* Play matching theme background intros at boot
* Add Tokyo Night sunset lake boot intro
* Stage Tokyo Night boot intros on update
* Add user controls for background boot intros
* Optimize Tokyo Night boot intro videos
* Add Tokyo Night cityscape boot intro
* Add Ristretto boot intro videos
* Add Solitude boot intro videos
* Add White boot intro videos
* Add Vantablack boot intro videos
* Add Miasma nature boot intro
* Add Matte Black boot intro videos
* Add Lupine wave boot intro videos
* Add Last Horizon blink boot intro
* Add Everforest tree tops boot intro
* Add Ethereal cosmic boot intro
* Add four Retro 82 boot intros
* Add Tokyo Night Quattro boot intro
* Add Catppuccin Latte color fade boot intro
* Add five Gruvbox boot intros
* Expand Retro 82 boot intro coverage
* Complete Ethereal boot intros
* Complete Retro 82 boot intros
* Stage boot intros for the active theme
* Add Catppuccin boot intros
* Complete Tokyo Night boot intros
* Expand Lupine boot intros
* Add Osaka Jade mountain boot intro
* Prime boot intros before revealing wallpaper
* Complete Osaka Jade boot intros
* Keep kernel migration test valid after timestamp reuse
* Shorten packaged boot intros to six seconds
* Revert "Shorten packaged boot intros to six seconds"
This reverts commit 5530403aa9e789b977a1a1a77ea7acf37a9e3598.
* Document five to seven second intro target
* Ease Matte Black intros into six seconds
* Play boot intros through OWE instead of a shell player
The merged desktop video path removes BackgroundVideo.qml and makes
BackgroundMedia image-only. This keeps the intro feature by resolving the
matching intro as before and playing it with 'owe intro', which owns the
decode and the reveal. OWE 0.2.3 adds that command. The shell holds the
theme color while resolving and cancels with 'owe intro-stop'.
* Make boot intro startup atomic
* Retry boot intro through login window
* Document required OWE intro protocol
* Add Last Horizon video boot intros
* Play boot intros with released OWE
Use `owe intro` instead of the unreleased intro-prepare/intro-commit
protocol from omacom/owe#5. The boot is recorded before playback, and
OWE's intro_result status decides whether a failed intro never started
(release the boot for retry) or was interrupted (keep it consumed).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Replace Matte Black boot intros with shorter cuts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Hide the still behind black until the boot intro starts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Everforest boot intro
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Document that boot intros should open dark
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Refine the Osaka Jade boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Skip compositor fades on the background layers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Catppuccin Latte boot intro
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Catppuccin boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the White boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Vantablack boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Gruvbox boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Retro 82 boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Solitude boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Rework the Ristretto boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Shorten the Tokyo Night boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Complete the Lupine boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Complete the Last Horizon boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Complete the Miasma boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add the Nord boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add the Rose Pine boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add the Flexoki Light boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add the Hackerman boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add the Kanagawa boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add the Lumon boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Fade in the Last Horizon intros from black
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Animate the Catppuccin boot intros from their wallpapers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KAPp37DLjmKQy8GZr3vFvF
* Animate the third White boot intro from its wallpaper
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KAPp37DLjmKQy8GZr3vFvF
* Animate the Flexoki Light, Lumon and Rose Pine plants intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KAPp37DLjmKQy8GZr3vFvF
* Shorten the Ethereal boot intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KAPp37DLjmKQy8GZr3vFvF
* Animate the remaining placeholder intros from their wallpapers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KAPp37DLjmKQy8GZr3vFvF
* Replace Catppuccin intros with themotion scenes
Totoro moonrise, waves swelling from a line, and the blue eye tracing
itself open, rendered by https://github.com/yamz8/themotion
(scenes/catppuccin/*).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KAPp37DLjmKQy8GZr3vFvF
* Re-encode Catppuccin intros with exact final frames
