Commit Graph
6638 Commits
Author SHA1 Message Date
Ryan Hughes 72ec724c3c Use omarchy-cmd-present 2026-09-07 12:53:10 -04:00
Ryan Hughes 79138c0e70 Follow the active theme in T3 Code
T3 Code reads themes an environment publishes into its state directory, so
a generated t3code.json carries the palette the same way claude.json and
vscode-theme.json already do, and omarchy-theme-set-t3code republishes it
on every theme change for the app to pick up live.

The template overrides only the roles a theme actually designs -- terminal
and code surfaces, text on canvas, borders, selection -- and leaves muted
text, placeholders, and status foregrounds to T3 Code, which contrast-solves
them against whatever canvas it is given. Overriding those directly cost
readability on light themes: White fell to 1.0:1 on placeholder text.

Installing from the menu now routes through omarchy-install-ai-t3-code so a
fresh install publishes the current palette and opens wearing it.
2026-09-07 12:53:10 -04:00
Afonso Oliveira 0add43f9b7 Check dev update support before changing the system 2026-09-07 17:38:36 +01:00
Afonso Oliveira c8697407cb Keep channel transitions inside command-scoped sudo 2026-09-07 17:33:33 +01:00
Afonso Oliveira 5bc41b2585 Resolve security libraries beside canonical entrypoints 2026-09-07 17:31:54 +01:00
Afonso Oliveira f37c73fa20 Bind protected update commands to their source root 2026-09-07 17:27:04 +01:00
Afonso Oliveira 5b692c5b30 Preserve user PATH across updater relaunches 2026-09-07 14:31:07 +01:00
Afonso Oliveira aa422fcd4e Merge current Quattro while preserving command checks 2026-09-07 11:50:18 +01:00
Spencer Bull a703092631 Merge pull request #10613 from spencerbull/hermes-desktop-in-app-updates
Enable Hermes in-app updates and guard removal
2026-09-07 04:26:22 -05:00
Spencer Bull 9fb73b0051 Hide the upstream Hermes launcher in Omarchy
Keep the package launcher visible when Hermes builds register a second desktop entry. Use the existing launcher hide list so in-app updates cannot restore the duplicate menu row.
2026-09-07 04:20:13 -05:00
Spencer BullandGPT-6 Codex 1b4ac8380b Refuse Hermes removal while its files are in use
An open terminal can retain deleted SQLite WAL files across removal and reinstall, causing the updated desktop to refuse session writes. Check user processes before package/runtime removal and again after data confirmation, without killing sessions. Cover the failure with real SQLite writers in isolated fixtures.

Co-Authored-By: GPT-6 Codex (xhigh) <noreply@openai.com>
2026-09-07 03:56:51 -05:00
Spencer BullandGPT-6 Codex 827266fbed Prepare a consistent Hermes release for its first update
Align main with the packaged release and fetch connected history so the updater detects and rebuilds the first update. Guard local branch work before upstream installation, force only the admitted incomplete release pin, preserve existing command files, and explain incompatible packages. Exercise empty-directory publication races and delayed launches.

Co-Authored-By: GPT-6 Codex (xhigh) <noreply@openai.com>
2026-09-07 03:39:05 -05:00
Spencer BullandGPT-6 Codex aa3868b345 Prepare Hermes native desktop for in-app updates
Use the packaged upstream installer and matching prebuilt app to prepare the writable user installation before launch. Preserve existing builds and modified sources; record the upstream build stamp only for a matching prebuilt app.

