Backport of #11845 for v4-0-4. Supersedes #11729 with the final generic
kernel migration, without introducing the intermediate PTL migration.
Resolve against 4.0.3: remove the retired PTL installer, update the ISO
package list and NVIDIA headers, and retain the release hardware scope.
Cam Link and Dell sidecar support are absent from this release branch,
so omit their installer and test changes.
(cherry picked from commit 86a2e5830e)
Chainfire (@Chainfire) privately reported the passwordless asdcontrol watchdog reboot on August 25, 2026.
The fix landed in the 4.0.2 security work: #9200 (df819a6f) removed Omarchy's unrestricted sudo grant, while omacom/omarchy-pkgs#242 and omacom/omarchy-pkgs#243 restricted the package's grant. This records the reporter credit omitted from those changes.
Reported-by: Chainfire (https://github.com/Chainfire)
(cherry picked from commit 5b91db503c)
Thanks to _SiCk // afflicted.sh for independently reproducing the passwordless sudo persistence issue and reviewing the proposed fix in #7990. The follow-up fix landed in #9387 (945af75a), with the 4.0.3 backport in cf459ba7.
The original boot-cleanup patch was contributed by @Adolanium. Preserve that co-author credit alongside this acknowledgment.
Co-authored-by: Adolanium <94890352+Adolanium@users.noreply.github.com>
(cherry picked from commit 131bda36b5)
Arch removed the prebuilt broadcom-wl package on 2026-09-02 and rebuilt
broadcom-wl-dkms with replaces=(broadcom-wl). A replaces entry only helps
upgrades of an already-installed package, so the name is now unresolvable
as an explicit pacman target and the ISO offline mirror download fails
with "target not found: broadcom-wl".
broadcom-wl-dkms depends on dkms, so the explicit dkms in the hardware fix
is redundant; linux-headers stays because the module has to build against
the running kernel.
(cherry picked from commit 649c0b7433)
Keep the baseline glyph names and add Cursor with compatible format-2 post and format-12 cmap tables. Exercise listing, disposable SVG addition and occupied-codepoint rejection.
* Add Muse Code as a default coding agent
Meta ships Muse Code only as a binary, so it installs from the AUR
(muse-code-bin) instead of mise, and a fresh install runs the muse login
browser flow in the install terminal before the agent opens.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148qKzr366p2Ubu2igCLvPg
* Refine Muse Code menu and prompt forwarding
* Install Muse Code from OPR
* Install Muse Code through mise's HTTP backend
* Preinstall the Muse mise stub
* Use the shared Muse installation flow
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
(cherry picked from commit 0d223fe820)
* Add Cursor CLI as a coding agent choice
* Launch Cursor CLI through its agent subcommand with --trust
Cursor CLI still dispatches a one-word prompt that names one of its
subcommands (update, login, help) even after a bare --, so name the agent
subcommand outright and pass the prompt behind -- there, where it also
keeps a prompt starting with a dash from being read as an option. --yolo
only auto-allows commands; the workspace trust dialog is skipped only by
--trust, and a launcher that must not stop to ask needs both.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Leave an official Cursor CLI install alone
Cursor's own installer symlinks ~/.local/bin/cursor-agent, the same path the
mise wrapper takes. The migration now installs the wrapper only when no
cursor-agent command exists, and Remove Preinstalls deletes the path only
when it holds the wrapper omarchy-mise-install wrote, the way the Hermes
wrapper is handled. Selecting the agent treats an executable at that path
other than the wrapper as the user's own install and skips mise, since the
mise shims precede ~/.local/bin on PATH and a mise copy would only shadow
it. The wrapper resolves through mise's registry, which lists cursor-agent
from 2026.8.15 on.
The tests write a real cursor-agent stub before Remove Preinstalls runs,
cover the preinstall opt-out for the new migration, and check that a
symlinked official install survives removal and selection alike while a
dead file at the same path still installs.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Give Cursor its brand mark and one name in the menu
Add Cursor's mark to the Omarchy icon font as U+E90D and point the agent
entry and both editor entries at it, so one brand is drawn one way across
the menu. Label the agent entry "Cursor CLI", the name the command and the
manual already use, and spell it the same in the migration and the tests.
Append the manual row after the others at the standard width.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Keep an official Cursor CLI install through a user re-provision
User setup writes every mise wrapper unconditionally, which is fine on a
fresh install but replaces the symlink Cursor's own installer leaves at the
same path when omarchy-provision-user runs again with --force. Guard that
one line the way the migration does.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: John Cavanaugh <59479+cavanaug@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit a62e34ea8e)
(cherry picked from commit 1c05f141f158b3521c193b66f03350aa94719d95)
Search the same forbidden ASCII references as bytes so generated Python bytecode does not abort the aggregate test run.
(cherry picked from commit 8f3642b3662ea2409e17c80ee18a231bac5c8d7c)
Build from the T3 font and append only Hermes, OpenClaw and Perplexity using distro FontTools. Retain every baseline glyph and metric; omit Ori and Cursor. Update the font character bounds and preserve glyph naming metadata.
(cherry picked from commit 0c28d16e30f03da897503ae2e10ffd4b7c28b01a)
Keep provisioning tests isolated from application refresh and link the real command-presence helper into the Hermes remover fixture. Cover only selected AI menu/scaffold additions, retained default agents and Dictation placement, and new-user/migration mise pruning parity.
(cherry picked from commit 1bd969eb386169e107d0b9f15be4b3e1d2a9b4cb)
1Password reads the display scale itself, the way Electron apps do, so
on a scaled monitor it comes up oversized next to every other window.
Pin it with --force-device-scale-factor=1 and let the compositor scale
it.
The app menu is covered by the packaged .desktop, which we build
ourselves in omarchy-pkgs. This is the other route in: the hotkey runs
the binary directly and never reads that file.
Claude-Session: https://claude.ai/code/session_01JB9phxP56gnP7qSidkkUJE
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 446fbc28b1)
(cherry picked from commit 2acfa32b0aac3e4613849e7b8e56968379971a51)
Keep mise upgrades from pruning versions still in use
(cherry picked from commit 0973169098)
(cherry picked from commit e4fa14cefff0a19e72bb9f41722edd6b6f1afd93)
Fail closed when passwordless sudo expiry cannot arm
(cherry picked from commit a87d396f01)
(cherry picked from commit 88ba230e6affefe83899ea5cda228311c73b924b)
Use the command helper in the AI app removers
(cherry picked from commit 18410a0e48)
(cherry picked from commit 67125c330b36204356a92867b9c9120a4599afae)
Move Kitty defaults to the system config and restrict remote control
(cherry picked from commit f04366de79)
(cherry picked from commit 6dfbfa146b91bf310f2ff7147953afddef73de9a)
Replace locate configuration script with packaged service defaults
(cherry picked from commit d7c783ecf5)
(cherry picked from commit 142ac21ed3d86fa3733b2a4fe41618eb67747ef8)
* Use updated libfprint-git for fingerprint setup on edge
* Pick the fingerprint driver from the reader, not the release channel
The channel gate blocked every edge and dev user until the newer
libfprint-git pin is published, misrouted dev checkouts on the stable
mirror, and left the stock-libfprint migration reverting the driver on
accounts without its marker. Key both the setup and the migration on
omarchy-hw-fingerprint-git, a USB ID table of readers stock libfprint
cannot drive, so the git snapshot only goes where it is needed on any
channel. Qualify the package with the omarchy repo, and skip pacman
entirely when the packages are already current so a rerun cannot become
a partial upgrade.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* Install libfprint-git for every fingerprint reader
Stock libfprint lags upstream on new readers, and gating the git
snapshot per reader or per channel only added machinery to keep in sync
with the package repo. Install libfprint-git unconditionally instead:
the omarchy-pkgs pin is the single place a new reader gets enabled. The
migration that swapped it back to stock goes away with the policy it
enforced; late updaters keep the driver they have and pick up the new
pin as a normal package upgrade.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: powderluv <powderluv@powderluv.org>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit adcc96a782)
(cherry picked from commit 8d0ca2a628fdeab5ce9f9c4a779630cd38223c85)
Make Hermes follow the Omarchy theme as a skin
(cherry picked from commit 988da12cb0)
(cherry picked from commit 6d3ae7a811ecda54ca11bff0991c2a72878a29e3)
Add the Perplexity desktop app to Install > AI
(cherry picked from commit f1b065c292)
(cherry picked from commit 680930915eaba8c3741980c56ad160a40c50bcb9)
Ask, default no, before Remove Hermes deletes the user's data
(cherry picked from commit 959e49dc52)
(cherry picked from commit 4e77199945a15ac194511b1af6317761fb813ba0)
Add OpenClaw as a desktop app and a coding agent
(cherry picked from commit eb56446c42)
(cherry picked from commit bde2584b5596412142d0a2039d44dd6a25949517)
Fix the Hermes CLI readiness probe, and tear the CLI down on uninstall
(cherry picked from commit f99d33a8dd)
(cherry picked from commit de739ea736563763150725ce33151001c5966add)
Add Hermes as a desktop app and a coding agent
(cherry picked from commit b71dcad96e)
(cherry picked from commit b27908369ed5fa95ca24dca2c68b895032d879d2)
Correct the local conflict parser consuming context beyond the selected hunk. Preserve all baseline entries and add only the selected T3 and removal scaffold rows.
(cherry picked from commit 473713413a9132375b6bf96627e8220f118ddf00)
Port only Remove > AI and T3 removal/tests from #7504 (023021ad2d). Keep Dictation in its baseline location and omit unrelated removers.
(cherry picked from commit 73480ffabc091b812a0cfbe7bc845799c6078a88)
t3code-bin is in the Omarchy repo now, so the menu can offer it the way it offers Cursor and Grok Bot: install the package, then launch the desktop entry it ships.
The mark is a trace rather than a download. T3 publishes no monochrome SVG — the app icon is a black rounded tile with the letters knocked out of it, and a tile flattens to a solid square once the menu recolors every path with the theme foreground. Tracing the lettermark out of that icon keeps the silhouette that actually reads.
The font is package-owned, so the glyph reaches a desktop through an omarchy-settings release rather than omarchy update. Until that release lands, a pulled checkout draws the entry with no icon.
🤖 Generated by Opus 5 in Claude Code.
(cherry picked from commit 260a729104)
(cherry picked from commit a863dc8555a51e62535f0edf28d4158d9d2e9fb4)
Exercise production JavaScript from #9485 and #9618 together with a synchronous Qt test double. Cover keepLoaded identity, detached authentication retention, refreshed manifests, cleanup eligibility, sticky classification, and clone lookups without the unrelated video-wallpaper services alias. Native QObject, PAM, and Wayland validation remains separate.
* Honor keepLoaded for services during plugin hot-reload
Plugin reload destroyed every service, including omarchy.lock, which drops the ext-session-lock client while Hyprland still holds the lock and surfaces the crashed-lockscreen fallback.
* Prove keepLoaded service survival with a fixture service
A fresh lock service also reports an empty lastEventAt, so comparing it
across the rescan passed whether or not the instance survived. A fixture
keepLoaded service whose in-memory marker is set before the rescan and
read back after can only pass when the same instance is still mounted.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop kept services whose plugin no longer declares a service
The _syncServices cleanup only asked whether the plugin was still
installed and enabled, so a kept service whose plugin dropped its
service kind or entry point kept running as a zombie until shell
restart. Apply the same eligibility checks used at creation, and hand
kept instances the refreshed manifest after a rescan.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Cover omarchy.media in keepLoaded expectations; note kept services reload on restart
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit d3d23fddde)
* Quote install-app and install-font names like install-and-launch
* Quote the package list too, not just the display name
The display name was quoted but omarchy-pkg-add's own arguments were still interpolated into the bash -c string raw, so `omarchy install app Vim 'vim; id'` ran id. The list has to reach the helper as several words, so it cannot be quoted whole: it is split the way the unquoted expansion split it and each word is quoted on its own. Reading with -d '' keeps a newline-separated list intact instead of dropping every package after the first, which plain read -a would. install-font's package is singular and is quoted whole, and install-and-launch carried the same flaw.
Reported by acrogenesis in review of #7843.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Codex XHigh <noreply@openai.com>
* Test that install-font skips font-set when pkg-add fails
The hostile-package case was asserting the family still got set, which only held because the mock always exits 0. pacman would reject that name and the && chain would skip font-set.
* Keep the installers working when errexit is inherited
read -d '' always ends at EOF rather than on its delimiter, so it reports failure on every input. Under an inherited errexit the installers exited there and built no command at all.
Reported by Codex XHigh in review of #7843.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Codex XHigh <noreply@openai.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Codex XHigh <noreply@openai.com>
(cherry picked from commit 625c4a1603)
Cherry-picked from quattro (7d58bb9a).
Stop world-writable Chromium and Firefox policy directories: create them
root-owned at 0755, purge non-root entries, refuse planted symlinks, and
write the browser theme colour through a passwordless helper instead of
a world-writable policy file.
Conflict resolution for v4-0-2:
- bin/omarchy-install-browser: dropped the `chromium)` case, which does
not exist on this branch.
- test/shell.d/default-apps-test.sh: dropped; the file does not exist on
this branch.
* Fix Codex usage collector approval policy
* Capture codex argv with boundaries in the scanner test
The stub joined its arguments with "$*", so the assertion compared one
flattened string and could not tell five arguments from fewer containing
spaces. Passing "-s read-only" and "-a on-request" as single arguments --
which codex rejects as an unexpected argument -- passed the test. NUL
separation and an array comparison keep the boundaries the assertion is
about.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Codex XHigh <noreply@openai.com>
---------
Co-authored-by: Omabot <omabot@omarchy.org>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Codex XHigh <noreply@openai.com>
(cherry picked from commit 4cd8a081cb)
The wildcard granted passwordless root for timedatectl set-timezone plus any trailing arguments, so -H/--host and -M/--machine reached the SSH and machine transports as root. Systemd 261 guards argv injection into ssh, but -H still drives root's SSH client at an attacker-chosen host, and the transport resolves its helper through PATH; only Defaults secure_path stands between that and a planted ssh running as root. Match the argument with an anchored POSIX ERE that admits exactly one timezone token (no whitespace, no leading-dash segment, no traversal component), so no second argument and no option can ever match. The sole caller, omarchy-menu-timezone, passes one list-timezones value and is unaffected.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Codex XHigh <noreply@openai.com>
(cherry picked from commit 0ae1694830)
Backport of the FIDO2 authfile fix (PR #7904 by @mdisec, merged to quattro as
23dab9ec) onto the v4-0-1 release branch.
pamu2fcfg wrote to /tmp/fido2 and the registration was then moved into place
with sudo mv. Any other local user can pre-create /tmp/fido2, and rename(2) does
not dereference the final component, so the privileged move installed the
attacker's symlink itself as pam_u2f's global authfile -- a file consulted by
sufficient lines in /etc/pam.d/sudo and /etc/pam.d/polkit-1.
The same move also carried the staged file's ownership into /etc, so on every
install to date /etc/fido2/fido2 is owned by the invoking user at mode 0644.
That needs no attacker, no race and no second account: anything running as that
uid can append its own credential and satisfy the machine's sudo prompt without
knowing the password.
The setup now creates a unique staging file as root beside the final authfile
and pipes pamu2fcfg into it, so root never reopens a caller-owned pathname,
rejects failed or empty enrollment output, publishes with an atomic mv -Tf,
cleans the exact staging file after every failure, refuses non-regular authfile
states, and installs root:root 0644. A migration repairs machines set up by
earlier versions by replacing the inode rather than chowning in place: a process
that already holds a writable descriptor on the legacy user-owned mapping keeps
it, so the repair has to leave that inode behind where PAM no longer reads it.
Clean cherry-pick: all six files are byte-identical to quattro, so merging
v4-0-1 into quattro resolves without a conflict. The migration's timestamp
(1787494718) is older than others already on this branch, which is harmless:
omarchy-migrate marks each migration by filename rather than tracking a
watermark, so this one runs on every machine that has not run this exact file.
test/shell passes: 195 files, including the three this adds -- the setup's
staging and failure paths, the migration's repair and unrepairable states, and
the removal's symlink handling. test/cli passes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the input-device name fix (PR #8129 by @acrogenesis, merged to
quattro as 9285b19d) onto the v4-0-1 release branch.
Hyprland input-device and monitor names come from USB descriptors and hyprctl
output, so they are attacker-influenceable, yet the toggle and monitor commands
interpolated them straight into hyprctl eval and into generated Lua that
Hyprland re-executes on every reload. XF86TouchpadToggle is bound with
locked = true, so a malicious USB name reached Lua execution from the lock
screen as the logged-in user, and a persisted disable made it run on every
start. Publicly reported by Jorrit Jongma / Chainfire.
The disable is no longer executable Lua anywhere. The device name is stored as
plain-text data in a *-disabled-name sidecar and read back by a packaged module,
default/hypr/disabled-input-device.lua, on every reload; the live hyprctl eval
Lua-quotes the name and rejects control characters outright. The reload loader
excludes the two legacy filenames, so a leftover generated *-disabled.lua on a
not-yet-migrated install can never be sourced as code again, and a migration
recovers the device name from it and deletes it, sanitizing installs that ran
the vulnerable version. All four monitor scripts validate an output name against
a plain-connector-name pattern before writing it as Lua, closing the same latent
pattern in the siblings, and paths.lua treats a set-but-empty XDG_STATE_HOME as
unset to match the bash side.
Clean cherry-pick: all fourteen files are byte-identical to quattro, so merging
v4-0-1 into quattro resolves without a conflict. This branch ships no leftover
*-disabled.lua template of its own -- the tracked "disabled" files are the same
two quattro has -- so the migration is the only path that has to sanitize
anything here.
test/shell passes: 192 files, including the three this adds. The toggle suite's
public-PoC case passes here, as do the monitor scripts' accept/reject cases and
the XDG path cases. test/cli passes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the DNS PATH pin (PR #8172 by @mdisec, merged to quattro as
4637735a) onto the v4-0-1 release branch.
omarchy dev link prepends a user-writable checkout's bin/ to sudo's secure_path
so privileged Omarchy commands resolve to the development versions, and that
reaches the subprocesses they launch too. This branch carries the same
passwordless grant -- etc/sudoers.d/omarchy-dns lets wheel run
/usr/bin/omarchy-dns Cloudflare, Google and DHCP without a password -- so the
packaged script ran as root while resolving bare helpers (dirname, install,
tee, rm, nmcli, systemctl, awk) through the caller's secure_path. Write access
to a dev checkout became arbitrary root execution, with no password prompt in
the way.
Pin PATH to trusted system directories once EUID is 0. The restriction lands
only after elevation, so the unprivileged wrapper phase keeps the caller's PATH
and can still find sudo or pkexec; every helper the privileged half uses is a
system utility, so it needs nothing from the checkout.
Clean cherry-pick: both files are byte-identical to quattro, so merging v4-0-1
into quattro resolves without a conflict. Verified by mutation: with the pin
removed, test/shell.d/dns-sudoers-test.sh fails at the poisoned-helper case;
restored, all four of its cases pass. test/shell (189 files) and test/cli pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the TOC renumbering (PR #8089 by @samirpokharel, merged to quattro
as b86d4505) onto the v4-0-1 release branch.
Dropping manual/43-extra-themes.md shifted every chapter after it down by one,
on this branch as much as on quattro. The TOC rode along on the old numbers, so
its last ten links pointed at files that are not there: resolving every
manual/*.md link in this branch's README before the change found ten that do not
exist, from 43-extra-themes.md through 52-unattended-installs.md. After it, all
of them resolve.
Clean cherry-pick: the TOC now matches quattro's, so merging v4-0-1 into quattro
resolves without a conflict. test/shell passes: 189 files.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the Taildrop toast fix (PR #7953, merged to quattro as 7e469f96)
onto the v4-0-1 release branch.
A delivery can land hours after it was sent, and the toast announcing it was
expiring after five seconds -- so a file that arrived while nobody was at the
machine was gone from the screen before anyone could click it open. Critical
urgency is what the shell reads as a popup that lives until it is clicked or
dismissed, the same thing omarchy-crash-watch uses to keep its click-to-diagnose
toast around.
The mechanism is already on this branch: omarchy-notification-send parses
options that follow the two positionals, and NotificationLogic.js gives a
critical popup duration 0, which never expires.
One conflict, in test/shell.d/notification-send-test.sh. #7953 added coverage
for the trailing-option path in the notify-send form it had then; #7926, which
merged after it on quattro and is already backported here, rewrote that file for
the Notify D-Bus form and carried the same coverage across. This branch
therefore already asserts what #7953 added -- an urgency and a glyph after the
description reach the call, and the urgency is set once -- so the branch's
version stands and the resolved file is unchanged.
Verified by mutation: with -u critical removed, test/shell.d/tailscale-receive-
test.sh fails at once; restored, it passes, including the new assertion that
every announcement waits to be answered.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the shared URL check (PR #8174, merged to quattro as 68ab12f7) onto
the v4-0-1 release branch, on top of the #8067 backport it follows.
omarchy-theme-install and omarchy-plugin-add both clone a URL a stranger can
choose, and each carried its own copy of the rule that refuses a git option or a
transport helper before cloning. The rule now lives in omarchy-git-url-check and
both callers ask it: two copies of a security check drift, and the second copy
arrived four months after the first only because someone went looking for it.
That rule was also enforcing half of what it described. <helper>::<address> is
one of two shapes git resolves a remote helper from -- it also runs
git-remote-<scheme> for <scheme>://<address> whenever the scheme is not one it
connects itself, so ext::sh -c id and ext://sh -c id reach the same helper while
only the first was refused. Nothing exploitable follows on a stock system:
protocol.ext.allow defaults to never, and the :// spelling hands git-remote-ext
a command name it cannot exec. But a third-party helper installed on PATH is
reachable through the scheme form alone, and a guard is worth more when it
enforces the rule it states.
The :// shape cannot be refused the way :: is, because it is also how every
legitimate URL arrives, so the scheme is checked against the transports git
still connects itself: ssh git git+ssh ssh+git http https ftp ftps file.
git+ssh and ssh+git are on that list because they are spelled like a helper and
read as plain ssh; leaving them off would refuse a URL that clones today. ext
and fd are off it deliberately. A single colon is always scp-style ssh and a
bare path is always a path, so neither needs constraining.
The check fails closed: the callers read a non-zero status as a refusal, so a
missing omarchy-git-url-check refuses the URL rather than waving it through.
Clean cherry-pick on top of the #8067 backport: every file is byte-identical to
quattro, so merging v4-0-1 into quattro resolves without a conflict. test/shell
passes: 189 files, including the one this adds. test/cli passes, so the new
command's metadata is well-formed. Exercised the check here: https, scp-style,
ssh, git+ssh and scp-style IPv6 all pass, while ext:: ext:// fd:: fd:// and a
leading-dash form are refused, as is an uppercase EXT:// spelling.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the sudoless Docker follow-up (PR #8098, merged to quattro as
06a3dbca) onto the v4-0-1 release branch, on top of the #8056 and #8080
backports it follows.
Group membership only takes effect on a fresh session, and in practice a logout
or newgrp is not enough -- only a reboot reliably applies it. The setup and
remove commands now flag the reboot and offer to do it right away with a gum
confirm, the same shape as the GPU toggle, and their notices say "after a
reboot" instead of pointing at logout or newgrp. The existing-user migration
reuses the removal command inside omarchy update, so it passes
OMARCHY_DEFER_REBOOT to skip the prompt there and lets omarchy-update-restart
handle the reboot once the whole update has finished.
Setup > Security showed Sudoless Docker under both Setup and Remove, and the
guards tested the running session's groups, which do not change until the
reboot: after enabling sudoless Docker the menu still offered Setup, the one
action that could no longer do anything, while Remove stayed hidden. Add
omarchy-sudo-docker as the single answer to both questions that differ in that
window -- by default whether this session can reach the socket, which is what
decides if a command must elevate, and with --configured whether the account is
set up for it, which is what the menu and the toggles need. It succeeds when
sudo is needed, so the Setup entry appears while sudoless Docker is off and
Remove once it is on. lazydocker and the Windows VM keep prompting until the
reboot lands.
Clean cherry-pick on top of the earlier backports: every file is byte-identical
to quattro except default/omarchy/omarchy-menu.jsonc, which merged into this
branch's menu and whose two Sudoless Docker lines match quattro exactly.
test/shell passes: 188 files, including the two this adds. test/cli passes, so
the new command's metadata is well-formed. Exercised the helper here: with no
socket it reports sudo is needed, and --configured answers from the account's
groups.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the plugin-add URL guard (PR #8067 by @bastidotnet, merged to
quattro as 30471bf3) onto the v4-0-1 release branch.
omarchy-plugin-add cloned a user-supplied git URL without the transport-helper
guard omarchy-theme-install already applies. That guard arrived with #7884,
which is on this branch, but it never touched plugin-add -- so the sibling
command still leaned entirely on git's own protocol.ext.allow=never to keep a
URL like ext::sh -c <cmd> from running a command at clone time.
Stock systems are unaffected: Omarchy sets no protocol.* override, so the git
default holds and there is no live exploit here. This is defense in depth --
it closes the gap #7884 left in the sibling path and drops a silent dependency
on a default the project does not control. Reject ext::/fd:: and leading-dash
forms; https, ssh, scp-style and token-auth URLs still clone, including an
scp-style IPv6 host, which carries :: of its own.
Clean cherry-pick: both files are byte-identical to quattro, so merging v4-0-1
into quattro resolves without a conflict. The guard reads the same as the one
already in bin/omarchy-theme-install on this branch. test/shell passes: 186
files, with the plugin-add suite's new cases all running here -- including the
pty-driven prompt case, which is the only path that reaches the guard's
leading-dash arm.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the keypress fix (PR #8082, merged to quattro as 5d3299fb) onto the
v4-0-1 release branch.
gum 2.0 runs a spun command without the terminal attached, so the gum spin --
read -n 1 that held the presentation terminal open returned at once. Every menu
command that ended in a failure took its window down with it before the error
could be read, which is how a failed update looked like a terminal that just
quit.
Read the key directly. gum's own terminal query replies are still sitting on the
tty when the spinner stops, so drain those first or they answer the prompt on
the user's behalf. The /dev/tty node is there whether or not a terminal is
behind it, so open it rather than test for it -- the existence check passed on a
headless run and left both reads failing with "No such device or address" -- and
prompt on the terminal rather than stdout, so a caller that redirects us does
not leave the user waiting on a prompt they were never shown.
The green dot reads better than the globe did, so the provisioning notice uses
it too and drops its spinner along the way.
Clean cherry-pick: both files are byte-identical to quattro, so merging v4-0-1
into quattro resolves without a conflict. Exercised against the installed gum
2.0.0: headless it exits 0 at once, and on a pty it prints the prompt and
returns on one keypress. test/shell (186 files) and test/cli pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the reboot flag (PR #8080, merged to quattro as 1565919c) onto the
v4-0-1 release branch, on top of the #8056 backport it follows.
Group membership is fixed at login, so removing (or adding) the docker group
does not take effect in the running session. The existing-user migration and the
Setup > Security toggles now call omarchy-state set reboot-required, so
omarchy-update-restart prompts for the reboot that actually applies the change
and the bar shows it pending. A plain log out and back in still works.
The migration test now exercises the real removal command and omarchy-state
rather than a stub, asserting the reboot flag is set on removal and left alone
when the user is already out of the group.
Clean cherry-pick on top of the #8056 backport: all three files are
byte-identical to quattro, so merging v4-0-1 into quattro resolves without a
conflict. omarchy-state and omarchy-update-restart are unchanged on this branch
and read the same ~/.local/state/omarchy/reboot-required marker. test/shell
passes: 186 files.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the docker group removal (PR #8056, merged to quattro as b5ded31e)
onto the v4-0-1 release branch.
The docker group is root-equivalent: anything in it can docker run -v /:/host
and rewrite the host as root with no password. On a single-user box that is not
an escalation -- the owner is already a wheel user -- but it hands any code
running as the user, a rogue plugin or a poisoned dependency, a silent,
headless, passwordless path to root that sudo's password prompt would otherwise
gate.
Stop granting the group by default. The daemon still runs, the Docker TUI and
the Windows VM reach it through a polkit prompt, and the plain docker CLI runs
under sudo. Sudoless Docker becomes a warned opt-in under Setup > Security, and
no automatic path re-grants it: install and first-boot provisioning never record
or apply the group, and the Quattro upgrade no longer adds it. A migration takes
existing installs out of the group, reusing omarchy-remove-security-sudoless-
docker so the change and its notice have one source of truth.
The Windows VM keeps needing the root daemon for a privileged container, so it
runs without the group without becoming a new way in: the compose moves to a
root-owned directory written only by an elevated, input-validated writer, volume
paths are rebuilt from $HOME on migration rather than trusted from the
user-writable legacy file, the privileged sub-action is checked against an
allowlist before dispatch, pkexec elevates a verified root-owned command path,
mount sources are refused when they are or resolve through a symlink, and the
guest password moves to a private 0600 per-user file instead of a
world-readable compose. Existing installs auto-migrate the VM without a
redownload.
Two files had diverged from quattro and were resolved by hand:
bin/omarchy-windows-vm -- v4-0-1 still carries the "Starting Windows VM" toast
that #7585 dropped on quattro, and the new start path has no user-side status
check to hang it on: after this change the user cannot inspect the container
without privilege, which is the whole point. Took quattro's version. #7585's
reason holds here too -- the shell shows its own "Launching Windows…" OSD until
the RDP window appears (shell/services/AppLibrary.qml) -- and the failure
notification stays. The file is now byte-identical to quattro.
manual/28-windows-vm.md -- took the new paragraph on the root-owned compose,
without the neighbouring OEM-key paragraph, which documents omarchy windows key,
a command quattro has and this branch does not.
test/shell passes here: 186 files, including the three this adds.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the omarchy-sudo-reset removal (PR #8046, merged to quattro as
d99d4fc6) onto the v4-0-1 release branch, so 4.0.1 stops shipping the command.
Nothing in the repository called omarchy-sudo-reset, and its one line
interpolated an environment-supplied $USER into a string handed to a root
shell: su -c "faillock --reset --user $USER". $USER is an environment variable
rather than a kernel-supplied identity, so whatever set it before the command
ran chose the rest of what root's shell executed. That is not a way past PAM on
its own -- su still has to authenticate -- but the installer sets root's
password to the user's own, so the prompt this raises is one the user answers
by habit.
It bought little for that. Omarchy sets deny=10 unlock_time=120 in
/etc/pam.d/system-auth and in the lock screen's PAM stack, so a lockout takes
ten wrong passwords to reach and clears itself two minutes later, and
manual/45-troubleshooting.md documents the root-TTY reset for anyone who would
rather not wait. That reset is unaffected by this change.
The sudo group keeps keepalive and passwordless, so GROUP_DESCRIPTIONS[sudo] is
unchanged and omarchy sudo reset falls through to the router's unknown-command
path. No migration is needed: bin/omarchy-* ships as files in the omarchy
package, so an upgrade drops what the package no longer contains.
Clean cherry-pick: the file was byte-identical to quattro's pre-image and
nothing else on this branch referenced it, so merging v4-0-1 into quattro
resolves without a conflict. test/shell and test/cli pass here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the synaptic touchpad quirk fix (PR #7236, merged to quattro as
20400bad) onto the v4-0-1 release branch, so 4.0.1 installs stop dying on it.
install/hardware/fix-synaptic-touchpad.sh calls modprobe against the running
kernel. On 4.0 the only thing that runs it is the ISO finalizer, inside
arch-chroot, where uname -r still names the live ISO's kernel while
/lib/modules holds the target's. The live ISO always boots linux-t2 and the
configurator gives every machine that is not a T2 Mac stock linux, so the two
never match: modprobe exits 1 with "Module psmouse not found in directory
/lib/modules/<live kernel>". run_logged returns that status and
omarchy-apply-hardware runs under set -euo pipefail, so a fresh install stops
on the first machine with a device named "synaptics" and no psmouse loaded --
reported from a ThinkPad in #6985, but nothing about it is Lenovo-specific.
Ask modprobe itself, with -qn, whether it can resolve psmouse for the running
kernel before asking it to load one, and warn instead of failing when it
declines for any other reason. The chroot mismatch becomes an unresolvable
module, skipped in silence. An optional touchpad improvement must not be able
to halt an install.
This does not make InterTouch reach the installed system: a module loaded into
the live kernel is gone at reboot, so on 4.0 this script has never applied
anything to an installed machine -- it only ever aborted installs. Persisting
it would mean writing options psmouse synaptics_intertouch=1 to
/etc/modprobe.d, which forces the SMBus transport past the kernel's own
allowlist on any touchpad merely named "synaptics". That is a
hardware-behaviour change on a wide class of machines, left as a separate
decision on quattro.
Clean cherry-pick: both files are byte-identical to #7236, so merging v4-0-1
into quattro resolves without a conflict. test/shell.d/synaptic-touchpad-test.sh
passes here, as does the rest of test/shell (183 files).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Backport of the notification click-command hardening (PR #7926, merged to
quattro as 43bfe9b9) onto the v4-0-1 release branch. Click actions are argv
vectors run without a shell, omarchy-notification-send calls the Notify D-Bus
method directly via busctl instead of notify-send, and --exec takes the command
as rest-of-line words. Excludes docs/notifications.md, which does not exist on
v4-0-1.
* Stop an installed theme from shipping code
`omarchy theme install <url>` clones a stranger's git repository into ~/.config/omarchy/themes, and omarchy-theme-set then copied that whole directory into the staged theme. Most of the files in a staged theme are code rather than colour: Hyprland requires hyprland.lua and gum_env.lua from it at login, Neovim loads neovim.lua at startup, and alacritty.toml, kitty.conf, foot.ini and ghostty.conf each name the program the terminal launches. Installing a theme was the same act as running its author's code, and nothing on disk distinguishes an installed theme from one the user wrote.
Stage only what a theme needs in order to be a theme: colors.toml, light.mode, the preview and unlock images, and image files under backgrounds/. Everything else is ignored, named on stderr, and generated from default/themed/*.tpl instead. Symlinks are never followed, because in an untrusted theme they point wherever the author chose. A theme older than colors.toml keeps its palette: its alacritty.toml is read for colours in a scratch directory and only the resulting colors.toml is staged, so the terminal config never lands.
The filter belongs in omarchy-theme-set rather than in omarchy-theme-install because staging is the choke point. It also covers themes installed before this change, themes copied in by hand, and files a theme gains later through `omarchy theme update`.
First-party themes under $OMARCHY_PATH/themes are unaffected. Per-theme overrides of a generated file are no longer available to user themes; the template at ~/.config/omarchy/themed/<file>.tpl replaces that, and icons.theme is the one setting with no replacement.
🤖 Generated by Opus 5 in Claude Code.
* Stop a theme URL or name being read as an option or a path
Three paths in the theme commands took an attacker-shaped string straight into git, into basename, or into rm.
`git clone "$REPO_URL"` passes the URL as the first positional argument, so a URL beginning with a dash is parsed as an option instead and the destination path becomes what git tries to clone. Pass `--` before the URL so a URL is always a URL. git also treats `<helper>::<address>` as a remote helper to run; git's own protocol.allow default already refuses `ext::`, so rejecting that shape here is a second line rather than the fix, and it keeps holding if that default ever moves. The helper name is a bare word at the very start of the URL, which is what the guard matches: an scp-style IPv6 host such as git@[2001:db8::1]:org/repo.git carries `::` of its own and still clones.
`basename "$REPO_PATH" .git` has the same problem one step later, after the scp-style prefix has been stripped: `host:-s/foo.git` leaves basename reading `-s` as an option and returning `.git` as the theme name. Take the name with `--`.
That name is then joined into a path that is about to be `rm -rf`'d, so a repo whose basename came out as `..` would take ~/.config/omarchy with it. omarchy-theme-remove had the same shape from its own argument, and omarchy-theme-set's sed/tr normalization does not stop a name containing a slash. Reject empty, anything starting with a dot, and anything containing `/` in all three, before the name reaches a path.
🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh.
Co-Authored-By: Codex XHigh <codex@openai.com>
* Re-stage the current theme for installs that already applied one
Dropping a theme's code at staging time only takes effect the next time a theme is staged. An install that already applied an extra theme keeps that theme's hyprland.lua, gum_env.lua, neovim.lua and terminal configs in ~/.local/state/omarchy/current/theme, which Hyprland requires at login and the terminals include at launch, and nothing forces a theme change — so for those installs the fix would arrive whenever the user next happened to switch themes, which may be never.
Re-stage once through omarchy-theme-refresh. First-party themes stage identically, so the cost for everyone else is a single retint during an update they are already running.
🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh.
Co-Authored-By: Codex XHigh <codex@openai.com>
* Stop a theme's unlock image republishing a file it points at
omarchy-plymouth-set-by-theme reads unlock.png straight out of ~/.config/omarchy/themes, which is an installed theme's own directory and outside the staging filter, and hands the path to omarchy-plymouth-set. That path was copied twice into world-readable /usr/share — once by the user into the Plymouth theme, and once by `sudo cp` into the SDDM theme. A symlink there was followed both times, so a theme could name a file it cannot read and have root publish it.
Refuse a symlinked logo, and copy the staged logo to SDDM instead of rereading the caller's path as root. The staged copy is made by the user, so nothing privileged opens a path the caller chose.
🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh.
Co-Authored-By: Codex XHigh <codex@openai.com>
* Limit only what an installed theme could run
Two corrections to the rule this branch introduced, both narrowing it to what it was actually for.
It applied to every theme under ~/.config/omarchy/themes, which swept up themes the user wrote themselves. Their machine, their file: a theme they wrote is theirs to fill however they like, and Omarchy's own themes were never in scope. Only a theme that came from someone else needs limiting, and the repo already knows which those are — omarchy-theme-extras calls a theme with a `.git` directory an extra and a symlink someone's working copy, because that is what `omarchy theme install` leaves behind when it clones. Use the same test.
It was also an allowlist, which dropped files that carry nothing but colour and left theme authors worse off for no gain. Drop only what can run: any `*.lua`, since Hyprland requires a theme's hyprland.lua and gum_env.lua at login and Neovim loads neovim.lua at startup; the four terminal configs, since each names the program the terminal launches; and vscode.json, whose extension field reaches `code --install-extension` and a VS Code extension is arbitrary JavaScript. Everything else an installed theme ships is kept, so btop.theme, chromium.theme, helix.toml, icons.theme, keyboard.rgb and shell.toml go back to being the theme's to set.
Symlinks are still dropped, now at any depth rather than only where an allowlist happened to look.
A denylist is wrong the moment someone adds a template and does not think about it, so the decision is forced rather than remembered: the test fails on any default/themed/*.tpl whose output is recorded as neither code nor colour, and a new terminal or a new Lua-loading editor cannot be added without classifying it.
What this does not cover, and is written down in docs/theming.md rather than implied: a theme shipped as an archive and unpacked by hand looks exactly like one the user wrote. `omarchy theme install` only takes git URLs, so the supported path is always filtered, but this marks where a theme came from and is not a sandbox.
🤖 Generated by Opus 5 in Claude Code.
* Fix what the review found
Four things, all confirmed against the source before changing anything.
The migration failed permanently when the active theme had been removed. `omarchy theme remove` deletes the directory without repointing theme.name, so the name survives, the staged copy survives, and omarchy-theme-refresh exits 1 because neither source directory exists — leaving the migration pending forever and the stale staged Lua exactly where it was, which is the one thing it existed to remove. Seed the default theme in that case: there is nothing to re-stage from, and the removal should have left a working theme behind anyway.
The staging test skipped the strict-mode header that docs/testing.md makes the contract for every shell test. Adding it means the patterns that fail on purpose have to stop being bare `cmd && fail` compounds, which errexit reads as the script itself failing; the mutations were re-run afterwards to confirm the assertions still fire rather than the run dying early and looking like something else.
The guards in omarchy-theme-install and omarchy-theme-remove had no coverage — they were checked by hand and left that way. theme-install-guards-test.sh stubs git and the themes directory and proves an option-shaped URL, a transport helper, and a name that would climb out all stop before git or rm runs, that a dash inside the path no longer becomes a basename option, and that an ordinary URL still clones and applies.
The new docs/theming.md prose was hard-wrapped, which AGENTS.md forbids for docs/. Unwrapped. The rest of that file is wrapped from before and is left alone rather than churned through this change.
🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh and Copilot.
---------
Co-authored-by: Codex XHigh <codex@openai.com>
(cherry picked from commit ef6d9e6605)
* Stop a video title from becoming the Download Video play command
The host parsed yt-dlp's after_move line as title plus path, so a newline in page metadata could forge the path. Clicking the toast then handed that value to mpv as options. Print only the real file, ignore anything that is not inside the download dir, and invoke mpv with --.
* Refuse downloads whose video title contains control characters
The hoodie page still offered a real hidden clip, so yt-dlp saved it even after the play-action fix. A title with newlines is not a legitimate name; abort before the download and tell the user it was refused.
* Test the forged record in the order yt-dlp emits it
The records ran forged-first and good-last, so the assertion measured recovery after
bad records rather than preservation of an already-captured path when a forged record
arrives afterwards. That is the shape a hostile title actually produces, because a
title ending in a newline closes its own record and leaves the genuine path on a line
the loop ignores. As written the assertion passed with resolve_download_file replaced
by a no-op.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Resolve the download path without dropping a trailing newline
Command substitution strips trailing newlines, so an in-directory symlink pointing at
a regular file whose name ends in one canonicalised to a different path -- which may
itself exist -- and that path then passed the containment check and reached ffmpeg and
the click command. Reading realpath's NUL-terminated output keeps the name intact, and
a resolved path carrying a control character is refused outright.
Not reachable through a yt-dlp download, since --restrict-filenames strips control
characters from the name it writes; it is the helper's contract that was wrong.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Codex XHigh <noreply@openai.com>
* Accept a download directory that resolves to /
realpath returns "/" for the root directory, which made the containment pattern "//*"
and rejected every file saved directly under it, so the host reported a failed download
after saving the file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Codex XHigh <noreply@openai.com>
* Stop refusing a download because its title has control characters
The gate cannot tell a hostile title from a legitimate one. --print emits one line per
extracted video and --no-playlist does not collapse a multi_video result, so a page
holding two clips arrives as two titles separated by a newline and is refused exactly
like a forged record would be.
It also guaranteed nothing it was read as guaranteeing. The simulate run and the
download run are separate fetches, so a site is free to answer them differently, and
the check never constrained the metadata the download actually used.
What stands between a record and the click command is resolve_download_file, which is
untouched here. Leaving a check that refuses valid pages while securing nothing invites
the path validation to be relaxed later on the strength of it. A gate that would work
is possible -- --print '%(title)j' encodes each title as JSON on its own line, which
separates a newline in the metadata from a newline between videos -- but it belongs
with a use for the title rather than as a bare refusal.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Codex XHigh <noreply@openai.com>
* Disarm the legacy exec-before-download hook too
--no-exec clears the modern --exec map but leaves --exec-before-download stored
separately, and yt-dlp restores it as a before_dl postprocessor, so a hook configured
in the user's yt-dlp config still ran during the download this host drives.
The accompanying test runs download_url itself against stubbed tools. Everything else
in this file exercises the helpers in isolation, which left the invocation uncovered:
restoring the title to the record template, or dropping --no-exec or the trailing --,
passed every assertion here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Codex XHigh <noreply@openai.com>
* Toast the page title again instead of the saved filename
Deriving the toast text from the sanitised filename cost the title it was meant to
show: "My Great Clip" arrived as "My_Great_Clip [My_Great_Clip]". The title is safe as
notification text -- it is an argv element, never part of a command -- so the only
question was getting it out of yt-dlp without reopening the record forgery.
It now comes from the download run, so it describes the file that was actually saved,
and it is printed as %(title)j. JSON-encoding is what makes that safe: a newline or tab
in page metadata becomes an escape sequence inside one quoted string rather than a
record boundary, so a title can no longer split itself across lines. The decoder keeps
only what precedes the first control character, refuses anything notify-send would read
as an option, and leaves the filename-derived title as the fallback when a page offers
nothing usable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Name the saved file after the page title
The download landed as "My_Great_Clip [My_Great_Clip].mp4" when the page called it
"My Great Clip". --restrict-filenames was carrying more weight than it earns here: it
folds spaces to underscores and strips non-ASCII, which is what mangles the name, and
it is not what keeps the record stream safe. yt-dlp removes control characters from a
filename either way -- a newline becomes a space, tabs and DEL and NUL are dropped --
so a path printed after the move is still only ever one line, which is the property
resolve_download_file depends on.
Dropping the [%(id)s] suffix is the other half of matching the title, and it trades
away the uniqueness that suffix bought: two videos sharing a title now share a name,
and yt-dlp skips a download whose file already exists, so the second one toasts as a
failure. Restoring the suffix is a one-line change if that trade is the wrong way
round.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Omabot <omabot@omarchy.org>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Codex XHigh <noreply@openai.com>
(cherry picked from commit b71c60fe30)
* Only offer Update > Extra Themes when there is one
omarchy-theme-update pulls the themes under ~/.config/omarchy/themes that came from a git clone, so on a machine that has never installed one by hand the row opens a terminal that prints nothing and closes. Guard it with the same predicates the command itself applies, since a row that shows over a symlinked theme or a worktree's `.git` file is the same dead end in a narrower shape, and pin the two to each other in the guard test.