Same motion; the settled frames are encoded at a fixed high quality so
the handoff lands on the wallpaper (themotion 0c5e86c).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Replace Lumon intros with themotion scenes
United in severance draws its lines and globe with a small pen-tip
light; Opinions equally wakes inside the picture's own screen and types
out the mark and tagline. Both keep the wallpaper's proportions, so the
handoff holds its shape. Made with https://github.com/yamz8/themotion
(scenes/lumon/*).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Land the Last Horizon intros exactly on their wallpapers
Same footage and timing; the last 0.4 s now blends into the wallpaper as
the shell draws it (libwebp decode, BT.709 limited range), with the
settled frames at high quality. Re-finished with themotion fit (09f156e).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add Nord video boot intro for Night Hawks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Replace Rose Pine intros with themotion scenes
Funky shapes pop in on a jelly spring and the doodles draw on (replacing
the reversed stock clip), the dot map spins in from a swelling dot, and
the plants spring up before the OMARCHY letters drop in. Made with
https://github.com/yamz8/themotion (scenes/rose-pine/*).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Replace Hackerman intros with themotion scenes
The synthwave terrain unfolds as the sun rises and the valley glow
flares into the floor; the geometric network bursts out from a triangle
at its core and locks into place. Made with
https://github.com/yamz8/themotion (scenes/hackerman/*).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Replace White 3-white with a themotion scene and land 1-2 exactly
3-white folds and slides its paper sheets into place along their
diagonal (themotion scenes/white/3-white). 1-white and 2-white keep
their footage and timing; their last 0.4 s now blend into the wallpaper
as the shell draws it (themotion fit).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Replace Ristretto 0-1 with themotion scenes and land 2-3 exactly
0-launch lifts its stripes off and bends them into their curves, and
1-color-curves fans its colour bands in along their curves (themotion
scenes/ristretto/*). 2-coffee-beans and 3-industrial-moon keep their
footage and timing; their last 0.4 s now blend into the wallpaper as
the shell draws it (themotion fit).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Replace Vantablack intros: new layer scenes, shared dot-hands cut
0-dot-hands uses the Matte Black cut, since both themes ship the same
wallpaper. 1-twisted-stairs keeps its footage and lands exactly on the
wallpaper (themotion fit). 2-layers-deep opens its depth front to back
and 3-layers-stacked lays its papercut stack down sheet by sheet
(themotion scenes/vantablack/*), replacing footage that opened on
unrelated shapes and a plain fade-in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Drop the shockwave ring from the Totoro intro
The moon now opens from its seed of light with only its halo; the thin
ring racing outward read as clutter (themotion 6970484).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Drop the shockwave ring from the blue-eye intro
The eye closes with its pulse and halo only (themotion, same change as
Totoro's).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Land the earlier footage intros exactly on their wallpapers
Everforest, Osaka Jade, Catppuccin Latte and two Matte Black intros
were finished before the exact-ending tooling and ended 0.9-4 levels
off their wallpapers (up to 134 on small spots). Their footage and
timing are unchanged; the last 0.4 s now blend into the wallpaper as the
shell draws it (themotion fit).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Fade two Matte Black intros up from black
ship-at-sea and dark-waters opened at brightness 17-20, so they popped
in after the black cover. They now fade up over 0.3 s; the cuts and
their exact endings are otherwise unchanged (themotion fit --fade-in).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Drop the Flexoki Light intro for now
Its orb scene isn't good enough yet, so Flexoki Light starts on its still
until a better intro is ready.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit bfe60d6c0a7a0983509a2dc2b295693bec2ceeb8)
* Skip boot intros while animations are off
A VM starts with animations off, and there Hyprland renders on the CPU, so a
video intro costs the most. The launcher now consumes the boot without playing
when Hyprland reports animations:enabled false, and the shell's cover check
treats that, like the intros toggle, as nothing to wait for.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add Miasma video boot intro for Crowned
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Keep boot intro startup outside the background service
OWE destroys and recreates the background plugin during playback. Keep the launcher and black cover in the persistent shell host, consume the boot before waiting briefly for OWE, and start on the video's first frame. The startup check runs with a video background too, so enabling the still background service later cannot play an intro over an established desktop.
