checklist

I read the extension guidelines
I read the documentation about publishing
I ran npm run build and tested this distribution build in Raycast
I checked that files in the assets folder are used by the extension itself
I checked that assets used by the README are placed outside of the metadata folder

- Fix stylings - Return results for running - Rename visible label window toggle - Remove error catch - Merge branch \'main\' of https://github.com/gitmichaelqiu/Raycast_DesktopRenamer - Remove redundant annotations - Optimize format - Add MIT License to the project - Update subtitles - Merge branch \'main\' of https://github.com/gitmichaelqiu/Raycast_DesktopRenamer - Remove Windows platform - Remove windows platform - Add dark icon - Update extension icon - Add rename-current-space - Rename to toggle-active-window-visibility - Add toggle-visibility-of-active-label-windows - Add toggle-preview-label-windows - Add toggle-active-label-window - Add toggle-space-label-windows - Add toggle-menubar-item - Initialize Raycast extension folder

raycastbot · 2026-01-17T16:32:14Z

Congratulations on your new Raycast extension! 🚀

We're currently experiencing a high volume of incoming requests. As a result, the initial review may take up to 10-15 business days.

Once the PR is approved and merged, the extension will be available on our Store.

greptile-apps · 2026-01-17T16:46:00Z

Greptile Summary

Adds new extension for DesktopRenamer app that allows users to control macOS desktop spaces from Raycast. The extension provides commands to switch desktops, rename spaces, and toggle various UI elements.

Configuration files follow Raycast standards (ESLint v9+, Prettier, CHANGELOG format)
Proper error handling with user-friendly messages and app installation prompts
Most user inputs are correctly sanitized using escapeAppleScriptString helper
Critical security issue: AppleScript injection vulnerability in switch-to-desktop.tsx:111 where space.id is not sanitized before being passed to the rename command

Confidence Score: 2/5

This PR contains a critical AppleScript injection vulnerability that must be fixed before merging
The extension is well-structured with proper configuration and error handling, but has a critical security vulnerability where space.id is interpolated directly into an AppleScript command without sanitization. While the impact depends on whether DesktopRenamer's API can return malicious IDs, the risk of code injection exists and must be addressed.
Pay close attention to extensions/desktoprenamer/src/switch-to-desktop.tsx - the AppleScript injection vulnerability on line 111 must be fixed

Important Files Changed

Filename	Overview
extensions/desktoprenamer/package.json	Extension configuration is clean with proper metadata, categories, and dependencies
extensions/desktoprenamer/src/switch-to-desktop.tsx	Main view command with AppleScript injection vulnerability on line 111 where `space.id` is not sanitized
extensions/desktoprenamer/src/utils.ts	Helper utilities with proper escaping function and error handling

_{Last reviewed commit: 6df9b75}

greptile-apps

_{22 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

extensions/desktoprenamer/src/rename-current-space.ts

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

- Merge branch \'contributions/merge-1768701926453\' - Pull contributions - Restyle - Merge branch \'contributions/merge-1768701779248\' - Pull contributions - Use black theme screenshots - Add metadata - Accept suggestion from greptile

- Fix stylings - Update extension name - Rename within switch to space - Group spaces by displays - Use desktop icon - Highlight current desktop in switch-to-desktop - Remove unused components in current-desktop - Fix current-desktop fetching - Remove view of current-desktop - Fix current-desktop to display name at subtitle - Add switch-to-desktop

pernielsentikaer

Hi 👋

Thanks for your contribution 💪

I have now tested your extension, and I have some feedback ready for you:

subtitle should not be used to describe the command - you can read more about that here
Maybe you can show some showFailureToasts when there is some errors like not installed?
Cuold you add some more about how to use it and what to install so other users can read a bit more about it?

I'm looking forward to testing this extension again 🔥

Feel free to contact me here or at Slack if you have any questions.

I converted this PR into a draft until it's ready for the review, please press the button Ready for review when it's ready and we'll have a look 😊

- Remove unused variable error - Update switch-to-desktop - Update README.md - Update README.md - Fix error output of switch desktop - Add error handling for current-desktop - Remove subtitles - Add debug info

- Fix stylings - Fix syntax

gitmichaelqiu · 2026-02-07T12:18:36Z

Hi @pernielsentikaer, thanks for your review and suggestions!

I have modified the subtitles which went against the styling guide and added "DesktopRenamer is not running." return.