Co-Authored-By: Codex XHigh <noreply@openai.com>
* Extract the Extra Themes guard into omarchy-theme-extras
The row's `when:` and omarchy-theme-update each carried their own idea of which themes came from a git clone, and the two only matched because a test held them together. Name it once instead: omarchy-theme-extras lists those directories and exits nonzero when there are none, so the row asks exactly the command its action runs. Living in a script also puts the glob out of reach of whatever shopt a login shell left set for the guard batch.
Co-Authored-By: Codex XHigh <noreply@openai.com>
---------
Co-authored-by: Codex XHigh <noreply@openai.com>
(cherry picked from commit 13a969e1ab)
* Switch back to the packaged quickshell now that 0.3.1 kills synchronously
Omarchy shipped the quickshell-git build for a single fix: 0.3.0's `kill` returned before the instance had exited, so the kill loop in omarchy-restart-shell could race a dying shell. Upstream 0.3.1 ships that fix, which makes extra/quickshell the better package to be on again — signed, versioned, and not rebuilt from a moving branch on every update.
The migration swaps unconditionally instead of first checking which version the mirror offers. A machine left holding quickshell-git while the shipped package list names quickshell has no way to reconcile the two: omarchy-reinstall-pkgs installs that list with --needed, which does not skip a name that is not installed, and the conflict it then walks into has no answer under --noconfirm. A mirror that is briefly behind installs 0.3.0 instead and the next upgrade carries it to 0.3.1, which is much the cheaper way to be wrong.
🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh.
Co-Authored-By: Codex XHigh <codex@openai.com>
* Drop the quickshell version note from the shell restart loop
The comment qualified the kill loop as needing 0.3.1 or newer, but omarchy-restart-shell ships in the same package upgrade that brings quickshell along, so a machine running this code already has the version the loop depends on. The caveat could never be false where it was read, which left it as version archaeology rather than something the code could not say for itself.
🤖 Generated by Opus 5 in Claude Code.
---------
Co-authored-by: Codex XHigh <codex@openai.com>
(cherry picked from commit 2c593dbbaa)
With the default scale = "auto", sync_internal_scale read the config,
rejected "auto" as non-numeric, fell back to the hardcoded default 2,
and force-applied it whenever the compositor's auto resolution differed.
Since the script runs from omarchy-system-wake after every idle cycle,
the panel flapped between 2 and auto's own value (1.5666667 on a 198 DPI
panel) on every wake/reload pair.
A config without a usable number -- "auto", or an expression only
Hyprland's Lua can evaluate -- delegates the scale to the compositor:
whatever it resolved for the enabled panel is the configured scale, so
there is nothing to correct. Recovery of a disabled panel is unchanged
and still re-enables it with the remembered scale, falling back to the
historical default 2.
Fixes#7265. Also the scale-revert half of #7301.
Claude-Session: https://claude.ai/code/session_01L4Z6GimYhR1Kpsir24VAPF
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit b63616422f)
grant_covers re-implemented etc/sudoers.d/omarchy-dns in bash -- one of
the three providers, and %wheel -- but never asked whether the rule was
installed. It ships in the etc/ tree that omarchy-settings copies, so
every machine still on an older settings package answers yes to a grant
it does not have. require_root then execs into sudo with no way back,
and the panel's one-click toggle dies on a password prompt it has no
terminal to show.
Ask sudo instead. `sudo -l` alone reports whether a command is
permitted, which the blanket %wheel rule answers yes to for everything,
but the long listing prints the matched entry's tags -- !authenticate is
the grant and nothing else. It runs nothing, and under -n it prompts for
nothing, so a machine without the rule falls through to polkit and gets
a prompt on screen.
The provider list and the wheel check go away with it; sudo owns that
policy now, and it stays right if the rule is ever edited or removed.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 1e70cca144)
* Switch DNS providers without a password prompt
The network panel and the menu run omarchy-dns from a process with no
terminal, so require_root reached for pkexec and put a polkit password
prompt in front of what is meant to be a one-click toggle.
Grant %wheel passwordless sudo for the three stock providers and take
that path whenever the grant covers the invocation. Custom stays out of
the grant: it points the machine at servers the caller supplies, and it
already runs in a terminal that can ask.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Pick the elevation path without asking sudo
The `sudo -n -l` probe answered the wrong question. It reports whether a
command is permitted, not whether it is passwordless, and the %wheel rule
every Omarchy install ships permits everything -- `sudo -n -l /usr/bin/rm
-rf /tmp/x` exits 0. So the probe passed for Custom too, and the exec
below it ran `sudo -n`, which fails outright with no terminal and no way
back to pkexec.
Decide from what the sudoers rule actually says instead: sudo when there
is a terminal to type into, or when the resolved path and the provider
are both ones the rule names. Everything else keeps going through polkit.
Pin a root-owned PATH once elevated, too. `omarchy dev link` puts a
user-writable checkout ahead of sudo's secure_path for every command, so
a passwordless grant on a script that resolves nmcli, tee, and install
through PATH would otherwise hand root to whoever can write there.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Keep users outside %wheel on the polkit path
The rule grants %wheel, so path and provider alone do not mean sudo will
take it. A user outside the group was sent to sudo anyway, and with no
terminal to answer the prompt that is a dead end -- polkit at least
offers to authenticate as somebody else.
Two holes in the test alongside it: it accepted any file containing the
expected rule, so a second, argument-free line would have widened the
grant unnoticed, and run as root it would have sailed past the stubs and
rewritten the host's own DNS config.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Elevate the system install, whatever copy was invoked
The rule names /usr/bin/omarchy-dns, so a dev-linked checkout handed sudo
a path nothing could match and fell back to a polkit prompt. Re-exec the
packaged path instead: the privileged half is the system install
everywhere, the grant matches everywhere, and the path comparison and the
PATH pinning that existed to work around the checkout both go away.
Dev-linked checkouts run their own unprivileged half and the installed
one as root, which is the trade for not carrying a second code path.
---------
Co-authored-by: Omabot <david@hey.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 3765e8010b)
The background and the lock screen are drawn by Quickshell, so they decode
through Qt, which ships handlers for png, jpeg and gif but not webp. Any
third-party theme shipping a .webp background comes up blank without the
qt6-imageformats plugin, and extra themes are their own repositories.
Only the dependency is taken here. The background conversion that came with
it re-encodes all 79 bundled backgrounds, which 4.0.1 has no need of.
(cherry picked from commit a4219f8fbeb85ee7a2bc0e14eda9d38cc85d3d0d, dependency only)
* Switch to the mise-bin package
mise-bin carries mise's own release artifacts from the Omarchy repo --
PGO+BOLT-optimized on x86_64, glibc-native on both arches -- instead of
Arch's mise, and tracks jdx/mise releases directly.
Existing installs need a migration because the two packages conflict, and
omarchy-pkg-add cannot make the swap: pacman answers its own conflict
question with No under --noconfirm and fails the transaction. --ask=4
answers that one question, so mise-bin replaces mise in a single
transaction -- which is also what keeps omarchy-zsh and omarchy-fish, both
of which depend on mise, satisfied through the swap by its provides.
* Guard the swap with a conditional instead of an early exit
Two-path control flow takes an if, per the style guide; the early exit only made the swap line unreachable from a distance.
(cherry picked from commit 262d6f0681)
The dial already grouped its digits for the locale above 10, but below 10 it
went through toFixed, which hardcodes a dot. A German desktop therefore read
9.5 and 1.235 off the same dial, switching decimal convention halfway up the
scale.
Send both branches through the locale. A reading is a measurement rather than
interface text, so its separators follow the system's number conventions even
though the interface itself stays English.
English output is unchanged.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 9f109a7f3e)
The calendar grid's header row and the week-start toggle label were the only
text in the shell that followed the system locale, so a German desktop drew
MO DI MI over an interface that is English everywhere else. Nothing chose that;
they were the only two places reading day names off Qt.locale().
Take them from en_US instead. Where the week starts still follows the locale:
that is a regional convention rather than a translation, and it stays
overridable through weekStartDay.
Dropping the trailing-period strip with it, since that existed only for the
locales this no longer renders.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 25bee1d2a3)
omarchy-plugin-clone only takes the source id as the first argument, but the
menu passed --edit ahead of it, so the id fell through to the unknown-option
branch and every clone from Setup > Plugins failed.
Closes#6913
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit ff4e92e63b)
Bar widgets propagate their composed press-and-hold down to the center gesture
area without handing over the grab, so the gesture area started a bar move and
then received neither a release nor a cancel to end it. The move ghost stayed on
screen for the rest of the session. Ignore the gesture unless we hold the press.
Closes#6881
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit c0a20e2e43)
mise use -g announces the resolved tool on stdout, so every wrapped command
prepended a "tools:" line to its own output. That corrupts anything speaking a
protocol over stdout, such as codex app-server. Pass --quiet, which keeps errors
on stderr and preserves the exit status.
The obsolete-wrapper check in the agent migration matched the generated command
verbatim, so loosen it to match the package instead of the flags.
Closes#6908
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 1c3da94906)
A 3.8.3 migration appended the section header with one backslash too many, so
sed wrote the literal characters instead of a newline plus the header. foot
rejects the line and stops reading the rest of the file. The later text-binding
migration matches the header with grep -qxF, misses the broken line, and appends
a second section, leaving the config broken across the Quattro upgrade.
Closes#6903
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit b5bb8dac05)
Hyprland reaps its own children, so os.execute() gets ECHILD from waitpid and
never sees an exit status. Every call reported failure, which meant the NVIDIA
env detection in hypr/nvidia.lua never set NVD_BACKEND, LIBVA_DRIVER_NAME or
__GLX_VENDOR_LIBRARY_NAME. Read a marker off stdout instead.
Closes#6914
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 0965ac2e4f)
* Wait for the current Windows boot before connecting RDP
docker logs retains output across stop/start, so grepping the whole log
matched "Windows started successfully" from an earlier boot and returned
immediately, firing xfreerdp3 while the guest was still booting. Anchor the
scan to the container's current StartedAt, and run it even when the container
was already running, since the image restarts the guest in place on reboot.
* Skip Kerberos when connecting to the Windows VM
FreeRDP 3 attempts Kerberos before NTLM for NLA, and Arch's stock
/etc/krb5.conf declares default_realm = ATHENA.MIT.EDU, so every launch tries
to reach MIT's KDC. Off the network each attempt blocks ~23s and xfreerdp3
sits in CLOSE-WAIT without drawing a window, which reads as the VM failing to
start. Point FreeRDP at a realm-less krb5 config so it falls through to NTLM,
which is what the local Windows account uses anyway.
* Re-read the container start time on every readiness poll
A failed docker inspect left STARTED_AT empty, and docker logs drops the
--since filter when it is, putting the scan back on the whole retained log
and its stale success line. Sampling per poll also keeps the window on the
current boot if the container restarts mid-wait.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 75b99f7fd4)
* Launch claude and codex agents with auto-review instead of full bypass
Claude's auto permission mode and codex's --approve-for-me both run
unattended without prompting, but keep automatic review (and codex's
workspace-write sandbox) instead of skipping approval entirely. Grok
stays on bypassPermissions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Match the bash aliases to the agent launcher's auto-review modes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit dd9dee417f)
* Host the manual's images in the repo under manual/images
Replaces all learn.omacom.io/manual.omakub.org hotlinks with local webp
files capped at 1600px wide (~20MB total), so the manual is fully
self-contained. Theme and unlock previews are converted from the
canonical themes/*/preview.png files. A handful of illustration shots
are interim conversions of the current images, pending retakes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Retake the illustration screenshots fresh at 3x scaling
Navigation, clipboard history, notices, tmux layouts, prompt, and About
reshot on a clean workspace at 3.13x (1920x1080 logical on 6K) across
ten themes: Tokyo Night, Catppuccin, Gruvbox, Kanagawa, Everforest,
Nord, Osaka Jade, Rose Pine, Matte Black, and Ristretto.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop the extra themes chapter from the manual
The community theme gallery will live elsewhere. Removes the chapter
and its 114 gallery images, renumbers the following chapters, and
repoints the two references (theme installs still work via
Install > Style > Theme in the menu).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Reference the shipped theme previews instead of copying them
The themes chapter now points straight at themes/*/preview.png and
preview-unlock.png, so previews can never drift from the source and
manual/images drops from 6.3MB to 3.5MB.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Restore preinstalls from the menu, and drop the Omacom apps with them
Remove Preinstalls missed omacut, omacalc, and omawrite, so the three Omacom
apps survived an opt-out that was supposed to clear the desk.
Opting out was also one-way. Install > Preinstalls now puts everything back:
the shipped .desktop launchers and mise stubs via omarchy-refresh-applications,
the dropped packages via pacman, and the opt-out marker deleted so the
preinstalled keybindings return on reload. The two menu entries guard on the
marker, so exactly one of them is ever visible.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Trim the preinstall lists to what quattro actually ships
Remove Preinstalls was still dropping typora, spotify, 1password, 1password-cli,
signal-desktop, opencode, claude-code, and github-cli. None of those are in
omarchy-base.packages anymore: typora gave way to omawrite, the services moved
to on-demand menu installs, and the agent CLIs are mise-managed. Removing them
took out apps the user had deliberately installed, and restoring them would have
put back what we no longer ship.
Both lists are now the same twelve packages, all of them in omarchy-base.packages.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Keep the opt-out marker when a restore fails
omarchy-pkg-add exits non-zero when pacman cannot install a package, but the
restore ran straight past it, cleared the marker, and reloaded Hyprland. That
reported success and brought back keybindings for apps that never arrived. The
marker now falls last, behind a check on the transaction.
The new test also pins the two lists to each other and to omarchy-base.packages,
which is the drift that let retired packages linger in the removal list.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Pacman answers its own conflict question with No under --noconfirm, so one
retired package can stop every update after it. Which package to drop is a
decision rather than a cleanup, so run the upgrade again with pacman asking
when there is a terminal to answer on, and report instead when -y promised
not to ask.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The migration asked a user to close every running browser before repairing
the Copy URL shortcut, but a browser only ever rewrites its own Preferences
on exit. Waiting on all browsers deadlocks `omarchy update` for anyone whose
main browser is effectively never closed: the pending ghosts commonly sit in
a stale profile nobody has open, yet the migration blocks on the always-open
browser until the prompt is declined, failing the whole update.
A running Chromium-family browser holds a SingletonLock (and socket) inside
its user-data-dir, so whether the profile being repaired is open is
mechanical. Gate on that instead of on the sheer presence of a browser
process — the repair proceeds where the affected profile is closed, and
browsers attached to other profiles no longer hold the update hostage.
The gate stays conservative while an affected profile actually is open, and
the existing post-repair verification still catches a browser that starts
mid-repair and restores stale Preferences on exit.
The migration test now simulates an open profile with its SingletonLock
instead of a pgrep stub; every prior scenario still passes.
LocalSend registers an Ayatana item with no ItemIsMenu and no Activate
handler, so its primary click is a silent no-op and the menu offers only
Open and Quit. Share > Receive already opens it, so drop the item the way
Dropbox's is dropped when its dedicated widget owns the surface.
Closes#6838
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
gum draws its confirm UI on stderr, so the migration's `2>/dev/null` threw
away the whole prompt while gum still held the terminal in raw mode reading
keys. With a browser open, an update stopped after "Running migration
(1786643346)" on an unpainted screen with no way to tell it was waiting for
an answer.
Nothing else in the repo suppresses gum's stderr; the redirect only ever hid
gum's own error in the no-terminal case, where the migration already explains
itself on stderr before deferring.
Fixes#6841
Claude-Session: https://claude.ai/code/session_01So4yKzTDdJJp7orjnF8i1J
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The switchers chapter shifted everything from chapter 3 up by one, and
the TOC was still on the old numbers. Add its missing entry too.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The network and bluetooth panels stopped launching them; the module
catalogue still said otherwise.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add "Coming From Mac or Windows" as chapter 3: a translation layer for
Cmd/Win instincts rather than a feature tour.
Fill the remaining coverage gaps: fcitx5 input methods, laptop speaker
tuning, touchpad haptics, crash capture in the toggle table, the
installable font list, and the ChatGPT Desktop and Grok Bot entries.
Correct claims that drifted from the source: the network and bluetooth
bar icons no longer launch nmtui/bluetoothctl, monitor scaling steps
rather than cycles, and the display widget's scroll steps brightness.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Rebind ghost Copy URL shortcut registrations to the pinned id
Chromium never hands a suggested shortcut to one extension while
another — even a long-gone one — still holds the registration. Profiles
that first loaded Copy URL before its id was pinned registered
Alt+Shift+L under an id derived from the extension's load path at the
time, so the pinned extension never receives the shortcut and the
keypress does nothing (#6816).
The quattro upgrade tried to repair this against one hardcoded
path-derived id, which only ever matched a single home directory. The
historical ids are unknowable in general — they hash long-gone absolute
paths through whatever symlinks existed then — but the registration
itself names the command, so a migration now rebinds any copy-url
command that points away from the pinned id, unless that id belongs to
an extension that is actually installed or the pinned extension already
holds a binding of its own.
Browsers rewrite Preferences on exit, which reverts any repair made
while one runs, so the migration asks for this user's browser windows to
be closed first — failing and staying pending when there is no terminal
to ask in or the prompt is declined. The backup a repair leaves behind
marks it as attempted but unverified: until a browser-free run confirms
the registration stayed repaired, the migration keeps itself pending
rather than trusting a disk state an open browser may still overwrite.
The upgrade-time repair is dropped: the upgrade already runs migrations,
so the migration is the single implementation.
Fixes#6816
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Pin the WhatsApp Slim extension id
Keyless unpacked extensions get path-derived ids, which go stale if the
load path or packaging ever changes — the same class of bug that broke
the Copy URL shortcut for pre-package installs. Pin the id with a
manifest key like the other bundled extensions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Crash capture stays on by default, but Trigger > Toggle > Crash Capture (or
`omarchy toggle crash-capture`) now turns the watcher off. The toggle writes the
usual flag file and stops the unit for this session; the unit checks the same
flag with ConditionPathExists, so the choice survives a logout without the unit
having to be disabled.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The blank timer was gated on `authenticating`, which is
`authenticatingPassword || fingerprintAuthenticating`. The fingerprint
PAM sits armed for the entire lock waiting for a finger, so on any
machine with a reader enrolled the gate is true from lock until unlock:
the timer is stopped when the lock begins and never re-armed, and the
display stays lit indefinitely.
Gate on `authenticatingPassword` instead. A password check in flight
still holds the display up, and the passive fingerprint wait no longer
does.
Claude-Session: https://claude.ai/code/session_01EDpyC9793TKZBS2jXUNECG
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Fix notification focus for agent terminals
* Restrict notification title fallback to agents
* Simplify the focus fallback to a lazy two-tier query
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Keep AppLibrary scans out of login shells
A login shell sources the user's profile, and tools like mise touch
~/.local/share on activation. Quickshell's desktop-entry watcher monitors
that tree, so every scan retriggered another scan: a self-sustaining loop
that pinned ~20% of a core at idle. The scans only use bash builtins,
find, and sort, so they don't need the login environment.
Fixes#6806
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Pin the AppLibrary scans to non-login shells in tests
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Cover the KVM and disk requirements, the resources and credentials the
installer asks for, the launch/stop/status commands and --keep-alive,
what the RDP session carries, and what removal deletes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Persist notification images so history keeps avatars
Persisted popup and history entries stored image/appIcon as URLs into
resources that die with the live notification: Chromium-family senders
(every Omarchy web app, WhatsApp included) pass avatars as files in a
scoped /tmp dir deleted when the notification closes, and raw image-data
hints surface as in-process image:// URLs that die with the server
object. Replaying history then found dead references and hid the icon.
Copy file-backed images into the notification state dir when persisting,
keyed by the entry's file stem, and reference the copies from the JSON.
Blank dead image:// URLs so the card falls back to the app icon. The
copies die with their JSON: superseded-popup deletes, history trims and
clears remove them, and a startup sweep collects copies orphaned by a
restart killing a queued job mid-write.
Hold DND-silenced notifications open until their history write has run,
since untracking tells the sender to delete its avatar file, and carry
replayed on-screen rows over via their persisted copies, since the
replay dismisses their live notifications first.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Coalesce silenced updates and bound image copies through temp files
A replaces_id update lands on a held DND notification without a second
onNotification, so releasing after the first write could persist a stale
snapshot. Re-snapshot when the write completes and write again until the
content is stable, reusing the original file identity.
The image copy reopened the sender-controlled path after checking it, so
a file growing or becoming a FIFO mid-copy defeated the size bound. Read
through head -c under a timeout into a temp file, validate its size, and
rename it into place; the startup sweep clears temp files a killed job
leaves behind.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Neither group has any commands behind it, so both only ever printed
"Unknown Omarchy command" when browsed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add chapters for the top bar and its panels, screenshots and recording,
toggles/idle/screensaver, browsers, shell plugins, and networking, which
collects the Wi-Fi, DNS, firewall, and Tailscale material that was spread
across the FAQ, TUIs, and services chapters.
Fill smaller gaps in the existing chapters: user hooks, autostart, menu
extensions, printing, power profiles, factory reset, drive and user
passwords, passwordless sudo, firmware updates, display text size, and
the LocalSend share menu.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* perf(agents): cut codex usage collector memory with SQL filter and cache
The codex collector scanned every row of opencode.db (1.7 GB, 55k+ rows)
with Python-side json.loads, peaking around 716 MB of RSS on every run
-- including the panel's refreshLimits() call, which passed --limits-only
that the collector silently ignored.
Filter rows in SQL (LIKE gates + json_valid + json_extract authority,
mirroring the old Python filter semantics) so giant blobs are never
parsed, and cache the local stats scan in XDG_CACHE_HOME following the
claude collector's pattern (atomic writes, flock, schemaVersion).
--force rescans, --limits-only and normal mode reuse a fresh cache and
fall back to a full scan when it is missing, stale, or corrupt.
Measured: cold scan 716 MB -> 158 MB peak; warm --limits-only ~85 MB
and ~1.4 s. Output record schema and values are unchanged for the same
data (parity verified against the old filter, including malformed rows).
* Scope the codex scan cache's 15-minute reuse to --limits-only
A no-flag run is the widget's periodic refresh, and refreshIntervalSec is
configurable down to 30 seconds; holding every mode to a 15-minute cache
meant stats could lag far behind the interval the user asked for. Mirror
the claude collector: normal runs reuse a scan for ~20 seconds purely to
dedup concurrent collectors, and only --limits-only, which promises just
fresh limits, may reuse a scan for up to 15 minutes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Invalidate the codex scan cache across day boundaries
The cached stats embed date-dependent fields (todayPrompts,
todayTotalTokens, recentDays), but only the file's age was checked, so a
cache written at 23:58 served yesterday's numbers as "today" for up to
15 minutes past midnight. Stamp the envelope with the scan's local date
and treat any other date as a miss.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Reject codex scan caches with a future mtime
A cache whose mtime is ahead of the clock has a negative age, which the
freshness check accepted forever: setting the clock backwards froze the
stats until real time caught up with the file. Require a non-negative
age before trusting the cache.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Never cache an interrupted opencode scan
A transient lock, schema migration, or corrupted database aborts the
opencode scan mid-flight; the partial numbers still serve the current
run, but persisting them let a single bad read suppress opencode usage
for every cache reader until expiry. The claude collector already skips
its opencode cache write on a database error; do the same here.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Make the json_valid guard order explicit in the opencode query
The query relied on json_valid(data) evaluating before json_extract(),
but SQLite does not promise that AND terms run left to right; a
reordered plan would let json_extract raise on a malformed row and
silently truncate the scan. Wrap each json_extract in a CASE so the
guard is structural rather than positional.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop a claude-collector comment that is false for codex
"These caches were world-readable before" was copied from the claude
collector; codex had no caches before this one existed. Explain the
chmod on its own terms.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: markbusking <marcosbustos.dev@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
omarchy-hw-hybrid-gpu gates the Hybrid GPU menu entry, and it queried
supergfxctl unbounded — a wedged supergfxd stalled menu rendering
forever. Bound the query with the same TERM-then-KILL escalation the
toggle uses, and treat a daemon that cannot answer like a machine
without supergfxctl: fall back to counting GPUs rather than hiding
hardware that is really there. An ordinary supergfxctl failure still
hides the entry.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Only offer video capture devices as webcams
V4L2 exposes raw processing and output-only nodes beside usable cameras. The webcam picker and automatic recorder selection treated the first /dev/video node as a camera, so IPU6 laptops opened a black overlay instead of their loopback capture device.\n\nShare one device lister across detection, selection, and recording, and keep only groups whose first video node advertises Video Capture in Device Caps. Cover raw IPU nodes, ordinary capture devices, and capture-less systems.
* Fall through to a later capture-capable node in a webcam group
A group whose first video node is not capture-capable vanished entirely,
even when a later node in the same group could capture. Probe each node
until one qualifies, still emitting at most one device per group. Also
exit zero explicitly: a trailing filtered device used to leak the failed
capability check as the script's exit status.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Bound hybrid GPU mode queries
* Test blocked hybrid GPU queries
* Give the blocked-client test headroom over its 12s of kill cycles
The third case spends ~12s of real TERM/KILL escalation against its own
15s watchdog, which can tip to a spurious 124 on a loaded machine. Also
drop the TEST_LOG plumbing no stub ever wrote.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The interval floor was applied with max(), so the zero that --force
picked could never win: max(0, 15) is 15. Forcing a refresh within
fifteen seconds of the last probe silently served the cache instead,
though --force documents itself as ignoring them.
The window exists to absorb a panel opened and shut repeatedly, which
arrives as --limits-only. --force is a person pressing refresh, and it
should outrank a window meant for flicks.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Stop closed network panels from leaving Wi-Fi scanning enabled
refresh() defaults scanWifi to false and its no-scan branch enabled the
scanner unconditionally. Five paths reach it with no panel on screen —
Component.onCompleted, clearNetworkAction(), failNetworkAction(), the
band-change actionProc exit, and the 30s actionTimeout — so the scanner
stayed on and Quickshell kept re-arming RequestScan behind a closed panel.
scanRestart had the mirror gap: it enabled the scanner 100ms after
refresh(true) without re-checking that the panel was still open.
Every sweep takes the radio off the operating channel, so this degraded
the link it was scanning from: one sweep every 17s, gateway RTT rising
from ~2ms to repeated 150ms+ spikes on an otherwise idle connection.
Gate the scanner block on the panel being open, cancel a pending restart
on close and re-check the panel when it fires, and track the WifiDevice
this instance enabled so close, device replacement and destruction
release the right object. Destruction matters on its own: a bar reload
with the panel open would otherwise die with opened still true and never
write scannerEnabled = false.
* Cover the scanner ownership helper's own invariants
The previous assertion only pinned that no write bypasses
setScannerEnabled(); it said nothing about what the helper does. Dropping
either the opened gate or the release-before-adopt from the helper still
passed, while a closed instance could reclaim scanning and a device swap
could leave the previous interface scanning.
Run the helper's actual JavaScript against stand-in devices instead,
following the extract-and-eval pattern the agents panel tests already use.
Removing either invariant now fails its own assertion.
* Measure the About layout in UTF-8 so its window is not fitted too narrow
wc -L only counts display columns in a UTF-8 locale. A session that never
set one leaves it counting the box-drawing and Nerd Font glyphs the About
layout is built from as nothing, which measured the content 21 columns
narrower than it renders and fitted the window to clip it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Open the About window at the size it last settled on
The window used to map at the float rule's starting size, paint, and only
then measure itself and resize, so every open flashed one window size and
reflowed into another. The size that hugs the content can only be measured
from inside the terminal, so remember it and apply it as a window rule
before the terminal is spawned: the window now maps at its final size and
never moves. A rebranded logo or a new font falls back to the float rule
for one launch, refits, and is remembered from then on.
The fit itself now moves the window by the cells it is off by, rather than
scaling it to the grid, which multiplied up the terminal's padding along
with them and left the fit a column or two short. It accepts a cell of
slack instead of chasing an exact grid, since a window lands where the
terminal's cell boundaries put it, not where it was asked to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Only the Claude Code CLI can refresh the OAuth token it saves; the
collector just reads it. A machine left alone long enough finds the
token lapsed, and that branch returned an empty limits list with no
status text at all, so the panel hid its whole limits section and
explained nothing.
Say what is wrong, and fall back to the cached limits already on disk
rather than discarding them. Cached windows are kept only until they
reset: a percentage from a window that has rolled over describes a
period that is over, and pinning a stale 78% on an allowance that is
now untouched would be worse than showing nothing. The probe-failure
path gets the same filtering for the same reason.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Drop the kms hook when the proprietary NVIDIA driver handles early KMS
install/hardware/nvidia.sh early-loads nvidia_drm (modeset=1) for early KMS,
but HOOKS still carried the kms hook, so autodetect pulled nouveau and
~100 MB of its GSP firmware into every initramfs for a driver that never
runs. On a Limine UKI setup that meant a 256 MB image where ~144 MB is
normal, doubled again by the fallback history on /boot.
Filter kms out of HOOKS when nvidia_drm is in MODULES (nvidia.conf sorts
before this drop-in) and every PCI display controller is NVIDIA. Hybrid
systems keep kms so the iGPU retains early KMS at the LUKS prompt.
Verified on an RTX 4090 (nvidia-open-dkms 610.57.04): UKI shrinks
256,183,296 -> 144,066,048 bytes, nouveau and its firmware gone, the
nvidia-utils GSP blobs and all four nvidia modules retained, Plymouth
still owns the LUKS prompt via nvidia_drm.
Fixes#6790
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address review: quote literals, harden PCI detection, add shell tests
Quote fixed string literals in the [[ ]] comparisons per AGENTS.md, and
read the PCI tree through OMARCHY_PCI_DEVICES_PATH, the same seam
bin/omarchy-hw-nvidia already uses.
Require a positively identified NVIDIA display controller before dropping
kms: an empty or unreadable PCI tree previously counted as "no non-NVIDIA
GPU" and would have dropped the hook. Unexpected trees now keep kms.
Cover the conditional in test/shell.d/nvidia-kms-hook-test.sh: nvidia-only,
hybrid, no nvidia_drm, MODULES unset under set -u, audio-function-only,
empty tree, and a device directory missing its sysfs attributes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Treat unreadable PCI devices as inconclusive and make the test hermetic
A device whose class/vendor attributes cannot be read could be another
GPU, so skipping it let a readable NVIDIA GPU beside it drop kms without
having verified the whole tree. Count it as a non-NVIDIA sighting so kms
stays, and cover the mixed case in the test.
The test also sourced the host's /etc/vconsole.conf under set -u, where a
valid KEYMAP-only file makes the XKBLAYOUT expansion fail in the subshell
and ties the result to the machine running it. Predefine XKBLAYOUT and
FILES before sourcing the config.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Rebuild existing initramfses once the kms hook no longer applies
The settings package deploys the new omarchy_hooks.conf conditional, but
nothing rebuilds the initramfs when only a mkinitcpio drop-in changes, so
existing NVIDIA-only installs would carry nouveau's ~100 MB of GSP
firmware until their next kernel update. Following the precedent of
1784476564, add a migration that rebuilds via limine-mkinitcpio — once
per machine, and only where evaluating the installed drop-ins shows the
conditional actually dropped kms, so hybrid machines, non-NVIDIA
machines, and user-edited configs are left alone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Document the mid-sourcing MODULES caveat in the kms conditional
A later-sorting drop-in that resets MODULES outright (as
surface_device_modules.conf does) would strip nvidia_drm after kms was
already dropped. Every machine Omarchy writes such a file for is hybrid
Intel and keeps kms through the PCI scan, but that is worth stating so
the invariant is not broken by accident.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Quattro hands wifi to NetworkManager, which starts wpa_supplicant through
D-Bus activation. Installs carrying a wpa_supplicant.service mask from the
iwd days break that activation: NetworkManager retries five times, gives
up, and every wifi device sits at "unavailable" with no network to
research the fix on. Remove the mask (including a runtime one) and restart
an active NetworkManager when a wifi device is stuck, so wifi comes back
without a reboot.
Fixes#6783
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The discovery retry timer turned adapter.discovering on every second
while the panel was open, and nothing ever turned it off. The BlueZ
discovery session behind it is held by quickshell's D-Bus connection,
so one visit to the panel left the radio in inquiry until the next
shell restart — continuously starving A2DP audio on the same controller
into stuttering, and 'bluetoothctl show' kept reporting
'Discovering: yes' long after the panel was gone.
The panel now tracks the StopDiscovery it owes BlueZ and settles it
once closed. A timer bound to the confirmed discovery state does the
stopping, rather than a write in the close handler: quickshell only
forwards a discovering write that differs from the last state BlueZ
reported, so a stop issued while a just-fired StartDiscovery is still
awaiting confirmation would be swallowed and leak the session. Binding
to adapter.discovering re-arms the stop whenever the confirmation
lands, a reopen inside the first interval keeps the scan running
uninterrupted, and attempts are bounded so a session another BlueZ
client holds up cannot draw StopDiscovery calls forever.
One widget instance exists per monitor and they all share the default
adapter — the same shared-backend shape the network panel's wifi
scanner fix (#6772) dealt with — so the debt follows the session: an
instance opening onto a running scan adopts it, a closing instance
hands it to a panel still open on another monitor (the popout handoff
closes one instance as it opens the next), and a destroyed instance
passes it to a surviving sibling.
Fixes#6789
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Recover image picker after interrupted thumbnails
* Use arithmetic assertions in image cache tests
* Bound thumbnail lock waits and reap partial thumbnails
A hung generator (vips stuck on a corrupt file or slow mount) held its
flock forever, wedging every later picker open; the directory-lock era
capped that wait at 30 seconds, so keep the same bound. A generator
killed mid-write also stranded its partial .jpg.<pid>.jpg forever, since
nothing prunes the cache directory; only the lock holder writes those,
so reap them right after taking the lock.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Harden thumbnail locks and cache publication against races
Adversarial review caught three holes. The lock fd leaked into
vipsthumbnail, so an orphaned or hung vips kept holding the lock after
its shell died; close it for the child. Reaping legacy lock directories
unconditionally raced a still-running legacy generator through an
upgrade; only reap ones older than the longest plausible generation.
And cache publication was neither atomic nor exclusive, so a picker
killed mid-write, or two interleaving, could leave truncated or
mismatched rows behind signatures that still validated - the same
permanent hiding this branch set out to fix; publish via renames under
a per-key lock, rows first.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix `--help` being skipped for bin routes that only partially resolve to a file
* Add regression tests for --help on partially resolved routes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Stop help-flag scanning at -- and match --json as an exact token
A `--` marks the rest of the args as belonging to the command itself, so
neither --help nor --json past it should be treated as router flags. The
--json check also matched substrings of flattened args, so a --json inside
one quoted argument switched --help output to JSON.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The floating rule pinned every agent terminal to 1200x800, which
overflows small and scaled displays: window rules see logical pixels, so
a 2560x1440 monitor at scale 1.6 is only 1600x900 and the window covered
89% of its height. Tiling drops the fixed size along with the rule, and
the shared app-id still earns the terminal tag from terminals.lua.
* Offer an AI diagnosis when a process crashes
systemd-coredump journals every core dump under a known MESSAGE_ID with the
crashing program, pid, and signal as structured fields. omarchy-crash-watch
follows that stream and raises a "Process crashed: <program>" toast; clicking it
opens omarchy-agent-crash, which briefs the default agent on the crash.
The toast goes through omarchy-notification-send --exec rather than a libnotify
action, because the shell runs clicks from its own omarchy-exec hint and never
emits ActionInvoked. It keeps the default "omarchy-action" app name too, the
only one shouldBypassDnd() lets through -- a crash being the last notification
worth swallowing. It stays quiet until an agent is configured, since a
diagnosis is all it offers.
The method lives in a diagnose-crash skill rather than the prompt, so it is
edited in one place and works with whichever agent is default. It covers
investigating the core, and reporting a confirmed Omarchy bug upstream: scoped
to bugs Omarchy controls, searched for duplicates first, only with the user's
agreement, and signed with the model and harness that produced it.
A migration reaches existing installs, whose skill symlinks and unit enablement
would otherwise sit behind one-time setup paths.
* Let the diagnosis clean up the core it extracted
"Do not modify or delete anything" contradicted the symbolization step right
above it, which writes a core to a temp file and deletes it on exit. Read
literally, the core survives -- and the same section warns it holds passwords
and tokens. The prohibition is about the system, not about your own scratch.
* Do not spend a crash toast on a dead notification server
The shell owns org.freedesktop.Notifications, so its own crash takes the
notification server down with it -- and a shell crash is exactly what you want
told about. The toast was sent once into that gap and the dedupe window was
recorded regardless, so the rest of the crash loop went quiet for a minute and
`journalctl -n 0` never replays what was missed.
It now waits for the restarted shell to reclaim the bus name, as
omarchy-migrate-notify already does, and only a delivered toast starts the
dedupe window.
* Reshape the agent launcher into omarchy agent
omarchy-launch-agent becomes omarchy-agent, with prompts on omarchy-agent-prompt
rather than the bare route: `omarchy agent` is both a command and a group, so a
positional prompt there would shadow any subcommand under it. The launcher takes
flags only and points at `omarchy agent prompt` when handed one.
Every agent window now launches under a fixed org.omarchy.agent app-id instead of
omarchy-launch-tui's default of org.omarchy.<binary>, so one rule floats them all
whichever agent is default.
Omarchy also stops picking an agent for you. omarchy-default-agent prints nothing
until one is chosen, leaving every entry under Setup > Defaults > Agent unchecked,
and a first-run invitation offers to take you there.
* Wordsmith
* Cover the agent routes and the invitation
The route split is the point of the change, so exercise `omarchy agent`,
`omarchy agent prompt`, and a rejected positional prompt through the router
rather than only the binaries behind them.
The invitation gets the same treatment as the Voxtype and fingerprint ones: it
notifies once, opens the agent defaults menu, and leaves both the notification
and the marker alone for anyone who already chose an agent.
* Offer the agent choice from the keybinding
Super + Shift + Ctrl + A now runs `omarchy-agent --pick`, which opens Setup >
Defaults > Agent when nothing is chosen yet. A keypress that writes to stderr
and opens nothing just looks broken.
* Reach existing installs with the agent invitation
first-run installs the invitation hook, and existing accounts marked it complete
long ago, so they would never see it -- while being the accounts most likely to
need it, since the old getter returned opencode implicitly and most have no
agent recorded at all. Post-update hooks run later in the same update, so the
invitation arrives without waiting for another one.
* Say what the Defaults submenus set
Setup > Defaults lists Agent, Browser, Terminal, Editor, but the header inside
each repeated the same bare word, which reads as a category rather than a
setting -- and says nothing at all when the menu is summoned straight into it.
The list keeps its short labels; the headers now name the setting.
Standing in for an abandoned compositor means binding a Unix socket, and the
sandboxes this guard exists for are the ones that deny it: the fixture raised
PermissionError and took the whole file down with set -e, adding a failure in
the environment the guard was written to keep clean. Run the cases that need no
socket first and skip the rest when one cannot be bound.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Read the keyboard being typed on rather than the one holding main
The main flag names no keyboard for long. fcitx5 takes it with the
virtual keyboard it binds to inject, and those are filtered out, so on a
seat running an input method the pick lands on nothing at all: no label,
and the widget hides itself off the bar. #6727 keeps polling in that
state rather than settling it, and the poll has nothing new to read.
Once fcitx5 unbinds, the flag lands on whichever device libinput listed
last, as easily a lid switch as a keyboard, and a device that never
receives the toggle reports the layout it started on forever, which is
the reading #6574 opened.
Every device carries the seat's layout list, but only the keyboard being
typed on advances through it, so read the furthest-advanced one.
activelayout names the keyboard it moved ahead of the layout, so take
that name and let it settle the pick, and the click that switches it.
* Leave the buttons out of the seat the widget reads
Reading the keyboard being typed on left keyboardName standing for two
things at once: the device a click switches, and the device activelayout
last named. Only the second was still being set, so the first went empty
until a switch happened -- which left the click doing nothing on a seat
whose only switch is the click, and left the poll running forever on the
one-keyboard install it was written to leave alone. Give each its own
property, and set the switch target from the reading that confirmed the
keyboard is there.
Layout progress only points at the keyboard being typed on while the
other devices stay where they started, and the ACPI power button, lid
switch and sleep key never do move on their own -- but they answer to
switchxkblayout and can hold the main flag, so anything that reads or
switches whatever the seat hands back can end up describing a button, and
unplugging the keyboard beside one leaves it standing in for the seat.
Drop them where the virtual keyboards are already dropped.
A reading that reaches hyprctl and finds no keyboard now clears the label
rather than leaving a device that is gone described on the bar, told
apart from the empty output a killed query leaves by the device list
itself, and the watchdog asks again rather than waiting for a poll that a
settled seat has already stopped.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Skip shell tests when the compositor can't be reached, not just when WAYLAND_DISPLAY is unset
A set variable only proves the environment was inherited. Sandboxes pass it
through while blocking $XDG_RUNTIME_DIR, so Quickshell cleared the guard and
aborted inside QGuiApplication, leaving two core dumps per launch instead of a
clean skip. Probe the socket and, when there's a signature to ask with,
Hyprland itself. Disable core dumps on the way through for the compositor that
dies mid-run, which no probe can catch.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Retry the compositor query before calling it dead
Hyprland can miss a query while it reconfigures outputs, and one miss was enough
to skip a whole file's runtime coverage. Retry the way omarchy-launch-shell
does. Only a leftover socket reaches the query at all, so the ordinary skip
still returns immediately.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Quickshell watches the QML it loaded and reloads on change, so pacman
replacing /usr/share/omarchy/shell mid-transaction makes the running
shell reload against a half-written tree. That reload fails, and a
failure that reaches the config load is not harmless: it raises the
reload popup, which is a second engine generation.
EngineGeneration::currentGeneration() returns null unless exactly one
exists, so the IPC kill that omarchy-update sends moments later takes
the QCoreApplication::exit(0) branch instead of the generation's own
quit, and Quickshell tears the QML graph down after deleting the
QGuiApplication. The first GUI resource touched on the way out aborts:
FATAL: QPixmap: Must construct a QGuiApplication before a QPixmap
The user gets the crash dialog after an update and a coredump per
occurrence. Reported in #6748 with 3 crashes across 10 updates, always
following a failed reload.
Fixing this in omarchy-update — stopping the shell around the pacman
step — would cover one caller and cost the polkit agent and the
notification server for the length of the transaction, which the
migrations that run next still notify through. It would also have to
carry omarchy-restart-shell's refusal to restart a locked session, or
reintroduce the hazard that refusal exists for.
And omarchy-update is not the only thing that rewrites the tree. The
pacman guard turns away a bare pacman -Syu, but nothing turns away a
targeted pacman -S omarchy, a pacman -U of a locally built package, the
documented OMARCHY_ALLOW_DIRECT_PACMAN bypass, omarchy-dev-pkg-test, or
a checkout in a dev-linked tree.
Turn the watcher off instead. Omarchy has never reloaded through it:
omarchy-restart-shell is what picks up QML changes, and config and
plugin changes go through the shell's own IPC. Third-party plugin hot
reload is PluginRegistry's own inotifywait and FileView watches its own
files, neither of which this touches — QuickshellSettings::watchFiles()
gates the config scanner and nothing else. The popup goes off with it,
because QML can still ask for a reload directly and leave the same
extra generation behind.
Environment reaches Quickshell only at launch, so the update that
delivers this still runs under a watching shell. It takes effect from
the next one.
Verified against an isolated instance: breaking a config in place and
then sending the IPC kill reproduces the FATAL, and it stops with either
variable set. QS_DISABLE_FILE_WATCHER also keeps the failed reload from
happening at all.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Drops the ChatGPT web app from the default set at the same time, so installing
the openai-codex-desktop package can't leave two identical-looking ChatGPT
entries in the launcher. Super + Shift + A still opens the web version, which
is the only place it was really used.
The bundled ChatGPT icon stays: the package's own chatgpt.desktop asks for
Icon=chatgpt and ships no hicolor icon of its own.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The vendor-ID guess rejects any device with a driver bound, on the
reasoning that libfprint drives readers from userspace so a real one sits
there unbound. But libusb claims interfaces through a synthetic usbfs
driver, so the reader binds one for as long as fprintd holds the claim —
which is exactly while it is being enrolled or verified against.
Readers that name themselves take the product-string branch and never
reach this, so the exposure is the ones that don't: Goodix 27c6:6594
reports "Goodix USB2.0 MISC", matches on vendor ID alone, and drops out
of detection mid-authentication. The menu entry disappears and the
first-run invitation stops firing while the reader is in use.