Co-Authored-By: Codex Medium <codex@openai.com>
* Release the boot marker lock before waiting for OWE
The marker settles startup once it is written. Keeping the lock through readiness and playback makes a fresh shell wait for an older launcher before it can discover that the boot was consumed, leaving the still covered during that wait.
* Keep the boot intro cover above native and cloned backgrounds
Cloned backgrounds receive a scoped shell interface without the startup coordinator. Keep the input-transparent cover in the persistent host so every background stays hidden until OWE has a frame, without widening the plugin interface.
Co-Authored-By: Codex Medium <codex@openai.com>
* Map the startup cover only for an unsettled boot
The cover must know the boot was already consumed before its first frame, so restarting the shell during playback leaves OWE visible. Snapshot the marker without watching subsequent writes: the launcher consumes this boot before the intro starts, while the cover remains needed until the first decoded frame.
* Exercise automatic boot cover release in the clone test
The fixture hid the cover itself before the fake launcher exited, so a broken exit handler still passed. Let the launcher finish before checking the actual background pixels and leave cover release to the service.
Co-Authored-By: Greptile <165735046+greptile-apps[bot]@users.noreply.github.com>
* Finish the Miasma, Kanagawa, Ethereal and Nord intros
Start each intro on its scene instead of fading in from black, since
OWE now starts intros on their first frame.
- Miasma Crowned: ejuro's intro, shortened to 6.7 s and opening on the lit hand
- Nord Night Hawks: ejuro's intro
- Kanagawa: rendered in the wallpaper's own shape, so the handoff matches on
16:10 and 3:2 screens too
- Ethereal, Nord and Miasma Crowned: 1080p endings that blend into the exact
wallpaper, so the handoff no longer sharpens visibly
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Finish the Tokyo Night intros
Start each intro on its scene instead of fading in from black, since
OWE now starts intros on their first frame.
- Winding Road: a new starry night to sunset with no added clouds or sun,
ending on the wallpaper
- Quattro: a new take where the car lands in the wallpaper's exact pose,
colour-matched to the wallpaper
- Oma Cityscape: drop the second, larger moon that faded out at the end
- Quattro, Swirl Buck, Omakub and Oma Cityscape: 1080p endings that blend
into the exact wallpaper, so the handoff no longer sharpens visibly
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Pair background intros by filename and play them on theme switches
Keep matching clips in backgrounds/intros so the selected image determines playback without registration, overrides, or checksum sidecars. Retain one global toggle and play automatically at boot and on a different theme selection.
Launch theme playback after releasing the selection lock. Check the staged theme directory identity so an older launcher cannot play a newer selection when filenames are reused. Skipped or failed playback immediately hands the selected still to the shell, including new pixels behind an unchanged path.
Synchronize the clone screenshot fixture with capture instead of a fixed launcher lifetime, while still requiring the real exit handler to release the cover.
Co-Authored-By: Codex Medium <codex@openai.com>
* Settle pending background colors when applying the current theme
An intro applies its theme immediately while a previous still-image reveal may still hold an older palette. Replace and consume that pending palette through the background's existing handoff methods so its reveal or fallback timer cannot restore old colors. Reusing those methods also works with existing background clones.
Publish the fake renderer's PID before announcing playback readiness, so the lock test cannot read an unwritten PID file. Regressions reproduce both failures on 7b238cf1 and pass with the fixes, including a deliberate scheduling delay at PID publication.
Co-Authored-By: Greptile <165735046+greptile-apps[bot]@users.noreply.github.com>
* Use the existing animations menu toggle for background intros
Keep the separate intro command available without another Style menu control. Disabled animations already suppress playback at boot and on theme changes.
Use remembered backgrounds with matching clips when testing suppressed theme intros, and require the normal still transition so the checks cannot pass merely because no clip was selected.
Co-Authored-By: Codex Medium <codex@openai.com>
* Finish the Lupine intros
Start each intro on its scene instead of fading in from black, since
OWE now starts intros on their first frame.