As long as users have installed DesktopRenamer, no extra actions are required to run the extension. The previous error you encountered (I assume so) was because I had not pushed the update of the DesktopRenamer app. It should work out now.

Thanks for your time and it is a pleasure to contribute to the Raycast store! Let me know if furthur actions are needed.

greptile-apps

_{3 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

extensions/desktoprenamer/package.json

extensions/desktoprenamer/src/switch-to-desktop.tsx

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

- Update README.md - Update interval to 10s - Refresh space list after switching - Fix package.json - Pull contributions

greptile-apps

_{22 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-08T03:40:59Z

extensions/desktoprenamer/src/switch-to-desktop.tsx

+function RenameSpaceForm({ space, onRename }: { space: Space; onRename: () => void }) {
+  const { pop } = useNavigation();
+
+  async function handleRename(values: { name: string }) {


AppleScript injection via id

RenameSpaceForm interpolates space.id directly into AppleScript (rename space "${space.id}" ...). If get all spaces ever returns an id containing quotes/backslashes, this can break the script and allows AppleScript injection. Sanitize/escape space.id the same way you do in switchSpace before interpolation.

greptile-apps · 2026-02-08T03:41:00Z

extensions/desktoprenamer/src/switch-to-desktop.tsx

+  if (data) {
+    const [spacesStr, curName] = data.split("|||||");
+    currentName = curName ? curName.trim() : "";
+    spaces = spacesStr
+      .split("\n")


Ambiguous parsing delimiter

The AppleScript returns allSpaces & "|||||" & currentName and then JS does data.split("|||||"). If any space name contains ||||| (or if the get all spaces output format changes), parsing breaks and spacesStr/curName become incorrect, which can make the list empty or mis-identify the current space. Prefer returning a structured format (e.g. JSON) or a delimiter that is guaranteed not to appear, and validate the split count before using it.

greptile-apps · 2026-02-08T03:41:01Z

extensions/desktoprenamer/src/utils.ts

+    return await runAppleScript(`tell application "DesktopRenamer" to ${command}`);
+  } catch (error) {


AppleScript injection surface

runDesktopRenamerCommand interpolates the command string into an AppleScript template (... to ${command}). Any caller that passes user-controlled or untrusted strings without escaping will produce broken scripts or injection. Since this is a shared helper, it’s safer to accept structured inputs (e.g. action + args) or centrally escape quoted parameters before building the script.

pernielsentikaer

Hi 👋

Thanks for the update 🔥

Two things:

Can't we use something like what the extension https://www.raycast.com/Yukai/eagle does? Looking up if the app is installed and prompt to install before running the commands? That would give a much better UX
Is any of the feedback from Greptile worth looking into?

I converted this PR into a draft until it's ready for the review, please press the button Ready for review when it's ready and we'll have a look 😊

- Run lint fix - Fix opening app fallback - Run it status - Prevent injection - Adopt new ~|~ separator

- Remove unused functions - Add installation check for all commands - Add installation check

gitmichaelqiu · 2026-02-26T08:52:09Z

The app will now automatically deletes the ~ character in names before injecting. The separator should no longer be an issue now.
The Apple Script is sanitized.
The commands will hint the user to install the app if not installed or to launch the app if installed.

extensions/desktoprenamer/src/switch-to-desktop.tsx

Ohhhh miss one Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

pernielsentikaer

Looks good to me, approved 🔥

github-actions · 2026-03-06T12:42:17Z

Published to the Raycast Store:
https://raycast.com/michael_qiu/desktoprenamer

raycastbot · 2026-03-06T12:42:19Z

🎉 🎉 🎉

We've rewarded your Raycast account with some credits. You will soon be able to exchange them for some swag.