Ignore a driver link that resolves to usbfs, and keep rejecting the real
ones — usbio-bridge, usbhid, uvcvideo — including on a device that has
both.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Restore FPC fingerprint detection
* Anchor the FPC product match to a prefix
*fpc* is an unanchored three-letter token on the one branch that is
trusted outright, with none of the kernel-driver checking the vendor
guess gets. Every FPC reader on record leads with it — "FPC Sensor
Controller", "FPC Sensor Controller L:0002 FW:25.26.23.14", and this
branch's "FPC L:0000 FW:1425046" — so requiring the prefix costs no
coverage while keeping three letters from matching mid-string, where
FPC abbreviates unrelated things like flexible printed circuit.
Also restore the note about why Elan is kept out of the vendor list, so
the two signatures read as the same deliberate exception.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Write no product descriptor for a two-field device spec
${remainder#*:} returns the string unchanged when there is no second
colon, so a spec meant to describe a device with no product descriptor
wrote the product id out as its product string instead. Every call site
happened to pass a trailing colon, so the suite was right by accident.
Guard the split and drop the trailing colons, so the two vendor-match
cases exercise the path they were written for.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Bind a named driver in the kernel-driver fixture
Touching a bare `driver` file asserts that any driver at all disqualifies
a vendor guess, which is more than the detector should promise: libusb
claims an interface through a synthetic `usbfs` driver, so a reader in
active use looks bound by that rule.
Link the interface at a named driver directory instead, the way sysfs
does. The case still covers what it was written for — a Synaptics bridge
or a camera on a fingerprint vendor ID — without fixing the shape of the
answer for drivers it was never about.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The widget polled hyprctl every 10 seconds per monitor, including on the single-layout install where it never shows. Keep the poll only where its answer can change - a seat with more than one keyboard, where Hyprland moves the main flag with no event to announce it - and stop it entirely once a one-keyboard seat has been read.
Also coalesce a refresh that arrives mid-query instead of dropping it, time out a query that never returns rather than letting it hold the guard shut for good, and re-read the layout on configreloaded.
Co-Authored-By: markbus-ai <markbus-ai@users.noreply.github.com>
* Replay the history a dismissal or a clear was still being written into
The popup files a replay reads are written by a serialized queue of shell
jobs, and the read ran as its own process alongside it. A dismissal issued a
moment earlier could still be queued when the directory was read, leaving the
notification out of the replay it was the newest entry of, and a clear issued
a moment earlier could still be queued too, replaying entries it was about to
remove.
The read now waits for the queue to go idle, so the replay shows the history
as of the moment it was asked for rather than whichever jobs happened to have
landed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Catch up on an update that arrived before its popup had a row
Watching a notification for in-place updates starts the moment it is handed
over, but the row those updates write to is inserted a tick later, deferred to
keep a mid-incubation Repeater from being mutated underneath. A client fast
enough to update inside that window found no row to write to, and a property
that has already changed does not change again — so the toast and its file sat
on the superseded content until something else moved.
The row is now refreshed from the live notification once it exists. That reads
the same object the signals would have, so an update that beat the insert is
picked up and one that did not costs nothing: a refresh whose content matches
the row it would write is dropped, which also collapses the several signals a
single multi-property update emits into one rewrite.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Hold queued file work behind the replay's read, not just ahead of it
The read waited for everything queued before it, but nothing stopped the queue
from running on while it worked. A clear or an archive issued during the read
could delete or move files out from under awk mid-glob, so a replay could still
show a partial history — some of what a clear was in the middle of emptying.
The read is a barrier in both directions now: the queue holds until it exits,
and it releases on exit rather than on output, so a read that comes back empty
or fails cannot park the queue behind it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Queue the replay's read instead of waiting for the queue to empty
Waiting for the queue to go idle before starting the read still let work
overtake it. A clear or an archive enqueued after the replay was asked for,
while the current job was running, was dequeued the moment that job exited —
the read only starts once nothing is left — so the replay showed the state
after those jobs, which is the race this was meant to close. Unbroken file
traffic could postpone the read indefinitely for the same reason.
The read is now an entry in that queue rather than a process running beside
it. It takes its place in line behind the work queued before the request and
ahead of everything queued after, so no later job can overtake it and no
amount of traffic can push it back.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The pacman cache grows without bound across updates, and nothing in the
update flow ever reclaimed it. On a machine that has been updating for a
while it reaches several gigabytes of superseded versions that nothing
will ever install again.
Prune it with paccache -rk2 as the first step of an update. Both halves
of that placement are load-bearing.
Keeping two versions rather than one preserves the rollback path. The
cache is Arch's only offline downgrade: when an update breaks a single
package, reinstalling its predecessor from here is the surgical fix,
where a snapshot rollback would revert every other package too. Pruning
before the packages update means the installed version is still the
newest cached, so it survives along with a spare. Retention is by
version order and never consults what is installed, so that holds while
the installed version is among the two newest cached; a deliberate
downgrade or repeated failed transactions can stack newer archives on
top of it.
Running before the snapshot is what actually frees the space. The cache
sits on the snapshotted root subvolume, so a prune taken afterwards
leaves the fresh snapshot holding those extents and reclaims nothing
until it ages out of the number cleanup.
A failed prune warns and continues. Cache housekeeping should not trip
the update's ERR trap and tell the user their update went wrong.
This runs after omarchy-update-requires-free-space, so it reclaims space
during healthy updates but does not rescue a machine already under the
10 GiB gate.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
A client that updates a notification through replaces_id does not produce a
second onNotification: Quickshell writes the new content onto the Notification
object the shell is already holding. The card draws a snapshot copied out of
that object — deliberately, since a live QObject in a ListModel role becomes a
dangling pointer the moment the server destroys it — so the toast kept showing
the superseded text, and archived it to history when it left the screen. A
Slack thread that updates in place read as stuck.
Every property the card draws is now watched on the notification we hold, and
a change rewrites both the model row and the file the popup was persisted
under. The file name is that popup's identity, so the rewrite lands in place:
a shell restart restores the version last shown, and so does the copy that
reaches history.
The countdown starts over when the content changes. New text arriving a second
before the toast was due to expire deserves a full look, not the remainder of
the clock the text it replaced had nearly run through.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
History was a pair of in-memory lists mirrored into notifications.json, split
into "pending" and "past" by a seen/unseen distinction no surface exposed,
capped at 100, deduped by an id that repeats across server generations, and
pruned by a 15-minute TTL. Replaying it showed five rows drawn from whichever
list happened to hold them.
Every toast already writes a file under ~/.local/state/omarchy/notifications
so it can survive a shell restart. That file is now the history record: when
the popup leaves the screen it moves into notifications/history instead of
being deleted, the newest ten are kept, and showHistory replays exactly what
is in there, including the toasts still on screen when it is asked for. A
notification DND silenced is written straight into the same directory, since
a toast that never showed is the one worth looking back at.
That leaves the models, notifications.json history payload, past pruning, and
the /tmp image cache that existed to keep century-old history thumbnails alive
with nothing to do, so they go.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every supported agent spells it differently, so map each one to its own
bypass flag instead of leaving the launcher at each agent's default.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1784917531 gated its UKI rebuild on initramfs_async=0 being present in
the Limine config, but omarchy-settings ships omarchy-defaults.conf with
that parameter already in it. Any machine that installed the package and
ran the migration in the same update matched the config the package had
just written, skipped the rebuild, and kept booting an image baked
before the config existed — without initramfs_async=0, so encrypted
boots still fell back to an unthemed text LUKS prompt. Compare the
booted command line against the configured one and rebuild when they
disagree.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The stub polled for the lock with its own flock, competing with the
holder it had just started. The holder took the lock non-blockingly and
never retried, so a lost race killed it and left the lock free. The
notifier then saw no update in progress and sent the toast the test
asserts it withholds. Wait on the holder's own signal instead.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The sleep inhibitor deliberately outlives the start that spawns it, but
script tears its pty down as soon as the command returns, and the SIGHUP
that follows could kill the inhibitor before it managed to exec. The
sudo stub then never logged and the test failed about half the time.
Hold the session open from inside until the inhibitor has started.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
omarchy-monitor-state stopped shelling out to
omarchy-hyprland-monitor-focused when it started deriving the focused
name from its own hyprctl snapshot, so the stub the test installed was
never called and the assertion could never pass. Expect the focused
monitor from the fixture instead, and drop the dead stub.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Accept either name for the lock authentication command
omarchy-setup-lock was renamed to omarchy-apply-lock in 536fcd5c, but
the upgrade calls into whatever the channel just installed, and every
released package still ships the old name. The rename only moves in
lockstep for the ISO, which installs the runtime from the mirror it
ships with; the upgrade has no such guarantee, so it aborted every run
with "omarchy-apply-lock is unavailable" right before the point of no
return.
Prefer the new name and fall back to the old one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Leave the Omarchy 3 session alone until the reboot
The upgrade tried to start Quickshell in the live session, and only
stopped waybar/walker/elephant if that worked. Every branch of it could
fail, so it needed a warning for each, and those warnings were the first
thing users read at the end of an upgrade that had otherwise succeeded.
The reboot is the cutover. Swapping the UI out underneath a running
session buys nothing, so drop the attempt and both functions with it.
The Omarchy 3 bar, launcher, and notifications keep working until the
reboot, which is what happened anyway whenever the start failed.
Also warn up front when the live Hyprland session cannot be reached, and
drop the package_mode label that was set on both branches of the
dev-package check and never read.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Shim the legacy Hyprland defaults from the backup, not from GitHub
populate_legacy_hypr_defaults tried a sparse git clone of master, then a
curl of the master tarball, and only if both failed the backup taken a
few lines earlier. That backup is the checkout the running session is
sourcing right now: it is the correct content, it is already on disk,
and it needs no network in the middle of an upgrade. master is a guess
that is wrong for any machine not on master.
Try the backup first and drop the git clone, which fetched the same
thing as the tarball by a longer route. The network path stays for the
case that has no backup, where the legacy root was already a symlink.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Clear the Hyprland error bar the upgrade leaves behind
The two settings were applied through both the keyword and the Lua API,
in four calls on the way out and three on the way in, split differently
each time. Fold that into one helper that takes the value.
The error bar needed more than suppression. An explicit hyprctl reload
re-reads the config from disk, which resets both keywords before it
reports what it found, so suppression cannot survive one; anything that
reloaded during the swap left the bar on screen. Hyprland then keeps it
up until a later clean reload, which this script deliberately never
performs, so it was still there when the upgrade finished. Clear the
overlay on the way out, once the shims have made the legacy config
resolve again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Run the packaged firewall config instead of a copy of it
configure_snapper_policy and configure_lock_authentication already call
into the installed tree; apply_firewall_defaults reimplemented
install/config/firewall.sh inline instead, and had already drifted from
it. The packaged script also installs the ufw-docker rules, so upgraded
machines came up without the Docker firewall protections a fresh install
gets.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Stop the Voxtype toggle migration reloading a mid-swap session
This is the reload behind the "source= globbing error" bar users see
during a Quattro upgrade. The upgrade runs the packaged migrations
against a still-running Omarchy 3 session, and this one ends with
hyprctl reload. That re-parses a legacy config whose theme source= has
nothing to resolve to yet, so Hyprland paints an error bar and keeps it
up until a later clean reload the upgrade deliberately never performs.
It was still on screen when the upgrade finished.
The upgrade already exports OMARCHY_UPGRADE_TO_QUATTRO_LIVE for exactly
this, and 1782002156 honors it. Do the same here. Nothing in that
session reads the toggle being removed; the reboot applies it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Assert the retired session entry points stay gone
The ordering check would still pass if either came back, while the
comment above it claims they cannot. Name them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Upgrade onto the channel the machine is already on
The upgrade always defaulted to stable, so an rc machine taking it
landed on production packages from the stable repo. rc callers worked
around that by passing --channel rc, which then forced every caller
onto rc, stable machines included.
Read the channel off the mirrorlist the way omarchy-version-channel
does and follow it: stable machines get omarchy and omarchy-settings
from stable, and rc or edge machines get omarchy-dev and
omarchy-settings-dev from edge, which is what --dev already selects.
An explicit --channel or --dev still wins, and an unrecognized
mirrorlist still falls back to stable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep rc machines on the rc mirror when taking dev packages
--dev forced the edge channel, so an rc machine following its own
channel was moved onto the edge Arch mirror as well. The constraint is
narrower than that: the dev packages are only published to the edge
package repo, which the rc and edge channels both already point at.
Only stable is incompatible.
Reject --dev only for stable, and default to edge just when no channel
was chosen. rc machines now upgrade against rc-mirror with the dev
packages out of the edge repo, which is where Quattro lives until it
ships.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Repair theme symlinks the state-move migration left dangling
1781043107.sh re-linked legacy theme symlinks whose targets were stored
with a literal "~/.config/omarchy/current/..." string. The replacement
used the same literal tilde, which the filesystem never expands inside a
symlink target, so btop, Helix, and VS Code/Cursor lost their theme and
the migration reported success anyway.
Fix the source migration to relink through the already-defined
$current_state_dir variable, and add a follow-up migration that repairs
the links the applied version left dangling — matching the existing
1785002349.sh pattern, so it is idempotent and leaves custom links alone.
Co-Authored-By: Claude <noreply@anthropic.com>
* Only repair theme symlinks that could never have worked
The repair matched any target containing omarchy/current, so a working link
into a user's own dotfiles was rewritten to the state directory and their
setup was lost. Claim a link only when its target starts with a literal "~/",
which the filesystem never expands, and names this exact theme file: that is
what 1781043107.sh wrote, and no working link can look like it. A dangling
target is not enough on its own, since a dotfiles repo may just be unmounted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Clean up every scratch directory the CLI suite creates
Five of the eight mktemp directories were never registered with the exit
trap, so each run left them behind in /tmp. Route them all through a helper
that records them for cleanup.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Drop the theme symlink migration tests
A migration runs once on each machine and is then inert, but a test for it
sits in the suite forever. Now that the repair behaves correctly, keep the
migration and let it go untested rather than grow the suite permanently.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Every other pointer at the community lives in an error path or a doc, so
there was no way to reach it from the menu. Prefer the Discord app when
it is installed, and fall back to the invite in a browser when it is not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The row list was capped at 60% of screen height so a card could never read
as a page. On a laptop-height display that folds the starting menu one row
early, hiding About behind the peek for no gain.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Herdr ships its own annotated keybindings menu, same as Tmux, but nothing
in the menu pointed at it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
lspci reads PCI config space, and the kernel resumes a runtime-suspended
device to serve that read. On a hybrid laptop the discrete GPU idles in
D3cold, so the first lspci of a Hyprland config load spends over a second
waking it — longer than the 1.5s budget Hyprland gives the whole load.
The reload then fails at whichever line runs next, which is why the error
pointed at default/hypr/apps/1password.lua rather than at nvidia.lua.
Read the vendor, class, and device IDs from sysfs instead. Those are
served from cached fields and never touch config space, so nothing wakes
up. Classify by device ID while we're here: Turing is both the first
generation with GSP firmware and the first at 0x1e00 or above, and
Maxwell opens at 0x1340, one ID past the last Kepler part. Bounding the
older detector at both ends keeps pre-Maxwell cards off the 580xx driver
that cannot drive them, and picks up the Maxwell and Pascal parts the
lspci name regex used to miss.
omarchy-hw-nvidia was also checked in without its executable bit, which
it needs now that nvidia.lua runs it.
Fixes#6660
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(monitor): prevent mirror toggle deletion during recovery and fix UI state
* Assert the external monitor helper counts mirrors as active
The helper now asks `hyprctl monitors all -j`, so the test that pinned it
to plain `monitors` failed. A mirrored external is absent from plain
`monitors`, which reads as a disconnect and hands the mirror toggle to
recovery.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep the mirror state line when nothing is mirrored
Piping the first mirroring monitor into the branch fed jq's test() a null
whenever no output mirrored, and jq aborts there rather than falling back
to "". The panel reads this output by line, so the missing line shifted
the focused monitor, the scale, and the display list up one, and left
mirroring reading as on whenever the external display had focus.
Select first and branch inside the pipeline, so the branch only ever sees
a monitor and the empty case falls to "" as the lines around it do.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Cover the monitor panel state the shell reads by line
Nothing exercised omarchy-monitor-state, so both the mirror direction it
reported and the jq that reported it went unguarded. The panel reads the
output by line index, where a helper dying mid-script costs a line and
shifts every field below it into the wrong property without failing.
Assert the line count alongside the fields, over extended, mirrored both
directions, and clamshelled displays.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Coding agents refuse to persist trust for $HOME, so the keybinding and
menu launches -- which inherit the session's ~ cwd -- re-asked on every
single session. ~/Work is already the work root Omarchy creates, and
trust there sticks.
Only applies when the cwd is exactly $HOME, so the inline alias still
starts in whatever project directory it was run from.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Fix unclickable tray submenus by drilling down inside the popup
Clicking a tray menu entry that has children was a silent no-op: the
row called QsMenuEntry.display(), which renders a *platform* menu, and
Quickshell refuses that unless the shell root sets `//@ pragma
UseQApplication` -- shell.qml does not. The log shows "Cannot display
PlatformMenuEntry as quickshell was not started in QApplication mode"
and nothing opens. Apps whose whole menu is submenus, like
radiotray-ng's station list, were unusable.
Adding the pragma would be the wrong fix: it switches the entire shell
from QGuiApplication to QApplication, dragging QtWidgets into the
process and changing application-class behavior for the sake of one
popup -- which would then render as an unstyled platform menu beside
omarchy's own popup styling anyway.
Instead, submenus drill down inside the existing popup. A child
QsMenuEntry inherits QsMenuHandle, so it can feed a nested QsMenuOpener
and render through the same row delegate. Each level keeps its own live
opener on a stack -- a child entry is owned by its parent opener's
model, so collapsing to a single reassigned opener would destroy the
very entry being displayed. A back header row walks out one level; at
the root the menu renders exactly as before, and items without a
DBusMenu still use the platform fallback.
* Destroy submenu openers deepest-first and reset before switching items
resetTrayMenu() destroyed openers front-to-back and only cleared
submenuStack afterward. A deeper opener's menu entry is owned by its
parent's children model, so destroying the parent first could
invalidate an entry a still-live child opener referenced. Clear the
stack before tearing anything down, then destroy deepest-first so a
child is always gone before the parent whose model owns its entry.
openTrayMenu() reassigned activeTrayItem before calling resetTrayMenu().
trayMenuOpener.menu binds to activeTrayItem.menu, so that reassignment
immediately swaps what the root opener's children expose -- invalidating
entries any live submenu opener still referenced, before resetTrayMenu()
got a chance to tear them down. Reset first, then switch items.
Thanks @Copilot for catching both.
* Defer submenu reset until the popup's fade-out actually finishes
onTrayMenuOpenChanged reset the submenu stack the instant trayMenuOpen
went false, but the popup stays visible for the whole 140ms opacity
fade (PopupCard's own visible: open || card.opacity > 0) -- dismissing
from a submenu flashed the root menu mid-fade, and could resize or
reposition the fading popup if the two have different geometry.
Moved the reset to trayMenuPopup's own onVisibleChanged, which only
fires once the fade has genuinely completed. Switching to a different
tray item is unaffected: openTrayMenu() already resets explicitly
before assigning the new item, independent of whether the popup ever
dips to invisible (rapid reopen mid-fade never does).
Thanks @Copilot for catching this.
* Ignore tray menu clicks for a beat after changing submenu level
Changing level swaps the Repeater's model, which rebuilds the row
delegates synchronously -- a fresh row lands under a cursor that hasn't
moved. Submenu clicks used to be silent no-ops, which trained users to
click them twice, so that second click now fires whatever entry took
the spot. On radiotray-ng that means an accidental station switch.
Gate row and back-header clicks for 250ms after each level change. A
deliberate follow-up click is slower than that; a double-click is not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Pin the submenu back header above the scrolling menu rows
The back header lived inside the Flickable's Column, so in a submenu
taller than the 420px cap -- exactly the long station list this
drill-down exists for -- scrolling down pushed the only way back off
screen, with no Escape or right-click alternative.
Move it into a pinned Column above the Flickable and account for its
height in the popup's contentHeight.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Reset the tray menu scroll offset when the drill-down is torn down
Flickable keeps its contentY across a model swap whenever the new
content is still tall enough to hold it. A menu dismissed while
scrolled therefore reopened part-way down with its first entries off
screen: reproducible on any tray app whose root menu outgrows the
420px cap, and now reachable on every app once a long submenu has
been scrolled.
Zero the offset in resetTrayMenu(), which runs both on teardown and
before switching items.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Toni Nowak <t.nowak@ai-flow.no>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Previously, right-clicking the audio icon muted only the output. Whereas
the switch at the top of the panel mutes all audio (inputs and outputs).
Pairing the right-click to the switch seems a bit less confusing, and
also matches the behaviour with other panels (e.g. Bluetooth, Tailscale,
etc).
Opening the cheatsheet outright put a menu in front of someone who had not
asked for one, and it blocked first run until they dismissed it. Go back to a
toast that opens the same menu when clicked.
The body carries real newlines now. It was written with a literal \n, which the
card renders as the two characters rather than a line break.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sharing a file or folder over LocalSend opened a terminal to run an fzf
pick over a find of the whole home directory, which is slow on a large
home, shows no previews, and looks nothing like the rest of the desktop.
The portal chooser is already how the other pickers here ask.
The chooser has a directory mode, so folder sharing asks for one the same
way, and neither entry needs a terminal to host a picker anymore.
A chooser that never opens is told apart from nobody picking anything, so
a portal failure says so rather than passing for a cancelled share.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
A pinned internal monitor rule that referenced the omarchy_monitor_scale local
had the variable name captured as the scale, so clamshell recovery fell all the
way to the hardcoded 2.
Read the config the way Hyprland writes it: a key's value is whatever sits
between the `=` and the next separator, and a bare word resolves against a local
only when one exists, so a quoted string stays a string. Comments are cut before
anything is matched, and position gets the same resolution since it had the
identical bug.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Select a screen region and decode the QR code in it to the clipboard, so
an otpauth:// setup code shown on screen no longer needs a phone.
The decoded value is only ever placed on the clipboard, and marked
sensitive so clipboard history skips it. Decoding is restricted to QR so
a stray barcode elsewhere on screen can't take the clipboard instead.
Co-authored-by: Hlib Kanunnikov <hlibwondertan@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
A monitor powered off when the machine boots — a smart strip cutting AC, the PC
coming back on its own — still answers DDC, but with a partial EDID that carries
no video modes. Hyprland takes the connector as present and brings the monitor
up at 0x0. Powering it on afterwards changes nothing: the connector never
dropped at DRM level, so no hotplug fires, nothing re-reads the EDID, and the
screen stays black until a reboot.
Only a reload re-reads it. Forcing a DRM re-probe would work too but needs root,
and the kernel's cached mode list stays empty without one, so there is nothing
cheaper to poll: the reload is both the fix and the only way to learn whether it
was needed. Poll only while a monitor is in that state, back off from three
seconds to a minute, and stop as soon as one reports a mode — the machine can
sit black all night, and powering the monitor on fires no event to stop on.
Nothing will ask again if this loop gives up, so an unreadable answer is not
taken for a healthy monitor. It is also not waited on forever: a compositor that
stays silent has gone, and with it the session and any reason to keep asking.
Reloading on our own schedule means minding the reload guard, which exists to
keep Hyprland out of package-owned config mid-transaction, and which only
disables the automatic reloads. The guard can now be asked, and recovery holds
off while a transaction is in flight.
A reload lands a monitor at 0x0 the same way a boot does, so configreloaded is
watched alongside the hotplug events. The recovery's own reload comes back
through it, and a lock keeps that from stacking a second loop. Contention waits
rather than drops: a trigger arriving while a loop is exiting is the last one
that will come, and one arriving while a loop is running is answered by its next
pass anyway.
Mirrors are dropped from `hyprctl monitors`, so the check asks for all of them
and filters the disabled ones itself. Monitors turned off on purpose sit at 0x0
too, and re-applying config would fight the user over those.
The existing poll here recovers internal panels on docked laptops and never runs
on a desktop, which is where this happens.
Reported in #6668.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Label the keyboard widget with the xkb language code
The label was the first word of the layout description cut to three
characters, so a US layout read ENG and a Portuguese one read POR.
xkb already pairs every layout and variant with a short language code,
which is the code GNOME shows in its own indicator. Read that table once
at startup from xkbcli list and key it by description, which is what
hyprctl reports as the active keymap, so the same layouts read EN and PT.
The code is a language rather than a country, so it stays sensible for
the layouts named after neither: Esperanto is EO, Arabic is AR, and Latin
American Spanish is ES. Layouts missing from the table keep the old
truncated description.
* Read the exotic xkb rulesets for the keyboard label
xkbcli list leaves out the exotic rulesets, so layouts like trans were
missing from the table and fell back to the truncated description: the
IPA layout read INT rather than IPA. Those layouts ship in the same
xkeyboard-config package and set just as well, so read them too.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep the keyboard label to three characters
The brief was used verbatim while the fallback was truncated, but not
every brief is two or three characters: Burmese (Zawgyi) is my-zwg and
Shan (Zawgyi) is shn-zwg. Selecting either widened the widget past its
neighbours on the bar. Drop the script suffix and cap the brief the same
way the fallback is capped, so those read MY and SHN.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Stop an xkb brief carrying past its own block
The brief was only cleared once a description consumed it, so a block
printing a brief without one would hand its code to the next block's
description and label it wrongly rather than falling back. Nothing in
the current xkb data does that, and the option groups were skipped only
because the last layout happened to consume its brief first. Clear the
brief when a line starts a new block so the pairing is explicit, and
cover the option list the 2-space match is what keeps out.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Fall back when a layout description names a built-in
A custom xkb group called constructor or toString reached an inherited
member of the lookup rather than a brief, and splitting it threw a
TypeError that took the whole label binding down instead of falling back
to the truncated description. Take the lookup only when it returns a
string.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The letters name a panel; the numbers count them. One is the leftmost
panel in the right section, so the number matches the icon a user would
point at: a widget with no panel of its own is passed over, and so is one
that is hiding itself.
Counting rather than naming means the hotkeys follow the bar. Rearranging
the section, or adding a widget to it, renumbers the panels with no
binding to rewrite.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
A scoped window read as "Fable weekly" beside "Session" and "Weekly", so
the one row that names a model was also the one row in lowercase.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Fix theme install code execution and drop tzupdate NOPASSWD
VULN-01 (C, D, E): a malicious theme can execute arbitrary code
during install through three injection sinks:
C: colors.toml values reach a sed script unsanitized.
GNU sed's `e` flag runs the pattern space as a shell command.
D: vscode.json `.name` is interpolated into a sed replacement
string without escaping sed metacharacters.
E: keyboard.rgb content is interpolated into a python3 -c
argument without validation.
Fix C by validating keys and values in omarchy-theme-color's parser
with a character allowlist. Byte-identical output for all 22 shipped
themes.
Fix D by escaping backslash, ampersand, and slash in the theme name
before sed interpolation.
Fix E by gating on ^[0-9A-Fa-f]{6}$ before interpolation, in both
the Framework 16 and ASUS ROG keyboard scripts.
VULN-02: the tzupdate sudoers grant has no argument constraint.
tzupdate -l lets any wheel user write a root-owned symlink to any
path. Drop it; nothing has invoked tzupdate since omarchy-cmd-tzupdate
was removed. Keep timedatectl set-timezone.
* Harden keyboard and vscode theme scripts
keyboard-f16: pass hex as sys.argv instead of interpolating into
python3 -c. The hex validation gate stays as the primary defense;
argv separation is defense-in-depth per OWASP guidance.
vscode: replace sed interpolation of theme name with jq, which
handles arbitrary strings safely via --arg. Validate extension IDs
against ^[a-zA-Z0-9._-]+$ before passing to --install-extension.
* Keep VS Code settings edits JSONC-safe
settings.json is JSONC, so routing the write through jq dropped theme sync
entirely for anyone with a comment or trailing comma in the file, including
the `{ "workbench.colorTheme": "",\n}` shape Omarchy itself creates. Edit in
place again and close the injection by validating the theme label instead.
Scope the extension-id guard to the install so a malformed id no longer skips
the colorTheme write, and treat a missing descriptor field as empty rather
than the literal string "null".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Widen the accepted colors.toml value charset
The sanitizer dropped gradient angles, decimals, underscored palette
references, and paths, which vanish from --raw/--all and leave a raw
{{ placeholder }} in the generated config. Allow the punctuation real
palettes use, keep out everything sed treats as special, and say so on
stderr rather than dropping a key silently.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Show the per-model weekly limit Claude's usage endpoint reports
Model-scoped allowances arrive in the payload's limits array, not in the
seven_day_<model> buckets, which come back null. Read them so a window
like Fable's own weekly limit stops being spent against invisibly.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Read every model-scoped window, and title it for what it is
A model can hold more than one scoped window, so keying the dedupe on the
model alone dropped whichever came second — including a fuller one that
decides the headline. The model and the window kind together make the key,
and both make the title, so one model's two rows read apart.
The panel guesses a window out of the label, and that guess cannot survive a
model name: "Opus 5 (1M context)" parses as a one-minute window and renders
as a second "Session". The collector states the title outright now and the
panel takes it, eliding a long one rather than running it into the percentage.
Scoped percentages are read on whatever scale the payload speaks, the way the
flat buckets already are, rather than assuming percentages, and a model that
names only an id still names a window worth showing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
A ping at hyprland.start answers for a machine that has not finished coming up.
Ethernet is still negotiating DHCP, so a working desktop was told to set up
Wi-Fi and offered an update it could already have run. Ask NetworkManager
instead: -s returns once it has tried every connection it could auto-activate,
which is the first moment the answer means anything, and -x then takes that
answer as it stands rather than waiting out a timeout that a laptop with
nothing to connect to would spend in silence.
The update prompt now waits for a connection rather than being phrased around
not having one. There is nothing to update against until a link lands, and one
usually does land later on the machines that started without it, so the prompt
follows the connection whenever it arrives.
That wait runs detached. It outlasts first run by design, and the keybindings
menu is on screen behind it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The welcome toast spent three lines telling you about a cheatsheet that takes
one keystroke to read, and the only way to act on it was to click the toast,
which opened that cheatsheet. Open it directly instead.
Dismissing the menu exits non-zero, since no selection was made, so the step
tolerates that rather than failing first run and retrying the whole sequence
next login.
It also goes last now. The menu blocks until it is answered, and the Wi-Fi and
update toasts are the only other things left to show, so sending those first
leaves them waiting underneath rather than behind an open menu.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Detect a compositor session lock through one helper
omarchy-restart-shell decided whether the session was locked by looking for
"LOCK" anywhere in the hyprctl monitors payload. That works, but not for the
reason the code reads like: Hyprland reports no lock state of its own, and the
string comes from solitaryBlockedBy, the list of reasons a monitor cannot hand
a client the whole screen. An active ext-session-lock is one of those reasons.
A substring match over the whole payload also answers yes to a workspace or a
monitor description that merely spells LOCK, and locking a desktop nobody asked
to lock is the worst way to be wrong. Match the reason list itself, and put it
behind a helper now that a second caller needs the same answer.
That second caller needs a third answer too, because the reason list is not
always readable. Hyprland stops at the first reason on a monitor with no
workspace yet — one just coming back — and returns before it ever looks at the
lock, so a missing LOCK there means nothing was asked rather than nothing was
found. Neither that nor an unreachable compositor is an unlocked session, and
locks strand precisely while outputs are coming and going, so both exit 2.
Callers that only branch on success are unaffected.
The test fixture claimed the string came from a workspace name, so it was
encoding the wrong model of the compositor. It now returns what Hyprland
actually returns.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Retake a session lock stranded by a dead shell
ext-session-lock keeps the session locked when its client goes away — that is
the point of the protocol, so a crashing lock screen cannot expose the desktop.
The cost is that a shell which dies while locked leaves the compositor locked
with nothing left to authenticate against: Hyprland's failsafe, which takes a
TTY or another machine to clear.
Nothing carried the lock across a restart. Quickshell relaunches itself after a
crash and omarchy-restart-shell can be run by hand, but both bring back a shell
holding no lock, so the failsafe stayed up. A fresh shell never holds a lock, so
a session already locked as the lock service starts can only be that orphan:
take it back and let the user type their way out.
Asking once is not enough. These deaths happen while outputs are going away,
and the replacement shell comes up inside that same window, where there is
nothing to read a lock off. So the question is asked until the answer means
something: on a short timer while the session settles, and again when a screen
comes back, since a display asleep for hours outlasts any timer worth running
and returns through a state the compositor cannot answer for either. Once an
answer does arrive the search ends, so the timer stops and later screen changes
cost nothing.
Three ways this could lock a desktop nobody asked to lock, all closed. A lock
this shell took itself is not an orphan, including one taken while the question
was in flight — omarchy-restart-shell re-locks a fresh shell, and the answer
cannot tell whose lock it found. Recovery runs once and clears the flag, so
nothing lingers to fire after an unlock. And PAM landing late reopens the
question rather than answering it: clearing the failsafe from a TTY is the
documented way out, so a yes from before there was anything to do about it may
be stale by the time it can be acted on.
The check has to live here rather than in the launcher. Quickshell's crash
handler re-execs in place, keeping the same pid, so a supervising process never
sees the restarts that recovery matters most for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Relaunch the shell when it dies without a signal
Quickshell restarts itself after a crash, but only from its signal handlers:
SIGSEGV, SIGABRT, SIGFPE, SIGILL, SIGBUS, SIGTRAP. Qt does not always leave
that way. When the Wayland connection fails, QWaylandDisplay::checkWaylandError
calls _exit() directly, which raises no signal at all — so the crash handler
never runs, no report lands in ~/.cache/quickshell/crashes, and the desktop is
left with no bar and no explanation.
That is how #6684 ends: the lock path meets a screen with no valid Wayland
output, declines to create a lock surface for it, and the connection dies with
EINVAL. Supervise the launcher so those deaths come back.
A clean exit is deliberate — omarchy-restart-shell stops the shell over IPC and
starts its own replacement — and a signal to the supervisor means the session is
going away, so neither relaunches. Neither does a shell that outlived its
compositor, though that takes more than one unanswered query to conclude: the
shell dies while outputs are being reconfigured, which is also when a busy
compositor can miss one without being gone. A shell that cannot stay up gives
up after five tries in a minute rather than spinning.
Signals need care now that a launcher stands between the session and the shell.
Bash defers a trap until a foreground command returns, so the shell runs as a
job and the supervisor waits on it. Stopping the launcher used to stop the shell
with it, back when this script exec'd Quickshell, so the signal is passed on
rather than leaving a desktop nobody is watching. One arriving during the
backoff sleep only reaches the trap afterwards, so the flag is read again at the
top of the loop: a shutdown racing a crash would otherwise get one more
Quickshell on its way out.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Place a bar widget on a bar without the widget it names
'omarchy bar put X --after Y' refused outright when Y was not on the bar, so
migration 1786279107 failed for every user whose clock is their own clone of
omarchy.clock rather than the built-in, and took the rest of the migration
chain down with it. put is the verb a migration or an install reaches for
precisely because it cannot know what the bar it places into looks like, so it
now falls back to the widget's usual spot instead of failing. 'plugin enable',
which someone types, still says when it cannot find the target.
A clone also answers as a placement target now, whether it is the widget the
placement named or the anchor the fallback lands against: cloning the clock
leaves a bar carrying your id where omarchy.clock used to be, and a caller
naming the source means the clone that took its place, the way resolveEnabledId
already routes calls to it. So the widget sits next to that clock rather than
at the end of the section.
Fixes#6678
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep asking a shell that is still starting
An 'omarchy update' landing while the shell restarts failed migration
1786279107 twice over. Quickshell answers a call made before it finishes
loading with "Not ready to accept queries yet." on stdout and exits 0, so a
caller polling with a ping read a starting shell as up and then took that
sentence for the answer to its real call; report it as unreachable, which every
caller already knows how to handle, and omarchy-restart-shell stops cutting its
readiness loop short on it too.
Reading the plugin manifests is a subprocess behind that, so IPC starts
answering before the registry knows the widget it is being asked to place, and
put refused it as unknown. Say which of the two it is and let put keep asking.
Only a shell that was never there is nothing to fail over. One that never
finishes starting, one that stops responding, one too old to know the call at
all: each has to fail, since omarchy-migrate records a migration that returns 0
as done, and the widget is then never placed and never asked for again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Fall back for the shell an update has not restarted yet
omarchy-update runs its migrations before omarchy-update-restart, so the shell
answering migration 1786279107 on the update that carries this fix is still the
one that shipped without it, and it refuses the placement exactly as before.
The users this is for would have watched one more update go wrong. put owns the
fallback it documents, so let the command carry it: asked again without the
neighbour the shell says it cannot find, that shell places the widget.
A restarted shell never answers this way — it falls back itself, and knows to
look for a clone of the widget the placement named, which the command cannot.
Having answered once is now remembered across both asks. A shell that speaks
and is then gone has stopped mid-request, and reading that as a machine that
never had one would leave the migration recorded as done.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Wait for a shell that has not appeared yet
A shell being spawned has no socket to answer on, and nothing tells the command
a launch is under way, so a put landing in that window read the silence as a
machine without a shell and carried on — leaving the migration recorded as done
with nothing placed. Give one three seconds to turn up first. A machine that
genuinely has no shell still carries on, three seconds later.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Leave a clone of the widget being put where it is
A clone is the widget it was cloned from wearing its owner's name, so a bar
carrying one already has what put is being asked to place. put only saw the
literal id, and enabling a first-party source whose clone is active is how you
switch back to the built-in — so a migration placing omarchy.keyboard-layout
would have handed a user's own copy back for the shipped one, and called it
done. Targeting learned to read a clone as its source; presence had not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Trim the comments on the bar put path
Roughly a line of comment per line of code, most of it restating what the code
and the assertion messages already say.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Following the rule as written is what put apply back in the top-level group
listing right after every command in it was hidden: the table drives that
listing on its own, with no regard for whether anything in the group is
visible.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
setup is where a user goes to configure something: direct boot, security
keys, hibernation. These three are not that. omarchy-apply-system is the
ISO's entry point in the target chroot, omarchy-apply-hardware is what it
calls for device quirks, and omarchy-apply-lock is called by
install/config/lockscreen-pam.sh.
apply is the verb they already used to describe themselves, and it carries
the contract: declared state under install/ converged onto the machine,
idempotent, safe to repeat.
The group gets no GROUP_DESCRIPTIONS entry on purpose. That table drives the
top-level group list on its own, so an entry would put apply back in front of
users even with every command in it hidden, the way provision already stays
out. A test covers it.
The ISO installs the runtime from the mirror it ships with, so it moves to
the new names in lockstep and no compatibility route is needed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The setup group is described as interactive setup wizards, but these three
are not that. omarchy-setup-system is the ISO's entry point in the target
chroot, omarchy-setup-hardware is what it calls for device quirks, and
omarchy-setup-lock is called by install/config/lockscreen-pam.sh. None of
them is something to browse to and run.
Hiding only affects listings, so the ISO and the install leaves keep routing
through the CLI exactly as before.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Apply the Broadcom Wi-Fi quirk to Macs without a T2
brcmfmac lets the Wi-Fi firmware run the WPA handshake itself, and on Apple
hardware that offload fails against an access point in WPA2/WPA3 transition
mode: the client associates, the four-way handshake never completes, and
NetworkManager reports the password as wrong. feature_disable=0x82000 turns off
the firmware supplicant and authenticator so wpa_supplicant does the handshake
in software.
That quirk already shipped, but only for Macs with a T2 chip. The bug is in the
Broadcom firmware rather than in the T2 bridge, so it was never the right thing
to gate on: a MacBookPro11,4 has BCM43602 with 2015 firmware, fails exactly this
way, and got nothing. Gate on the hardware that actually has the firmware — an
Apple machine with a Broadcom wireless part — which covers both.
Moving it out of fix-t2.sh also leaves one owner for the file. Two leaves writing
the same config would have meant the later one silently winning, decided by an
ordering in all.sh nobody would think to check.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Gate the Broadcom Wi-Fi quirk on the T2 ID or a brcmfmac chip ID
Sniffing lspci for an Apple vendor with a Broadcom network controller made T2
Macs depend on a detection line they never needed: they carry a T2 PCI ID that
is always there, and the class name half of `lspci -nn` comes from the pci.ids
database. Keep their original gate untouched.
Naming the rest by DMI model does not hold up either, because the model year
does not predict the part. A MacBookPro11,4 from Mid 2015 carries a BCM43602
and needs this; a MacBookAir7,2 from Early 2015 carries a BCM4360 and does
not. Covering the lineup by name takes around twenty identifiers across four
product lines and grows every time Apple ships hardware.
The set has an exact definition already: the PCI IDs brcmfmac binds, from the
driver's own brcm_hw_ids.h. That reaches the 2016 and 2017 MacBook Pros and
the T2-less iMac19,1 and iMac19,2 that a hand-written list missed, and it
leaves out the BCM4360 Macs for free, since their out-of-tree wl driver would
never read a brcmfmac option anyway.
Matching an exact vendor:device ID also drops the piped `grep -q`, which
returns 141 under pipefail once the producer is killed by SIGPIPE (#6608). The
test runs the leaf with pipefail so the chatty lspci stub proves it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Fix Macs already installed without the Broadcom Wi-Fi quirk
The quirk is written at install time, so a machine set up before it shipped
never gets it, and no pre-T2 Mac ever did. Those installs still fail the WPA
four-way handshake against an access point in WPA2/WPA3 transition mode,
which is the state the reporter had to repair by hand.
Appending leaves anything else in the config alone: modprobe reads every
options line for a module, and nothing else sets feature_disable. Only an
active options line counts as already applied, and the driver keeps the old
behaviour until it reloads, so this asks for a reboot rather than pulling
brcmfmac out from under a connection that currently works.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
The menu ranks the launcher bindings by hand, and Herdr had no rule, so it
fell into the unranked middle far from the terminal it sits beside in the
bindings. Rank it right after Tmux and shift the rest down, and give
"Show Herdr key bindings" the same treatment next to its Tmux counterpart
at the bottom.
The cache key is bumped so machines holding records from the old order
rebuild them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Forking perl to produce {"menu":"<route>"} cost more than the IPC call it
fed. jq is already a runtime dependency and emits identical JSON.
Opening the menu drops from ~42ms to ~28ms.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Thumbnails were generated one ImageMagick process at a time. Queue the
missing ones and drain them across every core with vipsthumbnail, which
decodes and encodes faster and lets the per-process startup overlap.
Cold cache for a 92 wallpaper directory drops from 14.2s to 1.3s, and
the bundled theme previews from 2.0s to 0.26s.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Turn Bluetooth off with an rfkill soft block
BlueZ never persists an adapter's Powered property, so turning Bluetooth off in
the panel lasted only until the next boot. Omarchy's answer was AutoEnable=false,
which persists nothing either — it just means "never power the adapter on", so
Bluetooth came up off every boot whatever the user had chosen.
The soft block already does the job. systemd-rfkill saves every switch under
/var/lib/systemd/rfkill and restores it early on the next boot; that is the
entire purpose of the unit. Blocking also covers every controller at once, where
bluetoothctl only ever addresses the default one.
So the block becomes the state and BlueZ follows it: with AutoEnable back at its
stock default, lifting the block is enough for bluetoothd to power the adapter up
on its own. Powered still tracks the block, so the panel switch and icon read it
exactly as before. Everything that turns Bluetooth on or off goes through
omarchy-bluetooth-power, because bluetoothctl power on fails while a block is set.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Carry installed machines over to the rfkill block
Existing installs have AutoEnable=false, so their adapter is down at every boot
and Powered is the only record of what the user actually wants. Read it before
anything changes, hand it to the block, then put AutoEnable back to its default
so bluetoothd can act on that block. Only the exact line Omarchy wrote is
reverted, so a hand-edited opt-out survives.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Ask the power helper for a direction, not a toggle
The helper runs detached and the switch only moves once BlueZ catches up, so a
second click inside that window re-read the pre-click state and undid the first.
The panel already knows which way it wants to go, so let it say.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Read every controller and bound the power-up wait
The block hits every Bluetooth radio at once, but the state was read from a bare
bluetoothctl show, which reports the default controller only. A powered dongle
sitting behind a powered-down internal controller read as off and got blocked
along with it. Enumerate the controllers and take any powered one as on, exposed
as is-on so callers do not each reinvent the read.
The wait counted probes rather than time, so a wedged D-Bus turned a two-second
bound into roughly fifty across a full power-up. One deadline around the whole
wait holds it near nine.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Change the radio through sudo in the migration
/dev/rfkill is only writable unelevated from an active graphical seat, so an
update run over SSH failed here with EACCES. Migrations run under bash -e, so
that aborted before the config revert and the marker, and aborted again on every
retry. The privilege guidance already calls for sudo on machine-wide work run
from a visible terminal.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Hold the indicator peek open while the pointer is on the bar
Revealing the hidden indicators widens their section, and a section that
grows can slide a neighbouring widget under a pointer that never moved.
Collapsing the peek on that un-hover narrowed the section again, moved the
neighbour back out, and re-opened the peek, so a pointer resting in the bar
space beside a grown section stuttered the bar until it moved away.
Hold the peek while the pointer is anywhere on the bar and close it only
once the pointer has left, which keeps the reveal-on-empty-space gesture
and drops the feedback loop.