- Cherry Blossom White: a new take that pulls back from fresh leaves to the
whole tree, easing to a stop on the wallpaper
- Pastel Clouds: drop the unrelated starry opening and its dip to black
- Elegant Blue Wave: drop the empty white opening
- Cherry Blossom Bokeh, Pastel Clouds, Elegant Blue Wave and Cherry Blossom
White: 1080p endings that blend into the exact wallpaper
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JBE1V6gjrqn2aXCNNGhrUY
* Synchronize theme intro and bar crossfades
* Start theme intro fades from a cached first frame
* Open theme intros on moving scenes
* Start theme crossfades promptly
* Prepare theme intros before switching
* Finish the Catppuccin intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JBE1V6gjrqn2aXCNNGhrUY
* Keep theme intro handoffs covered
* Reload Hyprland after theme intro playback
* Finish the Rose Pine intros
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JBE1V6gjrqn2aXCNNGhrUY
* Restore the wallpaper early on each login
* Keep the startup wallpaper cover transparent
* Wait for readiness in the intro lifecycle test
* Consume login intros for updates outside Hyprland
* Fade login directly into the ready desktop intro
* Sharpen Quattro, Swirl Buck and Oma Cityscape
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Keep compositor backgrounds black during login
* Keep the shell visible through compositor shutdown
* Bound the login cover when startup media fails
* Encode the 1440p intros at H.264 level 5.1
At 2560x1440 the previous encodes used 16 reference frames, which puts
them at level 6.0. Intel hardware decoding plays those with stray grey
blocks. Four reference frames keep them at level 5.1, like the other
intros. Swirl Buck's stag now changes colour as one silhouette instead
of leaving a shrinking black disc on its head.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Hide the startup cursor until the desktop fades in
* Restore Swirl Buck's original stag
The stag now changes colour exactly as in the original clip again;
the previous edit made it jump from black to purple in one frame.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Initialize the startup cursor before the first compositor frame
* Render the Hackerman intros at 1440p
Both open on their first motion instead of fading in from black.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Render the Lumon intros at 1440p
Both open on their first motion instead of fading in from black.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Sharpen the Lupine intros
Upscaled from the original 720p clips and exported at 1440p with a
gentler encode, keeping the same frames, timing and endings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Resolve login intros before the wallpaper daemon starts
* Synchronize cold-start captures with the fixture phases
* Sharpen the rest of the Tokyo Night intros
Winding Road and Sunset Lake are regenerated natively at 1440p from
their wallpapers, since their original clips were 360p and 720p.
Omakub and Oma are redrawn from their wallpapers with the same motion.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Bjarne Oeverli <1419214+bjarneo@users.noreply.github.com>
Co-authored-by: Erik Johansson <172146456+ejuro@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Omarchy Bot <omarchybot@users.noreply.github.com>
Co-authored-by: Codex Medium <codex@openai.com>
Co-authored-by: Greptile <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Let users choose passwordless sudo duration
* Warn in the menu bar when passwordless sudo is active
* Fix sudo indicator hover behavior and repeated authentication
* Disable passwordless sudo from the bar without a terminal
* Shorten passwordless sudo indicator tooltip
* Recover interrupted passwordless sudo duration switches
* Allow sudo grant changes when listings require authentication
* Start passwordless sudo setup with the duration question
* Apply agent account selection to CLI subprocesses
* Fix account dispatch edge cases and remove redundant shell wrappers
* Use the current account when launching a new agent session
A city on this machine's zone becomes homeCity, the zone's own city clears
it, and a city on another zone leaves it alone. Ported from omacom/elsewhen#5.