Co-Authored-By: GPT-6 Codex (xhigh) <noreply@openai.com>
2026-09-07 02:55:06 -05:00
Ryan Hughes e989b5b3ee Merge pull request #7994 from Adolanium/mise-install-name-guard
Quote mise-install arguments and refuse unusable command names
2026-09-07 03:15:39 -04:00
Ryan Hughes e78d89ee2a Merge pull request #9618 from acrogenesis/security/plugin-auth-boundary
Restrict third-party plugin access to authentication services
2026-09-07 03:14:48 -04:00
Ryan Hughes a87d396f01 Merge pull request #9387 from omacom/security/nopasswd-expiry-fail-closed
Fail closed when passwordless sudo expiry cannot arm
2026-09-07 03:10:09 -04:00
Ryan HughesandGPT-5.6 Sol a7a4a682e5 Keep mise cleanup compatible with escaped wrappers
Co-Authored-By: GPT-5.6 Sol <noreply@openai.com>
2026-09-07 02:30:56 -04:00
Ryan HughesandGPT-5.6 Sol 572a34d3e3 Refresh cached plugin bar shell facades
Co-Authored-By: GPT-5.6 Sol <noreply@openai.com>
2026-09-07 02:28:12 -04:00
Spencer Bull 18410a0e48 Merge pull request #10460 from codemonkey76/fix-openclaw-cmd-present
Use the command helper in the AI app removers
2026-09-07 01:15:08 -05:00
Ryan Hughes f04366de79 Merge pull request #10605 from omacom/fix/kitty-system-defaults
Move Kitty defaults to the system config and restrict remote control
2026-09-07 02:02:10 -04:00
Ryan HughesandErik Melton eaed240bea Credit Erik Melton for the Kitty remote-control fix
Co-authored-by: Erik Melton <meltonaerik@gmail.com>
2026-09-07 01:59:12 -04:00
Ryan Hughes 37bb46e037 Make Kitty migration guidance easier to read 2026-09-07 01:49:49 -04:00
Ryan Hughes 04a9cda98d Explain how to opt out of Kitty theming 2026-09-07 01:46:55 -04:00
Ryan Hughes 4cb9c75a96 Move Kitty defaults into the system config 2026-09-07 01:24:12 -04:00
Ryan HughesandGPT-5.6-Sol 23aeb4c670 Preserve clone summons in replacement bars
Co-Authored-By: GPT-5.6-Sol <noreply@openai.com>
2026-09-06 22:18:52 -04:00
Ryan HughesandGPT-5.6-Sol 3292c19fef Preserve built-in clone integrations
Co-Authored-By: GPT-5.6-Sol <noreply@openai.com>
2026-09-06 22:04:48 -04:00
Ryan Hughes d7c783ecf5 Merge pull request #10579 from omacom/fix/locate-service-defaults
Replace locate configuration script with packaged service defaults
2026-09-06 21:52:21 -04:00
Ryan Hughes 04b0a47c9b Configure locate through the packaged service
Reported-by: uiop / @wasdhjklxyz <uiop@wasdhjkl.xyz>
2026-09-06 21:42:31 -04:00
Ryan HughesandGPT-5.6-Sol f2b4731bb3 Prevent authentication service capability downgrades
Co-Authored-By: GPT-5.6-Sol <noreply@openai.com>
2026-09-06 20:20:30 -04:00
Ryan Hughes c82a0837b0 Merge pull request #10425 from acrogenesis/security/root-owned-sleep-hooks
Harden ownership of installed sleep hooks
2026-09-06 19:36:07 -04:00
Ryan Hughes 0c20243214 Bound GPU mode requests during sleep 2026-09-06 19:34:36 -04:00
Afonso Oliveira 35551b04da Disable the Yay sudo loop with its supported option 2026-09-07 00:24:43 +01:00
Afonso Oliveira 177d5729c9 Wait for notifications when restarting the shell 2026-09-07 00:08:07 +01:00
Afonso Oliveira d41ca88f76 Wait for the actual Stay Awake launcher 2026-09-07 00:03:53 +01:00
Afonso Oliveira 978dffaa3e Use required gum directly in AI removal prompts 2026-09-06 23:32:28 +01:00
Afonso Oliveira a9e9954e3e Clarify unattended updates still require sudo authorization 2026-09-06 22:59:08 +01:00
Afonso Oliveira 1f8f5bacac Integrate current quattro before security review 2026-09-06 22:56:04 +01:00
Afonso Oliveira f2c3925431 Revoke before session cleanup and protect standalone inhibition 2026-09-06 22:49:43 +01:00
Afonso Oliveira c52381f092 Keep update regressions isolated from host authentication 2026-09-06 22:32:34 +01:00
Ryan Hughes 3f91f06a62 Merge pull request #10225 from mdisec/security/harden-quattro-fprintd-path
Harden lock authentication command lookup
2026-09-06 17:26:28 -04:00
Afonso Oliveira 35b318ed09 Complete command-scoped authentication across update phases 2026-09-06 22:26:06 +01:00
Afonso Oliveira 7f9a401bb1 Merge commit 'b71dcad96e9d0b2962b7d225828a5cb6000ad720' into codex/review-9469-20260906 2026-09-06 22:11:06 +01:00
acrogenesis feb0557e1d Harden ownership of installed sleep hooks
Publish privileged sleep-hook and hybrid-GPU files through root-owned replacement inodes, repair unsafe existing copies while preserving administrator customizations, and keep partial hibernation setup retryable.