Fixes#6581
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Assert the whole-bar hover helper does what the peek depends on
The earlier assertions all held against a no-op setBarHovered, which would
leave barHovered false and let the oscillation straight back in. Pin the
assignment and the collapse re-run too, so the helper cannot be emptied
without the suite noticing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Let the delayed peek re-check collapse only, never open
The timer assigned centerSectionRevealHeld outright, so it opened the peek
from bar hover alone. A pointer resting on the left section that dipped off
the bar and returned inside 120ms left the timer pending with barHovered
true again, and the indicators revealed without the pointer ever touching
the center section.
Opening stays the center section's own gesture in setCenterSectionHovered.
The timer now only closes what that opened, and the test asserts the
invariant against the whole file rather than one helper body that never
had the offending assignment in it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Tally bar hover per monitor instead of sharing one flag
Every screen's bar wrote the same barHovered bool, last writer wins. Sliding
along the top edge from one monitor's bar to the next can deliver the enter
before the leave, leaving the flag false under a live pointer; the collapse
then fired on a peek the user was still hovering, and no further hover change
arrived to correct it until the pointer left and came back.
Counting each surface's hover makes the order irrelevant. A bar destroyed
mid-hover — unplugging a monitor — never sends a leave, so it hands its
tally back on destruction rather than holding the peek open for good.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Warping to a target window's center selects the wrong window when a smaller
one covers that center: slurp keeps highlighting the coverer, so Tab could
never leave it. Navigation now warps to the most central point that resolves
back to the target, and skips windows that hovering could not reach either.
Unbinding the picker's transient keys by name also took a same-key binding
out of the user's own config with it; the bind handles are now kept and
removed individually.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keyboard window capture in the region picker: Ctrl+Return, Tab, arrows
Return already captures the entire focused monitor while slurp is open,
but grabbing a single window required the mouse: hover highlights a
window, a click captures it. Now the keyboard can do the same.
Ctrl+Return captures the selected window — the one under the cursor,
falling back to the focused window. Tab and Ctrl+Tab cycle that
selection through the workspace's windows in reading order, and the
arrow keys move it spatially; both warp the cursor to the target
window's center, so slurp's own hover highlight tracks the selection.
Ctrl+Return is implemented like --take-fullscreen: a layer-scoped bind
flags the intent via a marker file and dismisses slurp, and the picker
resolves the window under the cursor. On an empty workspace the pick
resolves to nothing and exits as cancelled.
Ctrl is the chord modifier because slurp reacts to held Shift by
squaring the selection's aspect ratio, which visibly reshapes the
hover highlight mid-chord. None of the keys slurp itself uses (Escape,
held Space to move a selection, held Shift) are bound, so its own
keyboard behavior is unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Resolve overlapping windows the way slurp highlights them
slurp highlights the smallest box under the cursor, but the capture and
selection hit-tests returned the first geometric match in hyprctl
clients order. With a floating window over a tiled one, Ctrl+Return
could capture the window underneath the visibly highlighted one. Track
the smallest containing window instead, in both the capture resolution
and the selection-movement origin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Document the region picker's keyboard modes in its usage line
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Resolve keyboard capture and navigation from one rectangle list
Duplicate window geometry (tabbed groups, stacked floating windows) stalled
the Tab cycle on the first copy, and the smallest-window-under-cursor
tie-break was applied to two differently ordered lists, so navigation could
cycle from one window while Ctrl+Return captured another. Ctrl+Return over a
gap or an empty workspace also ignored the monitor rectangle slurp was
highlighting.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Capture the highlighted window with Return, the display with Ctrl+Return
The picker highlights a window under the cursor far more often than a whole
display, so the unmodified key takes the highlighted rectangle.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Mirrors the Tmux keybindings menu on SUPER + ALT + K. Herdr has no CLI
that dumps resolved bindings, so the action list and its defaults come
from `herdr --default-config`, where every action appears as a commented
assignment, and the user config overrides what it sets.
Prose in that default config can read like an assignment, as in
`# type = "popup" opens a session-modal terminal`, so a line counts only
when its value is a bare string or an array of them. Both TOML quote
characters open a string, and with no config file at all the listing
shows Herdr's own defaults rather than the Omarchy seed config Herdr
never loaded.
Mirrors the Tmux binding on SUPER + ALT + RETURN. Herdr reattaches to the
persistent session on its own, so the launcher needs no attach-or-create
dance.
The setup progress screen stacked from row one while the greeter that precedes
it was already centered, so first boot changed shape between its two frames.
Center it on the same block height the ISO install dashboard uses — logo, blank,
title, blank, bar, blank, tip — and repaint it if the VT resizes, which is the
same virtio-gpu KMS handoff the greeter already watches for.
The greeter's ttfx call never passed --xterm-colors, so it hit exactly the
failure the comment above it describes: ttfx resolves even indexed stops to
truecolor, and the console reduces 256-colour codes well but 24-bit ones badly.
The gradient was being crushed rather than rendering as the indexed palette it
was written for, and the settle colour drifted off the green logo drawn beneath
it.
--canvas-width was cols-1 to stay off the autowrap column, which held for tte.
ttfx centres its text two columns right of plain centering, so cols-1 puts the
animated logo a column off the static one and it jumps when the effect starts.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Machines without @factory fell back to a degraded reset that kept the
current system and only wiped user state. Turn them away with an
explanation instead, and drop the degraded staging path.
The first-boot worker still honors a wipe-degraded marker so a reset
staged by an older version finishes its scrub rather than handing the
machine over with the seller's accounts intact.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
tmux set the outer terminal title from `set-titles-string '#h:#W'`, which
is what Hyprland reads for the group bar label. herdr had no equivalent,
so grouped terminals kept whatever the shell or ssh last set - most
visibly wrong when connected to a remote machine.
herdr now renders `ui.window_title` on the server, so mirror the tmux
line. herdr's own default matches, but setting it here keeps the group
bar correct regardless of what upstream picks as its default.
The timezone prompt falls back to `gum filter` when tzupdate can't guess a
zone, which is the common case on a first boot with no network yet. That was
the one widget in the form without a GUM_*_PADDING export, so it drew flush
left while every other step sat centered under the logo.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Clearing it for a "Starting Omarchy..." card only flashed another screen
before SDDM took over. The cursor now stays hidden through the handoff and
comes back only on the failure path, where the retry prompt needs it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
/etc/profile.d/locale.sh only runs for login shells, so bash started by
SSH or herdr's remote bridge ran in the C locale, where printf emits
\u/\U escapes literally instead of the character.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep the bar mapped while hidden so revealing it is instant
Hiding the bar set the panel invisible, which unmaps the layer surface and
releases the scene graph with it. Every reveal then had to rebuild all of
it: a new layer surface, a configure roundtrip, re-shaped glyphs and
re-uploaded textures, and a first frame before anything appeared.
Measured on a 2560x1440 screen, showing took 155-175ms against 20ms to
hide, and 400-595ms on the first reveal after a cold start. Splitting the
cost showed the exclusive-zone reflow was not to blame: show latency was
the same on an empty workspace as on a tiled one, and windows finished
moving ~15ms after the bar was already on screen.
Park the bar one bar-width past its anchored edge instead, and drop its
exclusion zone while hidden. The surface stays alive, so showing is only
a margin change: 10-14ms in both directions, at every bar position.
Since a hidden bar is now mapped, layer_present no longer proves the bar
is visible; the session acceptance test asserts on-screen geometry.
* Fix layer visibility checks on offset monitors
* Handle rotated outputs in layer visibility checks
* Cover hidden bar behavior in acceptance tests
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
A 1500ms budget plus the one 100ms poll interval the trailing sleep can
overshoot is exactly 1600ms, which was the bound — but the test measures a
whole process around that, so startup pushed real runs to 1602ms. Carry
another interval. Two intervals of overshoot, the regression this guards,
still trips it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gum and ttfx ship in omarchy-base.packages and setfont comes with kbd, so
none of them needs a presence check — and every setfont call already
tolerates a failure anyway. btrfs-progs is in omarchy-other.packages and a
reset genuinely cannot proceed without it, so that one keeps its guard and
moves to the helper.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The form's 0/1/130 statuses gate both the ISO configurator and first-boot
setup, and nothing tested them. Stubs gum with scripted per-screen answers
and drives each prompt bare under `set -euo pipefail` — the shape that makes
the status capture load-bearing, since a cancelled prompt is a failing
assignment. A RETURN trap marks that the prompt returned its status rather
than the shell dying inside it; both exit identically otherwise, so that
marker is what catches a regression to a plain `status=$?`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Swap terminaltexteffects for ttfx
ttfx is a Rust port of terminaltexteffects that renders byte-identical
frames as a single dependency-free binary. Same option names, defaults,
and exit codes, so every invocation here is unchanged apart from the
command name.
The screensaver runs at --frame-rate 120 with --random-effect. On a
fullscreen canvas Python cannot hold that for the heavier effects
(beams: 14.1 ms/frame against an 8.3 ms budget, so ~71fps); ttfx renders
the same effect at 564fps. Startup drops from ~107 ms to ~1 ms, and the
base image no longer needs Python for the screensaver.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Need a migration
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The keyboard layout list, the account and hostname validation rules, and the
gum prompts that ask for them all existed twice: once in the ISO
configurator's user step, once in first-boot owner setup. Nothing kept the
copies honest, and they had already drifted — a layout removed on one side
moved English (US) onto a page boundary on the other, burying the default at
the bottom of a screen of layouts.
install/provisioning/setup-form.sh is now the only copy. The PKGBUILD's
existing `cp -a install` ships it to /usr/share/omarchy/install/provisioning/,
and the ISO build vendors that very file out of the runtime package it
bundles, so an install and the first boot that finishes it cannot offer
different layouts or accept different usernames.
Cancel handling is unified along the way, which is what made the prompts
shareable at all. Every prompt reports 0 (answered), 1 (Esc — unwind to the
start of the form), or 130 (Ctrl+C — a side channel each caller defines).
Previously Esc and Ctrl+C were indistinguishable here: both re-asked the same
field, so there was no way back to an earlier answer. Ctrl+C now offers a
confirmed reboot instead. It cannot be a SIGINT trap — gum reads Ctrl+C as a
byte in raw mode, so the shell never receives the signal — so it hangs off the
exit status.
Status capture is written as `x=$(gum ...) && status=0 || status=$?` because
this script runs under `set -e`, where a cancelled prompt is a failing
assignment that would kill setup before the status could be read.
English (US) also leads the layout list now, ahead of the other English
variants. gum choose paginates in --height-sized pages and jumps to the page
holding --selected, so an alphabetical default landed wherever the list length
happened to put it.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Add OEM first-boot setup and factory reset
An OEM-mode ISO install (or omarchy-reset-computer) leaves the machine in OEM
state: fully installed, no user, /var/lib/omarchy/oem/pending armed. On the
next boot omarchy-oem-setup.service runs the configurator's user form on tty1,
creates the user with the groups system setup recorded, finalizes it offline
from the stashed Node tarball, re-keys LUKS from the throwaway install
passphrase to the user's password, and hands off to SDDM.
omarchy-reset-computer returns a machine to that state: it swaps the running
root for a fresh clone of the @factory snapshot the ISO takes at install time,
scrubs machine identity and prior users, and stages omarchy-factory-wipe to
drop the old root and recreate @home/@log on the next boot. Machines installed
before @factory existed get a degraded reset (current system kept, users and
state wiped) with that caveat surfaced in the confirmation.
omarchy-setup-system/-hardware gain --oem to run without an install user; the
group-granting install scripts now record their groups in
/var/lib/omarchy/oem/groups and only call usermod when the user exists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Harden OEM setup: correct cryptsetup key-file usage, retry on failure
cryptsetup reads --test-passphrase/--key-file inputs byte-for-byte, so feed
passphrases through process substitution consistently instead of positional
args or stdin (which has different newline semantics). Run each first-boot
setup attempt as its own process so a failure offers a retry instead of
stranding the machine at a user-less login screen — bash ignores errexit
inside `while !` conditions, a child process does not.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Always grant wheel sudo in OEM first-boot setup
Detecting an existing %wheel grant by grepping sudoers is error-prone:
omarchy ships narrow '%wheel ALL=(ALL) NOPASSWD: <command>' rules (e.g.
asdcontrol) that match the naive pattern, which left the OEM-created user
matching sudoers entries but unable to run anything. Write the drop-in
unconditionally — a duplicate of an existing full grant is harmless.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix LUKS re-key device resolution and OEM state readability
archinstall's encrypted installs put cryptdevice=PARTUUID=... on the kernel
cmdline, not UUID=, so the first-boot re-key never found its device and
silently skipped — leaving the throwaway auto-unlock keyfile in place, i.e.
the disk effectively unencrypted. Parse every cryptdevice= source spec form
and make any re-key failure abort the attempt loudly: a retry prompt beats a
machine that quietly boots without a passphrase forever.
The OEM state directory also has to be world-readable (its one secret,
luks-key, stays 0600): user finalization reads the stashed Node tarball as
the new user, and the 0700 directory forced it onto the network fallback.
Step markers now land in /var/log/omarchy-oem-setup.log for debuggability.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Purge stale machine-id boot entries when resetting or re-keying
limine-entry-tool keys its limine.conf OS entries by machine-id. A factory
reset gives the machine a fresh identity, so the previous system's entry
survived every rebuild, sorted first, and made Limine stop at a Blake2b
hash-mismatch warning once the UKI was rebuilt. Start limine.conf over from
the shipped template (and drop foreign machine-id history directories on the
ESP) before any post-reset rebuild: in the staged chroot rebuild, in the
first-boot LUKS re-key, and — for unencrypted resets, where nothing else
rebuilds — in a dedicated first-boot refresh when foreign entries are found.
The staged rebuild also verifies every UKI hash referenced by limine.conf
against the file on the ESP before the subvolume swap, and the running
system's limine-snapper-sync is runtime-masked during staging so it cannot
rewrite the config behind the rebuild.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Harden reset and first-boot setup failure paths
Review findings from codex and Copilot:
- Generate throwaway passphrases without a trailing head stage: under
pipefail, SIGPIPE from the infinite tr failed the substitution and errexit
aborted every encrypted reset before it could stage anything.
- Stage the fallible parts of a degraded reset (LUKS re-key, boot rebuild)
before arming the wipe, so a staging failure leaves the machine untouched
instead of scheduling a wipe for a reset that never finished.
- Gate first-boot setup on the factory wipe having succeeded
(ConditionPathExists=!wipe-pending plus an in-script guard): creating the
new user on a half-wiped system would hand their data to the wipe retry.
- Abort the wipe (keeping its retry marker) when deleting the old root or
recreating @home/@log fails, and abort resets that cannot remove a prior
account — a surviving account keeps its password and wheel membership.
- Resume a partially-created account on setup retry instead of rejecting the
username the failed attempt just created.
- Only purge machine-id directories the old limine.conf actually referenced;
a shared ESP may hold other installations' boot artifacts.
- Recreate the hibernation swapfile (nested subvolume, so never captured by
the factory snapshot) inside the factory root before its UKI rebuild, so a
reset machine keeps disk-backed swap and a valid resume offset.
- Source base-test.sh in the OEM groups test per test conventions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Recreate the hibernation swapfile even when resume drop-ins survive
omarchy-hibernation-setup short-circuits as 'already set up' when the resume
mkinitcpio drop-in exists — which it always does in a factory root, while the
swapfile itself never survives the snapshot (nested subvolume). Drop the
marker when the swapfile is gone so setup reconfigures from scratch, and
verify the swapfile actually exists before proceeding with the reset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Second review pass: encrypted-config coverage, factory-baseline sanitization, recoverable rekey
Codex xhigh round 2:
- Detect the LUKS backing device by walking the root's device tree, not only
the cmdline cryptdevice=; reset/first-boot now re-key roots reached via
rd.luks/crypttab too, instead of silently leaving the seller's slots valid.
- Sanitize the retained @factory baseline (accounts, /etc/shadow, machine
identity) during a full reset: the new wheel user could otherwise mount it
to recover the seller's data, and a second reset would restore the account.
- Re-key the disk recoverably: rebuild the no-auto-unlock UKI before killing
the throwaway slot or destroying the staged key, and restore the keyfile if
that rebuild fails, so a retry with a different password can never leave the
disk locked to the first attempt's password.
- Roll back a degraded reset's live-root auto-unlock material if its boot
rebuild fails, instead of leaving it for a later rebuild to embed.
- Treat a missing current-machine limine entry as stale so a retry after a
failed rebuild repairs the config instead of clearing OEM state over it.
- Erase fingerprint enrollments (/var/lib/fprint) in degraded wipes.
- Remove the resume-offset drop-in too when recreating the factory swapfile,
so the rebuilt UKI gets a correct offset.
- Pin first-boot retries to the account the first attempt created.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Expose factory reset in the Setup menu
Add a 'Reset Computer' entry under Setup (Omarchy's Settings menu, where OS
factory resets conventionally live), guarded to btrfs roots and launched in a
floating terminal. omarchy-reset-computer now self-elevates via sudo so the
menu entry needs no sudo prefix, forwarding the caller's gum theme env as
env arguments so styling survives an env_reset sudoers. The typed 'reset'
confirmation and the sudo password prompt remain as the guards against
accidental triggering.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Defer keyboard selection to first boot for OEM installs
The OEM first-boot setup now runs a keyboard step before the user form,
mirroring the ISO configurator: it loads the chosen layout on the live VT so
the password (and the LUKS re-key that follows) are typed under it, and
persists it with systemd-firstboot so the installed system gets both the
console KEYMAP and the XKB layout Hyprland reads — exactly what a normal
install writes. Layouts localectl doesn't know keep the default, same as the
installer.
This lets the OEM operator set nothing user-specific: the machine's owner
picks their keyboard alongside their account at first boot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Rename factory-reset commands to omarchy-system-factory-reset[-finish]
omarchy-reset-computer -> omarchy-system-factory-reset
omarchy-factory-wipe -> omarchy-system-factory-reset-finish
(and its systemd unit, log path, and temp mount to match)
Pure rename: every reference — the Setup menu action, the first-boot finish
service the reset stages and enables, the oem-setup ordering/gating, comments,
and the menu test — moves together, with no behavior change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Rename OEM vocabulary to provisioning (runtime)
Commands unify under the provisioning family:
omarchy-oem-setup → omarchy-provision-owner
omarchy-finalize-user → omarchy-provision-user
omarchy-first-run → omarchy-provision-first-run
And the deferred-provisioning state/vocabulary replaces 'OEM':
/var/lib/omarchy/oem/ → /var/lib/omarchy/provisioning/
/etc/omarchy/oem.key → /etc/omarchy/provisioning.key
install/oem/ → install/provisioning/
OMARCHY_SETUP_CONTEXT=oem-firstboot → provision-owner
omarchy-setup-system/-hardware --oem → --defer-provisioning
All callers (provision-first-run→provision-user, autostart, factory-reset
staging the provisioning units, the group-recording scripts) and comments
move together.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop remaining OEM mentions from the provisioning groups test
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Show install-style progress through first-boot account setup
The owner provisioning flow dropped to plain status lines after the
confirm form, went dark for the minutes finalize-user takes, and ended
with a two-second spinner. Give it the same treatment as the ISO
install dashboard: the logo header with a live progress bar and
rotating tips while the account is created, finalized, re-keyed, and
the boot entries refreshed, then the same tte celebration — ending in
a Start Omarchy Now button that hands off to SDDM, since first boot
continues into the session rather than rebooting.
The bar is the dashboard's engine in miniature: monotonic per-mille
position from an asymptotic time floor per phase, with finalize-user's
run_logged scripts in the log as the work signal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Match the first-boot console font to the ISO installer
The ISO installer runs on a low-resolution pre-KMS console, where the
default 8x16 console font looks large. By the time omarchy-provision-owner
runs, the installed system has reached full KMS resolution, where that
same 8x16 font is physically tiny — so first-boot owner provisioning
looked a lot smaller than the installer it continues.
Scale the console font up on high-resolution framebuffers so the two
read at the same size: latarcyrheb-sun32 (16x32) at >=1600px tall,
sun12x22 at >=1150px, and the default left untouched below that (already
installer-sized). Both fonts ship with kbd, so there's no new dependency,
and it's a no-op off a real VT.
Co-Authored-By: Claude <noreply@anthropic.com>
* Make first-boot font resolution-adaptive; widen the encrypting band
Two fixes to the first-boot provisioning screen surfaced on a real
high-resolution display.
Font: the earlier fixed thresholds could pick a 16px-wide font on a
~1280px-wide console — 80 columns, one short of the 81-column logo — so
the logo wrapped and the layout looked misaligned. Replace the thresholds
with a resolution-adaptive choice: pick the kbd font whose row count is
closest to the ISO installer's ~48-row feel, but never one wide enough to
drop below 90 columns, so the logo can never wrap. Low-resolution
consoles land on the default font (a no-op), matching the installer.
Progress: the LUKS re-key (a full UKI rebuild, the slowest step of an
encrypted first boot) had only an 8%-wide band, so the bar looked stuck
near the top while it worked. Make the bands adaptive — when a re-key is
pending, finalize yields most of its room to a wide, steadily-moving
re-key band; unencrypted installs keep finalize as the dominant step.
Co-Authored-By: Claude <noreply@anthropic.com>
* Add a Welcome greeter before first-boot setup
Deferred-provisioning first boot dropped the new owner straight onto the
keyboard picker. Open with a greeter instead — the same frame the setup
ends on: static logo, a centered "Welcome to Omarchy", and a single
"Start setup" button. No logo animation; it's the starting line, not the
celebration. Shown once in main(), before the keyboard step, so retries
don't repeat it.
Co-Authored-By: Claude <noreply@anthropic.com>
* Center the greeter and show the Omarchy tagline
Vertically center the greeter block (logo, tagline, button) on the
console like the boot logo, and replace "Welcome to Omarchy" with the
tagline "Beautiful, Modern & Opinionated Linux by DHH".
Co-Authored-By: Claude <noreply@anthropic.com>
* Animate the greeter logo with a skippable ColorShift
Run a looping tte ColorShift over the centered logo and replace the
button with a "Press Return to Start Setup" hint. The effect reads from
/dev/null so it never swallows the Return a foreground read waits on, and
--reuse-canvas is anchored one row below the logo so it repaints exactly
the rows drawn above. Return skips ahead into setup at any time.
Co-Authored-By: Claude <noreply@anthropic.com>
* Theme the greeter ColorShift to the Omarchy palette
Sweep the logo ColorShift through the Tokyo Night accent colors
(green, cyan, blue, purple, pink, orange) instead of tte's default
rainbow, settling toward the Omarchy green.
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix greeter ColorShift: green base, no flash, clean handoff
- Use indexed ANSI colors (green 2 + cyan 6 accent), since the framebuffer
console can't render tte's truecolor and crushed it to a muddy lavender.
The result is a green-based shift with a cyan accent, settling on green.
- Run one long tte invocation (--cycles 1000) instead of restarting every
couple cycles, removing the flash at each loop.
- Restore the tty with `stty sane` after killing the effect (tte leaves it
raw/no-echo, which silently killed the following gum prompts) and clear
the screen so the leftover frame doesn't linger under the keyboard step.
Co-Authored-By: Claude <noreply@anthropic.com>
* Kill the greeter animation cleanly so the form starts fresh
The ColorShift ran inside a `while` subshell that was backgrounded and
killed by its subshell PID — which orphaned the tte child, leaving it
painting the logo over the keyboard step (the screen never cleared and
the form was garbled). Run tte directly so the tracked PID is tte's own,
and killing it actually stops the animation before the screen is cleared.
Co-Authored-By: Claude <noreply@anthropic.com>
* Don't let the killed animation abort provisioning under set -e
wait on the tte PID reports its kill signal (143). Under set -euo
pipefail that nonzero status aborted greeter_screen — and the whole
service — right after Return, dropping first boot straight to the login
screen instead of the keyboard step. Tolerate it with `|| true`.
Co-Authored-By: Claude <noreply@anthropic.com>
* Wait for the terminal size to settle before drawing the greeter
A terminal emulator — or sudo's pty — reports a stale 24x80 for a few
hundred milliseconds after the process starts, before its real winsize is
set. The greeter measured immediately and fell into the 80x24 fallback,
rendering small in the top-left instead of centered (the real first-boot
console, already settled, was unaffected). Wait for stty to report a
stable size at least as wide as the logo before measuring.
Co-Authored-By: Claude <noreply@anthropic.com>
* Fall back to the default font when the greeter console is too narrow
scale_console_font sizes the console font from /sys/class/graphics/fb0,
but virtio-gpu (notably virtio-vga-gl) can report a resolution that the
console then settles below — leaving a font wide enough that an 81-column
logo no longer fits (e.g. sun32 at a settled 1280px is 80 columns). The
logo wrapped and hugged the top-left, with the animation tiling over it.
After the greeter measures the settled size, if it is still narrower than
the logo, drop to the default (narrowest) console font and re-measure so
the logo always fits and centers. Verified by forcing an 80-column
console: the fallback recovers it to 160 columns, centered, and
provisioning completes.
Co-Authored-By: Claude <noreply@anthropic.com>
* Redraw the greeter on console resize instead of measuring once
The first-boot greeter measured the console once, painted the logo and
launched the tte animation, then blocked on Return. On a fresh
deferred-provisioning boot under virtio-gpu the VT comes up in a
transitional ~80x25 mode and only widens to the real resolution a second
or more later, once KMS takes over (or, on virtio-vga-gl, the SDL window's
size lands). The old settle-wait accepted that transient (two matching
100ms samples was enough), so the greeter committed to an 80-column
geometry. When the VT then resized, Linux scrolled the stranded frame into
the top-left and reset the DEC saved cursor tte paints from with
--reuse-canvas — the small, top-left, tiled/garbled logo. The earlier
"fall back to default8x16 when cols<81" fix couldn't help: if the console
genuinely offers 80 columns, re-applying the narrowest font still leaves
80.
Treat a resize as a redraw trigger instead. greeter_screen now:
- waits for a real quiet period (console signature = VT size + framebuffer
identity/size held steady ~1.5s) before the first paint;
- sizes the font empirically — apply each candidate, read the columns
fbcon actually returns, keep the one nearest ~48 rows that still clears
the 81-column logo — rather than trusting fb0/virtual_size, which under
virgl can report a size the text console never reaches;
- paints from a nested _greeter_draw and, while waiting for Return, watches
SIGWINCH and the console signature; on any change it kills tte, settles,
re-fits the font, and repaints — so a resize arriving five seconds in
looks the same as one that never happened;
- draws each logo row at an explicit column and falls back to a centered
text-only greeter (no logo, no animation) when the console is narrower
than the logo, so a still-transient mode never wraps it into mush;
- runs tte at canvas-width cols-1 to stay off the autowrap column.
Verified the resize path in a tmux pane (a resizable pty): narrow first
paint falls back to centered text, and each later resize repaints a
correctly centered logo, with a clean exit on Return.
Co-Authored-By: Claude <noreply@anthropic.com>
* Ask the owner's timezone at first boot and hand off straight to Omarchy
Three changes to the deferred first-boot setup:
- Timezone: deferred provisioning skips the installer's user step entirely
(it defers user creation to first boot), but the first-boot form only
re-asked username/password/name/email — the timezone picker was never
carried over, so every deferred machine silently kept archinstall's UTC
default and the owner was never asked. Add the timezone step to the
first-boot user form (geo-guessed default via tzupdate, same as the ISO
installer's user step), show it on the confirmation screen, and apply it
during provisioning with timedatectl.
- Rename the progress-screen title from "Setting up your account" to
"Setting up your machine": first boot provisions the whole machine, not
just an account.
- Drop the timed "Installed Omarchy in Xm Ys" celebration screen and the
"Start Omarchy Now" button from first boot. That send-off belongs to a
direct install; here the oneshot service just hands straight off to SDDM
(Before=display-manager.service), which autologins on encrypted installs.
A brief "Starting Omarchy..." covers the handoff.
Co-Authored-By: Claude <noreply@anthropic.com>
* Autologin only the first deferred boot on unencrypted installs
The owner authenticates in the first-boot form, so setup hands straight into
the desktop instead of asking again at SDDM. Encrypted installs keep autologin
permanently (the LUKS prompt is the auth boundary); unencrypted installs
autologin just this once and a self-removing service deletes the drop-in after
the desktop is up, so later boots use the normal SDDM login and the disk isn't
left permanently open.
Co-Authored-By: Claude <noreply@anthropic.com>
* Ask the owner's hostname at first boot too
Deferred provisioning no longer bakes a hostname into the install, so add the
hostname to the first-boot user form (same letters/digits/dashes validation as
the ISO installer's user step, defaulting to "omarchy" on empty), show it on
the confirmation screen, and apply it with hostnamectl during provisioning —
alongside the timezone step.
Co-Authored-By: Claude <noreply@anthropic.com>
* Let the greeter logo appear from the animation, not a static pre-render
The greeter drew the logo statically in green and then started the tte
ColorShift over the same rows, so the logo visibly flashed as tte's first
frame repainted it. ColorShift shows the full logo on frame one (it's a color
effect, not a type-in), so let tte paint the logo itself: skip the static
render when tte is available (keep it only as the no-tte fallback). The logo
now simply appears, already animating, with no flash.
Co-Authored-By: Claude <noreply@anthropic.com>
* Drop the greeter color animation; show the logo in solid green
The greeter "flash" was tte's ColorShift crushing on the framebuffer console:
tte emits 24-bit truecolor, the console only has 16 flat colors, and
consecutive frames' greens snap to different buckets (green/bright-green/cyan/
gray) — a frame-to-frame judder. A smooth color fade is impossible on the
console (no blending), so the animation can't be made clean there. Show the
logo in solid green (indexed color 2, which renders stably) with no animation.
The resize-redraw resilience stays; there's just no tte to tear down now.
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix first-boot review findings: autologin-once ordering, offline timezone
Review of the deferred first-boot flow surfaced two real, user-facing bugs:
- Autologin fired twice on unencrypted installs. The one-shot cleanup unit was
ordered After=display-manager and enabled via a graphical.target.wants symlink
+ daemon-reload during the first boot — but graphical.target's job for that
boot is already computed, so systemd never pulled the new unit in. It only ran
on the *second* boot (which also autologged in) and removed the drop-in there.
Order it Before=display-manager instead (and drop the sleep fudge): this boot
autologins, the next boot's fresh transaction runs the cleanup before SDDM
reads its config, so that boot shows the normal login. Exactly one autologin,
deterministic, no race.
- Offline first boot aborted setup. `geo_guessed_timezone=$(tzupdate -p)` is a
plain assignment under `set -e`, and tzupdate exits non-zero with no network —
the common case for a fresh machine — killing the attempt before the offline
gum-filter fallback. Guard it with `|| geo_guessed_timezone=""`.
Also: configure_timezone no longer symlinks /etc/localtime to a nonexistent
zone file on a bad zone (guards on the zoneinfo file existing); scale_console_font's
stty-size fallback emits a trailing newline so `read` can't trip `set -e`; and
drop two stty-sane calls that only existed to recover from tte's raw mode (tte
is gone).
Co-Authored-By: Claude <noreply@anthropic.com>
* Seed placeholder hostname/timezone in deferred install, overwrite at first boot
Simpler than the empty-string approach: instead of writing hostname=""/timezone=""
and having the orchestrator fall back, the deferred install now seeds neutral
valid defaults (hostname=omarchy, timezone=UTC) and the first-boot wizard
overwrites both. Identical end state, one decision in one place, and no reliance
on archinstall accepting empty config values. Runtime comments updated; the
configure_* functions are unchanged (they still overwrite whatever was seeded).
Co-Authored-By: Claude <noreply@anthropic.com>
* Bring back the greeter ColorShift animation
Reverts the "drop the color animation" change — the framebuffer's truecolor
crush gives the ColorShift a quick flash, but that's acceptable; removing the
effect entirely was overreach. Restores the static green logo + looping tte
ColorShift overlay (green base, cyan accent, settling on green), keeping the
resize-redraw resilience and every other fix intact.
Co-Authored-By: Claude <noreply@anthropic.com>
* Hide the omarchy-provision-* commands from the listing
These run from services and install hooks (first-boot provisioning, per-user
finalize, first-login) — never something a user invokes directly. Mark them
omarchy:hidden=true and drop the group/examples that implied a user-facing
route. The binaries still work when called directly by their callers.
Co-Authored-By: Claude <noreply@anthropic.com>
* Hide the factory-reset first-boot worker from the listing
omarchy-system-factory-reset-finish runs from a first-boot service after a
reset — never invoked by hand — so hide it like the provision workers.
omarchy-system-factory-reset itself stays visible (Setup > Reset Computer).
Co-Authored-By: Claude <noreply@anthropic.com>
* Address final-review findings: LUKS fail-open, set -e aborts, drop-to-console
Codex xhigh final pass surfaced several real issues; the contained ones:
- LUKS re-key could fail open (security). If the user's slot couldn't be
identified, or luksDump/luksKillSlot failed, the code shredded the staged key
anyway while the throwaway/seller slots stayed valid — leaving the disk
unlockable by the install passphrase forever. Now it's all-or-nothing: require
the user's slot, enumerate and kill every other slot, and only retire the
staged key once all kills succeed; otherwise fail loudly and keep it for retry.
- Greeter animation cleanup: `kill "$anim"` was unguarded, so if tte had already
exited (crash or resize race) it returned non-zero and `set -e` aborted setup,
dropping to SDDM with no user. Guard it with `|| true`.
- reset_limine_config: `old_ids=$(grep ... | ...)` on an entry-less limine.conf
(left by a failed rebuild) exits 1 under pipefail and aborted the retry. Guard
with `|| true` so a rebuild failure stays recoverable.
- "Drop to console" on a failed setup exited to nothing usable (no user, root
locked, tty1 getty conflicted). Exec a root shell on tty1 instead; SDDM starts
when it exits.
Co-Authored-By: Claude <noreply@anthropic.com>
* Drop Bosnian and Khmer from the keyboard picker
Neither has a console keymap (loadkeys ba / loadkeys khmer both fail), so
picking them showed the choice as confirmed but silently left the system on the
default US layout. Remove them from the first-boot picker rather than offer a
layout that can't apply. The orchestrator keeps its defensive unsupported-keymap
handling for install-time robustness.
Co-Authored-By: Claude <noreply@anthropic.com>
* Finish the omarchy-first-run rename in the docs
Two doc references to omarchy-first-run were missed when the script was renamed
to omarchy-provision-first-run; update them to match.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add OEM first-boot setup and factory reset
An OEM-mode ISO install (or omarchy-reset-computer) leaves the machine in OEM
state: fully installed, no user, /var/lib/omarchy/oem/pending armed. On the
next boot omarchy-oem-setup.service runs the configurator's user form on tty1,
creates the user with the groups system setup recorded, finalizes it offline
from the stashed Node tarball, re-keys LUKS from the throwaway install
passphrase to the user's password, and hands off to SDDM.
omarchy-reset-computer returns a machine to that state: it swaps the running
root for a fresh clone of the @factory snapshot the ISO takes at install time,
scrubs machine identity and prior users, and stages omarchy-factory-wipe to
drop the old root and recreate @home/@log on the next boot. Machines installed
before @factory existed get a degraded reset (current system kept, users and
state wiped) with that caveat surfaced in the confirmation.
omarchy-setup-system/-hardware gain --oem to run without an install user; the
group-granting install scripts now record their groups in
/var/lib/omarchy/oem/groups and only call usermod when the user exists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Harden OEM setup: correct cryptsetup key-file usage, retry on failure
cryptsetup reads --test-passphrase/--key-file inputs byte-for-byte, so feed
passphrases through process substitution consistently instead of positional
args or stdin (which has different newline semantics). Run each first-boot
setup attempt as its own process so a failure offers a retry instead of
stranding the machine at a user-less login screen — bash ignores errexit
inside `while !` conditions, a child process does not.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Always grant wheel sudo in OEM first-boot setup
Detecting an existing %wheel grant by grepping sudoers is error-prone:
omarchy ships narrow '%wheel ALL=(ALL) NOPASSWD: <command>' rules (e.g.
asdcontrol) that match the naive pattern, which left the OEM-created user
matching sudoers entries but unable to run anything. Write the drop-in
unconditionally — a duplicate of an existing full grant is harmless.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix LUKS re-key device resolution and OEM state readability
archinstall's encrypted installs put cryptdevice=PARTUUID=... on the kernel
cmdline, not UUID=, so the first-boot re-key never found its device and
silently skipped — leaving the throwaway auto-unlock keyfile in place, i.e.
the disk effectively unencrypted. Parse every cryptdevice= source spec form
and make any re-key failure abort the attempt loudly: a retry prompt beats a
machine that quietly boots without a passphrase forever.
The OEM state directory also has to be world-readable (its one secret,
luks-key, stays 0600): user finalization reads the stashed Node tarball as
the new user, and the 0700 directory forced it onto the network fallback.
Step markers now land in /var/log/omarchy-oem-setup.log for debuggability.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Purge stale machine-id boot entries when resetting or re-keying
limine-entry-tool keys its limine.conf OS entries by machine-id. A factory
reset gives the machine a fresh identity, so the previous system's entry
survived every rebuild, sorted first, and made Limine stop at a Blake2b
hash-mismatch warning once the UKI was rebuilt. Start limine.conf over from
the shipped template (and drop foreign machine-id history directories on the
ESP) before any post-reset rebuild: in the staged chroot rebuild, in the
first-boot LUKS re-key, and — for unencrypted resets, where nothing else
rebuilds — in a dedicated first-boot refresh when foreign entries are found.
The staged rebuild also verifies every UKI hash referenced by limine.conf
against the file on the ESP before the subvolume swap, and the running
system's limine-snapper-sync is runtime-masked during staging so it cannot
rewrite the config behind the rebuild.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Harden reset and first-boot setup failure paths
Review findings from codex and Copilot:
- Generate throwaway passphrases without a trailing head stage: under
pipefail, SIGPIPE from the infinite tr failed the substitution and errexit
aborted every encrypted reset before it could stage anything.
- Stage the fallible parts of a degraded reset (LUKS re-key, boot rebuild)
before arming the wipe, so a staging failure leaves the machine untouched
instead of scheduling a wipe for a reset that never finished.
- Gate first-boot setup on the factory wipe having succeeded
(ConditionPathExists=!wipe-pending plus an in-script guard): creating the
new user on a half-wiped system would hand their data to the wipe retry.
- Abort the wipe (keeping its retry marker) when deleting the old root or
recreating @home/@log fails, and abort resets that cannot remove a prior
account — a surviving account keeps its password and wheel membership.
- Resume a partially-created account on setup retry instead of rejecting the
username the failed attempt just created.
- Only purge machine-id directories the old limine.conf actually referenced;
a shared ESP may hold other installations' boot artifacts.
- Recreate the hibernation swapfile (nested subvolume, so never captured by
the factory snapshot) inside the factory root before its UKI rebuild, so a
reset machine keeps disk-backed swap and a valid resume offset.
- Source base-test.sh in the OEM groups test per test conventions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Recreate the hibernation swapfile even when resume drop-ins survive
omarchy-hibernation-setup short-circuits as 'already set up' when the resume
mkinitcpio drop-in exists — which it always does in a factory root, while the
swapfile itself never survives the snapshot (nested subvolume). Drop the
marker when the swapfile is gone so setup reconfigures from scratch, and
verify the swapfile actually exists before proceeding with the reset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Second review pass: encrypted-config coverage, factory-baseline sanitization, recoverable rekey
Codex xhigh round 2:
- Detect the LUKS backing device by walking the root's device tree, not only
the cmdline cryptdevice=; reset/first-boot now re-key roots reached via
rd.luks/crypttab too, instead of silently leaving the seller's slots valid.
- Sanitize the retained @factory baseline (accounts, /etc/shadow, machine
identity) during a full reset: the new wheel user could otherwise mount it
to recover the seller's data, and a second reset would restore the account.
- Re-key the disk recoverably: rebuild the no-auto-unlock UKI before killing
the throwaway slot or destroying the staged key, and restore the keyfile if
that rebuild fails, so a retry with a different password can never leave the
disk locked to the first attempt's password.
- Roll back a degraded reset's live-root auto-unlock material if its boot
rebuild fails, instead of leaving it for a later rebuild to embed.
- Treat a missing current-machine limine entry as stale so a retry after a
failed rebuild repairs the config instead of clearing OEM state over it.
- Erase fingerprint enrollments (/var/lib/fprint) in degraded wipes.
- Remove the resume-offset drop-in too when recreating the factory swapfile,
so the rebuilt UKI gets a correct offset.
- Pin first-boot retries to the account the first attempt created.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Expose factory reset in the Setup menu
Add a 'Reset Computer' entry under Setup (Omarchy's Settings menu, where OS
factory resets conventionally live), guarded to btrfs roots and launched in a
floating terminal. omarchy-reset-computer now self-elevates via sudo so the
menu entry needs no sudo prefix, forwarding the caller's gum theme env as
env arguments so styling survives an env_reset sudoers. The typed 'reset'
confirmation and the sudo password prompt remain as the guards against
accidental triggering.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Defer keyboard selection to first boot for OEM installs
The OEM first-boot setup now runs a keyboard step before the user form,
mirroring the ISO configurator: it loads the chosen layout on the live VT so
the password (and the LUKS re-key that follows) are typed under it, and
persists it with systemd-firstboot so the installed system gets both the
console KEYMAP and the XKB layout Hyprland reads — exactly what a normal
install writes. Layouts localectl doesn't know keep the default, same as the
installer.
This lets the OEM operator set nothing user-specific: the machine's owner
picks their keyboard alongside their account at first boot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Rename factory-reset commands to omarchy-system-factory-reset[-finish]
omarchy-reset-computer -> omarchy-system-factory-reset
omarchy-factory-wipe -> omarchy-system-factory-reset-finish
(and its systemd unit, log path, and temp mount to match)
Pure rename: every reference — the Setup menu action, the first-boot finish
service the reset stages and enables, the oem-setup ordering/gating, comments,
and the menu test — moves together, with no behavior change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Rename OEM vocabulary to provisioning (runtime)
Commands unify under the provisioning family:
omarchy-oem-setup → omarchy-provision-owner
omarchy-finalize-user → omarchy-provision-user
omarchy-first-run → omarchy-provision-first-run
And the deferred-provisioning state/vocabulary replaces 'OEM':
/var/lib/omarchy/oem/ → /var/lib/omarchy/provisioning/
/etc/omarchy/oem.key → /etc/omarchy/provisioning.key
install/oem/ → install/provisioning/
OMARCHY_SETUP_CONTEXT=oem-firstboot → provision-owner
omarchy-setup-system/-hardware --oem → --defer-provisioning
All callers (provision-first-run→provision-user, autostart, factory-reset
staging the provisioning units, the group-recording scripts) and comments
move together.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop remaining OEM mentions from the provisioning groups test
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Finish the omarchy-first-run rename in the docs
Two doc references to omarchy-first-run were missed when the script was renamed
to omarchy-provision-first-run; update them to match.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Detect Elan match-on-chip fingerprint readers again
Elan readers report "ELAN:ARM-M4" as their product string, so the
*fingerprint* and *biometric* checks miss them. Elan's 04f3 is also left
out of the vendor list on purpose, because Elan makes touchscreens too.
Both checks fail, so the machine looks like it has no reader.
Add "elan:arm-m4" to the product string check. The comment above the
vendor list already says the excluded vendors should still match there,
so this makes that true. The vendor list and its has_kernel_driver guard
are unchanged, and touchscreens still cannot cause a false positive.
The string is a family name, not one device. libfprint uses it for
04f3:0c9c and 04f3:0ca7 as well as 04f3:0ca8.
Tested on an HP EliteBook X G2i with 04f3:0ca8.
* Point the Elan comment at the vendor list above it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Configure PAM only after a fingerprint enrolls and verifies
Detection proves a reader is present, not that libfprint can drive it.
Elan MOC sensors outside the elanmoc table pass the gate and then fail
to enroll, which left pam_fprintd in the sudo and polkit stacks with no
print to match.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Hide the keyboard layout widget on a single-layout install
There is nothing to read or switch when only one layout is configured, so the
label is noise on the bar most people have. Hide it until the keyboard reports
more than one, and keep showing it on a Hyprland that doesn't report the list
at all rather than hiding the widget everywhere.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Put the keyboard layout widget on the bar by default
The widget hides itself unless the active keyboard has more than one layout,
so shipping it costs a single-layout machine nothing and saves everyone else
from finding it in the plugin list. Sit it just right of the clock, and add it
to existing bars the way the agents widget was added, leaving a curated bar
and a disabled widget alone.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Cycle the layout with the hyprctl command that exists
switchxkblayout is a hyprctl command, not a dispatcher, so sending it over the
dispatch socket only produced a Lua syntax error and clicking the widget did
nothing. Run it instead, against the keyboard the label was read from.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add an idempotent bar add command
Nothing put a widget on the bar without going through the running shell:
plugin enable and bar move both forward to it over IPC, which a migration
cannot rely on. Add writes the config file the way position and transparent
already do, and leaves a widget that is already on the bar where the user put
it, so callers can ask for it repeatedly.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Put the keyboard layout widget on bars through the bar CLI
The hand-written jq was a normalizer, a presence check and a splice for what
is now one command that carries all three.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep bar add from writing a bar the shell was not reading
The shell takes a user shell.json only when it parses, says version 1, and
carries a bar layout, and does not deep-merge; anything else leaves the
shipped defaults on screen. Reading and writing the user file regardless
turned a config holding nothing but an idle timeout into a bar holding
nothing but the new widget, and made an unparsable one abort the migration
chain on every update. Work against whichever layout is actually in effect,
seeding the defaults before placing a widget they do not already carry.