Co-authored-by: Shawn Yeager <shawn@shawnyeager.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Move Elsewhen into Omarchy as omarchy.elsewhen
The world clock ships in the shell tree instead of its own package. A
migration renames existing bar entries with their settings and removes
the retired package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Remove Elsewhen's shelved Earth row, overlap band and sky tint
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Tidy Elsewhen's models, data helper and docs, and drop currency
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Restructure Elsewhen's panel and globe on the shared shell components
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Show Elsewhen's bar globe upright
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Use the shared city search for Elsewhen's globe jump bar
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Keep legacy Elsewhen entries single and retry offline geocodes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Fetch Elsewhen's weather with curl instead of a Python helper
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Add a theme-set sample hook that mirrors themes to herdr machines
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Mirror theme changes to herdr machines by default
Replaces the sample hook with omarchy-theme-sync, which omarchy-theme-set
starts detached after every theme change, and a theme-sync-off toggle that
stops a machine from both sending and receiving.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Rename omarchy-theme-sync to omarchy-theme-set-herdr-machines
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Label the toggle Herdr Theme Sync and extract its menu guard
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Answer the Herdr Theme Sync menu guard from omarchy-theme-set-herdr-machines
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Sync herdr machines one at a time and drop the dry run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Check the theme sync toggle under the lock and stop special-casing this machine
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Make herdr theme sync opt-in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Ask for the sudo password once per omarchy update
Every sudo call in omarchy update prompted, because the no-update wrapper
covered the whole run on top of per-phase revokes, and stay-awake revoked
the timestamp on its own entry and exit. A single update could ask four
times before the snapshot finished (#13319).
Authorize once, right after confirmation, starting from a revoked
timestamp so the prompt always belongs to this update. A background
keepalive refreshes it until the update is done. Prune, snapshot,
stay-awake, keyring, system packages, migrations, orphan removal, service
restarts, the post-update hook, and mise all share that authorization.
AUR builds run third-party PKGBUILD code, so they move to the end and run
cold: the keepalive stops, the timestamp is revoked, and yay and any bare
sudo use the no-update wrapper. The timestamp is revoked again after AUR
and on every exit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Keep the single authorization for passwordless sudo and ttyless inhibition
Authorize by running a command instead of sudo -v. Under the default
verifypw=all, -v prompts even when passwordless sudo is enabled, which
would have added a prompt those users never had.
Inside an update without a terminal, stay-awake now reuses the update's
authorization with a non-interactive sudo instead of asking again through
polkit. It falls back to polkit only if that authorization is gone.
The test sudo refuses a cold non-interactive call, as the real one does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A bare `omarchy-shell shell rescanPlugins` exits 1 when no shell answers on the caller's tree, and omarchy-migrate runs migrations under `set -e`, so an update run from a TTY or over ssh, or one whose shell had gone down while the package replaced its QML, died at "omarchy-shell is not running" before its post-update hooks, shell restart and reboot prompt, and re-failed the same way every time until a shell could be asked. The rescan is now best-effort, like `omarchy-bar put` already is and like #11117 makes the plugin commands' closing rescan: the update restarts the shell once the migrations are through, and a session without one has no bar to place on. An unknown widget on a live shell still leaves the migration pending.
Keep inhibitor state in validated private directories and verify the recorded owner, PID, start time and launch token before signaling. Authenticate the held command before detaching and drop it back to the invoking user.
Serialize launch and cancellation, identify the child before publishing its state, and preserve caller-owned idle choices. Cover cross-account fallback state, process identity, cancellation, retry, and update-lock handling with isolated regressions.
Restarting immediately after the plugin rescan races Quickshell IPC handler creation and can crash the exiting shell. The normal update flow already restarts after migrations. Let this migration finish through live enablement and placement without adding timing workarounds.
Link the package into the existing plugin directory and let bar put handle enablement, clock-relative placement, and the missing-clock fallback. Preserve user checkouts and existing placements, and seed the same link for new users. This removes the Atreyu packaged-discovery prerequisite and the checkout cleanup and JSON rewrite machinery.
Elsewhen (omacom.elsewhen) arrives as the elsewhen package under
/usr/share/omarchy/plugins, the packaged root the shell scans between its
bundled plugins and the user's. It opens the right section of the default
bar, just before the tray, and a migration installs the package, writes the
widget into a customized shell.json in the same spot, and retires a pristine
pre-package clone of the upstream repo that the package now shadows.
Three review findings on the update-hook boundary:
The pre-refresh-pacman hook had been moved after the refresh transaction
and, during a channel switch, deferred to the very end. That defeated the
hook's purpose: custom repositories and IgnorePkg entries were not in
place when the downgrade-capable -Syyuu ran. Run the hook where it used
to run, after the package config is re-synced and before the transaction,
but cold: revoke the timestamp, run it behind the no-update wrapper with
the caller's original PATH, and revoke again before continuing. Every
later privileged command authenticates with --no-update, so a detached
child left by the hook has no reusable timestamp to wait for. Channel
switching hands the caller's PATH to the refresh the same way the updater
receives it, and no longer defers or re-runs the hook.