- chore(hugeicons-ui):Update hugeicons-ui: bump @hugeicons/core-free-icons and @hugeicons/react - [Skills] Display Metadata from SKILL.md frontmatter (raycast#26101) - Update CODEOWNERs (c2c1e0d) - Add timely extension (raycast#25085) - Fix: copy prompt/answer for selected message (raycast#25438) - Update CODEOWNERs (46ecffc) - Update todoist extension (raycast#26087) - Dia: update @raycast/utils to 2.2.3 (raycast#26091) - Update CODEOWNERs (3503a64) - Add typewhisper extension (raycast#25733) - Update CODEOWNERs (5ea5ef7) - Add number-research extension (raycast#26060) - Update trustmrr extension (raycast#26085) - Update CODEOWNERs (40aabef) - Add desktoprenamer extension (raycast#24610) - Update tailwindcss extension (raycast#26067) - Update CODEOWNERs (7a13ffd) - Update time-awareness extension (raycast#25765) - Update CODEOWNERs (6c50032) - Update github-status extension (raycast#26063) - Update anna-s-archive extension (raycast#26076) - Update CODEOWNERs (46b879a) - Update shopify-developer-changelog extension (raycast#25711) - Update CODEOWNERs (22aa04d) - Update weather extension (raycast#26074) - Update kagi-news extension (raycast#25679) - Update (raycast#26073) - Update teak-raycast extension (raycast#25995) - otp-inbox: Add Windows support (raycast#25441) - Update CODEOWNERs (36e7a5f) - Add trustmrr extension (raycast#26069) - Update CODEOWNERs (d7c540c) - Add doubao-tts extension (raycast#25705) - GitHub: Improve auto-merge support (raycast#25256) - Update CODEOWNERs (9f556d5) - Update microsoft-edge extension add new feat to search and launch workspaces (raycast#25335) - Add RouteMesh MCP server to model-context-protocol-registry (raycast#25960) - feat: Add Advanced Batch Rename command with rule-based engine (raycast#25501) - Update media-converter extension (raycast#25836) - Update scheduler extension (raycast#26059) - Docs: Update the utils docs - [pipe-commands] Add data formatting utilities (raycast#25824) - Update CODEOWNERs (5b660b2) - Add hdri-library extension (raycast#25701) - Update CODEOWNERs (2ea8b9c) - Update ente-auth extension (raycast#25773) - Update CODEOWNERs (b9b9e2b) - Add grpcui extension (raycast#25697) - Update CODEOWNERs (1730346) - Update openrouter model search extension (raycast#26045) - System Monitor: Fix stale temperature readings in menubar (raycast#26025) - Update CODEOWNERs (4e3ff41) - Fix truncated row values in pass extension (raycast#25843) - Update CODEOWNERs (489aede) - Add quickreferences-raycast extension (raycast#23629) - Update CODEOWNERs (84a0a58) - Update cleanshotx extension (raycast#25985) - [ccusage] Hide "Usage Limits" details when using non-OAuth authentication (raycast#26009) - Browser Bookmarks: Add support for Perplexity Comet browser (raycast#25874) - Add Windows support (raycast#25882) - Update bmrks extension (raycast#25952) - Update CODEOWNERs (2faa166) - Update radarr extension (raycast#25953) - Update CODEOWNERs (d8b0e95) - Update google-chrome extension (raycast#25939) - Add PrusaConnect links to Prusa extension (raycast#25955) - Update CODEOWNERs (9f8c615) - Claude Code Launcher: Fix Ghostty PATH by using interactive shell (raycast#25976) - Update aave-search extension (raycast#26016) - uuid-generator: add Pack Type Id command (raycast#25800) - Update CODEOWNERs (39fe5d1) - [ccusage] Fix npx path resolution for fnm installs using XDG directories (raycast#26008) - fix(arc): prevent duplicate windows when Arc is not running (raycast#25806) - System Monitor: Add pin-to-display for menubar stats (raycast#25821) - Update CODEOWNERs (ec57b0b) - Add unified Wispr Flow extension (raycast#25218) - Update shadcn ui extension (raycast#26011) - Update CODEOWNERs (b354d33) - feat(gumroad): add price filter and copy actions (raycast#25703) - Update CODEOWNERs (134d6f9) - Add raycast-ai-custom-providers extension (raycast#25180) - Update CODEOWNERs (4accbb2) - Add zo-raycast extension (raycast#25464) - Update CODEOWNERs (227732f) - Add job-dojo extension (raycast#25677) - Update CODEOWNERs (eace185) - Add wallhaven extension (raycast#25656) - Update existing somafm extension: launch flow, refresh toasts, menu fallback (raycast#25187) - Update CODEOWNERs (d0f014f) - Add email-finder extension (raycast#24847) - Update cut-out extension (raycast#25990) - Update CODEOWNERs (1ef7a10) - Add cut-out extension (raycast#25663) - [Pokedex] Added support for Scarlet & Violet–style sprite artwork (raycast#25986) - Discogs extension new functions (raycast#25686) - Update nhk-program-search extension (raycast#25967) - Update kimi extension (raycast#25962) - Update CODEOWNERs (de246c1) - Update shiori-sh extension (raycast#25944) - fix(browser-bookmarks): fix slow initial load and open-in-browser reliability (raycast#25979) - Update CODEOWNERs (0ad09cd) - Add spacer extension (raycast#25652) - [zotero] Fix Zotero 7+ / Better BibTeX compatibility (raycast#25634) - Docs: update for the new API release - added ARM64 sdk support (raycast#25966) - Update CODEOWNERs (3051c01) - Add Bird extension (raycast#25481) - Update CODEOWNERs (7c4f8af) - Add Lock Time extension (raycast#25255) - Update CODEOWNERs (cdc0ceb) - Add paste-safely extension (raycast#25951) - Update CODEOWNERs (bd032c8) - Add polars-documentation-search extension (raycast#25589) - Update CODEOWNERs (564b0f2) - Add DevContainer Features extension (raycast#25603) - Update CODEOWNERs (2cdb8f6) - Update gift-stardew-valley extension (raycast#25552) - Update CODEOWNERs (f728891) - Update Inkdrop extension (raycast#25529) - Sourcegraph: Setup improvements (raycast#25950) - [Skills] Add support for updating skills (raycast#25887) - Update CODEOWNERs (cb956f6) - Add search repositories feature for Github for Enterprise (raycast#25661) - Fix/trakt manager user agent v2 (raycast#25825) - Update `CricketCast` extension - add menu bar for scores (raycast#25942) - Add Windows platform support to Goodreads extension (raycast#25936) - idonthavespotify: Add Qobuz, Bandcamp, Pandora support & fix crash on unknown adapters (raycast#25937) - Update singularityapp extension (raycast#25943) - Update raycast-surge extension (raycast#25883) - Update awork extension (raycast#25844) - Update extend-display extension (raycast#25894) - Update git-worktrees extension (raycast#25898) - [Image Modification] Fix QSpace / QSpace Pro selection detection (raycast#25923) - Update zeabur extension (raycast#25924) - Update vietnamese-calendar extension (raycast#25917) - [AzTU LMS] Fix Color & Add New Image (raycast#25912) - Update CODEOWNERs (c2aba2b) - Add Hop extension (raycast#25162) - [Music Assistant Controls]: Big update with many features (raycast#25860) - [MXroute] set mail hosting status + open webmail link (raycast#25895) - Update kitty extension (raycast#25856) - Update CODEOWNERs (b73dbee) - Addeed SDK implementation (raycast#25820) - Update CODEOWNERs (66857dc) - Add notilight-controller extension (raycast#25424) - Update raycast-store-updates extension (raycast#25865) - Update reader-mode extension (raycast#25872) - Update CODEOWNERs (f8eeb0d) - Update battery-optimizer extension (raycast#25509) - fix: show window icons on first load in window-walker extension (raycast#25871) - Update CODEOWNERs (7e705b7) - Update t3 chat extension (raycast#25803) - Update CODEOWNERs (19f337b) - Update modify-hash extension (raycast#25816) - Update CODEOWNERs (64e21d0) - Add `ZeroSSL` extension - list certificates, view + validate csr (raycast#25861) - [Cron Manager] Fix tasks disappearing from UI & permission handling (raycast#25845) - Update CODEOWNERs (abe1d59) - Add markdown-converter extension (raycast#24129) - Update betaseries extension (raycast#25842) - [Skills] Inline detail Panel (raycast#25658) - Update CODEOWNERs (f1bac6d) - Removed two extensions (raycast#25851) - Update CODEOWNERs (53db7b3) - Add shiori-sh extension (raycast#25757) - Docs: update for the new API release - feat(everything-search): allow custom cli arguments (raycast#24607) - Update CODEOWNERs (93ff0be) - Delete extensions/proton-pass-client directory (raycast#25841) - update (raycast#25840) - Update CODEOWNERs (d85419c) - Add kaneo-for-raycast extension (raycast#25461) - [Apple Reminders] Prevent accidental recurring reminders from AI (raycast#25746) - [Apple Notes] Fix AI tool note ID mismatch, timeout, and search filtering (raycast#25720) - fix: show window icons on first load in window-walker extension (raycast#25818) - [Namecheap] fix error when no domain dns hosts (raycast#25827) - Update youversion-suggest extension (raycast#25797)