A malformed hand-installed manifest fails the whole plugin catalog, which was
enough to refuse a first-party widget, so treat an unreadable catalog as no
answer rather than a no. Leave a widget listed in disabledPlugins off the bar
instead of writing a layout entry the registry refuses to load, and re-check
presence inside the mutation so two adds cannot both miss it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Read a widget's default bar section in one place
cmd_defaults spelled out the same "defaultSection, or center when it is
missing or not a section" rule that the add path already asks for by name.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Rename bar add to bar put
'omarchy plugin add' installs a plugin and 'omarchy bar add' placed one that
was already installed, which is too much meaning for one verb.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Place a newly added bar widget with bar put
plugin add reached the bar through plugin enable, which forwards to the
running shell, so it first had to poll until the shell noticed the clone and
then failed outright when no shell was there to ask. Putting a widget on the
bar is a config edit, so do that directly and leave plugin enable to the
plugins that need registering rather than placing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Put bar widgets through the shell instead of the config file
Placing a widget existed twice: once in PluginRegistry, which the shell uses
and owns the config it holds in memory, and once as jq against shell.json.
The second was there so migrations could run without a shell, which they do
not need to: the Quattro upgrade hands over the shipped shell.json before it
runs any, and every other path runs inside a session with a shell up. Ask the
shell, and say so and carry on when there is none to ask.
putBarWidget enables only what is not already on the bar, which is what a
caller that cannot know whether it ran before needs, and is the one thing the
existing enable path would not do.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Clean up the terminal and reconnect when SSH connections drop
A remote tmux, herdr, or editor arms terminal modes over the SSH pipe
(mouse tracking, focus reporting, the alternate screen) that only it can
disarm. When the connection dies instead of exiting cleanly, those modes
stay armed on the local terminal, and every mouse move floods the prompt
with escape-sequence junk.
Wrap ssh in a shell function that disarms those modes after every exit,
and automatically reconnects when an established interactive session
drops. Remote commands, configured RemoteCommands, and redirected stdin
never reconnect, so their side effects cannot replay, and the retry loop
runs in a subshell so Ctrl-C cancels both the in-flight attempt and the
loop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Detect dead SSH connections within a minute
Without keepalives, ssh does not notice a dead peer until TCP gives up,
which can take hours of sitting on a hung terminal with remote-armed
terminal modes stuck on. Ship a client keepalive default so drops are
detected in about 45 seconds, letting the shell's ssh wrapper clean up
and reconnect. ~/.ssh/config is read first and wins, so per-host
overrides still apply.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fail closed when ssh -G cannot resolve the effective config
An unresolvable configuration could hide a RemoteCommand, so treat it
as non-interactive rather than reconnectable. Also strengthen the
tests from Copilot review: assert the complete disarm sequence, and
verify on a real interactive pty that Ctrl-C during a retry attempt
kills the reconnect loop itself, not just the in-flight attempt.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Tolerate the explicit RemoteCommand none when probing ssh -G
The literal "none" is how ssh_config cancels a configured
RemoteCommand, and some OpenSSH versions emit it even when unset, which
would have silently disabled reconnecting entirely. Treat it as no
remote command while still failing closed on real ones and unresolvable
configs, and make the fake ssh -G emit the "none" form so the behavior
tests cover it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Fix hyprctl output parsing in KeyboardLayout plugin
* Never fall back to a non-active keyboard for the layout label
find(k => k.main) returning nothing fell through to keyboards[0], which is
the case the fix is for: on hardware whose first device is a permanently
English (US) radio-control keyboard, the label was wrong and the 10s poll
kept it wrong. The seat can also hold no active keyboard while a device is
re-added, and older Hyprland has no main field at all. Keep the last known
value instead, and skip entries without an active_keymap, since assigning
undefined to the string property throws before the label is ever set.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Run hyprctl directly from the keyboard layout widget
The shell wrapper only existed for a pipeline that is gone, so spawn the
command directly, as Style.qml already does for its own hyprctl query.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Read the layout from the keyboard the user types on
Every Omarchy install runs fcitx5 for ~/.XCompose, and it binds a virtual
keyboard that takes the seat's main flag whenever it injects. That keyboard
keeps the us layout the input method gave it, so on a machine configured for
another layout the widget flipped to ENG and the poll kept it there until the
next physical keypress. Skip virtual keyboards and hold the last known layout
instead, which the next poll corrects once a real keyboard is active again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep tracking the keyboard the layout was last read from
Holding a frozen label while fcitx5 owns the main flag went stale as soon as
the layout changed underneath it, and cycling still dispatched against
"current", which is that same virtual keyboard. Remember the keyboard the
label came from, re-read its layout on every poll, and cycle it by name so
the widget shows and switches one device.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The class is matched in full, so the bare "foot" alternative never covered
a window carrying org.codeberg.dnkl.foot. That left universal copy sending
CTRL + C into a terminal, the same way it did for the Omarchy TUIs.
default/hypr/apps/system.lua already treats that app-id as a foot window.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every keystroke in the search box scanned, lowercased, and split the
full text of every history entry, and the preview pane laid out the
entire selection with WrapAnywhere. A single 1.6MB paste (or a large
file selection) turned that into hundreds of megabytes of work on the
shell thread and stalled the render thread — freezing the whole
desktop.
Cap each entry once as it enters the display, so searching, previewing,
and rendering all work on a bounded prefix. Pasting reads the full entry
back from history by index, so nothing is actually lost. The cut lands
on a line break, keeping a file:// URI from truncating into a bogus path.
Co-authored-by: markbusking <marcosbustos.dev@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Ship herdr with a config that mirrors our tmux setup
Installs herdr through the mise shim, ships the matching config as an
Omarchy default, and adds the usual refresh/restart pair. The keybindings
map tmux sessions to workspaces, windows to tabs, and keep both the prefix
and direct bindings from config/tmux/tmux.conf.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add herdr versions of the tmux dev layout functions
hdl, hds, hdlm, and hsl drive herdr through its socket API instead of
tmux. hsl tiles into a real grid since herdr has no select-layout tiled.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Namespace the herdr layout helpers so they stay out of the shell
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Create hdlm's tabs in its own workspace instead of the focused one
herdr tab create follows the focused workspace without --workspace, so
switching workspaces while hdlm loops scatters the new tabs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Lay hsl's grid out in visual order
Splitting the first column repeatedly inserted each new column between it
and the previous one, so uneven counts put the spare row in a middle
column instead of the last.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Report herdr config reload failures instead of swallowing them
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Hide herdr's pane scrollbars to match tmux
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Escape queued herdr layout commands
* Install herdr from the omarchy-herdr package instead of mise
* Use native herdr resize keybindings for tmux-style pane resizing
* Rename the omarchy-herdr package to herdr
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two problems made a missing Wayland compositor look like broken tests.
The cleanup traps ended on a bare conditional, so when a test skipped
before creating its TMPDIR the trap's last command returned 1 and, under
set -e, that overrode the explicit exit 0.
Six tests that launch quickshell had no compositor guard at all, so they
ran anyway and failed on the Qt platform plugin.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
afa2839a5a (Rename bg/fg palette keys to background/foreground)
aliased `color0` to plain background in theme color resolution, but
the Helix template still uses `color0` as the subtle surface shade
behind `ui.cursorline.primary`, `ui.virtual.ruler`, `ui.highlight`, and
`ui.text.focus`. All four now render at exactly the background color
and vanish: no cursorline, no ruler, and the picker's focused row is
only distinguishable by its bold text. This is the same failure that
d80c98f025 ("Make color0 distinct from background/foreground and fix
helix theme", #5538) fixed back when themes defined color0 directly.
Point those scopes at `lighter_background`, the semantic key for a
surface one step off the background. Every first-party theme defines it
distinct from background except Last Horizon and Solitude, which
set the two equal on purpose; those, and legacy themes whose
`lighter_background` falls back to background, render exactly as they
do today.
Assisted-by: Claude:claude-fable-5
Signed-off-by: Luke Hsiao <luke@hsiao.dev>
Pi/omp sessions kept falling into the Claude record when the api
field merely started with 'anthropic'. Kimi and other providers that
speak the anthropic-messages protocol (kimi-coding) were therefore
charged against Claude Code, showing k3 buckets under a Claude tab
even for a user without a Claude login.
Match the codex collector's provider-only attribution: only sessions
whose provider is exactly 'anthropic' count toward Claude usage.
Add a test proving a kimi-coding session sharing the
anthropic-messages api does not land in the Claude record.
Co-authored-by: Luca <luca@itwasarch>
99293aa gave the Tailscale widget a right defaultSection, but the test
still asserted it landed in center after the weather widget, and that
dropbox was the first widget after the tray.
Anchor both assertions on the tray so they track the placement contract
in omarchy-bar rather than hardcoded indexes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two Claude collectors running at once both wrote the cache through a temp
path derived from the target, so the second replace found the file already
moved away and crashed the update with a FileNotFoundError.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Find the Omarchy UKI as root when setting up direct boot
/boot is mounted with dmask=0077 on encrypted installs, so the
unprivileged find returned nothing and direct boot always reported that
no UKI was present.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Check for the legacy UKI as root when refreshing limine
The unprivileged file tests were always false on encrypted installs, so
the stale <machine-id>_linux.efi was never cleaned up.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Persist the Omarchy shell log across sessions
Quickshell only logs to its instance runtime dir on tmpfs, so when the
shell dies the idle/lock event trail is gone after a reboot (#6628).
Launch the shell through omarchy-launch-shell, which pipes stdout/stderr
into the journal under the omarchy-shell tag — bounded, timestamped, and
persistent — and surface that log in omarchy-debug-idle.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Recover a locked session whose lock client died
When the shell dies while the session is locked, Hyprland's failsafe
keeps the session locked with no lock client left, and
omarchy-restart-shell refused to run in exactly that state, leaving
reboot as the only way back in (#6628). Gate the refusal on the lock
service actually holding (or acquiring) the lock rather than on the
session's LOCK state — a dead shell and a crash-handler relaunch that
holds no lock both fail that check — then restart the shell, re-acquire
the session lock, and wait for it to report secure, the same
secure-poll omarchy-system-sleep-lock uses, so the user can
authenticate out of the failsafe. Enable Hyprland's
allow_session_lock_restore so the compositor accepts the replacement
lock client.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Keep clicking a notification working after a shell restart
Notification actions lived only in the sending process: `-a` appended
`-A default=default`, so notify-send blocked on a D-Bus ActionInvoked signal and
the caller ran the command when it arrived. Nothing about that reached disk, so a
restored popup had no action to run and its sender stayed blocked forever.
Replace `-a` with `--exec <command>`, carried as an `omarchy-exec` hint into the
snapshot's `exec` role. It travels through the popup files and history, and the
shell runs it on click, so restored toasts behave exactly like live ones and the
sender exits immediately.
That drops the scaffolding whose only job was keeping a blocked sender alive: the
first-run invitations lose their `--show` re-entry and two transient units each,
omarchy-migrate-notify loses its transient service, and the screenshot,
recording, download, and taildrop toasts lose their wrapper subshells.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep a failed toast from failing the work it announces
Moving these sends out of their backgrounded subshells put a fallible command
on the foreground path, where the `&` used to swallow its exit status. A
notification outage — including the shell restart this branch targets — now
propagates:
- taildrop's receiver dies under `set -e` mid-delivery
- omarchy-capture-screenshot reports failure for a screenshot it already saved
- a completed download exits before scheduling its thumbnail cleanup, leaking
the mktemp file
Announcing is best-effort in all three: the work is already done by the time
the toast goes out.
Also drop the first-run sleep that spaced out the welcome and Wi-Fi toasts.
It compensated for the background notify-send processes this branch removes;
each send now returns only once the server has taken the toast, so sending in
order is enough to stack them newest-on-top.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Stop tying the preview cleanup to the toast's expiry
The shell loads a notification thumbnail into memory when the toast appears and
never re-reads the file, so the preview only has to outlive that load. Deriving
the cleanup delay from the expiry was false precision, and it turned -t into a
variable for no reason: -t is already the helper's expiry setting.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Without defaultSection, both 'omarchy bar defaults' and 'omarchy plugin
add' fall back to center, so upgrades landed Tailscale next to the clock
instead of alongside the other status widgets.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Give SSH commands the user-level tool paths
ssh host cmd runs neither a login nor an interactive shell, so on Arch it
gets the bare sshd PATH and can't find mise-managed tools like the agent
CLIs herdr scans for. Set PATH in the PAM environment (per-user via
@{HOME}), append the user-level dirs in env-bootstrap so login shells and
the uwsm session get them too, and source env-bootstrap before bashrc's
interactive guard for bash variants that read it non-interactively.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Don't let an empty PATH turn into a cwd entry
Appending with a bare "$PATH:" prefix leaves a leading colon when PATH
is unset, which shells treat as the current directory.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The wrappers install and upgrade their tool on first run, so the cooldown
held new versions back for days. Refresh the stubs on existing installs
too, since the generator change alone only reaches fresh installs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mise withholds releases younger than its cooldown, so omarchy update left
tools behind for days. The mup alias already bypassed it by hand.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Fit the About window to its rendered content
The About fastfetch layout needs more columns than the shared 875x600
float provides, and the terminal's grid often only reaches its final
size after fastfetch has printed, leaving the output wrapped over the
logo or clipped at the initial 80-column grid (#6465).
Give About a dedicated org.omarchy.about app id so launch-or-focus can
actually match it, render through a loop that repaints on window size
or branding changes, and measure the rendered content to fit the window
around it with even padding, whatever the terminal font or About logo.
Fixes#6465
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Spacing
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Fix WhatsApp Slim migration targeting brave-origin-beta instead of brave-origin
* Add migration to append WhatsApp Slim to Brave Origin for existing installs
* Don't corrupt flags files that lack a trailing newline
Appending --load-extension= with echo assumed the file ended in a newline.
A hand-edited flags file without one got the flag concatenated onto the
previous line, losing both that flag and the extension.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: akashgagda <akashgagda@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The script is fetched from the branch but calls into the installed
/usr/share/omarchy tree, which can lag it. A packaged build without
bin/omarchy-done aborted apply_user_transition under set -e two thirds of
the way through: NetworkManager was already enabled, iwd was not yet
disabled, and nothing was printed, so the run read as finished.
The completion markers are now written directly instead of through
omarchy-done, and the two remaining unguarded packaged commands warn
rather than abort. Retiring iwd moves up next to the NetworkManager
enable it depends on, so no failure in between can leave both enabled.
An aborted run now says so instead of returning to the prompt on a green
progress line.
Fixes#6575
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
test/shell and test/all inherit `set -euo pipefail`, so the first failing
test file aborts the whole run. One failure then hides every file behind it:
you fix it, rerun, discover the next one, and repeat a file at a time. On a
140-file suite a single unrelated failure can keep most of the suite from ever
reporting.
Keep going after a failing file, then list the files that failed and exit
non-zero. Individual files still stop at their own first failed assertion, so
per-file isolation is unchanged, and a clean run still exits 0.
The files are already independent of each other -- the set of failures is the
same whether the run continues or stops at the first one -- so nothing was
relying on the early abort.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Match display backlight candidates against real globs
[[ ]] does not do pathname expansion, so amdgpu_bl* and acpi_video* only
ever tested for files with a literal asterisk in the name. Every machine
without intel_backlight silently fell through to the alphabetical first
entry, which picks acpi_video0 over amdgpu_bl0.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Use the gmux backlight instead of the Touch Bar on T2 Macs
/sys/class/backlight on a T2 Mac holds appletb_backlight and
gmux_backlight. Neither was a candidate, so the alphabetical fallback
picked the Touch Bar and brightness keys dimmed it instead of the
display. Add gmux_backlight and never fall back to the Touch Bar, which
is not a display panel on any Mac.
gmux ranks above the GPU backlights because apple-gmux only registers
its device when the kernel has already selected it for the machine, and
on dual-GPU Macs the GPU's own PWM stops driving the panel as soon as
that GPU suspends.
Fixes#6558
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Exporting BROWSER=omarchy-launch-browser into the whole uwsm session made
xdg-settings refuse "set default-web-browser", which broke every browser's
own "Set as default" button. The export only exists for terminal programs
(like gh) to open URLs detached from the terminal process tree, so move it
to default/bash/envs where interactive shells still pick it up.
Fixes#6590
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The upgrade repoints the mirrorlist and the [omarchy] server, then ran
pacman -Sy. A plain -Sy keeps the legacy database whenever the new server's
copy isn't newer, so the checksums stay stale and every re-download of a
rebuilt package aborts as corrupted.
Fixes#6576
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Add a Fireworks balance collector and teach the agents panel prepaid ledgers
The omarchy-agent-usage-fireworks collector reads serverless token usage
from the Fireworks billing API, grouped by day and model for the last 30
days, and reshapes it into the shared record contract. Fireworks does not
expose its prepaid ledger through the documented API, so the record carries
an estimated balance instead of rate limits: credits configured in
~/.config/omarchy/agents/fireworks.json minus rated account costs since the
funding date. Credentials come from FIREWORKS_API_KEY/FIREWORKS_ACCOUNT_ID,
the auth.ini that firectl set-api-key writes, or — last, so an explicit
login wins — the key opencode stores for its fireworks-ai provider.
The panel gains two generic capabilities any agent record can use: a
balance object draws a BALANCE section — remaining credit, a fuel-gauge
meter that drains toward empty and lights the bar alarm below 10%, and
funded-versus-spent detail — and hasPromptStats: false keeps prompt and
session counts out of today's tooltip for agents whose billing API only
ever reports tokens, on this machine and through synced snapshots.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Feed Claude and Codex usage from pi, omp, and opencode sessions
A subscription burned entirely through another coding agent leaves no
native Claude Code transcripts and no Codex session files, so the panel
showed nothing for it. pi and omp write compatible JSONL sessions, and
opencode records per-message provider, model, and token usage in its
message database; the claude and codex collectors now scan all three —
filtered to Anthropic and OpenAI providers respectively — and merge those
numbers into their local stats. Fireworks stays out on purpose: its billing
API already sees that traffic server-side, and a local scan would count the
same tokens twice.
The collector tests pin XDG_DATA_HOME so a developer's real opencode
history cannot leak into fixture runs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Stop pipefail from turning grep -q SIGPIPE exits into false negatives
grep -q exits at the first match, and when the producer is still writing
it dies with SIGPIPE. Under pipefail that 141 becomes the pipeline's
status, so hardware checks like lspci | grep -q read as "not found" on
exactly the machines they target. The T2 defaults migration hit this and
silently skipped real T2 Macs (#6608).
Redirect grep to /dev/null instead of -q wherever a pipeline feeds grep
in a pipefail context, so grep reads all input and the producer never
gets killed. The install-time T2 checks aren't run under pipefail today
but are switched too, since they're the same detection line the issue
calls out.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Re-run the T2 defaults migration its broken hardware check skipped
The SIGPIPE bug marked 1785944594 as applied without doing anything on
affected T2 Macs. The original migration is idempotent, so a fresh
migration can just source it now that the guard is fixed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address Copilot review: fix OCR grep pipeline and prove the T2 repair
screen_contains piped tesseract into grep -Fqi under the acceptance
suite's pipefail, the same SIGPIPE false negative the rest of the branch
fixes. The T2 test's lspci stub now keeps writing past the pipe buffer
after the match so every scenario exercises the SIGPIPE case, and a new
case runs the rerun migration against fixtures a bitten install would
have.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
A bar surface is built per monitor, so panel routing had several live copies
of the same widget to choose from and took whichever registered its slot
first. Pick the one on the monitor Hyprland has focused instead, preferring
an already-open copy so hide and toggle still reach the visible panel.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Extract the speed test gauge cluster into a shared SpeedTestOverlay
The dial cluster -- scrim, ignition sweep, self-ranging dials, run-again
button -- moves from the network speed test panel into qs.Ui with the
labels, unit, title, scale stops, and layer namespace as parameters, so
other measurements can wear the same cluster. The network panel keeps
its process handling and becomes a thin dressing of the overlay.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add a disk speed test and move speed tests under Trigger > Tests
omarchy-disk-speedtest streams live write and read MB/s once a second by
sampling the backing block device's kernel I/O counters while dd workers
generate the traffic, the same way the network test samples the
interface counters. The stress data is an incompressible urandom chunk
staged in RAM, written with fdatasync per pass and fadvise drop-behind:
O_DIRECT silently falls back to the page cache on btrfs, and zeros never
reach a compressed filesystem at all. Scratch files are created
exclusively per invocation and removed even when a dismissal interrupts
the run mid-phase.
The omarchy.disk-speedtest panel dresses the shared SpeedTestOverlay
with write and read dials in MB/s, titled with the hardware model of
the disk under test.
The menu grows a Trigger > Tests submenu holding the new Disk Speed
Test and the Network Speed Test, which moves there from Setup > Network.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Make the disk speed test reproducible, direct, and read-first
Successive runs could swing 40% because the settled figure was just the
last one-second sample of a single buffered dd stream, taken while btrfs
copy-on-write churned the extent allocator on every rewrite pass and the
fadvise cache-eviction dance stayed advisory.
The test files are now marked NOCOW, which is what makes O_DIRECT truly
direct on btrfs -- with checksums on it silently falls back to the page
cache -- and lets every rewrite land in place. Four parallel workers per
phase give the device a queue depth it can stretch out on, and the
figure the dial settles on is the steady-state average over the whole
phase with the first warm-up second excluded, not whatever rate the
final second happened to catch. Together this tightens successive runs
from +/-40% to a few percent of each other, at the device's actual
spec throughput.
The read phase now runs first, staged against freshly written files,
with the read dial on the left. Workers also only loop while the main
script lives, so a dismissal that loses the kill race can no longer
leave an orphan hammering the disk forever, and any worker dying before
the deadline fails the run instead of passing off partial figures.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop the menu aliases from the speed test entries
Aliases are reserved for established alternate names users already
type, kept for compatibility -- not something new entries pick up by
default. Note that in the menu definition header and AGENTS.md so the
next entry doesn't repeat it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Group dial readouts with thousands separators
A gen5 disk reads five digits; 11,450 scans, 11450 doesn't. Uses the
locale's grouping separator.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Trim redundant overlay props and unused imports from the speed test panels
The network panel restated the overlay's default unit and scale stops,
and both panels carried imports and an omarchyPath property nothing
uses.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Publish the specific speed test error whichever handler fires last
Process exit and stderr stream-finished have no guaranteed order, so a
failure that beat the collector showed the generic message forever even
when the command emitted an actionable one; the collector now replaces
it once the text lands. Also stop clearing the error on every stdout
line: only a new run should do that, or buffered output delivered after
a failed exit erases the failure message.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Arm the disk speed test cleanup before any scratch file exists
A preflight failure -- tmpfs target, missing device statistics, not
enough free space -- exited between mktemp and the trap, leaking the
scratch files. Cleanup also now unlinks before stopping the workers and
sweeps once more after, so even a cleanup cut short by an impatient
SIGKILL leaves no names behind and a final worker pass cannot recreate
one.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The pacman configuration says nothing about debug symbol packages. Someone who
wants `glibc-debug` so that gdb or Valgrind has symbols to work with has to
discover on their own that Arch publishes `-debug` repositories, find a mirror
that serves them, and work out that the versions only line up while the system
tracks Arch current.
Appending the three repository sections to `pacman-edge.conf`, commented out,
will put them within reach without turning them on. The comment records that the
packages match the edge channel only, and that debuginfod already covers most
debugging on edge, so enabling them is often unnecessary. Only the edge template
gets them, because on stable and rc the upstream debug packages are newer than
the pinned packages they would need to match.
ref: https://github.com/basecamp/omarchy/discussions/6185
* Fail the snapshot when Snapper is installed but has no configs
omarchy-snapshot create loops over the configs snapper reports. With none,
the loop body never runs, so it prints "Create system snapshot" and exits 0
without capturing anything. Every update then reports a snapshot it never
took, and the absence only surfaces when a rollback is needed and the
snapshot list turns out to be empty.
* Say so when the update proceeds without a snapshot
The update ignores exit 127 so a system without snapper updates quietly.
Any other snapshot failure was being swallowed by the same expression,
which let the update continue with no indication that it was now
unprotected. Keep continuing, but say it out loud.
* Point the snapshot repair hint at how the installer runs it
Also hold the green header until a snapshot will actually be attempted,
so the no-config failure doesn't open with a success banner.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Continue the quattro upgrade when the pre-upgrade snapshot fails
The upgrade runs under set -e, so the new non-zero exit from an
unconfigured Snapper would have aborted a re-run at the snapshot step
instead of proceeding like omarchy-update does.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Keep root= in the kernel cmdline when upgrading to Quattro
The packaged drop-in /etc/limine-entry-tool.d/omarchy-defaults.conf sets
KERNEL_CMDLINE[default] with the += operator. limine-entry-tool.conf documents
what that costs: "+= appends parameters to an existing cmdline ... Ignores
/etc/kernel/cmdline and /proc/cmdline". As soon as the drop-in lands, the tool
stops auto-detecting the cmdline.
Fresh installs are unaffected, because the ISO writes /etc/default/limine from
default/limine/default.conf with @@CMDLINE@@ substituted. The upgrade path never
created that file. A pre-quattro install that relied on the auto-detected root=
therefore ends up with a cmdline that has no root= at all, in both limine.conf
entries and in the cmdline embedded in the UKIs. The next boot fails with
"ERROR: Failed to mount '' on real root" and drops to an emergency shell, where
the error gives no hint that the cmdline is the cause.
Capture the boot-critical parameters from /proc/cmdline before the reboot, while
the still-correct cmdline of the running kernel is readable, and write them to
/etc/default/limine, which is loaded last so += keeps the drop-in parameters
instead of replacing them. Copy root=, rootflags, rootfstype, resume,
resume_offset, the cryptdevice and rd.luks keys and rw/ro verbatim rather than
reconstructing them, so LUKS and hibernation setups survive too.
Re-running the upgrade on an already-broken system has no root= left to copy, so
fall back to deriving it from the mounted root, including the subvolume on
btrfs. Any config layer that already pins root= is treated as authoritative and
left untouched.
* Anchor the cmdline guard and harden the repair path
The early-return guard searched for the bare string root=, which matches the
commented example limine-entry-tool.conf ships at line 53:
#KERNEL_CMDLINE[default]+=rw root=UUID=...
That file is present on every stock machine, so the guard always fired and the
function never wrote anything. Match assignments instead, and check
/etc/kernel/cmdline separately since it holds bare parameters rather than shell
assignments.
Three fixes on the repair path:
Assigning boot_params discarded every parameter the collection loop had just
captured, so cryptdevice, cryptkey, resume and ro were dropped, and rw was
forced over a captured ro. Prepend the derived root= instead, and only add rw
when the booted cmdline stated no mount mode.
On an encrypted root, findmnt reports the unlocked mapper device, whose UUID
says nothing about which container to unlock. Emitting it produced a cmdline
that still could not boot while satisfying the final check, so the user rebooted
into the same emergency shell believing it was repaired. Warn and write nothing
in that case.
The allowlist gained rd.luks.key, rd.luks.crypttab, rd.md.uuid, rd.dm.uuid,
rootwait, rootdelay and dm-mod.create.
Verification now also reads the .cmdline section of each UKI. With
omarchy-uki.conf among the drop-ins that embedded copy is what actually boots,
so a green limine.conf alone did not prove the machine would come up.
* Filter guard paths and narrow the dm-crypt and UKI checks
The guard passed /etc/default/limine to grep unconditionally, and that file is
absent on exactly the machines this targets. A missing operand makes grep exit 2
without -q, so a drop-in pinning a real root= went undetected and the function
appended a second one, overriding the explicit setup it promises to leave alone.
Rather than relying on -q returning 0 despite the error, which is a GNU grep
special case and not true of every implementation, filter the paths first and
only grep the ones that exist. The exit status is then unambiguous.
The dm-crypt check gated on the /dev/mapper/* prefix, which also matches plain
LVM, dm-raid and multipath. Those roots need no unlock parameters and were
repairable before, so the prefix test denied them a working root=UUID= and told
them they were encrypted. Gate on the device mapper target type instead.
root_filesystem_encrypted() is not reused here on purpose: it treats every
/dev/mapper/* path and any non-empty /etc/crypttab as an encrypted root, which
suits its own call site but would reintroduce the same false positive.
UKI verification now runs through as_root, since a restrictive ESP fmask would
otherwise make find return nothing and the check pass in silence, and is scoped
to the omarchy_linux*.efi images limine-entry-tool generates so a shared ESP or a
stub without a .cmdline section cannot raise a false "do not reboot" warning.
The allowlist gained rd.lvm.lv and rd.lvm.vg.
* Strip the subvolume before resolving the root device type
findmnt appends the subvolume for btrfs mounts, so the source read back for an
encrypted btrfs root is /dev/mapper/cryptroot[/@]. lsblk cannot resolve that
path, the device type came back empty, and the crypt gate never fired. The
function then wrote root=UUID= with no unlock parameters, limine.conf ended up
carrying a root= so the final check stayed quiet, and the machine still booted to
an emergency shell. That is the layout Omarchy installs when encryption is
picked, so the gate missed exactly the roots it exists for.
The previous /dev/mapper/* prefix test matched the bracketed form by accident.
Moving to the device mapper target type is still the right call, it just needs
the unbracketed source, which findmnt --nofsroot provides.
Also give root_type an explicit empty default. It is assigned inside a branch and
read outside it, and set -u treats a declared-but-unassigned local as unbound, so
a findmnt that cannot answer would abort the upgrade with the quattro packages
already installed and everything from configure_snapper_policy onward skipped.
* Look for the crypt layer across the whole device stack
lsblk -no TYPE reports only the target's own type. On the standard full-disk
encryption layout, LUKS container -> LVM PV -> root LV, that type is lvm and the
crypt layer sits in the parents, so the gate never fired: the function wrote
root=UUID= with no unlock parameters, the final check found a root= and stayed
quiet, and the machine still booted to an emergency shell.
Walk the parents with lsblk -s and look for a crypt layer anywhere in the chain.
That keeps LVM, dm-raid and multipath roots on the repair path, since they carry
no crypt layer and root=UUID= is enough once mkinitcpio assembles them.
root_type is replaced by root_stacks_crypt, which says what is actually being
tested and drops the LVM-versus-crypt caveat the old target-type check needed.
Also drop a vacuous test assertion: piping a bracketed literal through grep -qv
'\[' selects nothing, so the branch was unreachable and the case passed whatever
the script did. The --nofsroot assertion above it is what holds that fix.
* Keep the crypt gate off a pipeline exit status
Capture the device stack and match it from a here-string rather than piping lsblk
into grep -q. Under pipefail a short-circuiting grep can leave the producer with
SIGPIPE and turn the pipeline into 141, which reads as "no crypt layer" and
disarms the gate silently. lsblk writes its whole table in one go, so this is out
of reach in practice, but nothing about the gate should depend on how much output
a helper happens to buffer.
Also correct a stale test comment that described the target-type check the
previous revision used, four lines above the comment explaining why that check
was insufficient.
* Harden the kernel cmdline preservation against false root= pins
The /etc/kernel/cmdline early return trusted a file limine-entry-tool
ignores once a += drop-in sets KERNEL_CMDLINE[default], leaving exactly
the targeted machines unbootable. The pin guard now reads only the
*.conf layers the tool loads, only the default key, and tokenizes the
assignment value so quoted decoys and volatile-root= cannot pin.
/proc/cmdline is tokenized quote-aware so dm-mod.create="..." survives
verbatim, the root= verification is token-anchored, and an unverified
cmdline now blocks the reboot instead of only warning.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Ask limine-entry-tool for the effective cmdline instead of parsing its configs
--get-cmdline default answers whether root= survives the tool's own
config merge, replacing the glob, grep and quote-aware tokenizer walk
over the config layers, and the quote-aware /proc/cmdline parsing
reverts to plain word splitting. The verification and the reboot gate
stay: they are what catches anything the simpler paths miss.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(network): drop the redundant rescan on the bar click
Opening from the bar ran open() and then a bare refresh(). open() already
triggers onOpenedChanged -> refresh(true), which defers the PHY scan by
disabling the scanner and re-enabling it from scanRestart. The bare
refresh() that followed defaults scanWifi to false, so it took the other
branch and set wifiDevice.scannerEnabled synchronously on the click frame,
undoing the deferral and stalling the open on NetworkManager's access-point
flood. It also double-started the DNS and band probes.
Co-Authored-By: shrijit <shrijitsrivastav@gmail.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(network): keep wifi rows QObject-free to prevent a delegate crash
wifiRow() embedded the WifiNetwork QObject in the row it returns, and those
rows are list-model data, so every delegate held a live QObject wrapper in a
var property. When NetworkManager churns the list -- a scan's access-point
flood, an AP disappearing -- the object can be destroyed while a delegate is
still incubating, and quickshell segfaults in QObjectWrapper::wrap_slowPath
on the dangling wrapper.
Project primitives only and resolve the backend object at action time via
the existing networkForSsid(). Both failNetworkAction() and
checkActionCompletion() already no-op on a null network, so a row whose
network has since vanished is handled the same way it was before.
Co-Authored-By: shrijit <shrijitsrivastav@gmail.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(bluetooth): keep device rows QObject-free to prevent a delegate crash
Same crash class as the wifi rows: scrollRows embedded the BlueZ Device
QObject in list-model data, so every delegate held a live wrapper in a var
property. Discovery churn -- a scan timeout dropping a device, an unpair --
can destroy the object while a delegate is still incubating, and quickshell
segfaults on the dangling wrapper.
Project primitives for both the scroll rows and the connected rows, and
resolve the backend object by address in deviceFor() for the click actions.
The keyboard flow already went through deviceAt(), which reads the live
device arrays directly rather than model data, so it is untouched.
Co-Authored-By: shrijit <shrijitsrivastav@gmail.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(network): guard row disconnects against a vanished network
Row activation resolved the WifiNetwork with networkForSsid() and passed the
result straight to disconnect(), which falls back to connectedWifiNetwork
when handed null. A row is a primitive snapshot, so scan churn can remove its
backing object while the row is still on screen -- activating it then tore
down whatever happened to be connected at that moment rather than doing
nothing.
Route both row paths through disconnectRow(), which resolves first and only
acts when the row still maps to a live network. disconnect() keeps its
fallback for callers that mean "drop the current connection".
Also covers the bar-click open path, which had no regression: the suite
already asserts against Panel.qml source, so assert the closed branch calls
open() alone and never a second refresh().
Co-Authored-By: shrijit <shrijitsrivastav@gmail.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: shrijit <shrijitsrivastav@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reopen wifi passphrase prompt after a wrong saved password
A failed first connection attempt leaves the network profile saved, so the
network shows up as known. Clicking it again reconnects with the stored
wrong PSK and fails with WifiAuthTimeout, but the inline passphrase prompt
only reopened on NoSecrets, leaving no way to re-enter the password short
of forgetting the network.
Treat an auth timeout on a protected network as a wrong saved passphrase
and reopen the prompt; connectWithPsk overwrites the stored PSK on submit.
Fixes#6582
* Scope the wifi passphrase reprompt to panel-initiated connects
Background auto-connect retries also fire connectionFailed; without a
gate they would pop the passphrase prompt open unbidden, stealing focus
and wiping a passphrase mid-entry when another network fails.
For the gate to see the failure, the action safety-net timer must
outlast NetworkManager's 25s supplicant timeout -- at 15s it cleared the
action state before WifiAuthTimeout arrived, so a wrong saved password
showed "Timed out connecting" instead of "Wrong password". Bump it to
30s.
Also share the one ConnectionFailReason map between the Model.js
helpers instead of building a second partial copy inline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Faking HOME alone was never enough: the shell QML and the agent usage
updater read XDG_STATE_HOME and XDG_CACHE_HOME directly, so a test
quickshell inherited the session's real paths. The bar widget contract
test instantiated the agents widget, whose refresh ran the real
collectors against the empty fake HOME and wrote hollow "Waiting for
auth" records into the developer's real usage data files — hiding the
agents widget from their bar — while littering the real cache with
per-tmpdir scan files.
Point XDG_CONFIG_HOME, XDG_CACHE_HOME, and XDG_STATE_HOME under the fake
home in every test that boots quickshell with one.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The panel resolves marks by walking assets/<id>-light.svg then
assets/<id>.svg, advancing on Image.Error. But the candidates binding is
re-evaluated whenever the provider objects are rebuilt, and a fresh array
identity with identical content reset the walk to the -light candidate.
Re-pointing source at a URL whose load already failed emits no
statusChanged, so the walker never advanced again and agents that ship a
single mark — Claude — fell back to the generic bar glyph on light
surfaces.
Key the reset on the candidate URLs instead of the array identity, and
defer the error advance one tick so stepping source from inside its own
status change doesn't trip the binding-loop detector.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add agent usage collectors that write display-ready data files
One omarchy-agent-usage-scan-<agent> collector per AI coding agent prints a
complete display-ready usage record — identity, tier, status, rate limits,
and today/week/all-time stats. omarchy-agent-usage-update runs every
collector it finds and writes the records atomically to
~/.local/state/omarchy/agents/usage/, so anything that displays usage only
ever reads JSON from there.
The Claude collector absorbs what the shell previously did in-process:
transcript scanning, the stats-cache/history fallback, credentials parsing,
and the OAuth limits probe, now with a probe throttle and last-good limits
kept across network failures. The Codex collector is the existing scanner
reshaped to the shared record contract.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Redo the model-usage plugin as omarchy.agents watching usage data files
The panel is now strictly a display. It discovers the JSON records that
omarchy-agent-usage-update maintains under
~/.local/state/omarchy/agents/usage/, watches them for changes, and draws
whatever appears — so adding an agent means shipping a collector, never
touching the panel. Marks resolve by convention (assets/<id>.svg with an
optional -light twin), the limits meters read a generic limits array, and
the per-provider QML adapters and in-plugin scanner scripts are gone.
Cross-device sync aggregation stays in the shell and keeps the snapshot
field names older versions wrote, so mixed-version fleets still merge in
both directions.
With the provider fan-out gone, the widget takes its real name: the plugin
id becomes omarchy.agents. A migration renames it wherever a user's config
mentions it — layout entries keep their settings and position, a disabled
widget stays disabled — then primes the data files once and drops the old
scanner cache. The migration test also drops a stale assertion that expected
migrations to restart the shell themselves, which c992cdff moved to
omarchy update.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address Codex review: synced-only tabs, limits retry, history fallback
Three data-availability gaps from review. An agent whose records only exist
in synced snapshots — a collector installed on just one machine — now gets
its tab by unioning the synced aggregate into the provider list, with rate
limits blank since those never travel. A Claude limits probe that reaches no
server at all writes retryAdvised into its record, and the shell honors it
with one 30-second retry instead of waiting out the full refresh interval,
restoring the old boot-before-DHCP behavior. And a machine with only
history.jsonl — no transcripts, no stats-cache — still reports today's
prompt and session counts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address second Codex pass: history-only visibility, targeted retries
Today's prompt and session counts now count toward an agent's presence in
the bar, so a machine whose only Claude source is history.jsonl shows up
without waiting for limits. And the 30-second limits retry passes the
advising agent ids to the updater, so an outage at one provider no longer
puts every other collector on a retry treadmill.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop omarchy-cmd-present jq guards from the agents migrations
jq ships in the default package set, which makes it a runtime invariant per
AGENTS.md — call it directly. The migration tests lose their now-unused
omarchy-cmd-present stubs with it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop the scan infix from the collector command names
Collectors are omarchy-agent-usage-<agent>; the updater skips its own name
when globbing them, and the update test proves it with a decoy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Keep the credential store out of the printed usage record
The Claude collector now reads .credentials.json once into three scalars —
the access token, its expiry, and the plan label — instead of passing the
parsed store around. The token reaches nothing but the Authorization header
of the limits probe, and only the plan label may travel into the record,
which is what CodeQL's clear-text-logging alert on the record print was
unable to see when the whole dict flowed through.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Fix unbound XKBLAYOUT under set -u in the keyboard-layout migration
/etc/vconsole.conf only guarantees KEYMAP -- XKBLAYOUT is written by some
installers but not required, and vconsole.conf on a stock install may not
define it at all. omarchy-migrate runs every migration with set -euo
pipefail, so referencing the unset variable directly aborted the migration
run instead of just skipping a layout this migration doesn't care about.
Read it with a default-empty expansion first, then apply the existing
comma-strip separately -- keeps both failure modes (unset, and set with a
trailing keymap variant) handled explicitly instead of folding them into one
expansion that only covers one of the two.
* Survive a missing vconsole.conf in the keyboard-layout migration
Defaulting XKBLAYOUT fixed the unset variable but not the other way this
line takes the migration chain down. `.` fails when /etc/vconsole.conf is
not there at all, `&&` short-circuits, and the non-zero status leaves the
command substitution and kills the assignment under omarchy-migrate's
`bash -euo pipefail` -- the same abort, one branch over. The file is
optional enough that both other readers of it, omarchy_hooks.conf and
1781485962.sh, guard with `-f` first.
Run the echo unconditionally so the substitution reports its status
instead of the source's.
Read both paths from the environment, the way the zram migration already
does, and cover the layout cases plus both crashes with a test.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Read the keyboard layout from vconsole.conf alone
Two ways the layout could come from somewhere other than the file, both
found reviewing the fix before it:
Sourcing does not clear an exported XKBLAYOUT, so on a machine that exports
one, a vconsole.conf that sets no layout -- or none at all -- left the
caller's environment deciding what the initramfs bundles. Unset it in the
subshell so only the file can answer.
Skipping the source when the file is missing, rather than letting the
substitution swallow the failure, also stops depending on errexit being
discarded inside command substitution. inherit_errexit takes that back and
the chain aborts again; nothing in Omarchy sets it today, but the other two
readers of vconsole.conf already check `-f` first and this now matches.
Test the layout list past its one Cyrillic entry, both orders of a
comma-separated pair, an exported XKBLAYOUT, and inherit_errexit. Each of
those catches a mutation that survived before.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Drop the test scaffolding from the keyboard-layout migration
A migration runs once and then gets deleted, so a suite entry for this one
is upkeep with a short shelf life. The path overrides existed only so that
test could aim the migration at fixtures; with the test gone they are
indirection nothing exercises, so both go back to literal paths.
The fixes stay: check the file before sourcing it, unset XKBLAYOUT so an
exported one cannot answer for a file that sets none, and strip the keymap
variant before matching.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Toni Nowak <t.nowak@ai-flow.no>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Persist on-screen notification popups across shell restarts
Mirror every popup to its own file under
~/.local/state/omarchy/notifications/ for exactly as long as it is on
screen: written when the toast appears, deleted when it expires, is
dismissed, is acted upon, or is replaced via freedesktop replaces_id.
On startup the directory is read back and still-valid popups re-shown,
so toasts survive the restart omarchy-update performs — critical
alerts, which never expire, always make it across.
Restored popups keep ids from the previous server generation, so the
replaces_id cleanup tracks them separately instead of mistaking a
fresh notification's reused id for a replacement, and the startup
restore only discards a persisted file when a live row with a
different timestamp has superseded it. Files are read back with awk
so a torn write can't glue itself onto the next file and take a valid
popup down with it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Close the remaining cross-generation id collisions in popup persistence
Notification ids restart from 1 with every server process, so an id
alone never identifies a notification across a shell restart. The
first round of fixes guarded row removal, but review (and a live
repro) showed the same collision biting everywhere else an id was
used on its own:
- Dismissing or clicking a restored toast resolved liveRefs by id and
could dismiss, or fire the action of, an unrelated fresh
notification, and archive its pending row. Restored rows now never
resolve to a live object, and pending rows are matched by id plus
timestamp.
- parsePopupFiles deduped files by id, so a fresh notification reusing
a restored critical alert's id got that alert's file deleted as a
"stale duplicate" on the next restore. Files are never deduped now:
each one is a popup that was on screen, and the rare genuine
leftover from a crash re-shows once and cleans itself up.
- The restore only skips an entry when a live row matches both id and
timestamp (it is that entry); an id-only match shows both toasts
rather than guessing which one to drop.
- A same-millisecond replaces_id update shares its predecessor's
filename; the replacement's file is no longer deleted alongside the
replaced row.
- A restored popup's reset lifetime is persisted as an absolute
deadline, so a second restart judges it by the clock that actually
governs its display instead of dropping it while still on screen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Evaluate menu guards one run at a time
A second evaluation starting while one was in flight could not replace it.