Stay Awake was released before AUR builds, hooks and mise, so the machine
could sleep during the longest part of an update. Releasing the inhibitor
needs no privilege because the held command already dropped to the user,
so stop it after mise and before the reboot prompt, as before.
A packaged channel destination cannot be inspected before its package is
installed, and a transaction can replace the running tree with a release
that predates the command-scoped wrapper; from then on a bare sudo would
resolve to /usr/bin/sudo and publish a timestamp, and the destination's
own updater authenticates the same way. The switch used to abort only
after the packages had changed, with generic rerun advice. Now it checks
for the wrapper after each transaction before any further privileged
step, completes what it safely can, and stops cold with instructions to
run that release's update from a fresh session instead of launching it.
Boundary tests pin the hook between the config copies and the transaction
with a cold timestamp on both sides, the older-destination stop with its
guidance and no launched updater, the new inhibitor position, and the
post-update hook staying unreached on failures and signals. Docs, the
manual and the sample hook describe the restored timing.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bring in the legacy-grant classifier fix and the reserved-prefix
quarantine from #9457 so this branch no longer carries a stale copy of
that command.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Matching a legacy grant by its filename and rule relationship is not a
complete fingerprint: the legacy writer took the filename from $USER but
produced the rule with echo, and under BASH_ENV with xpg_echo a name such
as ali\0143e yields an alice rule in a mismatched file. Preserving that
as administrator policy let the migration certify success with an
unrestricted grant still live until the next boot.
The prefix is reserved anyway: boot cleanup and the package hook remove
everything under it. Move any file the classifier does not recognize
into a fresh root-only directory under /var/lib/omarchy/sudoers-quarantine/
as `policy`, with the original name stored beside it, so nothing there
stays live, the administrator keeps the content, and a legacy filename
already close to NAME_MAX still fits. An untrusted quarantine directory
keeps the migration pending. Cover the mismatched and maximum-length
legacy files in the unit cleanup and through the real migration runner.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The legacy command wrote the caller's unvalidated name into both the
sudoers filename and the rule. Cleanup applied the current lower-case
account pattern to that suffix, so an exact legacy grant for an account
such as Alice was classified as administrator policy, left active, and
the machine-wide migration marker was written anyway.
Match a legacy grant by its exact filename and rule relationship instead
of the account policy, and cover it in the lifecycle suite through both
the unit cleanup and the real migration runner.
The account pattern itself stays lower-case: sudoers reads an upper-case
word such as ALICE as a User_Alias reference, and ALL as every user, so
such names must never reach the generated rule. Pin that with a test.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Upstream now runs every Omarchy-owned pacman transaction through the
hidden omarchy-update-pacman helper so a mid-transaction systemd reexec
cannot kill it. Keep the deferred pre-refresh-pacman hook and the
command-scoped sudo wrapper, and call the helper from the refresh and
channel commands; the wrapper still applies to the helper's own sudo.
The sudo boundary fixture copies the helper into its root and runs a
systemd-run stand-in that execs the wrapped pacman step in place.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Upgrading systemd runs its post_upgrade scriptlet mid-transaction, which
reexecs both the system manager and every user manager. When pacman runs
inside a user-session scope (the floating update terminal), that reexec
can SIGKILL it and abandon the transaction halfway, with packages
upgraded but none of the post-transaction hooks run.
Route every Omarchy-owned system mutation through a new hidden
omarchy-update-pacman helper that registers the transaction as a PID 1
scope via systemd-run, keeping it out of the user manager's cgroups.
System scopes survive the system manager's own reexec, and as a bonus the
transaction now also survives its terminal window closing. On unbooted
systems (the installer chroot) the helper runs pacman directly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Keep the migrations themselves for late-updaters. Drop the tests that only
exercised frozen file rewrites from 4.0.0, and keep live invariants,
privileged repairs, and the migrator.
Erik Melton