raycastbot added new extension Label for PRs with new extensions platform: macOS labels Jan 17, 2026

gitmichaelqiu marked this pull request as ready for review January 17, 2026 16:35

raycastbot assigned pernielsentikaer Jan 17, 2026

greptile-apps bot reviewed Jan 17, 2026

View reviewed changes

extensions/desktoprenamer/src/rename-current-space.ts Outdated Show resolved Hide resolved

gitmichaelqiu and others added 3 commits January 18, 2026 09:52

Update extensions/desktoprenamer/src/rename-current-space.ts

0b6b289

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Update desktoprenamer extension

9be21e2

- Merge branch \'contributions/merge-1768701926453\' - Pull contributions - Restyle - Merge branch \'contributions/merge-1768701779248\' - Pull contributions - Use black theme screenshots - Add metadata - Accept suggestion from greptile

pernielsentikaer requested changes Feb 4, 2026

View reviewed changes

pernielsentikaer marked this pull request as draft February 4, 2026 20:56

gitmichaelqiu added 2 commits February 7, 2026 20:04

Update desktoprenamer extension

2a618ed

- Remove unused variable error - Update switch-to-desktop - Update README.md - Update README.md - Fix error output of switch desktop - Add error handling for current-desktop - Remove subtitles - Add debug info

Update desktoprenamer extension

11fed74

- Fix stylings - Fix syntax

gitmichaelqiu marked this pull request as ready for review February 7, 2026 12:18

greptile-apps bot reviewed Feb 7, 2026

View reviewed changes

extensions/desktoprenamer/package.json Outdated Show resolved Hide resolved

extensions/desktoprenamer/src/switch-to-desktop.tsx Outdated Show resolved Hide resolved

extensions/desktoprenamer/src/switch-to-desktop.tsx Outdated Show resolved Hide resolved

Update extensions/desktoprenamer/package.json

4701ee5

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

raycastbot removed the platform: macOS label Feb 8, 2026

gitmichaelqiu and others added 2 commits February 8, 2026 10:41

Update extensions/desktoprenamer/src/switch-to-desktop.tsx

80c7154

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Update extensions/desktoprenamer/src/switch-to-desktop.tsx

e29266a

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

gitmichaelqiu marked this pull request as draft February 8, 2026 02:43

Update desktoprenamer extension

82876a7

- Update README.md - Update interval to 10s - Refresh space list after switching - Fix package.json - Pull contributions

raycastbot added the platform: macOS label Feb 8, 2026

gitmichaelqiu marked this pull request as ready for review February 8, 2026 03:28

gitmichaelqiu requested a review from pernielsentikaer February 8, 2026 03:28

greptile-apps bot reviewed Feb 8, 2026

View reviewed changes

pernielsentikaer requested changes Feb 16, 2026

View reviewed changes

pernielsentikaer marked this pull request as draft February 16, 2026 10:58

gitmichaelqiu added 2 commits February 26, 2026 15:43

Update desktoprenamer extension

a2d8882

- Run lint fix - Fix opening app fallback - Run it status - Prevent injection - Adopt new ~|~ separator

Update desktoprenamer extension

6df9b75

- Remove unused functions - Add installation check for all commands - Add installation check

gitmichaelqiu marked this pull request as ready for review February 26, 2026 08:49

greptile-apps bot reviewed Feb 26, 2026

View reviewed changes

extensions/desktoprenamer/src/switch-to-desktop.tsx Outdated Show resolved Hide resolved

gitmichaelqiu and others added 2 commits February 26, 2026 17:19

Update extensions/desktoprenamer/src/switch-to-desktop.tsx

876c330

Ohhhh miss one Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Add subtitle to commands

646e5da

pernielsentikaer approved these changes Mar 6, 2026

View reviewed changes

Update CHANGELOG.md and optimise images

6ae2f20

raycastbot merged commit 40aabef into raycast:main Mar 6, 2026
2 checks passed

		return await runAppleScript(`tell application "DesktopRenamer" to ${command}`);
		} catch (error) {

Conversation

gitmichaelqiu commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Screencast

Checklist

Uh oh!

raycastbot commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 2/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pernielsentikaer left a comment

Choose a reason for hiding this comment

Uh oh!

gitmichaelqiu commented Feb 7, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

pernielsentikaer left a comment

Choose a reason for hiding this comment

Uh oh!

gitmichaelqiu commented Feb 26, 2026

Uh oh!

Uh oh!

pernielsentikaer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Mar 6, 2026

Uh oh!

raycastbot commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gitmichaelqiu commented Jan 17, 2026 •

edited

Loading

raycastbot commented Jan 17, 2026 •

edited

Loading

greptile-apps bot commented Jan 17, 2026 •

edited

Loading

greptile-apps bot left a comment •

edited

Loading