Process ignores a command change until the next run and `running = true` is
a no-op while running, so setting them did nothing -- but clearing
`collected` first threw away the lines the running script had already
emitted. Its tail then landed as the entire result, and every id missing
from it went back to showing, since `when:` only hides a row on an explicit
false. That is how Setup > Defaults > Browser ends up listing browsers that
are not installed.
Queue the evaluation instead and run it once the one in flight lands, the
way provider enumeration already waits its turn.
* Answer repeated menu guard questions once per evaluation
The menu opens on the last evaluation's answers, so however long the guard
batch takes is how long a row can contradict the state it describes: stop a
recording and Screenrecord still offers to stop it, because the `pgrep` that
would hide it is queued behind fifty package lookups.
Almost none of that time is the questions, it is asking them one process at
a time. The shipped menu runs `omarchy-pkg-present` 54 times and
`omarchy-cmd-present` 23, and reads `omarchy-default-browser` once per row
in Defaults > Browser. Prepend a prelude that answers all of it inside the
one guard process, off a single package listing, bash's own PATH lookup, and
one capture per reader command. The captures are eager because `checked:`
reads them inside `$()`, where a lazy memo would not outlive the subshell.
Takes the shipped batch from 1.49s to 0.25s with identical answers for all
175 guards.
* Make the guard prelude answer exactly as the commands it stands in for
The prelude only helps if it is indistinguishable from the commands it
shadows, and it was not:
- `pacman -Q` resolves a name through what installed packages provide, so
with gvim installed it reports `vim` as present. A set built from
`pacman -Qq` sees only names, so `install.editor.vim` came back and
offered to install what was already there. Build the set from provides
too, and send version constraints, which no set can answer, to pacman.
- `omarchy-cmd-present` uses `command -v`, which finds builtins; `type -P`
searches PATH alone and disagreed on every one of them.
- Shadowing a reader with a function caught far more than the plain
`$(reader)` the rows use: `command -v omarchy-dns` got the function name,
and `VAR=x omarchy-channel-current` got an answer captured without the
variable. Substitute the captured value into the expression instead and
leave every other form to run the real command.
- A reader that exits nonzero could take the batch down under a login shell
with errexit set.
Also keep the results of a batch that was killed rather than finished, since
a row whose `when:` went unanswered shows, which is the failure this set of
changes exists to remove.
Costs 0.25s -> 0.33s against 1.49s before any of this, still with answers
identical to evaluating each guard on its own.
* Read every provide pacman reports, wrapped or not
`pacman -Qi` wraps a long list onto indented continuation lines whenever
COLUMNS is set in the environment, which the login shell the batch runs
under may well have done. Reading only the line that starts with `Provides`
dropped the rest: at COLUMNS=80 that is 537 of 856 provides on this machine,
which puts back exactly the "offers to install what is already there"
failure the provides lookup was added to prevent. Follow the continuation
lines instead.
The version-constraint case was also not testing what it claimed.
Interpolating the argument into the shadow's script text let `bash>=1` parse
as a redirection, so the shadow was handed `bash` and quietly agreed for the
wrong reason -- and left an `=1` file behind, which got committed. Pass
arguments as argv to both sides, drop the file, and wrap gvim's provides in
the stub so the parser is held to the format pacman actually emits.
* Split the end-user omarchy skill into topic guides
Move default/omarchy-skill to default/agents/skills/omarchy and break the
monolithic SKILL.md into on-demand topic files for Hyprland config, shell
plugins, theming, and hooks. Update the skill symlink wiring, relink
existing installs through a migration, and correct claims that had drifted
from the implementation: plugin hot-reload, terminal reload, menu
customization, refresh scopes, theme overlays, background locations, hook
timing, and the packaged (not git-managed) system directory.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add capture and contributing guides to the omarchy skill
Cover screenshots, screen recording, OCR text capture, and LocalSend or
Taildrop sharing, plus how to route bug reports, suggestions, and support
questions upstream with diagnostics and captures of the problem attached.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Scope Hyprland reload guidance to the Lua config files
hyprsunset.conf and xdph.conf are read by separate processes, so hyprctl
neither applies nor validates them. Document restarting hyprsunset after
editing its config, including in the night light example.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Extract the Wi-Fi QR share card into its own omarchy.wifiqr panel plugin
omarchy-network-qr now leads with an iface/security/ssid meta line, so a
bare summon self-detects the connection and the plugin owns the whole
share flow. The network panel loses its overlay lifecycle: with no
centered card left inside it, the shadowed open/close collapses back to
the stock panel behavior, and the QR button just summons the plugin --
which a clone or third-party plugin can replace, like the speed test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Keep canceled QR and password runs from leaking into their replacements
Copilot review: the cancellation guards dropped in onExited while the
canceled run's collectors were still allowed to fire, so a stale stderr
could shadow a successful regeneration and a stale password could be
revealed under a new network's card. The guards now stay up until the
next run launches, good output settles any earlier error, and a bare
re-summon no longer inherits the previous card's SSID.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Leave agents/ ready for other agent artifacts like definitions and
prompts alongside the skills.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Keep only universal rules in AGENTS.md and point to per-task guides
for shell development, acceptance tests, visual verification, command
metadata, and install scripts. Fold the migration notes into
docs/migrations.md and replace .claude/CLAUDE.md with a root CLAUDE.md
importing AGENTS.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Select-menu options gain an optional third field rendered under the
label, filtered alongside it, and returned with the selection. The
plugin picker uses it to show every plugin's id and act on the id the
selection hands back, replacing the duplicate-name label suffix.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The orphaned module cleanup loop was the last statement in the script, so
when the glob matched nothing the trailing && list left an exit status of
1. run_logged propagates that, aborting hardware setup on every Tuxedo and
Slimbook install.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The network panel now summons it, so a clone or a third-party plugin
declaring clonedFrom: omarchy.speedtest can replace the whole speed
test -- dials and run orchestration alike -- for every caller.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Apply the terminal tag to Omarchy's own terminal windows
Omarchy launches TUIs and its own terminal windows under dedicated
app-ids (org.omarchy.btop, org.omarchy.terminal, TUI.float, ...), so the
class never matched the terminal that drew the window and those windows
went untagged.
Also drop the tag's opacity rule, which stripped default-opacity only to
re-apply the identical value. Themes still override through the tag.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Match terminals by tag for universal clipboard shortcuts
The binding kept its own list of terminal classes, so SUPER + C in a TUI
window sent CTRL + C instead of CTRL + Insert. Read the terminal tag
instead of duplicating the definition.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
An installed app whose .desktop Keywords contain a menu id captured the
route: htop ships Keywords=system;..., so SUPER+ESCAPE opened an empty
"Htop" menu instead of the System menu once the Apps menu had merged its
rows. Exact ids now win, and app rows are no longer routable at all —
their keywords remain search-only.
Fixes#6554
Reported-by: Craig Derington (https://github.com/craigderington)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The first submenu move or search keystroke already froze the card's top
edge; freeze the rows height at the same moment so drilling into a longer
menu scrolls behind the fold instead of growing the card.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(network): pin overlay text to a fixed on-scrim palette
SpeedTestPanel and WifiQrPanel both draw over a hardcoded near-black
scrim, but their text/tick colors came from bar.foreground -- a color
themed to contrast with the *bar's* own background, which flips
dark/light per theme. On themes with a dark bar.foreground, digits
and labels went invisible against the black scrim, leaving only the
accent-colored arc/needle (Color.accent) visible.
Add a fixed white-based on-scrim palette (onScrim/onScrimDim) to both
overlays and route all text/tick colors through it, independent of
theme. bar.urgent stays theme-driven since it's a semantic color
already legible on near-black.
* Trim the on-scrim palette comments to the constraint
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Pin overlay error text to a fixed on-scrim urgent color
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Hyprland leaves an already-mapped layer surface at its old global
position when its monitor moves within the layout: undocking disables
the internal panel, the external monitor shifts to x=0, and the bar and
background keep rendering at the old offset until unmapped and remapped.
Watch each screen's origin and briefly unmap the window when it moves so
the compositor re-places the surface at the monitor's new origin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GTK only honors whole-number GDK_SCALE values, so persisting 1.6 or 1.25
verbatim left GTK apps without a usable scale. Round to the nearest whole
factor when writing monitors.lua.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: add bg/fg aliases for theme color resolution
Themes define bg/fg but the template system expects
background/foreground. The fallback chain only checked color0/color7,
leaving background/foreground empty for themes using bg/fg naming.
* Complete legacy theme palette compatibility
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Launch apps in their own scope instead of the compositor's cgroup
The launcher ran desktop entries through gtk-launch, so the app inherited
quickshell's cgroup, which belongs to wayland-wm@hyprland.desktop.service.
A kernel OOM kill there fails the compositor unit and tears down the whole
session, dropping the user at SDDM with every window lost. A single runaway
app took the desktop down three times in one afternoon.
Route launches through uwsm-app so each app gets its own scope under
app-graphical.slice. A runaway app now fails its own scope and the session
keeps running.
The post-install launches had the same inheritance bug in a milder form,
where the app landed in the installer terminal's scope and died with it.
0aedef58 patched that with setsid, which detaches the session but leaves
cgroup membership behind. A scope fixes it properly.
* Detach post-install app launches
* Preserve desktop entry launch compatibility
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Updates routinely replace the shell's QML, and a stale process can
lazy-load new files into old code. Restarting at the end of every
omarchy update removes the need for migrations to restart the shell
or defer one with the restart-shell-required marker: the login-time
migration path already runs a fresh shell that hot-reloads shell.json.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every preset in the right-click ring was 24-hour, so a 12-hour label was
something you had to hand-write into shell.json. Pair each locale-shaped
time preset with its AM/PM twin, and give vertical bars one stacked
variant. The ISO preset keeps its 24-hour clock, since ISO 8601 writes
time that way.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The Open-Meteo fetch is the only thing that updates the bar icon when a
location is configured, but a failed response was dropped silently with
no retry, leaving a stale icon until the next refresh tick. Give it the
same short retry loop the wttr fetch already has, and reset both retry
budgets on each full refresh cycle so an exhausted round (e.g. waking
before the network is back) doesn't starve retries for the session.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Make omarchy-network-qr detect the connected Wi-Fi interface
The interface argument is now optional so IPC and menu callers can
summon the QR card without knowing the device name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Move the speed test into a modal card with cluster dials
The network panel's Run button and the new omarchy.network speedTest
IPC route open a centered card where download and upload dials sweep
on open and track the live readings, Tucson style. Dismissing the card
stops the traffic workers. The QR card gains a showQr IPC route.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add Setup > Network menu with DNS, QR Code, and Speed Test
DNS switches providers through omarchy-dns with the current choice
checked. QR Code only shows while connected over Wi-Fi.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Hold the speed test card steady and add a corner dismiss
The Run Again button now fades instead of unmounting so the card keeps
its size across runs, and a small X in the corner closes the card
alongside Esc and the scrim.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Move the speed test action into the network panel hero
A speedometer icon beside the QR share replaces the dedicated inline
section, and the keyboard chain loses its speed stop accordingly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Float the speed test cluster on the scrim
Drop the bordered card and the pulsing halo: like the Tucson's floating
cluster, the dials now sit directly on a near-black scrim with a soft
under-glow along the value arc, fainter ticks, and hubless needles that
fade toward the pivot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Center the retry button between the dials
The measuring status lines and the corner dismiss go away; the retry
button moves into the gap between the two dials like a cluster's center
display, anchored out of the column flow so nothing ever shifts. The
fast.com attribution lives on as its tooltip, and only errors still
print below the cluster.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Put the retry button back beneath the dial pair
The dials close ranks again and the retry button returns below them,
centered on the pair and still fading in place so nothing shifts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Harden the network IPC routes against stale panel state
The QR menu route forces interface self-detection instead of trusting
details that stop refreshing while the panel is closed, and the
widget's canonical close now tears down the centered cards and their
traffic instead of only hiding the compact panel.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Re-range the speed dials for every run
The scale latched upward forever, so one unusually fast run would
compress every later one for the lifetime of the shell process. Each
dial now returns to the base scale when its measurement starts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Float the Wi-Fi QR share like the speed test
Same presentation as the dials: no bordered card, just the code on a
heavy scrim. Only the dark modules paint now, so the white canvas can
round its corners while the spec quiet zone keeps the code clear.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Pick the default-route device and pin the locale in QR detection
nmcli localizes state names, so the detection fallback pins LC_ALL=C
and accepts states like "connected (externally)". Detection now prefers
the default-route device, matching the connection the panel and the
menu's visibility gate describe when several Wi-Fi adapters are up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Make every network summon path overlay-aware
Opening the widget while a centered card is up now dismisses the card
instead of raising the compact panel behind an exclusive overlay --
the shadowed open() covers the keybind toggle, the bar icon, and IPC.
Re-summoning a card while its process is still tearing down queues the
fresh request for onExited instead of dropping it, and the speed test
route refreshes connection details like the QR route does.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Shrink the overlays to fit narrow outputs
The dial cluster and the QR card scale down instead of clipping when a
portrait or heavily scaled display is narrower than their natural size.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
hyprctl prints "Couldn't connect ..." on stdout for stale instance dirs
left in /run/user/*/hypr/, so jq's parse error leaked into pacman's
pre-transaction hook output. The dead instances were already skipped
correctly; only the stderr noise escaped.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ls3ump7hcv4oNnjWW5AXmn
omarchy-file-select gains an --extensions filter, passed through the
portal's native filters option, so the branding commands can offer
only png/svg instead of walking a find-generated menu of Pictures.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every toggle you could only reach by mouse or panel hotkey is now
scriptable through omarchy-shell:
- omarchy.bluetooth toggleBluetooth — the radio (was right-click / B)
- omarchy.network toggleNetwork — Wi-Fi on/off (was W in the panel)
- omarchy.tailscale toggleTailscale — the connection as one call,
matching the widget's right-click, instead of separate up/down
- omarchy.clock toggleWeekStart — calendar week start (was W)
- shell toggleBarTransparency — the bar background (was manage UI only)
Bluetooth and network follow the power/monitor pattern: manageIpc: false
so the panel owns the target's single IpcHandler and can extend it past
the inherited lifecycle methods.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omarchy-shell omarchy.power togglePercentage now flips the same setting
the widget's right-click does. Follows the monitor/tailscale pattern:
manageIpc: false so the panel owns the target's single IpcHandler and
can extend it past the inherited lifecycle methods.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The widget declared no indicator hint, so the mark fell back to 55% of
the slot — sized for a lone icon, too short once the percentage doubles
the block. Hint the glyph's painted width, the way the clock hints its
label width.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A shell.json write used to reassign the whole layout, and the module
Repeaters recreate every delegate when their array model changes — so
toggling an inline widget setting (battery percentage, clock format,
tray pinning) tore down and rebuilt every widget on every monitor,
closing any open panel along the way. When the layout structure is
unchanged, hand the new settings to the running widgets instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Support external monitor brightness
Route brightness through the focused Hyprland monitor so internal panels keep using the kernel backlight while compatible external displays use DDC/CI. Preserve the Apple Display backend and leave brightness unavailable when the focused display cannot be controlled.
Add cached DDC bus and VCP range handling, install ddcutil for new and existing systems, and cover backend selection and brightness conversion with shell tests.
* Harden external brightness caching
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Values longer than the remaining terminal width wrap back to column 0
and overwrite the logo column, which breaks the whole About layout. The
packages line triggers this on most systems.
Set display.disableLinewrap so overlong values clip at the right edge
instead. fastfetch documents this as the default but does not apply it
unless set explicitly.
* Make WhatsApp Web follow your Omarchy light/dark theme
WhatsApp Web's "System default" theme follows prefers-color-scheme and
repaints live, so a small theme bridge is enough to make it track the active
Omarchy theme with no reload and no WhatsApp-specific CSS.
- omarchy-chromium-theme-host: push-only native messaging host that reads the
active theme and emits it on connect and on every theme-set. Unlike copy-url/
yt-dlp (one-shot), it stays connected and pushes, since theme-following needs
the page to learn about changes while it is running.
- omarchy-chromium-theme-refresh: SIGUSR1s the running host(s); called from
omarchy-theme-set's post_theme_commands.
- whatsapp-theme extension: decides dark vs. light from the theme background's
WCAG luminance and drives a prefers-color-scheme shim, so WhatsApp's own
theme does the repaint.
Wired like copy-url/yt-dlp and whatsapp-slim: bundled under
default/chromium/extensions, added to --load-extension, host manifest
registered from the fresh-install/refresh/browser-install paths, existing users
covered by a migration.
The host is named com.omarchy.theme (a generic theme bridge) rather than
WhatsApp-specific, so other bundled web-app extensions can follow the theme by
connecting to it and adding their id to the host manifest's allowed_origins.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Address review on the WhatsApp theme bridge
Light/dark was decided by weighting raw sRGB bytes, which the comment above
it already described as WCAG relative luminance. sRGB is gamma-encoded, so
the weights only mean anything once each channel is linearized — the two
steps the shell already does in Panel.qml. Every shipped theme classifies the
same either way; a mid-tone custom background does not (#808080 reads 0.502
unlinearized and 0.216 linearized).
Drop the `tabs` permission. The WhatsApp host permission is what lets
tabs.query filter by url and what populates tab urls in onUpdated, so `tabs`
only widened this to every tab's url and title. Tabs without permission
arrive with url unset and fall out on the existing guard.
Give the two new bin commands their metadata directives. Without a summary
they failed test/cli's command metadata check.
Cover all three: the classifier over unambiguous and mid-tone backgrounds,
and the manifest for the permission it should no longer ask for.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Scope color-scheme listeners to their query and test the real host
Registrations all shared one Set keyed only by callback, so an app that gave
the same callback to both the dark and the light query and later detached one
detached the other too, leaving the query it still held deaf to theme
changes. Record the owning MediaQueryList and match on it. Adds native
dedupe behaviour while there: registering the same callback twice fired it
twice. addListener is a legacy alias of addEventListener("change"), so the
two share one registration space and either remover cancels either add —
which is also why useEvent had nothing left to select and is gone.
The refresh test signalled a synthetic sleeper carrying its own USR1 trap, so
it proved the refresh command sends a signal but would have stayed green
through any regression in the host's own trap, watchdog wait, or second
write. Drive the real host over a FIFO instead, count framed messages, and
assert the second one is a usable theme. Verified by neutering the host's
USR1 trap: the old test passed, this one fails.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Harden Chromium theme bridge
* Address Chromium theme bridge review
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Clones of omarchy.clock become dhh.clock instead of local.clock, so a
published clone carries its author's namespace. The clone command owns
the id derivation and gains --edit to open the result in $EDITOR, and
the shell exposes clonedFrom in listPlugins so the plugin menu no longer
reconstructs clone ids.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Sync Omarchy themes to Claude Code
Claude Code 2.1.118 added custom themes as JSON files in
~/.claude/themes, watched and hot-reloaded, so this follows the same
shape as the Pi integration (da53c0ff, bin/omarchy-theme-set-pi).
A claude.json template renders from each theme's colors.toml — no
per-theme files, so every stock and community theme is covered — and
omarchy-theme-set-claude copies the result into
~/.claude/themes/omarchy.json on theme switch, retinting running
sessions without a restart.
The theme just appears as "Omarchy" in the /theme picker, and picking
it once (or running omarchy-theme-set-claude --activate) makes every
future theme switch carry Claude Code along. No ~/.claude directory,
no-op.
* Respect custom Claude config directory
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Dismiss bar panels when clicking on another monitor
* Preserve keyboard focus for reopened panels
* Harden cross-monitor panel dismissal
* Wait for panel mapping before releasing focus
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Raw size/12 ratios hand GTK a fractional point size (11px -> 10.08pt),
which clips ascenders in GTK4 menus on scale-1 monitors. Round the
scaled interface font to a whole point and derive the factor from that,
keeping 12px anchored at exactly 1.0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Make menu overflow visible with a half-row peek and edge fades
Menus used to cut off clean at ten rows, so anything below the fold was
undiscoverable. Now the list sizes to what fits within 60% of the screen
and always ends mid-row when items overflow, with scroll-position-driven
fades at both edges. Keyboard navigation keeps the next hidden row peeking
past the cursor so the fold affordance travels with the selection.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Collapse WhatsApp Web to a Signal-style avatar rail in slim windows
Add a WhatsApp Slim Chromium extension that injects CSS into
web.whatsapp.com, collapsing the chat list to a 90px avatar rail with
floating unread badges when the window is narrower than 1100px. Wide
windows keep the stock layout.
Loaded through the existing --load-extension list in chromium-flags.conf,
with a migration to append it for existing users.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Menus used to cut off clean at ten rows, so anything below the fold was
undiscoverable. Now the list sizes to what fits within 60% of the screen
and always ends mid-row when items overflow, with scroll-position-driven
fades at both edges. Keyboard navigation keeps the next hidden row peeking
past the cursor so the fold affordance travels with the selection.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add Wi-Fi QR sharing to network panel
* Refine Wi-Fi QR sharing
* Use QR glyph for Wi-Fi sharing
* Add click-to-reveal password to the Wi-Fi share card
Scanning the QR is the fast path, but the person typing on a laptop needs
the actual password. A dimmed "Show password" hint under the QR toggles
the secret in place.
The password stays out of the shell until asked for: a click runs the new
omarchy-network-password helper (a private pipe, never an argument), and
closing the card drops it again. Open and enterprise networks never show
the control.
The card loses its Close button -- Escape and clicking outside already
cover it -- and now sizes itself to its content.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Keep a dismissed Wi-Fi share card closed and make Escape reliable
Closing the card mid-generation killed the helper, but its buffered
stdout still arrived and repopulated the matrix, reopening the card the
user just closed. Both collectors now honor qrExpectedStop, and the flag
survives onExited because exit and stream-finished have no guaranteed
order. The password fetch gets the same treatment so a reveal in flight
during dismissal can't stash the secret into a closed card's state.
The content's focus was claimed while the window was still unmapped, so
Escape could land nowhere. Re-acquire it after mapping, the way
KeyboardPanel does.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Share WEP networks correctly and restore the QR quiet zone
NetworkManager models WEP as key-mgmt "none" plus a wep-key, so the QR
helper encoded WEP networks as open -- a QR that scans fine and then
silently fails to join. Encode them as T:WEP and let the password helper
print the key.
Also widen qrencode's margin from 2 to the spec's 4-module quiet zone;
the card surround is dark, so that white border is all a scanner gets.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Nothing stood between "memory is tight" and "processes die at random":
the kernel OOM killer only fires after an allocation has already failed,
so a machine under pressure thrashes in reclaim until something breaks
somewhere fatal — seen in practice as Hyprland taking SIGBUS mid-memcpy
from a client shm pool that memory pressure was tearing down.
Enable systemd-oomd, which keys on PSI stall time rather than free
pages, and mark app.slice — and only app.slice — as its kill candidate.
Hyprland runs in session.slice, so the compositor is structurally
ineligible as a victim: oomd takes the app that caused the pressure and
the session survives. Thresholds (50% stall over 20s, Fedora's desktop
defaults) live in an oomd.conf.d drop-in; candidacy ships as a vendor
drop-in under /usr/lib/systemd/user so existing users get it on package
upgrade with no per-user seeding.
New installs enable the daemon from enable-services.sh; a migration
covers existing ones, restarting an already-running oomd so it doesn't
keep stale thresholds until reboot.
Deliberately not earlyoom: it triggers only when free RAM and free swap
are both under threshold, so Omarchy's large, mostly-idle swapfiles
keep it asleep through exactly this failure.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The previous wording claimed the argument must name a file under
$OMARCHY_PATH/config/ and that anything else is rejected. The check is
`[[ -e $default_config_file ]]` against an interpolated path, so `../AGENTS.md`
resolves in both trees and copies over $HOME/AGENTS.md, exit 0.
- The privilege-escalation rule told agents to use pkexec for all privileged
work, which contradicts default/omarchy-skill/SKILL.md — a file this repo
ships — and the code follows the skill, not this line. Defer to it rather than
restate it, so the two cannot drift apart again.
- config/hypr/hyprlock.conf does not exist, so the refresh example fails with
"Not a shipped user config". Use hypr/hyprland.lua, the example
bin/omarchy-refresh-config prints in its own usage.
- Neither IPC example was right: no target named `bar` is registered anywhere,
and `image-selector` is registered by shell.qml rather than the background
switcher, which registers `background`. Name the targets that exist.
Pins the active connection to 2.4/5/6GHz, or leaves the choice automatic.
The section only appears on Wi-Fi when the network answers on more than one
band, or while a pin is in force so it stays clearable.
bin/omarchy-network-band reports and sets the band. It sets NetworkManager's
802-11-wireless.band rather than pinning a BSSID: NM 1.44+ accepts a third
band value so 5 and 6GHz can be pinned apart, and a band survives an AP
rotating its BSSIDs while leaving roaming between APs intact. It refuses a
band the network does not answer on, and restores the previous setting if
reassociation fails rather than leaving the machine offline.
Under Automatic the pills collapse and the header reads the live band
("WI-FI BAND: 2.4GHZ"); pinning reveals them and the header goes plain. The
height is animated, and the section stays mounted through the reconnect a
band change causes -- otherwise `kind` briefly stops being "wifi" and the
whole segment would tear down and rebuild.
Two fixes to the same panel fall out of this:
- Every stat row stays mounted and reads "--" until it has data, instead of
appearing a beat after the panel opens and shoving the rows below down.
- The speed test's Run button is scaled to match the band header's controls
and joins the keyboard cursor chain.
ToggleSwitch gains a settable trackHeight so a compact placement can render a
genuinely small switch instead of scaling one down onto fractional pixels.
Defaults are unchanged.
Claude-Session: https://claude.ai/code/session_01XcKqYe1n5bnRBuAZwikwsr
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude Code reads CLAUDE.md, not AGENTS.md, so this repo's AGENTS.md
guidance was invisible to it while Codex and Cursor read it fine.
The bridge lives at .claude/CLAUDE.md and imports @../AGENTS.md, keeping
the repository root uncluttered. Content stays in AGENTS.md; this file
only points at it.
Open the main window fullscreen so the bar does not cover Resolve's menu, and let parent windows yield focus so their dialogs remain usable. Match both free and Studio editions.
Co-authored-by: 28allday <gavin.nugent@hey.com>
Add right-click handling to the notification card MouseArea so users
can manually dismiss notifications by right-clicking on them.
Previously, only left-click was handled (which triggered the default
action). Now right-click emits closeRequested() to dismiss the popup.
Co-authored-by: taxin <unknownbrofrombd@duck.com>
* Launch apps by their full desktop file name
gtk-launch only appends the .desktop suffix when the argument doesn't
already end with it. Apps whose desktop id itself ends in .desktop --
notably Telegram (org.telegram.desktop.desktop) -- were therefore looked
up as a nonexistent file and silently failed to launch from the menu,
while every other app worked.
Passing the full file name to gtk-launch resolves the entry
unambiguously for both naming styles.
* Clarify launch comment wording
* Warn when disk space is low before updating
* Simplify update free space warning
* Stop updates without enough free space
* Allow forcing updates with low disk space
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Show OSD and sync touchpad steps when scrolling bar widgets
Scrolling the volume or brightness icon in the bar changed the value
directly without ever calling omarchy-osd, so only the keyboard media
keys showed the popup. On top of that, a touchpad's stream of many
small wheel events per finger-drag wasn't matched to a mouse's single
±120 notch per click, so touchpad scrolling felt uncoordinated and
uneven next to the keyboard/mouse behavior.
- shell/plugins/panels/audio/Panel.qml: accumulate raw wheel delta and
only apply a step once it crosses a full mouse-notch's worth, so
touchpad and mouse move the volume in identical 5% increments, and
ping the OSD each time a step actually lands.
- shell/plugins/panels/monitor/Panel.qml: same accumulator for
brightness, with a 5% floor so scrolling down can never blank the
screen.
- shell/plugins/osd/Osd.qml: animate the progress bar's width instead
of snapping, so successive steps glide smoothly.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix bar wheel OSD behavior
* Normalize scaled wheel events
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Give built-in plugins an honest on/off state
Every built-in reported itself enabled no matter what. A bar widget said
"enabled" while sitting nowhere near the bar, and disabling a built-in service
silently did nothing, because enabled meant "listed in plugins[]" and a
built-in never is. Nothing surfaced that, since the only caller listing plugins
was the CLI.
For a widget, on and off is its place in the bar, so listPlugins reports layout
membership -- what enable/disable actually toggles. For everything else built
in, loading by default is the right behaviour to keep, so switching one off is
recorded the other way round, in disabledPlugins[]. shell.json still carries
only the deviation from the defaults: the key is dropped the moment nothing is
switched off, leaving a config that never disabled anything byte-identical.
isEnabled still answers a separate question -- whether the component loads at
all -- and deliberately does not follow a widget out of the bar. omarchy.menu
is both a widget and the menu itself, so tying the two together would let
taking its button off the bar lock the menu out of the shell, with no way back
that isn't the CLI.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Manage plugins from Setup > Plugins
Plugins were CLI-only. Setup > Plugins now offers Enable, Disable, Add, and
Remove, each list living in the menu itself so picking a row acts on it.
Enable and Disable cover the built-ins as well as anything installed -- the bar
widgets you can put in the bar, the services and overlays you can switch off.
Remove is limited to plugins the user installed, since a built-in has no
checkout to delete, and stays hidden until there is one. Whole-bar
replacements are left out; those are chosen under Style.
Enabling a bar widget asks for a section first, because enabling alone drops it
on the right and the only way to move it was a follow-up bar plugin move. The
CLI asks the same question after its own add, so both paths place a widget the
same way. Add and Remove run in a terminal: one needs a git URL and shows the
trust warning before cloning, the other deletes a checkout and prints where it
backed it up.
Providers grew two hooks for this. placementFor turns a row into a submenu
instead of an action, and volatile re-runs the enumeration when its submenu is
entered -- picking from these lists is what changes them, and rows a provider
no longer returns now drop out instead of lingering forever.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Trim the plugin menu after review
Menu.qml carried its own shellQuote while already importing Util and calling
Util.shellQuote a few lines up; two copies of the same escaping is one place
for a future fix to miss. isDisabled walked the array by hand to compare values
it writes itself, and dropDisabled was an eight-line helper with one caller.
Two bugs came out of the same pass. A whole-bar replacement belongs under Style
rather than these lists, but the exclusion sat in the shared row builder, so a
third-party bar could be installed and never removed -- Remove would show an
empty list under a guard that said something was there. The exclusion now sits
on the two lists that mean it.
Rows are keyed by id, and distinct plugin ids can slugify alike: acme.foo,
acme_foo and acme-foo all give acme-foo. The merge keeps the first row per id,
so the rest simply vanished from the list with nothing to say why. Row ids are
now made distinct before merging.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Pick a plugin the way we pick a theme
Setup > Plugins listed plugins as menu rows, which needed three providers, a
placement submenu, a volatile-refresh hook and a row-swap in the merge. Only
Font and Apps are built that way. Theme, Background, Unlock, Timezone and
Keybindings all pipe a list into omarchy-menu-select instead, which is one
action string and a small script -- so that is what these use now.
The trade is search: a plugin name is no longer findable from the root prompt.
Neither is a theme name or a timezone, and Enable Plugin still is, so the loss
sits where the rest of the menu already puts it.
Two pieces of the row machinery stay, because they are worth having for the
lists that remain. A volatile provider re-runs when its submenu is entered, so
a font installed since the shell started now shows up without restarting it,
and rows a provider stops returning drop out. Row ids are still made distinct
before merging: Fira Code and Fira-Code both slug to fira-code, and a repeated
id was silently dropped.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Let a picked option carry an icon
Moving the plugin lists onto omarchy-menu-select cost them their glyphs: the
select mode has always hardcoded an empty icon, which is why Timezone and
Keybindings have none either. An option may now lead with one, as
"<glyph><TAB><label>". The menu shows the glyph, filters on the label, and
hands the label back, so a caller never strips a glyph off its own selection
and a list of plain strings behaves exactly as before.
The plugin picker uses it for the puzzle glyph on each plugin and the align
glyphs on the sections, which also regain the capitals they lost when the
section names were passed through raw.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Switch bars by enabling one
A bar option was kept out of Enable and Disable on the grounds that picking
which bar to run belongs under Style -- but nothing under Style ever offered
it, so an installed bar could be added and removed and never actually put to
use. The menu was guarding a door to a room that was never built.
Enabling one is the switch. setEnabled already assigns bar.id for a bar
option, so a bar has always replaced the one before it; only the picker's
filter stood in the way. Dropping it costs nothing else, because enabled for a
bar option means active: the bar in use is the one row absent from Enable,
every other installed bar is one pick away, and the built-in is just another
entry, so going back to it is enabling Bar.
Disable keeps the exclusion. That is the one verb a bar cannot answer -- there
is no off, only a successor -- and offering it would have listed the built-in
bar on a stock system, where turning it off deletes a bar.id that was never
set and nothing happens.
A bar carries the bar glyph rather than the puzzle one, so a row that replaces
the whole bar does not read like one more widget to switch on, and enable now
says "Now using X as the bar" instead of "Enabled X", which understated a
whole-bar swap in both the enable and the freshly-added path.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Refuse a plugin that declares a kind it cannot load
A kind is a promise to supply something to load, and the shell reads that
something from a fixed key: entryPoints.bar to draw a bar, entryPoints.menu to
open a menu. Nothing checked the promise. A manifest could claim kinds ["bar"]
with no bar entry point, pass validation, install, and enable -- and then the
bar would fall back to the built-in and the widget would be skipped, leaving a
plugin that does nothing, explained only by a console.warn nobody reads.
Our own plugins have been held to this table by plugins-test.sh all along.
This holds third-party ones to the same table, at add and update time, where
there is still someone to tell.
A kind outside the table is left alone rather than guessed at, so a shell that
learns a new kind does not need this list updated first. The cost is that a
misspelled kind still installs quietly.
omarchy-plugin-validate had no tests; it has some now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Act on the plugin whose row was picked
The picker showed a name and then looked that name up again across every
plugin, filtered set or not, taking the first match. Two plugins can share a
name: cloning one keeps the name it was cloned from, so the documented
`omarchy plugin clone omarchy.clock local.clock` leaves two plugins called
Clock. Enable listed the clone -- the built-in was already enabled, so only the
clone was eligible -- and then enabled omarchy.clock, moving the built-in
widget instead. Remove listed the clone and tried to delete a built-in that has
no checkout to delete.
A row now carries its id alongside its label, and the id is read back off the
row that was picked instead of being derived from the name a second time. Where
a name is not unique among the rows on offer, the label carries the id too, so
two rows that would both say Clock can be told apart at all -- which they could
not before, whichever one the pick resolved to.
The verb prompt only ever sees the first two fields, so the menu shows what it
always did.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Never ask a bar where to sit in the bar
A manifest may declare both bar and bar-widget, and validation accepts it. The
picker saw bar-widget, asked for a section, and passed it to enable. setEnabled
takes bar as the dominant kind: it writes bar.id and returns, adding nothing to
any layout, so the move that followed had no widget to find and failed -- after
the bar had already been switched. A partial success with an error on the way
out.
Bar wins ahead of bar-widget now, in the picker and in the placement prompt
`plugin add --enable` asks, so a bar is enabled without a placement it cannot
use. The CLI refuses a placement on a bar outright, before the bar is switched
rather than after, since `omarchy plugin enable <bar> --section left` could
reach the same half-applied state without going through either.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Only replacement, no off
* Add default placement for bar widgets
* Simplify plugin menu actions
* Document plugin placement behavior
* Allow dropping widgets in empty bar space
* Treat plugin dependencies as runtime invariants
* Reject duplicate plugin ids on add
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Kvantum is a QStyle plugin, so it only ever painted the three QWidget
apps we ship, and it painted them with its own stock look: Omarchy has
never shipped a .kvconfig, so nothing about it tracked the active theme.
Without it Qt falls back to built-in Fusion while the palette still comes
from QT_QPA_PLATFORMTHEME=gtk3, so everything stays dark and now follows
the theme instead of ignoring it. Measured across a full 1920x1080 frame,
dropping it moves obs-studio by 132 pixels -- it overrides the platform
style with its own stylesheet anyway -- kdenlive by 0.8%, and the
Hyprland share picker by 4.7%. Flatter buttons, classic tabs, a
conventional checkbox tick.
Existing machines get a migration, which the Qt5 stack never did. The
difference is that this removal cannot reach the greeter. kvantum-qt5
goes in the same transaction, since it is the only thing that requires
kvantum, and it takes qt5-svg and qt5-x11extras along with it -- but
qt5-wayland is explicitly installed, so the cascade stops there and
leaves qt5-declarative and qt5-base standing for any sddm theme still
starting the Qt5 greeter.
kvantummanager stays in launcher.hides. The entry costs nothing once the
package is gone, and it keeps Kvantum Manager out of the launcher on
machines that have not run the migration yet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
JetBrainsMono Nerd Font draws 10% of the em above the ascent Text
reserves for it (yMax 1120 against ascent 1020), and a patched or
user-chosen family can be worse. In normal flow that sliver costs
nothing; at the top of a clipping list it is sliced off and the header
renders beheaded.
Reserving it in PanelSectionHeader covers every panel at once, rather
than each list working around it in its own geometry.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The widget hid itself well enough that nobody found it: it only ever
appeared if you knew the id and ran `omarchy bar plugin add`, since it was
in neither the shipped layout nor any migration.
Defaulting it on costs nothing on machines that don't use it. Panel.qml is
`visible: providers.length > 0`, and Main.qml only counts a provider that
is enabled and has actually recorded prompts, sessions, active days, or a
rate limit. A box that has never run Claude Code or Codex draws an empty
bar item, and the icon arrives on its own at the first scan that finds
usage — which is the behavior the widget already advertised.
The migration skips any config that already lists the widget in any
section, so a curated bar keeps its own placement rather than gaining a
second copy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
CapsLock is the compose key, so Caps Lock has to live somewhere else, and
both Shifts together is where it went. That combination is easy to hit by
accident while typing, and the lock then sticks until you notice it and
hit both Shifts again.
shift:both_capslock_cancel sets the lock exactly the same way, but types
the Shift keys as ALPHABETIC rather than TWO_LEVEL, so the next lone
Shift releases it. Since a misfire happens while reaching for Shift
anyway, it clears itself almost immediately.
Compose is untouched: <CAPS> stays [Multi_key, Multi_key], so the
~/.XCompose emoji sequences work as before.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The panel drove a Flickable by hand: two Repeaters in a Column, plus an
ensureCursorVisible() that mapped each row into content coordinates and
moved contentY itself. That is the machinery a ListView already has, and
the hand-rolled version came with a 6px margin that scrolled the list
whenever the mouse merely rested near the viewport edge.
Flatten the remembered and discovered groups into one model whose entries
carry the section they came from, and let the view keep the current row
visible. Section headers are computed per index the way the network panel
does it. The cursor keeps working in section-relative terms, so
activation, forget, hover, and the hero toggle are untouched.
Positioning has to be deferred a turn: called straight out of
onCurrentIndexChanged it silently does nothing, because the model is
rebuilt every time discovery reports and the swap resets the view out
from under the call.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kvantum-qt5 only ever existed to dark-mode VLC, and VLC is retired.
qt5-wayland was the Qt5 Wayland platform plugin, but it also quietly
dragged in qt5-declarative, which is what kept sddm's Qt5 greeter alive.
No application we ship runs on Qt5 any more, so the whole stack goes
from fresh installs: about 110 MiB across kvantum-qt5, qt5-wayland,
qt5-declarative, qt5-base, qt5-svg, qt5-x11extras and qt5-translations.
fcitx5-qt keeps a few Qt5 objects it builds regardless, and they simply
go unused.
sddm picks its greeter from the theme's SddmGreeterTheme/QtVersion and
defaults that key to 5, so a theme without it execs the Qt5
/usr/bin/sddm-greeter. That tie is only an optdepend, so pacman would
happily take qt5-declarative and leave a login screen that cannot start.
The theme declares QtVersion=6 now, and the Qt6 greeter renders it
unchanged.
kvantum, the Qt6 style engine behind QT_STYLE_OVERRIDE, was only ever
present as a dependency of kvantum-qt5, so the package list swaps to it
rather than dropping the line. obs, kdenlive and the share picker keep
the styling they have today.
Machines already installed keep their Qt5 stack. Shedding it there means
deciding which greeter sddm will actually launch, and that means
reimplementing its config loader: sddm reads every file in sddm.conf.d
whatever its extension, QSettings trims keys and lets the last duplicate
win, and ThemeDir can move the themes entirely. Not worth risking a
login screen for 110 MiB that a reinstall reclaims anyway.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every other bluetoothctl call in the script is silenced and time-boxed;
the new power check was neither, so a wedged D-Bus could hang pair before
it reached its own timeout and spill dbus assertions onto stderr.
Cover both paths with a stubbed bluetoothctl: the power-on sequence is
skipped when the adapter reports Powered: yes, and still runs when it
does not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The edge channel installs omarchy-dev, but omarchy-version only queried
omarchy, so it exited 1 there. omarchy-snapshot runs under set -e, so the
failed lookup aborted the whole update over a snapshot label.
It only worked at all because omarchy-dev declares provides=(omarchy) from
the installer repo. Builds without it fail, so check both packages here
instead of relying on a declaration from another tree.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The shell starts before DHCP finishes, so Claude's first probe of the
OAuth usage endpoint came back as a transport failure and pinned "Claude
limits unavailable" for a full refresh interval. Opening the panel could
not clear it either: the open path refreshed unforced and hit the same
throttle it was trying to escape.
A transport failure now arms a short retry that goes straight to the
probe, since a retry answering to the throttle never gets off the
ground. Any real answer disarms it — a server that replied, 429
included, is one to stop pestering. Probes are single-flight, a fresh
token skips the throttle its predecessor set, and opening the panel asks
for the wire without re-walking every transcript on disk.
The module also earns its place in the bar now instead of sitting there
dimmed with nothing to say: it collapses out entirely until a provider
has actually recorded usage, here or on a synced machine. That made both
presence probes redundant, so they are gone. Selection follows the
provider rather than its slot, so one appearing while the panel is open
no longer swaps out what you were reading.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Clipboard history is fed by two wl-paste --watch processes started once
when the shell loads. When one dies, nothing notices: copying still
works, the picker still opens, and the old entries are all still there,
so history just silently stops recording until the next shell reload.
Respawn them on exit instead. The one-shot timer both coalesces the case
where both watchers die together and keeps a wl-paste that cannot start
at all from spinning as fast as fork allows.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The hero switch is the panel's on/off, so it now carries output and input
together rather than output alone. It reads as on while anything is still
audible, which keeps muting a single channel from flipping the master switch.
Right-clicking a volume bar mutes just that channel -- output, input, or one
app's stream -- matching what the `m` key already does for the focused row.
Only channels that exist get a vote: a machine with no default source would
otherwise report its input unmuted forever, leaving the switch able to mute but
never to unmute.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sliders only ever accepted the left button. Audio wants right-click as a
secondary action on the track, so emit rightClicked() for it and keep dragging
left-button-only: press and release both ignore anything else, so a right-click
can neither start a drag nor move the value.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add Tailscale header on/off toggle
* Address Tailscale toggle review feedback
* Hide Tailscale tooltip while busy
* Keep Tailscale labels clear of header toggle
* Extract the switch from Toggle into a reusable ToggleSwitch
Toggle rendered its own track and knob inline, so anything else wanting a
switch had to copy the geometry. Pull it into Ui/ToggleSwitch.qml and let
Toggle compose it, and give PanelHero a trailingControl slot so a hero can
pin a control to its trailing edge without the caller doing the layout.
The switch draws its cursor as a ring outside the track: themes give normal
chrome a stronger border than hover-cursor, which is right for controls that
are borderless at rest but would make a bordered track go fainter under the
cursor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep the panel cursor on the virtual header section
clampCursor resets focusSection whenever it is not in visibleSections, but
"header" is virtual and never appears there. Any refresh of the underlying
model therefore threw the cursor off the hero toggle: muting republishes the
PipeWire snapshot, and toggling the Bluetooth adapter empties and refills the
device lists. moveCursor already special-cases "header"; clampCursor now does
too.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Toggle panel heroes with a switch instead of the status icon
The hero icon doubled as the on/off control, which was invisible as an
affordance and made the icon carry two jobs at once. Give Tailscale, Dropbox,
Bluetooth, Audio, and Network a ToggleSwitch on the trailing edge of the hero
and leave the icon to report status. The switch is the header's only cursor
target, so the keyboard reaches it the same way the mouse does.
Dropping the icon's focus ring also drops heroRingPad, which lets each hero
line up with the rows beneath it. Network's link detail moves inline after the
name -- "Ethernet (2.5gbit)" -- since the pill crowded the switch.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Make the network hero switch honestly a Wi-Fi switch
The switch reads and writes Networking.wifiEnabled, but its tooltip claimed to
turn "network" on and off whenever Ethernet was the active connection. A click
asserted nothing; a switch asserts state, so on a wired machine with the radio
off it sat there reading "off" beside a perfectly live Ethernet connection.