Reported-by: Roger Piñol <rogerpicar@gmail.com>
2026-09-06 14:36:27 -06:00
David Heinemeier Hansson 97a86af116 Nix ideas 2026-09-06 22:29:30 +02:00
0d223fe820 Add Muse Code as a default coding agent (#9915)
* Add Muse Code as a default coding agent

Meta ships Muse Code only as a binary, so it installs from the AUR
(muse-code-bin) instead of mise, and a fresh install runs the muse login
browser flow in the install terminal before the agent opens.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148qKzr366p2Ubu2igCLvPg

* Refine Muse Code menu and prompt forwarding

* Install Muse Code from OPR

* Install Muse Code through mise's HTTP backend

* Preinstall the Muse mise stub

* Use the shared Muse installation flow

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
2026-09-06 22:29:16 +02:00
Ryan Hughes f4a462ef20 Merge pull request #10537 from omacom/add-hyprland-rebind
Add o.rebind for replacing Hyprland keybindings
2026-09-06 16:04:51 -04:00
Ryan Hughes 1d466c4003 Add o.rebind for replacing Hyprland keybindings 2026-09-06 16:01:50 -04:00
steelcityapplianceandClaude Fable 5.1 a9eaf7978e Point the shipped agent skills at omacom/omarchy (#10532)
The repository moved from basecamp/omarchy to omacom/omarchy, but the skills
Omarchy installs into ~/.claude/skills, ~/.codex/skills and ~/.agents/skills
still name the old owner. Most gh calls follow the rename, so nothing looks
wrong in normal use. Search does not: `gh issue list --repo basecamp/omarchy
--search ...` exits 0 with no output, and the raw search API answers
"Validation Failed". An agent following contributing.md or reporting.md runs
its duplicate check before filing, sees zero matches, and files a duplicate.

Replace the owner in contributing.md, reporting.md and the issue-template
contact link, which is the same stale name on the contributor path. The git
clone and release URLs in bin/ and manual/ are left alone: GitHub redirects
those, and channel-test.sh asserts the exact clone URL, so changing them is a
separate change.

Fixes #10118

Written by Claude Fable 5.1 via Claude Code, reviewed by Marc Morriss

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-06 21:29:36 +02:00
a62e34ea8e Add Cursor CLI as a coding agent choice (#10465)
* Add Cursor CLI as a coding agent choice

* Launch Cursor CLI through its agent subcommand with --trust

Cursor CLI still dispatches a one-word prompt that names one of its
subcommands (update, login, help) even after a bare --, so name the agent
subcommand outright and pass the prompt behind -- there, where it also
keeps a prompt starting with a dash from being read as an option. --yolo
only auto-allows commands; the workspace trust dialog is skipped only by
--trust, and a launcher that must not stop to ask needs both.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Leave an official Cursor CLI install alone

Cursor's own installer symlinks ~/.local/bin/cursor-agent, the same path the
mise wrapper takes. The migration now installs the wrapper only when no
cursor-agent command exists, and Remove Preinstalls deletes the path only
when it holds the wrapper omarchy-mise-install wrote, the way the Hermes
wrapper is handled. Selecting the agent treats an executable at that path
other than the wrapper as the user's own install and skips mise, since the
mise shims precede ~/.local/bin on PATH and a mise copy would only shadow
it. The wrapper resolves through mise's registry, which lists cursor-agent
from 2026.8.15 on.

The tests write a real cursor-agent stub before Remove Preinstalls runs,
cover the preinstall opt-out for the new migration, and check that a
symlinked official install survives removal and selection alike while a
dead file at the same path still installs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Give Cursor its brand mark and one name in the menu

Add Cursor's mark to the Omarchy icon font as U+E90D and point the agent
entry and both editor entries at it, so one brand is drawn one way across
the menu. Label the agent entry "Cursor CLI", the name the command and the
manual already use, and spell it the same in the migration and the tests.
Append the manual row after the others at the standard width.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Keep an official Cursor CLI install through a user re-provision

User setup writes every mise wrapper unconditionally, which is fine on a
fresh install but replaces the symlink Cursor's own installer leaves at the
same path when omarchy-provision-user runs again with --force. Guard that
one line the way the migration does.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: John Cavanaugh <59479+cavanaug@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-06 17:07:40 +02:00
Erik Melton a805ef990e Fix OCaml sudo test portability 2026-09-06 15:46:59 +02:00