Say Wi-Fi, and only offer the switch when there is a radio to switch.
headerActionCount follows the same condition so the keyboard cannot reach a
control that is not there.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Stop the header cursor claiming an absent switch
The switch hides when the thing it toggles is unavailable -- no Tailscale CLI,
no Dropbox CLI, no Wi-Fi radio -- but "header" stayed reachable, so the cursor
could sit on a target that never rendered. The old clickable icon was always on
screen, so there was always something to highlight.
"header" stays navigable and Enter still no-ops safely; the cursor just stops
claiming a spot that is not there.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Wrap the gallery's switch caption
The caption sat unbounded inside the switch row. The gallery has a 560px
minimum width, horizontal scrolling off, and clipping on, so at that size the
end of the line was simply unreachable. Move it below the row and wrap it, the
way every other description in the gallery already does.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every install row that leaves a durable artifact now carries a `when`
that mirrors its remove counterpart, negated. Packages check
`omarchy-pkg-present`, Ollama checks the command since the action picks
between three packages, and the rest check whatever the installer
actually leaves behind: Games/battlenet, the Xbox Cloud and Windows VM
desktop files, the flatpak, the mise install dirs, ~/.rustup, ~/.opam,
the composer laravel binary, the phx_new archive.
Chromium Account now shows only when chromium-flags.conf exists and
lacks the oauth client id. It was a visible no-op both before Chromium
was installed and after the flags had been added.
The pickers stay unguarded: Package, AUR, Web App, TUI, Style, Docker
DB, and the RetroArch Game Launcher, which builds one launcher per game.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pacman refuses to install over a file it doesn't own, so any path an
Omarchy package starts shipping that a script had already written by
hand aborts the whole upgrade:
omarchy-settings-dev: /usr/lib/systemd/user/omarchy-fcitx5.service exists in filesystem
Errors occurred, no packages were upgraded.
The mitigation was a hand-maintained --overwrite allowlist, and it only
worked with foresight: an entry had to ship a release before the package
took the path, because pacman checks conflicts during transaction
prepare, so the script running the upgrade is the one already on disk. A
missed entry left people hard-stuck, since the upgrade that would
deliver the entry is the one refusing to run.
So react instead. omarchy-update-system-pkgs now does the ordinary thing
and hands a failed transaction to omarchy-update-system-pkgs-when-
conflicted, which moves the offending files out of the way and runs the
upgrade again. Nothing has to be predicted, and the allowlist is gone.
Moving rather than overwriting is what makes it small: no --overwrite
argument to build, no glob escaping, no separate backup step, and a
leftover directory is cleared too, which --overwrite cannot do at all.
Files go to /var/lib/omarchy/replaced/<original path>, not next to the
original. A sibling copy is not inert -- SDDM reads every file in
sddm.conf.d whatever its extension, and systemd-sleep runs every
executable in system-sleep -- and the directory a future path lives in
is unknowable, which is the whole point of a mechanism for paths nobody
predicted.
What it will not do:
- Take a file another package owns. pacman reports those with a
"(owned by x)" suffix, so the end anchor excludes them, and pacman -Qo
re-checks the live database before anything moves.
- Move a subset. If any reported conflict isn't recoverable the retry is
doomed anyway, and moving leaves that config inactive for nothing --
worse than the stuck-but-intact state.
- Leave anything inactive that was live. A failed retry, a failed move
partway through the loop, or an interrupt all put back whatever the
upgrade didn't install.
- Act on a report handed to it by hand. It is internal to the update,
and an old report would clear live files for an upgrade that isn't
happening.
Also adds a test that fails when a script writes a path under /usr that
no PKGBUILD installs, since not creating these is cheaper than
recovering from them. It reads the destination off the command, so a
path assembled from variables still slips through; the two known cases
are recorded with their reasons.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
omarchy-migrate-notify handed its notification to `systemd-run --scope`,
which is synchronous: the calling process becomes the payload, so
systemd-run does not return until the toast has been answered -- and if
the toast is clicked, not until the migration terminal it opens has been
closed.
omarchy-migrate-notify.service is Type=oneshot, which defaults to
TimeoutStartUSec=infinity, so the unit sat in activating for exactly that
long. On a machine that had not yet picked up c7e327b0, which orders the
notifier after graphical-session.target, that held the target open --
and wayland-wm-app-daemon.service is ordered after the same target, so it
never started. Every keybinding goes through uwsm-app, which waits ten
seconds for that daemon's pipes and then reports "App failure -- Timed
out waiting for pipes!" instead of launching anything. Keybindings were
dead for two minutes and seventeen seconds, until a pacman hook ran
`systemctl reload user@*.service`, whose re-exec of the user manager
broke the scope's bus connection and let the oneshot finish. That also
made systemd-run exit non-zero, so the notifier fell through to the
terminal fallback meant for having no user manager at all, and printed
the migration list into the journal.
Hand the notification to a transient service instead. systemd-run
returns once the unit has started rather than once the payload is done,
so the oneshot completes in milliseconds and nothing ordered after the
target waits on a toast. Put it in background-graphical.slice, which
systemd ships with PartOf=graphical-session.target, so an unanswered
toast ends at logout rather than outliving the session.
The terminal a clicked toast opens is unaffected: uwsm-app re-registers
it into app-graphical.slice, outside this unit's cgroup.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fcitx5 is what turns the CapsLock compose sequences in ~/.XCompose into
text for Wayland clients -- CapsLock m s for an emoji, CapsLock space n
for your name. It was launched fire-and-forget from Hyprland's autostart
via uwsm-app, so nothing supervised it, nothing restarted it, and it
logged nowhere. When it went away, every compose sequence stopped
working for the rest of the session with no visible symptom beyond
"emoji input is busted", and no record of why.
That is not hypothetical: it was found dead on a running machine with no
coredump, no OOM kill, and nothing in the journal to explain it.
Move it to a systemd user service:
- Restart=always, not on-failure. fcitx5 exits 0 when it finds another
instance already owning org.fcitx.Fcitx5, and a clean exit still
leaves the user with no input method.
- After=/PartOf=graphical-session.target. It needs WAYLAND_DISPLAY and
DISPLAY, which uwsm imports into the user manager before reaching the
target, and its wayland connection dies with the compositor.
- ConditionEnvironment=WAYLAND_DISPLAY. After= is ordering only and does
not stop the unit from being started while the target is inactive. An
update over SSH has a live user manager (pam_systemd) and no graphical
session, and a fcitx5 started there comes up blind -- then stays
active, so the later target activation won't pull in a working one,
because Wants= does not restart what is already running. Skipping the
start leaves the unit enabled and healthy for the next graphical login.
The migration hands over inside a live session only: it enables without
--now, and only when graphical-session.target is active does it drop the
autostart-launched process and start the unit. Because that kills a
fcitx5 that was working a moment ago, a failed start is reported instead
of leaving the session mute with the migration marked complete.
omarchy-restart-xcompose now drives the unit. It still clears any fcitx5
running outside it first: that process owns the bus name, so the unit's
instance would exit on arrival and the stale one would keep serving the
old table -- a restart that reports success and changes nothing.
Side benefit: fcitx5 now logs to the journal under its own unit, so the
next disappearance leaves a record.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Enable cd/dvd ejection by default for all systems with a key mapped to "XF86Eject".
This e.g. activates the eject button on vintage Macbook Pro laptops with optical drives.
The retired omarchy-update-user-notify.path stays loaded in sessions that
started before the update removing it, and pacman writes the migrations
directory mid-transaction, so it fired a critical toast for migrations that
omarchy-migrate was about to apply a step later. Migration 1785095882 stops
that watcher, but migrations run after pacman, so it lands 11 seconds too
late to prevent the toast it exists to retire.
Check the lock omarchy-update holds for its whole pipeline instead of
trusting that no trigger exists. That covers the stale watcher and anything
added later: during an update every pending migration is by definition
already being applied. The check repeats after waiting for the notification
server, which is long enough for an update to start underneath it.
Only this user's runtime directory is read, never the /tmp path the updater
falls back to without XDG_RUNTIME_DIR. A shared lock file belongs to whoever
created it first, so honouring it would let one user silence another user's
notification; a redundant toast is the better failure.
The sleep inhibitor now starts with the lock descriptor closed. It outlives
the step that starts it, so an update killed before restore_update_inhibitors
left it holding the flock indefinitely. That already blocked later updates,
and now that the notifier reads the same lock it would have silenced
migration notices at every login.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Chromium ships in the base packages, so it never goes through
omarchy-install-browser, and a first install stamps every migration as
already applied without running it. That left both bundled extensions
loaded from chromium-flags.conf with no host to talk to: Copy URL did
nothing at all, since the clipboard write and the toast both live in the
host.
The user install now registers both hosts itself, and a migration
repairs the installs that already missed out — Copy URL since 1784763917
landed, Download Video since 1780517689, unless installing a browser or
refreshing Chromium happened to fix them along the way.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VeAd2iERgi7bRSxq2gA1hp
The migration went away in 88ef6ca5, and the test resolved it by grepping
migrations/ for its banner, so it could only fail from that commit on. It
used the shipped 90-omarchy.conf as a fixture only; config-test and
zram-migration-test still cover that file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
omarchy-migrate-notify.service is a Type=oneshot wanted by
graphical-session.target, and systemd complements a target's Wants= with an
implicit After=, so the target waited for the notifier to exit. The notifier
does not exit quickly: it sends the notification through systemd-run --scope,
which is synchronous, and omarchy-notification-send -a blocks until the user
clicks. The target stayed in activating for as long as the toast was up.
wayland-wm-app-daemon.service is After=graphical-session.target and nothing
wants it, so uwsm-app starts it on demand. Clicking the notification runs
omarchy-launch-floating-terminal-with-presentation, which execs uwsm-app,
which blocks on a systemctl --user restart of that daemon -- a job queued
behind the very target the clicked notifier was holding open. The terminal
never opened; uwsm-app gave up on its own pipe timeout instead.
Declaring After= on the wanted unit suppresses the implicit dependency rather
than forming a cycle, so the target is reached without waiting and the
notifier runs behind it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The bar is instantiated once per screen, so each widget registers its IPC
handler once per screen and Quickshell reports a collision for every screen
past the first. Failing on any collision would have failed the suite on
multi-monitor desktops for behaviour that is correct; allow one per screen
and fail only beyond that, which is still what duplicate component loads
produce.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Qt.createComponent is asynchronous, but a widget was only recorded in
pluginWidgetComponents once its component finished. syncPluginWidgets runs
several times while the shell starts, and every pass that ran while a load
was still in flight could not tell it apart from one that had never
happened — so it started a second load of the same URL. All twenty bar
widgets were loaded twice.
The duplicate component then replaced the first in the registry, and
swapping a slot's component makes its Loader build the replacement before
dropping the original. Both were briefly live, and both registered the
widget's IPC handler, which is where the "another handler is registered
for target" warnings came from.
Claim the key when the load starts instead, and release it if the
component fails so a later rescan can retry.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Both sides tightened the same center-layout assertion. Taking quattro's:
it asserts the weather/update adjacency the test name is about instead of
pinning the whole row, which is what kept breaking it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The center section declares both an anchored and an unanchored
arrangement and shows whichever fits, but a hidden ModuleList is still a
loaded Loader. With a center anchor set — the default — every center
module was therefore mounted twice for the life of the session: two IPC
handlers registered for the same target, two clocks ticking, two of every
timer and network fetch behind them, one set of which nothing could
reach.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Double-tapping the year bar asks for a birth year and a life expectancy,
and a second bar appears below measuring one against the other. Tab moves
between the two, Enter commits the pair, Escape drops them. Hovering the
bar names the thing, and double-tapping it puts it away again.
A birth year rather than an age, so the bar keeps counting on its own
instead of going stale the moment it is entered. Expectancy defaults to
ninety and falls back to it when what is entered makes no sense, so the
bar always has something to measure against; a birth year that makes no
sense leaves the bar hidden instead, which is also where it starts.
Putting the bar away keeps the expectancy, so setting a birth year again
brings your own number back rather than the default.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The resize guard reads the Used column for /dev/zram0 out of /proc/swaps
and treats a missing row as an empty device, which is right for a device
that doesn't exist yet: the restart is what brings it up against the
config daemon-reload just generated. A device that exists and is merely
swapped off reads the same, and there the restart resets it first, which
returns EBUSY for as long as anything still holds it open. That leaves a
bare "Job failed. See 'journalctl -xe' for details." in the migration
output and falls through to asking for the reboot that would have
resized it anyway.
Tell the two apart by whether /sys/block/zram0/disksize is there at all.
The test modelled an absent device as a blank disksize file, which no
longer stands in for one, so it removes the file instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Its setup check grepped omarchy-setup-system for config/snapper.sh, which
the config phase has run since the install was split into phases.
The omarchy-pkgs and omarchy-iso lookups also missed the sibling checkout
layout that f375113f taught config-test about, so they failed on machines
where config-test passed. Both now take an explicit path override.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
updatedb refuses to run at all on a config that defines a variable twice
("variable `PRUNEPATHS' was already defined"), so any rewrite that misses
an existing line and appends a second one takes the locate index down
rather than fixing it. Two shapes updatedb accepts got missed: a trailing
comment after the value, and a setting indented by whitespace.
Read the existing paths out of the quoted value and write the whole
setting back canonically instead of splicing into a line of unknown
shape. Quotes are not optional to updatedb ("value in quotes expected
after `='"), so a bare value is already a broken config: rewriting it
quoted repairs the file as a side effect.
The tests now hand every rewritten file to the real parser through
`updatedb --config-file`, which is what caught this.
Read the Snapper config as root when the running user cannot read it.
snapper create-config leaves the config root-only, and a config the user
cannot read was passing for one that wants its timeline snapshots kept.
Report the snapshots the drain could not delete. omarchy-migrate writes
the completion marker whether or not the batches succeeded, so there is
no later run to pick up the remainder, whatever the comment claimed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A cloned bar widget is copied out on its own, so a relative JS import
lands in a directory without the file and the clone fails to load. Point
those imports back at the bundled module, the same way Qt.resolvedUrl()
references were already rewritten.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claiming the shared suppression flag before showing meant the outgoing
panel's close cleared it again, leaving the incoming panel open with the
indicators still revealed. Guarding the clear instead only moved the
problem: handing off to a panel that does not manage the flag left it
stuck on, and the center indicators stopped revealing on hover for good.
Claim it after the handoff instead. The panel taking over always wins,
and a handoff to a panel that knows nothing about the flag still leaves
it cleared.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Clicking the clock reveals a month grid with ISO week numbers, a year
progress meter, and month stepping. Right click walks the common label
formats and writes the chosen one back to shell.json, so the bar shows
what the config stores. The week start toggles from the grid's "W"
heading and persists as weekStartDay, defaulting to the locale's own
first day.
Rich popup widgets live in their own plugin directories, so the clock
moves out of bar/widgets/ into panels/clock/. The id is unchanged, so
existing layouts and centerAnchor keep working.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The bar identifies a panel by the widget mounted in its slot, but the
nested panel handed the popout coordinator itself. The open-panel mark
never lit under the weather pill, and Tab could not leave the panel.
Closing for a popout switch also cleared the shared hover-reveal flag the
incoming panel had just set.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A center-anchored module is mounted twice: the copy that is drawn, and a
zero-size placeholder holding its place in the flow beside the anchor.
findPanelWidget returned whichever registered first, and that order is
not stable across a live bar reconfiguration, so a panel could open
anchored to the invisible copy -- mispositioned, with the drawn slot
never lighting up and switchPanelFrom unable to find it again.
The mark was also always 55% of the slot, which fits an icon but
underlines only a fraction of a text label, and runs the full height of a
multi-line module on a vertical bar. Modules can now say how long the
mark should be along the bar; anything that does not answer keeps the old
proportion.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The center layout was reordered when the indicators moved next to the
clock, but the assertion kept the old order, so this has been failing on
quattro since.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Send files to a tailnet machine with Taildrop
The panel gets a send button next to the copy one on every machine that
Tailscale grades as a Taildrop target, and `s` does the same from the
keyboard. Picking runs through the XDG portal chooser, so it looks like
the file dialog every other app opens.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJQJfHXXApUk6En8EZisHg
* Save incoming Taildrop files and say so
Linux keeps Taildrop files in the daemon's inbox until someone asks for
them, so nothing arrived until you ran `tailscale file get` by hand. A
user service now stages each delivery next to the downloads directory,
hands it over under a free name, and announces it — with a preview when
it's an image, and a click to open it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJQJfHXXApUk6En8EZisHg
* Float every portal dialog, not just the titled ones
The portal only ever shows dialogs, and the title regex missed any
chooser an app names something else — ours included.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJQJfHXXApUk6En8EZisHg
* Re-run the Taildrop enable now that the unit ships
The unit was never installed to /usr/lib/systemd/user/, so the enable had
nothing to act on and machines that already ran the migration carry a marker
for a no-op. Rename it so they get a working pass, and report what systemctl
says instead of a bare failure line.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Wait for the file chooser on the connection that asked for it
The portal answers a request with a Response signal directed at the connection
that made it, and dbus-daemon delivers directed signals only to that
connection. gdbus monitor registers with AddMatch rather than BecomeMonitor, so
it never saw the reply: every pick left omarchy-file-select blocked on a read
that could not arrive, taking omarchy-tailscale-send down with it before it
reached either its notification or the transfer.
Make the call and wait for the signal on one connection, and give up after ten
minutes so an unanswered dialog cannot strand the caller.
Drop the "Sending to" notification while here, so a send reports once.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Mark Taildrop notifications with the panel's send glyph
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Stop a hung tailscale poll from freezing the panel
Each poll is skipped while its own process is still running, so one that never
exits leaves the panel showing whatever it last read, for good: the peer list
keeps a woken machine missing, and opening the panel cannot help because open
runs the same refresh that hits the same guard.
Reap anything still running fifteen seconds after a refresh, well inside the
thirty second interval, so the next tick starts clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Place a moved widget where an added one lands
'move omarchy.media left' named a section, not a slot, but the section went
through as an explicit target, which resolves a missing index by appending. The
widget landed on the far end of the row instead of after the section anchor
where 'add' puts it.
Its test has never run: the assertion covering this went in four hours after an
unrelated layout change had already stopped the file, and the runner stops the
whole suite at the first failure.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Keep the config test from failing on things it is not about
The center layout assertion pinned the whole row, so parking the indicators
left of the clock broke a test named for update sitting next to weather. Assert
that adjacency instead.
The package-defaults check reads PKGBUILDs from the omarchy-pkgs repo and blew
up with a traceback wherever that is not a sibling checkout. Skip it when the
checkout is absent, honour OMARCHY_PKGS_ROOT when it is somewhere else, and
keep failing when it is present and wrong.
Between them these stopped the suite eighty files early.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Make the file chooser a Python command rather than a bash host for one
The portal work was a heredoc wedged inside a bash script that existed only to
parse two flags. Drop the host: argparse covers the flags, and the file says at
the top why it is the one command here not written in bash.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Tell a chooser that never opened apart from one that was dismissed
Three fixes from review:
The poll watchdog rearmed on every refresh, so a refresh interval shorter than
its timeout — the setting goes down to five seconds — pushed the deadline ahead
of a hung process forever. Arm it on the launch that needs watching and leave
it alone.
omarchy-file-select exited 1 both for nothing picked and for a chooser that
could not run, and omarchy-tailscale-send read it through a process
substitution, which drops the status anyway. A session bus that was not there
looked exactly like someone changing their mind. Separate the two exits and
read them with a command substitution.
Delivery picked a free name and then renamed, which overwrites anything that
takes the name in between. Link to the name instead: link(2) refuses one that
is taken, so the check and the claim are the same step.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The machines this targets are the ones with an updatedb already grinding
through every snapshot, and `systemctl start` on an active unit is a
no-op. updatedb reads /etc/updatedb.conf once at startup, so a run that
began before the rewrite keeps burning CPU on the old config until it
finishes. Restart the service instead: it's Type=oneshot and plocate
builds into a temp db, so nothing is lost by replacing the run.
Quotes are optional in updatedb.conf, so parse the existing paths out of
whatever quoting the file uses and write the setting back in one
canonical form. `PRUNEPATHS=/tmp` previously fell through to the append
branch and got a second PRUNEPATHS line, which drops /tmp from the
pruned set. Comparing whole paths rather than substrings also keeps a
config that already prunes something like /var/lib/machines/.snapshots
from being mistaken for one that prunes /.snapshots.
Prefer $OMARCHY_PATH over the packaged copy when locating the config
script, per docs/migrations.md, so the migration test exercises the
checked-out script rather than whatever release is installed. Skip when
neither exists: omarchy-migrate runs under set -e, so a missing script
would take down every migration queued behind it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Prepending us whenever the layout wasn't already us would have demoted
every Latin layout — de, fr, dk — to a secondary group, so those users
would have booted into a US layout they never asked for. Latin layouts
resolve the default keysym bindings fine, so only the layouts that can't
type Latin letters need us in front. That list already exists for the
initramfs hook, and a test keeps the two copies in sync.
Also match on the first layout rather than looking for us anywhere in
the list: Hyprland resolves bindings against the leading entry, so
"il,us" needed the fix just as much as "il" did.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Choosing a non-Latin layout (e.g. ara, il, ru) via /etc/vconsole.conf
leaves Hyprland unable to match Omarchy's Latin-keysym bindings, since
Hyprland resolves bindings against the first layout in kb_layout only.
Prepending 'us' when the detected layout doesn't already include it
keeps shortcuts reachable, and activating grp:alts_toggle lets the user
switch to their layout with Left Alt + Right Alt.
* Fix Arabic falling back to Nastaliq in Chromium and Electron apps
* Cover the widened patterns too, and leave Urdu in Nastaliq
The weak binding only won the last-resort race for patterns fontconfig
had not widened. Anything whose family expands through the latin and
nonlatin alias chains -- Arial, Helvetica, Verdana, sans-serif, and so
the bulk of real CSS -- still resolved Arabic to Kufi, a display face
that suits body text no better than Nastaliq did. A strong binding wins
those too. Charset matching outranks family matching either way, so a
font that does not cover the codepoint still cannot be pulled in: Latin,
monospace, emoji, Nerd Font glyphs and CJK all resolve as before.
The untargeted rule also captured Urdu, which #6322 had deliberately
left alone by scoping itself to lang=ar. Urdu is conventionally set in
Nastaliq, so name it for lang=ur ahead of the Naskh append. Appended
rather than prepended, or it would displace the family the app asked for
and render Latin text in an Urdu locale as Nastaliq.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mb1gPTJ6s7QyQZck7Z6F9v
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Anchor the webcam overlay to the recorded region, not the monitor
Recording a single window on an ultrawide put the camera outside the frame.
The overlay is placed twice, and neither placement knows what is being
captured: the window rules in default/hypr/apps/webcam-overlay.lua position it
from monitor_w/monitor_h, and omarchy-capture-webcam-resize recomputes the same
corner from hyprctl monitors. Both resolve to the monitor's bottom-right, so a
window anywhere but the far right of the display records without the camera in
it, and dragging it into frame by hand is undone by the next resize.
The geometry is already known. select_capture_target resolves the picked window
to a region rectangle before start_webcam_overlay runs, and a bare click in
smart mode snaps that rectangle to the window's own bounds. gpu-screen-recorder
takes the region in the compositor's logical coordinate space, which is the
same space window moves take, so the value needs no conversion to be reused as
an anchor.
Publish it for the resize helper, which becomes the single place that positions
the overlay. It anchors to the region when one is recorded and falls back to
the monitor otherwise, so full-monitor captures, the portal backend, and manual
resizes outside a recording all keep their current behaviour. A malformed or
empty file falls back the same way.
Presets scale from the anchor's height rather than the monitor's, so the camera
keeps its proportion of the frame instead of covering a small capture outright.
A tall, narrow region cannot fit a preset derived from its height, so widths are
capped to the space available and heights follow at the same 8:9 aspect.
Placement happens inside start_webcam_overlay rather than after it returns.
Correcting the position once that function had returned left the move adjacent
to gpu-screen-recorder starting, and the camera was recorded sliding the last
stretch into its corner over the opening frames. The overlay is waited for
explicitly instead, positioned, and only then does capture start.
Waiting for the map is what the blind second was partly guessing at, so the
remainder is trimmed to hold the delay before capture where it was. Starting
later is not free: it eats the opening words of whatever is being narrated.
* Keep the webcam size ladder usable in a narrow region
Capping each preset's width to the region separately collapsed small,
medium and large onto the same width, so Super + Alt + [ and ] had
nothing to step between, and integer division left small taller than
medium. Cap the height the presets scale from instead, which shrinks
the ladder as a whole and keeps the three sizes ordered and distinct.
Cover the anchoring in the test suite: a region the camera follows, the
fallback for an unreadable one, and the narrow-region ladder. Point
XDG_RUNTIME_DIR at the test's own directory while doing so — the resize
helper now reads a region file from there, and the existing geometry
assertions would pick up a real one from a live recording.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The three hardcoded candidates are all relative to a sibling of the omarchy
checkout, so a clone anywhere else, such as ~/Work/omacom/omarchy-pkgs, found
nothing. The block then crashed on read_text() and the whole test exited on an
unhandled traceback, which reads as an unrelated failure rather than a missing
checkout.
Add the omacom layouts, an OMARCHY_PKGS_PATH override taking either the
checkout or its pkgbuilds directory, and a named failure listing where it
looked.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
omarchy-update-user-notify.path watched /usr/share/omarchy/migrations, but
pacman writes that directory during every update, including the blessed
omarchy update, which runs omarchy-migrate a step later. The watcher fired a
critical notification for the migrations the update was already applying in
the visible terminal. A watcher cannot tell that apart from a bypassed
pacman -Syu, so the only trigger that never collides with a running update is
a once-per-login check.
The service that already ran at graphical-session.target is now the whole
mechanism, renamed after the command it runs. That is also all the second-user
case needs: markers are per-user, so anyone who did not run the update finds
them missing at their next login.
Login timing means the toast can be sent before the shell has claimed
org.freedesktop.Notifications, so the notifier waits for a live server first.
The wait is omarchy-first-run's, lifted into omarchy-notification-wait rather
than duplicated.
The package keeps omarchy-update-user-notify.service as a symlink onto the new
unit. Existing users hold an absolute wants symlink to the old path, and the
migration that repoints it only runs for users who run an update, which is the
opposite of who the notifier is for.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
zram-generator creates no device at all when nothing configures one, so the
/etc copy is the only thing holding up swap until the vendor drop-in lands.
Removing it early costs a machine its zram entirely, not just its tuning.
The update pipeline installs packages before it runs migrations, so a packaged
machine always has the drop-in by then. A dev checkout does not: omarchy-update-dev
pulls migrations from a release the installed package has never seen, and no
ordering of the pipeline can produce a file that has not been built yet.
Checking for the drop-in is what makes the removal safe rather than well
sequenced.
The tests pinned the drop-in path to a fixture as well. Left at the real path
they would pass or fail on whether the machine running them happened to carry
the packaged copy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Migrations run under bash -euo pipefail, where an assignment from a failed
command substitution ends the script. Reading InhibitDelayMaxSec out of a
drop-in that is not there exits sed 2, so the migration died at exactly the
condition it was written to detect: instead of flagging reboot-required, it
aborted before reaching the flag. The busctl read had the same shape, with
pipefail standing in for the failed substitution.
An aborted migration is never marked complete and takes omarchy-migrate's own
-e down with it, so the two migrations queued behind this one stopped running
as well.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
zram-size = min(ram, 8192) is Fedora's default since F34, where
zram-fraction=1.0 with max-zram-size=8192 has run on desktops for five
years. The previous min(ram / 2, 8192) halved that on every machine
below 16G with nothing behind the fraction; at 16G and above the two
already agree.
A changed size only reaches a running device on the next boot, so the
migration resizes an empty device now and asks for a reboot otherwise.
It asks the generator what the config evaluates to rather than
repeating the expression here, and does neither when the device already
matches.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
libfprint-git only existed to carry the focaltech_moc driver and the
FocalTech FT9349 (2808:a97a) ID ahead of a release. libfprint 1.94.100
has both and is in the Arch repos, so fingerprint setup installs stock
libfprint again and a migration swaps existing installs back.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Say it once and match mergeAppRows: app rows sort after all menu items,
not interleaved among them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Searching the menu for an installed app buried it: "brave" listed Setup >
Defaults > Browser, Install > Browser and Remove > Browser ahead of the
Brave app itself. All four are exact label matches scoring 0, so the
tiebreak falls to declaration order, and mergeAppRows appends app rows
after every static item.
Bias app rows ahead of menu entries that match equally well. The bias is
smaller than the gap between match tiers, so a menu entry that matches the
query better still sorts first.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pacman checks file conflicts during transaction prepare, so the --overwrite
entry added alongside /etc/systemd/zram-generator.conf never got to run: the
copy of omarchy-update-system-pkgs driving the upgrade is the one already on
disk. Every machine carrying archinstall's copy aborted the transaction.
zram-generator.conf(5) reserves /etc for the local admin and has vendors ship
snippets under /usr/lib/systemd/zram-generator.conf.d/, where drop-ins outrank
the main config file. Nothing collides, and the tuning wins whether or not
archinstall's file is still around.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LjeyQZsNBxqyYy9z8KaKm7
A Dell XPS 14 with no fingerprint reader was invited to set one up on first
run. Its Synaptics webcam bridge, 06cb:0701 "SVP7500" bound to usbio-bridge,
matched omarchy-hw-fingerprint on the bare 06cb vendor ID.
The vendor list already excludes Elan and STMicro for being multi-purpose, but
Synaptics is just as multi-purpose and was left in. Dropping 06cb is not an
option: Synaptics and Validity are among the most common real reader vendors,
and many of those readers report no product string at all, so the vendor ID is
the only signal that finds them.
The vendor guess is now qualified instead. libfprint drives every reader it
supports from userspace over libusb, so a real reader sits with no kernel
driver bound to any of its interfaces, while the bridges, touchpads and cameras
that share these vendor IDs all bind one. The guard applies only to the fuzzy
vendor-ID path; a device whose product descriptor names it a fingerprint reader
is still trusted outright, since that signal is precise enough on its own and
should not be lost to a driver that happened to claim the device.
The menu entry was a second surface for the same bug. Setup > Security >
Fingerprint carried no when clause, unlike the Remove entry beside it, so it
appeared on every machine and dead-ended in the setup script's own hardware
check. It now gates on the same detector.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017q97Rsk8KwgaPUVq5ArLgM
A fresh install on a Dell XPS 14 spent 73s in "Configuring system", and two
silent gaps in the install log account for 66s of it. Both are the same
redundant work.
hardware/all.sh ran ipu7-camera.sh before ptl-kernel.sh. intel-ipu7-camera
pulls in ipu7-drivers, vision-drivers and v4l2loopback, so DKMS compiled all
three against the stock linux kernel and built a UKI for it. ptl-kernel.sh
then installed linux-ptl, which recompiled the same three modules against the
new kernel, and its pacman -Rdd of linux followed with three dkms removes and
yet another UKI rebuild. The log shows four UKI builds where one would do, and
everything the first script produced was deleted 42 seconds after it was made.
Running the kernel swap first means the DKMS modules are only ever built
against the kernel the machine actually keeps, which returns roughly 25s.
ptl-kernel.sh still installs linux-ptl before removing linux, so one redundant
UKI build for the stock kernel remains. Removing first would save it but would
leave the machine with no kernel at all if the linux-ptl install failed, so the
safe order stays.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017q97Rsk8KwgaPUVq5ArLgM
Closing the lid could suspend the machine with the session still exposed.
omarchy-sleep-lock held a delay inhibitor and waited for Quickshell to report
the session secure, but a delay inhibitor is a timer rather than a promise:
logind suspends once InhibitDelayMaxSec expires, locked or not. The default is
five seconds, and closing the lid also reconfigures displays -- exactly when
the lock service is waiting for the screen set to settle before it can secure.
The race is now off the critical path. switch:on:Lid Switch runs
omarchy-system-lid-close, which requests the lock the moment the lid closes,
before logind has decided to suspend at all, so the inhibitor window usually
finds the session already secure. A docked lid close does not suspend
(HandleLidSwitchDocked defaults to ignore) and must not lock either, since that
is clamshell mode still in use on the external display, so the handler gates on
the same closed-and-undocked pair logind itself keys on.
Suspends that never touch the lid -- idle timeout, the system menu, low battery
-- still arrive through the inhibitor, so that path gets room to work too. The
shipped drop-in raises InhibitDelayMaxSec to 15s, and the helper derives its
budget from logind's live InhibitDelayMaxUSec rather than assuming the drop-in
landed: a machine that has not reloaded logind yet, or that carries its own
override, gets a budget that fits what logind will actually allow. It leaves
logind a fifth of its own window and caps at 12s, so a hand-raised window
cannot strand a closed laptop awake in a bag.
The wait itself had three defects. Its deadline arithmetic read EPOCHREALTIME
assuming a period, so under any comma-decimal locale the subtraction parsed as
bash's comma operator and silently voided the deadline, leaving only the
attempt counter to stop it. The lock request shared the status polls' timeout
and exited on first failure, so a shell 300ms slow meant suspending unlocked;
it now has its own budget and is simply retried, since asking again is
idempotent. And a refusal the shell reports on stdout with a zero exit --
missing-pam -- read as success, burning the whole window on a lock that could
never happen.
Every call is bounded by what is left of the budget rather than by an estimate
of what the step should cost, so the deadline holds on hardware slower than
anything the constants were fitted to.
Failure is still possible and it used to be silent. It now writes to the
journal and raises a critical notification, which lands on the screen the user
unlocks into.
Incidentally, monitor-recovery-test asserted lid probing against
omarchy-hw-clamshell after that logic moved to omarchy-hw-laptop-closed. It
aborted the file under set -e, skipping the nine assertions behind it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1781158082.sh matched an explicit list of three legacy spellings for
~/.config/nvim/lua/plugins/theme.lua. At least one more exists in the
wild -- "../../../../.config/omarchy/current/theme/neovim.lua" -- so
those installs fell through the case, kept a dangling link, and Neovim
loaded no colorscheme spec at all. The failure looks theme-specific
because it only surfaces when you next switch themes.
Editing that migration would not help anyone, since it is already marked
applied. Add a new one that matches the shared suffix instead of an
enumerated list, so every spelling of the pre-state-dir path is caught.
It exits early when the link already points at the state directory and
ignores targets outside omarchy/current, leaving custom links alone.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LjeyQZsNBxqyYy9z8KaKm7
Both slots held #026fde, so strings and numbers rendered in one color
and syntax highlighting lost the distinction entirely. It mattered less
when the theme shipped its own nvim and vscode files; now that both
generate from this palette, the collision is visible everywhere.
The green slot takes a violet. Lupine's hues sit at 210, 214, 224, 267
and 301, leaving one real gap between blue and magenta, and that gap is
the only place a new color fits without either crowding an existing hue
or breaking the blues-and-purples character. Its bright variant becomes
a lavender, which suits a theme named for the flower. Nothing here reads
as green; the slot keeps its ANSI name, not its usual hue.
Yellow, orange and cyan remain close to each other. Pulling those apart
means either warm hues or a wider spread than the theme allows, which is
a bigger change than this one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CC9kSQv8ZEogaxDoeKBzL
The JPEG drew the wordmark in #358fff on pure white, matching neither
the accent nor the background. Every other theme's omarchy wallpaper is
a flat two-color image: the theme's background behind its accent. Lupine
now follows that, so the wallpaper, the lock screen, and the focused
window border are all one blue.
Recolored from the shared wordmark rather than redrawn, so the glyphs
land on the same pixels as every other theme. JPEG was the wrong
container for two flat colors anyway; at one bit per pixel the PNG is
2KB against 71KB, with no ringing around the letters.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CC9kSQv8ZEogaxDoeKBzL
Drops city, lavender-bloom, dusk-horizon, purple-mountains, lake-dawn,
and snowy-dawn, then renumbers the survivors so the sequence stays
contiguous. The remaining set is uniformly pale, which is what a light
theme needs; the cut ones were mid-tone or saturated enough that the
bar and window borders lost contrast against them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CC9kSQv8ZEogaxDoeKBzL
Rename the palette keys to the canonical background/foreground names the
resolver actually reads. The short bg/fg spellings were never aliased, so
every derived key was silently falling back.
Fill in the orange and brown slots too. Lupine is a deliberately cool,
near-monochrome blue palette, so both stay in family rather than
introducing warm hues the theme never had.
Drop neovim.lua and vscode.json. They pinned third-party extensions that
had to be installed separately; the generated templates cover both from
colors.toml alone.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CC9kSQv8ZEogaxDoeKBzL
Convert the Lupine theme to the semantic color system introduced in the
quattro/Omarchy 4 line:
- Rewrite colors.toml from the old accent/foreground/background/color0-15
scheme to the semantic palette (mode, bg/fg ramp, named ANSI hues, and
bright_* variants). The chromatic palette is preserved exactly; only the
keys are renamed.
- Replace the empty light.mode marker with mode = "light".
- Drop the hand-shipped btop.theme and chromium.theme; both are now
generated from default/themed/*.tpl at theme-set time.
Selection now follows the convention used by the other light themes
(selection_foreground = bright_fg over a light selection background)
instead of the previous inverted dark selection bar.
Replaying an empty history did nothing at all on screen, which reads as
a dead keybinding rather than an empty log.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The reader is still reachable on an external keyboard or a docked
laptop, so hiding the icon and skipping the scan just forced the
password. sudo and polkit keep their pam_exec lid gates.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The user override was written with mode="assign", but it loads after the
package default has already assigned JetBrainsMono, so it never displaced
it. prepend_first puts the chosen family at the head of the list.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Tensaku shows a "Pick a default annotation size factor" dialog until
its persisted state names one. Neither config.toml nor the CLI flag
suppresses it, so ship the state file itself.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Solitude had no unlock assets at all, so it fell back to the default
Plymouth logo. Last Horizon shipped a preview-unlock.png derived from
Nord's that still carried Nord's navy #2e3440 entry-box fill; only the
background and logo had been recolored.
Both are now generated the way the rest of the set was: the logo mask
recolored to the theme's accent, and the preview rendered by the same
pipeline as `omarchy plymouth preview` using each theme's background
and foreground. Last Horizon's unlock.png was already correct and is
untouched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CC9kSQv8ZEogaxDoeKBzL
It was the user override file for the first Quickshell bar, back when the
bar layered it over bar-defaults.json. Unifying everything into
shell.json left an empty file that installs and the quattro upgrade kept
faithfully copying around.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Moving them ahead of the clock left the old entry in place, so a fresh
config rendered the widget on both sides of the time.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
tmux only raises an activity flag for windows that are not currently
selected, so a long-running command in the window you left selected --
the common case, since you switch away by moving your Hyprland focus
elsewhere rather than by selecting another tmux window -- finished
silently and the indicator never lit.
Windows now also count as waiting when they are selected in an attached
client, every client showing them is unfocused, and their window_activity
is newer than an @omarchy_unfocused_activity watermark. The watermark is
stamped by a new `track` subcommand wired to client-focus-in/out and the
existing select-window hooks, so it records where attention last was.
The hooks pass #{window_id} and #{window_activity} as arguments, which
tmux expands when the hook fires; run-shell -b would otherwise let output
arriving during the handoff be swallowed by the new watermark. The focus
hooks take index 100 to leave a user's own bindings alone.
That state has no hook of its own, so it needs polling to be noticed.
The probe therefore moves out of the indicator and into a service plugin,
alongside nightlight and battery. A bar surface exists per monitor and
each one instantiates every indicator twice, once per block, so a timer
on the indicator meant a shell-out per instance per tick -- four probe
processes every three seconds on a two-monitor machine, forever. One
service polls for the whole shell instead.
Sharing the state also fixes what per-instance polling would have papered
over: each indicator used to own its own count, so a timer-driven update
only refreshed the bar it ran on and left the other monitors stale.
Refreshes still arrive over the existing indicator broadcast, which now
coalesces into a single run no matter how many bars relay it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CC9kSQv8ZEogaxDoeKBzL
The lineup now reads toward the clock instead of away from it, so Stay
Awake sits nearest the time, then do-not-disturb, night light, reminder,
screen recording, dictation, and tmux alerts trailing off to the left.
Active indicators render after the hover-revealed ones so they stay
against the clock, and a newly active indicator joins on the far side
rather than shoving the ones already showing sideways.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The tmux alert hooks fire omarchy-shell through run-shell, and run-shell
builds its own environment rather than passing the server's along, so the
hook ran without WAYLAND_DISPLAY. qs matches instances by display, so every
refresh from a bell died at "omarchy-shell is not running", which -q then
swallowed by design.
That left the indicator with no way to turn itself on. Its five second poll
only runs while the indicator is already active, so an alert raised after
startup was invisible until the shell happened to restart with the window
still flagged. The icon appeared roughly never.
Recovering the display from the socket in XDG_RUNTIME_DIR fixes it in the
one place that needs it, and covers any other caller reaching the shell from
a stripped environment rather than just the tmux hooks.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Omarchy installed zram-generator but never shipped a config for it, so the
only zram tuning any machine had was whatever the ISO wrote once, and the VM
sysctls were untouched kernel defaults aimed at spinning disks.
The generator's own default caps the device at 4G, which on a large machine
sends reclaim to the hibernation swapfile far earlier than it needs to go.
Ship min(ram / 2, 8192) instead, matching what Fedora settles on, and state
the priority explicitly since it has to sit above the pri=0 that
omarchy-hibernation-setup gives the disk swapfile.
The four sysctls follow from swap being RAM rather than a disk. swappiness
above 100 says evicting an anonymous page beats dropping a page-cache page
that would have to be read back, which is true once swap is compressed
memory. page-cluster drops to one page per fault because the default of 8
buys readahead for a seek zram doesn't have and pays a decompression for
each page. Zeroing watermark_boost_factor stops fragmentation from producing
reclaim bursts while memory is still free, and raising watermark_scale_factor
gives kswapd room to reclaim in the background instead of letting allocations
stall in direct reclaim. The last two are what actually addresses the stutter
people notice and misread as swap being used too eagerly: proactive swapping
to zram is the cure, and synchronous direct reclaim is the disease.
Every ISO-installed machine already has an unowned zram-generator.conf, which
pacman would refuse to overwrite, so both upgrade paths need it listed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The apps list rebuilt its rows by writing into the maps held by the menu's
items and itemOrder var properties. Writing into an object owned by a QML var
property is not reliable: the same row object written into a plain JS object
always lands, but written through the property it occasionally arrives with the
key created and the value undefined. One write per rescan was lost, on a
different app each time.
A lost write left an id in itemOrder with no item behind it. The old purge only
deleted app rows it could find in items, so the orphan survived the next merge,
the add loop appended a second row for the same app, and the list grew by one --
permanently, and again on every later rescan. Touching a single desktop file
fires around a dozen merges, because the entry model emits valuesChanged per
insert and removal while it reconciles, so duplicates piled up quickly: nine
YouTube rows on the reporting machine, and Alacritty doubled before that.
The bookkeeping moves into MenuModel as two pure functions that build fresh maps
for the caller to assign in one shot, so the fragile write disappears. They also
make the merge self-healing rather than merely correct-when-nothing-is-lost: an
id with no item is dropped instead of carried forward, and an id is listed once
even when two desktop entries claim it -- so no single dropped write can compound
into a duplicate row again. The bash-backed providers behind the font and power
profile lists had the same latent bug and get the same treatment.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJQJfHXXApUk6En8EZisHg
Clicking the Voxtype or fingerprint invitation did nothing. The launcher
execs setsid, which forks because the transient unit's main process is
already a process group leader, so the unit exits within milliseconds and
systemd's default control-group kill took the still-starting terminal down
with it. Run those units with KillMode=process instead.
The invitation tests had also drifted from the two-unit design and were
failing; teach the systemd-run mock to run the command it is given.
Both notifications are sent from background subshells, so whichever
notify-send registered first won the bottom slot. Give the update toast a
tick to register so Wi-Fi lands newest and stacks on top.
Reported to suit the XPS 16 as well, so the tuning now matches both machines and
the directory is named for the pair rather than the one model.
Gating moves from the DMI product name to the product SKU, which is what Dell keys
the Cirrus speaker firmware on -- 10280db9 for the XPS 14, 10280dba for the XPS 16
-- so it identifies the speaker hardware itself instead of a marketing name. SKUs
are compared as whole values, not substrings, so this cannot widen to the rest of
the XPS line the way a short product-name match would: product_family on these
machines is "Dell Laptops".
match_sku and match_dmi are now lists, letting one tuning name every model it
covers. A plain string still works as a single entry.
The measurements in tuning.conf were taken on the XPS 14 (0DB9). The XPS 16 is
covered on report rather than measurement, and tuning.conf and the graph both say
so, because the profile's bass lift and high-pass were fitted against one
machine's excursion and distortion limits.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Laptop speakers ship voiced by the vendor's Windows DSP layer, which Linux does
not get. A tuning restores that as a PipeWire filter-chain in front of the
internal speaker sink, matched to the machine by DMI string and expected sink.
Adding a laptop is a directory under default/audio/tunings with two files and no
new code: matching is data. The XPS 14 DA14260 tuning included here was derived by
measuring the xps-audio-linux EasyEffects profile (MIT) and fitting a biquad chain
to it, so no impulse response or other upstream asset is redistributed. It measures
1.24 dB RMS against that reference, and matches its dynamic range within 0.1 LU --
the reference's multiband compressor turned out to contribute nothing, so a linear
chain replaces it. Bass Q is capped deliberately: a closer magnitude fit swung
group delay 31 ms across 63-80 Hz, which smears bass transients.
The graph runs as its own PipeWire client under its own config name rather than
loading into the audio daemon. The daemon only reads its config at startup, so a
daemon-loaded tuning could only be switched by restarting PipeWire -- which drops
every PulseAudio client's connection, and applications that do not reconnect
(Spotify) then have to be restarted by hand. Hosting it separately also contains
failure, since a malformed tuning breaks only that service.
Three things about the surrounding audio graph needed fixing for this to behave:
- Volume must live downstream of the tuning. omarchy-audio-output-sink is now the
single definition of which sink an output's volume really uses, shared by the
volume keys, the output switcher's OSD and the audio panel, so they cannot
disagree. It resolves the current default output, which keeps it correct when
headphones are selected while a tuning exists.
- The tuning's own output is a movable sink input, so rerouting "all streams" to a
newly selected output would drag the processing onto headphones, or into the
tuning's own sink, which is a cycle. It is pinned, and stream moves are limited
to streams carrying an application.name.
- The physical sink a tuning fronts is not independently selectable, since picking
it would only bypass the tuning, so it is kept out of the output list.
Applying happens at first-run, not finalize-user, because finalize-user also runs
in the ISO chroot where there is no audio server and nothing would retry.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Voxtype/fingerprint invitations run as a transient
omarchy-*-invitation.service that shows a critical toast and waits for a
click. On click the service execs the install terminal, so the service
stays active for the whole life of that terminal.
The installer ends with omarchy-restart-shell, which re-triggers any
still-running omarchy-*-invitation.service on the assumption that a
still-running unit is an unanswered toast wiped by the shell restart. But
an answered invitation is still running only because it is the parent of
the very install terminal that triggered the restart, so it gets falsely
re-fired and the invitation toast pops a second time right after the
install finishes.
Launch the installer in its own transient unit so the invitation service
exits immediately after the click. Genuinely unanswered invitations still
block in notify-send and are still recovered by restart-shell; answered
ones are gone and no longer match the re-show glob.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHPDqx5hwLTwq27f7KpM9d
A bar surface is built per monitor, so a widget in the layout is live once
per screen — but an IPC target only ever routes to the handler that
registered first. `omarchy.indicators refresh` therefore reached a single
bar, and since indicators only re-read their state on that signal, the
other screens kept showing a stale reminder count, tmux alert, or DND
state until the next reload. Clock and system-update refreshes had the
same reach.
Let the bar resolve every live instance of a widget id and relay the call
to all of them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Kernel 7.1 unpacks the initramfs asynchronously, which races /init: the
early /proc, /sys, /dev, and /run mounts fail with EPERM while unpacking
settles, so plymouthd exits when it can't read /proc/cmdline and encrypted
boots fall back to an unthemed text LUKS prompt. Boot still completes only
because the kernel passes key=value cmdline params to init as environment
variables and devtmpfs is automounted.
Force synchronous unpacking via initramfs_async=0 until the race is fixed
upstream: in the packaged defaults for fresh installs, and via migration
for existing systems.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
argv is world-readable in /proc for every local process while the
connection attempt runs. Create the profile without the secret, then
set it through nmcli's scriptable connection editor, which reads from
stdin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The on-battery toggle bought a fraction of a watt while the radio
idled -- twenty-some minutes across a full discharge in the best case
-- and paid for it with 20-300ms latency spikes on idle links and
outright link drops on Intel BE200/BE211 firmware. NetworkManager can
keep power save off natively with one conf.d line, which replaces the
udev rule, the setter script, and any per-card deny-listing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
SCALE only applies to the focused monitor, which is easy to lose track
of with several displays. Show the focused monitor's name on the right
of the SCALE header (matching the BRIGHTNESS/TEXT SIZE value
convention), hidden when only one display is enabled.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
An unsupported terminal notified once per monitor and each monitor
paid a wasted wait; check before the loop instead. The per-read
timeout also let a chatty event stream extend the wait indefinitely,
so spend the 5 seconds against one deadline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Use Region { item: popupColumn } instead of manually mirroring the
column's x/y/width/height. It tracks the item's mapped geometry directly,
so it stays correct without assuming the column shares the window's
coordinate space.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The generator fix only helps fresh installs; existing wrappers in
~/.local/bin keep the recursive exec line until rewritten. Detect the
generated wrapper shape, extract package and bin, and reinstall each
one, which also repairs wrappers users created for their own packages.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A regex over the QML text breaks on innocent reformatting and passes
even when the scrolling behavior regresses.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
xdg-settings get also consults $BROWSER, so unset it for the getters too.
A failed best-effort fallback default should not abort the browser removal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The popups used one Wayland layer surface per output sized to their content
(implicitWidth/Height bound to the toast column), so every time a toast was
added or removed the surface resized. During that resize the compositor
briefly scaled a stale buffer, stretching or squishing the cards mid-
transition -- worst with only one or two toasts, where each resize is a
larger relative change.
Make the surface full-screen and fixed, like the OSD overlay, so adding or
removing a toast only changes the content inside it and the surface never
resizes. Mask the input region to the toast column so the otherwise-
invisible full-screen overlay stays click-through.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
omarchy-launch-screensaver loops over the monitors, focusing each and
spawning a terminal on it -- but the spawn is asynchronous. Slow-starting
terminals mapped their windows after focus had already moved to the next
monitor, so every screensaver landed on the last-focused monitor and the
others got none (and the fullscreen rule applied inconsistently when two
windows mapped at once).
Listen on Hyprland's event socket and wait for each monitor's screensaver
window to open before moving focus to the next one, so there is exactly one
screensaver per monitor. The stream is opened before spawning so a
fast-mapping window can't be missed, with a read timeout as a safety net.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Restarting the shell kills its notification server, and a pending
invitation's notify-send waiter then hangs forever: the dying server
never emits NotificationClosed. So a still-running
omarchy-*-invitation unit means an unanswered invitation — re-run it
once the new shell is up so its toast reappears.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The setup installs packages (libfprint-git, fprintd, usbutils), which
isn't reliable on a fresh install before the databases have been
synced. Defer the invitation with a post-update hook, like Voxtype.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sending the shortcut through wtype's virtual keyboard let the physically
held SUPER merge into the injected chord, so terminals saw
SUPER+CTRL+Insert instead of CTRL+Insert, and injected CTRL+V could even
trigger the SUPER+CTRL+V clipboard manager bind. Send via send_key_state
with no window target instead: explicit mods go straight to the focused
surface, layer-shell panels included.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XnMDbwJXQA3fvW8o8Pwr97
Session names can contain pipes but never colons, so split fields on
colons instead. Remember refreshes that arrive while the indicator is
already polling, and jump to the most recently used tmux client rather
than an arbitrary one.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Show a bar indicator whenever tmux has flagged a window, the same state
that highlights the tab, and jump to it on click or with Super + Ctrl + J.
Tmux hooks push the state to the shell, so nothing polls while no pane is
waiting.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
pgrep -x tmux never matched, since the processes are named "tmux: server"
and "tmux: client", so config reloads were silently skipped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Extend the clamshell gate to /etc/pam.d/sudo, not just polkit-1. When the
lid is shut the reader is unreachable, so a terminal sudo would block on
"Place your finger" until pam_fprintd timed out before letting you type the
password. The same pam_exec gate (success=1 skips fingerprint when the lid
is closed) now runs ahead of pam_fprintd in the sudo stack as well.
setup and removal share one gate definition across sudo and polkit; the
migration now gates both stacks on existing installs.
Resolves the clamshell case in #856 and supersedes #6003.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a first-run notification, alongside the keybindings/Wi-Fi toasts, that
invites anyone with a fingerprint sensor to enable it. Clicking launches
omarchy-setup-security-fingerprint in a floating terminal.
Detection lives in a new omarchy-hw-fingerprint helper that reads sysfs
(device product descriptor plus a fingerprint-vendor allowlist), so it
works before fprintd/usbutils are installed and without nagging machines
that have no reader. The setup script reuses the same helper as an early
gate, bailing before installing any packages when no reader is found
(replacing the old post-install fprintd-list probe).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a first-run notification, alongside the keybindings/Wi-Fi toasts, that
invites anyone with a fingerprint sensor to enable it. Clicking launches
omarchy-setup-security-fingerprint in a floating terminal.
Detection lives in a new omarchy-hw-fingerprint helper that reads sysfs
(device product descriptor plus a fingerprint-vendor allowlist), so it
works before fprintd/usbutils are installed and without nagging machines
that have no reader. The setup script reuses the same helper as an early
gate, bailing before installing any packages when no reader is found
(replacing the old post-install fprintd-list probe).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bring the fingerprint affordance to the Quickshell lock screen and polkit
dialog, matching what hyprlock did on master.
Lock screen: render the md-fingerprint glyph inside the password field's
right edge when a sensor is enrolled, reserving space so long passwords
never run under it.
Polkit dialog: show one method at a time. When a sensor is enrolled and
the reader is reachable, the dialog is just the centered fingerprint icon
(square card); the moment PAM asks for a password it switches to the
password field. Detects pam_fprintd anywhere in the auth stack now that a
gate can precede it.
Lid awareness: a closed lid means the reader is unreachable, so both
surfaces fall back to the password. polkit gets a pam_exec clamshell gate
(auth [success=1 default=ignore] before pam_fprintd) so a shut lid drops
straight to the password prompt instead of blocking on the reader for the
pam_fprintd timeout; the lock screen hides the icon and skips scanning.
The gate points at the fixed /usr/bin path the package always provides so
it survives switching between package installs and dev-link. A migration
adds the gate for existing fingerprint setups.
New helper omarchy-hw-laptop-closed (pure lid state); omarchy-hw-clamshell
now composes it with the external-monitor check.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The menu card re-centered on every resize, so searching or moving into
a submenu made it jump around. It still opens centered like before, but
the first search keystroke or submenu move freezes the top line where
it sits — from then on the card only grows and shrinks downward.
Closing unfreezes. Also drop the 220px minimum height so the card
always hugs its content instead of leaving a void under short lists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Installs from before the Snapper setup was normalized ran hourly
timeline snapshots. Newer configs stopped creating them but never
deleted the existing ones, and number cleanup skips snapshots marked
Cleanup=timeline, so they sit there forever: one machine installed from
the 2026-05-11 ISO had accumulated 592 of them, silently pinning 219 GB
of disk. The limine-snapper-sync limit-mismatch warning that would have
surfaced this is disabled by default since the notifier migration.
Delete leaked timeline snapshots in batches of 20 (a single mass delete
can die on a DBus timeout partway through), and only when
TIMELINE_CREATE="no" so anyone who deliberately re-enabled timeline
snapshotting keeps their setup untouched.
The drain is best effort: a batch that fails is skipped rather than
aborting the migration run and everything queued behind it, since the
next run re-lists whatever is left.
The stock Arch updatedb.conf interacts badly with Omarchy's Btrfs
layout in both directions:
- Snapper snapshots under /.snapshots are nested subvolumes reached by
plain directory traversal, so updatedb indexes the entire system once
per snapshot. On machines that accumulated snapshots this means
multi-hour updatedb runs at full CPU, gigabytes of RAM, and a
multi-gigabyte plocate.db (observed: 18 GB db, 7.5 h runs at 96% CPU
with 592 snapshots; 43 MB and ~1 min after the fix).
- PRUNE_BIND_MOUNTS="yes" treats Btrfs subvolume mounts like /home as
bind mounts, so locate finds nothing in home directories at all.
Configure updatedb.conf at install time and migrate existing installs,
then rebuild the index in the background. Both settings are matched
tolerantly and appended when absent, so a hand-edited updatedb.conf is
fixed rather than silently skipped.
exec via `mise exec "$package"` so the tool resolves from mise's
install dir instead of by name through PATH. Previously `exec "$bin"`
could re-find the wrapper itself when ~/.local/bin precedes mise's
install path (e.g. when starship/zoxide clobber mise's PROMPT_COMMAND
hook, #3685), recursing forever. Scoping to $package keeps lazy install
and avoids leaking other runtimes into PATH.
Model rows stored the live Notification object in a ref role. When the
server destroyed the notification (sender close, DND untrack, dismiss)
the role became a dangling C++ pointer, and the next read segfaulted in
QQmlListModel::data — typically when replaying history over IPC. Track
live notifications in a JS map keyed by originalId instead, cleaned up
on close and untrack, where a stale reference degrades to a catchable
error instead of a crash.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Match the other editors (VSCode/Zed/Cursor) by launching once install
finishes. Uses gtk-launch emacsclient so it opens a frame on the
emacs.service daemon that omarchy-install-emacs just started, rather
than spawning a second standalone instance.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bring back per-theme Plymouth unlock theming, dropped when walker +
elephant were removed. Selection now uses the same image carousel as
the theme and background switchers instead of a name list.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Quickshell's IconImage decodes at logical size, so on HiDPI displays
PNG icons were rendered from a texture at half the needed resolution
and looked blurry next to SVG icons. Use plain Image with sourceSize
scaled by Screen.devicePixelRatio, as the notification widgets
already do.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Prefer the site's own apple-touch-icon (typically 180-512px) over
Google's favicon service, which often serves an upscaled 16-32px
favicon. Validate downloads are actual images so an HTML error page
never gets saved as an icon.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(clock): display date, week, and year vertically in vertical
* fix vertical date alignment in panel
* Update Clock.qml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address review feedback on Clock vertical format
Use the BarWidget-provided `vertical` property instead of repeating the
`bar && bar.vertical` ternary, and clean up stray tab/trailing whitespace.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Accumulate sub-threshold movement so slow motion with a flat acceleration profile updates selection. Sample pointer state on row entry and carry pointer intent through subordinate menus while preserving predictable keyboard selection.
Spawning quickshell directly from omarchy-restart-shell leaked transient
environment variables from the calling terminal, SSH connection, or
development tool into the fresh shell. Dispatch the launch through
Hyprland instead so it inherits the canonical session environment, same
as autostart.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Runs inside a live Omarchy session (typically a VM installed by
omarchy-iso-test) and verifies the desktop actually works: session
health, application launches by window class, and shell surfaces via
IPC — including typing into the launcher and launching the top hit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omarchy bar transparent now accepts toggle, flipping the current value
in one jq update (absent counts as opaque, matching the shell).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Static submenus and links now inherit visibility from their descendants,
so hardware sections like Touchpad Haptics disappear on machines without
the hardware instead of opening empty. Laptop Display and Mirror Display
are guarded by omarchy-hw-laptop.
The guard evaluator brace-wraps every when/checked condition before
silencing it, so conditions in the jsonc no longer need their own
>/dev/null plumbing, and parents no longer need to repeat their
children's guards.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A freshly-started hyprsunset applies its default temperature at the end
of boot, silently overriding a set sent while it was still starting.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
With quickshell-git, qs kill blocks until the instance has fully
exited, so restarting no longer needs to resolve pids and wait for them
to die. Kill in a loop until none remain - each call takes the oldest,
and duplicates from stale sessions are the reason this script exists.
The timeout bounds a wedged shell that can't process the quit message:
its kill would otherwise report success after Qt's 30s wait gives up,
re-killing the same undead instance forever. The test mock now kills
real processes synchronously to match.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
quickshell 0.3.0's qs kill returns before the instance exits, forcing
restart tooling to babysit pids. Upstream fixed kill to block until the
process is gone, but only on master, so the Omarchy repo now carries
quickshell-git pinned past that fix. New installs get it from the base
packages; existing installs migrate with a single --ask 4 transaction so
the conflicting quickshell package is replaced in place, then restart
the shell after the update to pick up the new binary.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
qs parses -n before the ipc subcommand as its top-level --no-duplicate
launch flag and silently ignores it, so IPC still went to the oldest
matching instance - exactly the stale one left behind around a restart.
The --newest flag belongs to the ipc subcommand: qs ipc -n. Verified
against two live instances; the test now pins the flag position.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The bar-null-shell-null-typeof-function ternary guarded against our own
shell missing a method it always defines. bar?.shell?.firstPartyServiceFor()
handles the only real case, delayed bar injection, in one line. The
typeof checks that probe genuinely third-party plugin objects stay.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Same treatment as Stay Awake: the indicator polled the toggle CLI over
a Process with a timer to paper over the race after clicking, and the
CLI ended by asking the shell to refresh every indicator over IPC. A new
omarchy.nightlight service owns hyprsunset instead - it probes the
temperature on startup, applies changes itself for in-shell toggles, and
answers on the nightlight IPC target. The indicator becomes a plain
binding. The CLI still drives hyprctl directly so keybindings, the menu,
and ssh work without the shell, but now just nudges the service to
re-probe since hyprsunset has no state file to watch.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deriving the tray's implicit size from childrenRect fed layout results
back into the bindings that produced them, tripping implicitWidth
binding loop warnings. Compute it from the active and inactive blocks'
own implicit sizes instead, and center the loaded blocks rather than
anchor-filling containers that are sized by their content. The contract
test now instantiates the tray to check the collapse/expand cycle and
fails on any implicitWidth binding loop in the log.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The indicator polled omarchy-toggle-idle over a Process and re-ran it on
a timer to toggle, while the CLI called back into the shell over IPC to
apply and refresh the state it had just changed. Now the indicator binds
straight to the idle service's stayAwake property and flips it in
process. The CLI only touches the state file, which the service already
watches, so toggling from keybindings and scripts still reaches the
shell without any reentrant IPC.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hyprland only takes scales where the mode divides into whole logical
pixels (in 1/120 steps), so picking 3x on a 1280x800 QEMU display threw
a red error overlay and silently kept the old scale. Round the request
up to the nearest clean divisor instead, so 3x becomes 3.2x.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hyprland 0.56 fixed premultiplication in the color-management shader
(hyprwm/Hyprland#14403), so the same opacity values now render visibly
more transparent than on 0.55. Raise each value to its perceptual
equivalent (a^(1/2.2)) to restore the previous look.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hyprland 0.56 fixed premultiplication in the color-management shader
(hyprwm/Hyprland#14403), so the same opacity values now render visibly
more transparent than on 0.55. Raise each value to its perceptual
equivalent (a^(1/2.2)) to restore the previous look.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hyprland 0.56.0 emits invalid JSON from `hyprctl -j binds`: the new
allow_input_capture field was added to the format template at slot 16
but its argument at position 8, shifting every value from
has_description onward and landing unquoted strings in numeric slots.
The jq parse failure emptied the keybindings menu down to the two
static web-app entries — and the empty result got cached under a
stable key, permanently.
Parse the plain-format output instead, which is unaffected (and also
immune to the older quotes-in-args JSON breakage), refuse to cache a
record set with zero dynamic binds, and bump the cache version so
poisoned caches invalidate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds named reboot and shutdown OSD icons, and gives the touchscreen
toggle a proper gesture-tap glyph instead of the restart arrow it
was accidentally using.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Transient systemd timers default to AccuracySec=1min, so the 2s
reboot/shutdown could fire up to a minute late.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both services fire one status poll when the shell starts, but after a fresh
boot that lands before tailscaled has connected or dropboxd has finished its
respawn dance, leaving the bar icons stale for a full 30s/60s refresh
interval. Re-poll every 2s until the service shows up (or ~30s pass), then
hand off to the normal periodic refresh.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Use omarchy-display-text-size 11 instead of a lone GTK text-scaling-factor,
so the XPS 13 nudge moves shell, GTK, and terminal text together.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A macOS-style slider snapping to curated stops (9-20px), applied via
omarchy-display-text-size. Suppresses hover-driven focus changes while a
size change reflows the panel, so h/l on the slider can't let a shifted
row steal keyboard focus.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
One knob for apparent text size, anchored to the 12px shell default: it sets
the shell font base-size (~/.config/omarchy/shell.toml), GNOME/GTK's
text-scaling-factor (12px -> 1.0), and the terminal font point size
(12px -> 9pt) in lockstep. Accepts 9-20px; reset returns all three to
default. Terminals live-reload where they can (alacritty/kitty/ghostty);
foot gets a single restart nudge that replaces itself instead of stacking.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Optional tickCount cuts evenly-spaced marks into the track for stepped
sliders. Defaults to 0, so existing sliders are unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Read ~/.config/omarchy/shell.toml as a user override merged over the active
theme's shell values, so a personal font/spacing/bar tweak survives theme
switches. The file is watched, so edits re-flow the shell live.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Point the Emacs entry in the install-editor menu at a dedicated
omarchy-install-editor-emacs script, matching the pattern already used
for Helix, VSCode, and Zed. The script installs the omarchy-emacs AUR
package and runs its installer, which pulls in emacs-wayland, applies
the theme/font integration, and enables the user emacs.service.
This is the AUR-packaged approach dhh suggested on #4807 (superseding
the in-tree integration proposed there), now that the package exists and
is maintained on the AUR. End-user behavior is unchanged except that a
freshly installed Emacs now tracks the active Omarchy theme and font out
of the box.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Each panel's hero on/off toggle (Tailscale, Dropbox Wi-Fi, Bluetooth,
network, audio mute) now has a reachable "header" cursor section, a focus
ring around the hero icon, Enter/Space activation, a letter shortcut, and
hover parity. The hero is inset by heroRingPad so the ring stays inside
the Flickable/ScrollView clip box instead of being cut off.
Bluetooth and audio get a virtual "header" section above their device
sections, so the adapter/mute can be toggled by keyboard even when no
device rows exist. Network repurposes its previously dead header section.
For the PanelHero-based panels (Tailscale, Dropbox), route panel state
through the wrapper's `header` id: inside a PanelHero iconComponent `root`
resolves to PanelHero, not the Panel, so `root.headerHasCursor` and
`root.setHeaderCursor()` silently referenced the wrong object.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The hero icon is now the optimistic on/off toggle with a tooltip,
replacing the connect block and the progress lines beneath the hero.
The disconnected cross is drawn grey rather than red, and action
errors expire after a couple of seconds instead of sticking forever.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Click the Dropbox hero icon to pause or resume the daemon (dropbox-cli
stop/start), with a tooltip on hover. When paused, both the hero and the
bar icon grey out and the phrase reads "Syncing paused". The greying is
optimistic so it reacts the instant you click, then reconciles with the
real daemon state once it settles (reverting if the command failed).
Also fix status.py's running detection, which was stuck reporting true:
this dropbox-cli inverts the `running` exit code and reports "isn't
running" (not "not running") when stopped, so the paused state never
showed. Detection now keys off the status text alone.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Suppression was enabled only after cleanup_legacy_user_paths had already
moved ~/.local/share/omarchy aside, so the live session could auto-reload
during the swap window and pop "source= globbing error: found no match"
for every legacy hyprland.conf source line. Enable suppression as the
first step of the upgrade sequence instead; the EXIT trap still restores
it if the upgrade dies early.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Extract run_as_user_omarchy and run_as_user_wayland_session helpers to
replace ten hand-rolled run_as_user env blocks
- Declare the retired user-unit list once instead of three times
- Use git ls-files --others to find user-added theme backgrounds instead
of diffing against the tracked list by hand
- Stop rewriting the SDDM 10-theme/10-wayland confs the omarchy package
already installs, and drop the duplicate [Theme] section from
99-omarchy-login.conf
- Drop the legacy-path rewrite in the theme hyprland.conf shim; the user
transition already rewrote those references
- Remove dead code: the unreachable channel re-validation, the declare -F
guard in cleanup_on_exit, and the unset block at the end of the
user-transition script
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The user-transition script is fed to bash on stdin, so the browser-close
gum confirm read the script itself: it auto-declined and swallowed the
remaining script text, leaving bash to fail on a mid-construct syntax
error. The outer confirm and reboot prompts had the same exposure when
the script runs via curl | bash. Read all three from /dev/tty.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Copy URL shortcut repair checked the outer script's yes variable,
which never reached the user-transition heredoc's bash process, so the
upgrade died with "yes: unbound variable" under set -u whenever a
browser was running with the old extension id in its Preferences.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
graphical.target was gated on network-online.target: cups-browsed orders
itself After=network-online.target and sits in multi-user.target, so the
session waited for NetworkManager-wait-online (DHCP/Wi-Fi association)
before coming up. On the bench VM that was ~140ms, but it's the classic
multi-second boot stall on real Wi-Fi.
Mask NetworkManager-wait-online.service so network-online.target is
reached immediately and nothing in the boot waits for connectivity;
NetworkManager still comes up and cups-browsed browses once the link is
live. Mirrors the existing systemd-networkd-wait-online mask. Enabled at
install (enable-services.sh) and masked on existing installs via
migration.
Verified on a fresh boot: the graphical.target critical chain no longer
passes through network-online.target / NetworkManager-wait-online.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gum_env.lua is fed into the compositor environment via hl.env at login,
but that environment is captured once and is not refreshed on a theme
switch. Terminals launched through uwsm-app inherit the caller's
environment (scopes don't read systemctl --user set-environment), so a
floating terminal would show the login-time theme's gum colors.
Extract the export logic into a sourced omarchy-restart-gum helper and
source it from the presentation terminal launcher so gum widgets match
the active theme.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
system-config-printer ships /etc/xdg/autostart/print-applet.desktop, so
installing it for the printer GUI also starts a ~24 MiB Python tray applet
in every session whose only job is print-job notifications. Override it
with a Hidden=true entry in config/autostart (same mechanism already used
for fcitx5 and limine-snapper-notify), so the applet no longer autostarts.
Printing and the system-config-printer GUI are unaffected.
Verified: with the override in place, systemd's xdg-autostart generator no
longer produces app-print\x2dapplet@autostart.service.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Guards the dock-gating in omarchy-hyprland-monitor-watch: the poll runs
only when omarchy-hw-laptop and an external monitor are both present, via
sync_poll_state, with the event loop fed by process substitution so it
can start/stop the poll. Behaviourally simulated (stubbed hw checks +
synthetic monitor events): the poll runs only while docked and stops on
undock; a desktop or undocked laptop never polls.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The media service ran a 500ms repeat timer calling syncPlayingOrder() for
the whole session — two CPU wakeups a second even with nothing playing.
syncPlayingOrder only depends on the set of MPRIS players and each
player's isPlaying state, both of which the Mpris service already signals.
Replace the timer with onPlayersChanged (players appearing/disappearing)
plus an Instantiator that connects isPlayingChanged for each live player,
and a Component.onCompleted for the initial sync.
Verified with a test MPRIS player: play/pause and player add/remove all
update the active player with no periodic timer.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The reconciliation poll (added in "Fix clamshell display recovery") is a
backstop for lid transitions the Hyprland switch binds can miss across
suspend/resume. But the internal panel is only ever disabled while the
laptop is docked — lid shut with an external monitor active — so the poll
has nothing to reconcile when undocked. Running it 24/7 on every laptop
wakes the CPU every 2s for no reason, which is exactly the case where
battery matters most.
Start the poll when an external monitor is present and stop it when the
last one goes away (driven by the socat monitor-add/remove watch), gated
on omarchy-hw-laptop. Undocked laptops and desktops now never poll; a
docked laptop keeps the 2s recovery poll. Switch the event reader from a
pipe to process substitution so it runs in the main shell and can manage
the poll's lifetime.
Desktop verified: no poll runs even with external monitors attached. The
docked-laptop start/stop path needs a check on real laptop hardware.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omarchy-hyprland-monitor-watch ran poll_clamshell_state() every 2s for
the whole session, and each pass forks omarchy-hyprland-monitor-clamshell
plus its hyprctl/jq/monitor-* children. Clamshell (lid) handling can only
ever apply to a machine with a lid, so on desktops and VMs this was pure
churn — the single largest remaining source of idle process wakeups
(~3 forks/sec on an otherwise idle desktop).
Gate the poll behind a new omarchy-hw-laptop helper (lid button, or a
laptop DMI chassis type as a fallback). The event-driven socat watch on
Hyprland monitor add/remove is unchanged, so monitor hotplug still
reconciles everywhere; only the periodic lid poll is now laptop-only.
Verified on a desktop: steady-state omarchy-hyprland-* forks drop from
~3/sec to zero, socat watch still present.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The pill was populated by polling omarchy-network-status (previously
every 3s, then 10s). Derive kind/signalStrength directly from the
Quickshell.Networking service instead: wired-connected → ethernet
(preferred, matching the default-route device), else a connected Wi-Fi
network → wifi with its signal, else disconnected. The service's
properties are change-notified, so the pill updates on connect/
disconnect and signal changes with no polling and no subprocess.
Removes the last periodic poll from the bar; the label/frequency pill
fields were write-only and are dropped.
Verified live: pill tracks ethernet → disconnected → ethernet in real
time as the wired device goes down and up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Each `bash -lc` starts a login shell that re-sources the profile
(mise activation, /etc/profile.d) on every invocation — ~16 forks per
call versus ~2 for `bash -c` — which taxes every menu/panel/launcher
action the shell shells out for. The session already exports PATH and
env to the shell, so omarchy commands resolve fine under `bash -c`.
Switch the internal/omarchy-owned spawns (theme+background switches,
brightness, monitor scaling, DNS, lock/fingerprint, keyboard-layout
probe, voxtype status, and the `:`/printf state-file writes) to
`bash -c`. Leave `bash -lc` on the sites that run user-configurable
commands (custom bar-widget exec, menu provider/guard scripts,
launcher scan commands, configurable idle/screensaver command), where
a user's command may rely on their login environment.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The monitor panel polled `omarchy-monitor-state` every 5s (26 forks per
call) and the network panel polled `omarchy-network-status` every 3s,
both with `running: true` rather than gating like the sibling panels.
Monitor: gate the poll on `opened` (brightness/scale are only shown in
the open panel, which already refreshes on open) and drive the bar glyph
from Quickshell.screens instead of the polled display list, so monitor
count stays correct without polling.
Network: the bar pill needs live-ish state, so keep polling but at 10s
instead of 3s. (Deriving the pill from the native Networking service
would remove the poll entirely; left as a follow-up since it needs Wi-Fi
state testing.)
Idle fork rate drops ~20/s to ~14/s.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The indicators widget broadcast a refresh every 2s, fanning out to four
status subprocesses (nightlight, idle, reminder, screen-recording), and
NightLight/StayAwake each ran an additional 5s poll. On an idle desktop
this was the dominant source of process churn (~33 of ~53 forks/sec in a
VM). The state-changing commands already push `omarchy.indicators
refresh` over IPC, so the polling was redundant.
Drop the 2s broadcast and the two 5s timers; indicators now refresh at
startup and on the IPC push. Also fix three callers that pushed to the
wrong target `Indicators` instead of `omarchy.indicators` (screen
recording, notification silencing, and the omarchy-shell help example) —
those pushes silently failed and only appeared to work because the poll
masked them.
Idle fork rate drops ~53/s to ~20/s.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The background plugin ran a 100ms Timer that spawned a readlink
subprocess ~10x/sec for the life of the shell, purely to notice
wallpaper changes. Wallpaper updates already arrive over IPC
(omarchy-theme-bg-set calls `background set`, omarchy-theme-set calls
`background themeTransition`), and the initial wallpaper is read once
in Component.onCompleted, so the poll was redundant.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omarchy-update-user-notify.path used PathExistsGlob= on the packaged
migrations directory. That directive is level-triggered: systemd re-checks
it every time the triggered unit deactivates and fires again while the glob
still matches. Since applied migrations stay on disk forever (state lives in
~/.local/state/omarchy/migrations), the glob always matches, so the oneshot
notifier re-triggered itself in a tight loop (~26-66 starts/sec) — burning
about a core and flooding the journal for the whole session.
The loop existed since the unit was introduced, but the default start-rate
limit killed it after 5 iterations, taking the .path unit down with
'unit-start-limit-hit'. That symptom was reported as #6174 and fixed
yesterday by setting StartLimitIntervalSec=0 — which removed the only brake
and turned the capped hiccup into an unbounded busy-loop.
Fix the actual cause instead:
* Drop PathExistsGlob= from the .path unit, keeping the edge-triggered
PathModified= watch for updates that land mid-session.
* Revert the StartLimitIntervalSec=0 override; with the level trigger gone
there is no self-re-fire to trip the limit, and the default limit is a
useful backstop again.
* Preserve the once-per-login pending check the glob used to provide by
giving the service its own WantedBy=graphical-session.target, enabled at
first-run alongside the other user units.
* Add a migration that daemon-reloads, revives a rate-limit-killed .path,
restarts the watcher, and enables the login-time notifier on existing
installs.
Verified with transient path/service units: the old config runs the service
200 times in 3 seconds; the new config runs it zero times while idle and
exactly once when a new migration file lands.
Thanks to @HANCORE-Linux for finding and diagnosing the problem.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The tree is wholly package-owned, but files can land there unowned
(in-place extension work, script-written files), and pacman then aborts
the entire upgrade on the file conflict — as happened when copy-url's
service worker was renamed to background-2.js. The conflict check runs
before any hooks or scriptlets, so the package itself can't recover;
the update command has to allow the overwrite.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds shift:both_capslock alongside compose:caps so pressing both Shift
keys together toggles real Caps Lock. Caps Lock alone remains the
Compose key, and single-Shift behavior is unchanged. Provides an escape
hatch when Caps Lock gets stuck on (e.g. after an fcitx5 desync).
Closes#5981
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The lock service arms a 5s blank timer whenever the screen locks, and
input at the lock screen re-arms it. Closing the lid sprays pointer
noise over the lock surface, so the timer was routinely armed right
before suspend, froze mid-countdown, and fired moments after resume --
blanking the freshly woken unlock screen under the user.
Guard the timer with a wall-clock check: if far more time elapsed than
the interval, the countdown slept through a suspend, so take a fresh
run-up instead of blanking. This also blanks the lock screen 5s after
an untouched resume.
Two accomplices made the flash worse and hid the real bug:
- The clamshell watcher's 2s poll fired an unconditional global DPMS
enable whenever no external monitor was active, relighting any blank
within 2 seconds (lock-screen blanking never stuck on undocked
laptops) and racing the resume modeset. Recovery now only wakes
displays when it actually re-enables one.
- Every keystroke at the lock screen dispatched a redundant DPMS
enable via omarchy-system-wake, forcing extra modesets in the
fragile just-resumed DRM state. Brightness "on" now skips the
dispatch when every active display is already lit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The colorset is the Monokai Pro Ristretto palette, so the generated
themes keep all the accent colors. Brightened muted to Monokai Pro's
actual comment color, since comments sit on that key.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The stable Brave Origin's process is named plain "brave" (the wrapper
execs /opt/brave-origin-bin/brave), so pgrep -x brave-origin never
matches, and pgrep -f brave-origin also matches the installer's own
floating terminal - which made omarchy-install-browser launch a
headless browser and hang on first install.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Brave now publishes brave-origin-bin on AUR, so use it instead of
brave-origin-beta-bin. The stable wrapper also parses flags files
correctly, so Brave Origin can use the normal chromium flags like
the other Chromium-based browsers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Tuned muted, dark_foreground, and lighter_background to the tiers the
explicit themes used, which also fixes muted falling back to pure white
in the generated terminal configs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ports #6092 from master: the video-app opacity opt-out only matched
Chrome/Chromium on the default profile, so Brave, Edge, and non-default
profiles kept the translucent default-opacity styling.
Co-Authored-By: Zeus-Deus <github.commits@widow.cc>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Chromium-based browsers auto-detect their os_crypt backend at launch. On
Hyprland the xdg-desktop-portal Secret backend has no provider, so the
autodetect can fall back to the 'basic' (v10) store, making previously
v11-encrypted cookies and saved passwords undecryptable — the user is
silently logged out of everything. Pin gnome-libsecret (the stock
omarchy keyring) so the backend is deterministic, matching what we
already do for VSCode.
Migration covers chromium, brave, chrome, and edge flags confs for
existing installs.
Co-authored-by: Niklas Tscheppe <ntscheppe@drgt.net>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* emoji panel: handle CTRL+BACKSPACE to clear filter
* shell: handle CTRL+BACKSPACE to clear filter in all search overlays
* Indentation fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* menu filters: align keyboard editing with Qt standard shortcuts
* menu filters: extract shared filter-editing helpers
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* potential fix for pull request findings
* Only treat filter edit keys as edits when they change the text
Backspace/Ctrl+U on an empty filter no longer calls setFilter(""),
which was resetting the list selection back to the top. This also lets
the menu's empty-filter Backspace fall through to goBack() with any
modifier held, as it did before the Util extraction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
With initial workspace tracking disabled, windows naturally open on the active workspace. Remove the explicit Hyprland workspace dispatch and let shell actions, shell restarts, and presentation terminals launch directly.
Set misc:initial_workspace_tracking = 0 so new windows appear on the currently
active workspace rather than the one their process was first launched on.
Without this, file-picker dialogs drawn by xdg-desktop-portal-gtk (browser
Open/Save, GTK app choosers, etc.) always open on the workspace where the portal
process started at login (typically workspace 1) instead of following the app
that requested them. So a Save dialog triggered from a browser on workspace 2
pops up on workspace 1, out of view.
Trade-off: an app launched on one workspace that switches away before its window
maps will now open on the new active workspace. In practice the dialog-follows-app
behavior is the more intuitive default.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Long passwords used to overflow the input field and clip with no
feedback that typing was still registering. Scale the dot size and
letter spacing down as the password grows, like macOS, so every
keystroke stays visible.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The skill still described pre-Quattro .conf files and workflows, sending
agents to inactive config files and stale commands. Now covers the Lua
config layout, o.bind/hl.unbind/hl.monitor forms, .d hook directories
with omarchy hook install, plugin cloning, and corrected command routes.
Distilled from #6310.
Co-Authored-By: ssupt <149246609+ssupt@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omarchy-restart-shell now kills by config dir via quickshell kill and
relaunches with --no-duplicate, polling kill until every instance is
gone since kill returns without waiting and -n silently exits if one
remains. The locked-session refusal reads Hyprland monitor state alone,
which covers a hung shell holding the lock; the redundant shell IPC
probe, availability guards, and omarchy-shell path indirection are gone.
Shell IPC calls now time out (2s default, OMARCHY_SHELL_IPC_TIMEOUT to
override) so probing an unresponsive shell fails fast instead of
hanging the caller.
omarchy-hyprland-launch checks dispatch output for "ok" rather than the
exit code, which is 0 even on Lua errors, so a failed dispatch falls
through to the bash -lc fallback instead of silently launching nothing.
The Quattro upgrade cutover delegates to omarchy-restart-shell instead
of carrying its own copy of the lock check, pkill, and readiness loop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Restore the key translation the awk parser used to do (C-M-S-Left →
CTRL + ALT + SHIFT + LEFT, PPage → PAGE UP, etc) as a display pass over
the tmux list-keys output, along with the PREFIX header line and the
COPY MODE table label.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Use tmux to list keybindings
* Annotate tmux keybindings
* List unannotated bindings too and let the isolated server exit on its own
list-keys -aN falls back to the raw command when a binding has no note,
so user-added bindings in an existing tmux.conf still show up. Dropping
exit-empty off means the throwaway server exits when the client
disconnects instead of relying solely on the trap.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Explicit profile selections from the power panel or menu are now saved
under an ac/battery key in ~/.local/state/omarchy/powerprofiles and
reapplied on boot and on plug/unplug. Only successful, user-made
selections are persisted, so the performance/balanced defaults still
apply when nothing has been chosen.
All entry points key off the same power signal, UPower's OnBattery:
the shell reads it natively and omarchy-powerprofiles-set autodetect
queries it via busctl. This replaces the sysfs online checks, which
disagreed with the shell on desktops without power_supply entries and
lagged behind plug events on some USB-C laptops.
Plug/unplug switching moves from the udev rule into the shell's battery
service, which already receives UPower's debounced state changes, so
the udev rule and its settle-sleep workaround are gone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hyprland can report a scale set to 3 as something like 3.0000000000000004.
The previous directional comparison treated that as above the 3 preset, so
Super+Alt+Slash (scale down) would stay at 3 instead of reaching 2.
Snap the reported scale to the nearest preset first, then step up/down.
Add a regression test for the floating-point case.
Bundling vconsole.conf makes Plymouth apply the user's layout at the LUKS
prompt, but for layouts whose letter keys aren't Latin (Hebrew, Greek,
Cyrillic, Arabic, ...) that makes the necessarily-Latin passphrase
untypeable and locks the user out of their machine.
mkinitcpio sources its conf.d drop-ins as shell, so omarchy_hooks.conf now
checks XKBLAYOUT at every rebuild and only bundles the file for Latin
layouts; non-Latin layouts keep the US fallback the passphrase was set
under. A migration strips the unconditional line and rebuilds the UKI on
affected installs.
Closes#6229.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omarchy-update-user-notify.path watches /usr/share/omarchy/migrations
with PathModified. A single update commonly drops several migration
files at once, so the oneshot service is re-triggered in a burst and
exceeds the default start-rate limit (StartLimitBurst=5 / 10s):
omarchy-update-user-notify.service: Start request repeated too quickly.
omarchy-update-user-notify.path: Failed with result 'unit-start-limit-hit'.
When the limit trips, the watching .path unit itself fails and stops
watching, so migrations that land later in the session are never
surfaced until the next login.
Set StartLimitIntervalSec=0 on the service. omarchy-migrate-notify is
idempotent, so there is no downside to letting it run on every trigger.
Co-authored-by: Claude <noreply@anthropic.com>
* Align MAX_SNAPSHOT_ENTRIES with Snapper retention
Snapper is configured with NUMBER_LIMIT="5", but limine-snapper-sync
also counts the freshly-created / currently-booted snapshot, so five
retained snapshots are reported as six entries and it warns on every
snapshot and update:
Snapshot limit mismatch: 6 Snapper snapshots exceed configured
MAX_SNAPSHOT_ENTRIES=5
Raise MAX_SNAPSHOT_ENTRIES to 6 (NUMBER_LIMIT + 1) so the boot-menu cap
and Snapper's retention agree and the off-by-one warning stops. (An
alternative is MAX_SNAPSHOT_ENTRIES=auto, which derives the cap from
Snapper directly; kept an explicit value here to preserve the existing
boot-menu limit.)
Co-Authored-By: Claude <noreply@anthropic.com>
* Clarify Limine snapshot limit
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Prevent empty drive encryption passwords
* Use sudo, quote the confirmation compare, and cover mismatches in test
The unquoted [[ $new_password == $confirmation ]] made the confirmation
a glob pattern, so a confirmation like * matched any password. And pkexec
brought nothing over the repo-standard sudo here while failing outright
in sessions without a polkit agent.
Verified against a loopback LUKS device: new key lands from stdin without
a trailing newline while the current passphrase is prompted on the tty.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: mplaczek99 <mplaczek99@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The canonical colors.toml keys are now background/foreground, including
all permutations (dark_background, darker_background, lighter_background,
dark_foreground, light_foreground, bright_foreground). The old short
names are gone entirely, not kept as aliases; legacy alacritty-generated
themes still resolve through the ANSI color0/color7 fallback.
Theme files are also regrouped: accent/selection/muted first, then the
backgrounds, then the foregrounds, then the named colors.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hyprland falls back to compositing the cursor into the frame on GPUs
without working hardware cursors, so grim would capture it. Force
hardware cursors for the duration of the capture and restore after.
Closes#6142
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Existing quattro installs get sof-firmware, the Mesa Vulkan drivers,
the tmux terminal-features and pane-binding fixes, and the XPS 13 text
scaling via migration, while Omarchy 4 upgraders get the same hardware
support and scaling through omarchy-upgrade-to-quattro.
The Vulkan driver backfill adapts da46ad85 from master.
Co-authored-by: Sai Sridhar <tarrasridhar1154@gmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The 2560x1600 panel on the 2026 XPS 13 (DX13260) renders the default
scaling a touch large. Ports f1fa7f69 from master.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The sof-audio-pci-intel-* driver family needs sof-firmware to boot the
DSP, but mainline linux only optdeps it, so affected installs came up
with a Dummy Output sink only. Replace the Panther Lake check with
omarchy-hw-intel-sof, which detects any Intel PCI audio controller.
Ports ffa81021 from master, which adapts basecamp/omarchy#6200.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
With a fixed --unit name, the rule fails to start when a unit from a
previous power event still exists, leaving the power profile stale.
Letting systemd-run generate unique unit names keeps every trigger
working; --collect still garbage-collects each unit on exit.
Ports 749a8c04 from master.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pacman -Q resolves provider names, so dropping a virtual package could
remove whichever package provides it. Read pacman -Qq once and match
requested names exactly, ignoring providers and duplicate arguments.
Ports the provider-ignoring semantics of 9791b227 from master with a
single pacman query instead of one per package.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
libretro-bsnes2014 and libretro-mame2016 no longer exist in the repos,
which made the whole retroarch install fail. Ports fe30a07d from master.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Position the bar by dragging (or click-and-holding) empty bar space
toward a screen edge, with a ghost slab previewing the target edge.
With drag for position and double-click for transparency, the bar
config panel, its inline gear button, and the omarchy-launch-bar-settings
CLI are no longer needed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The clamshell watcher polls omarchy-hyprland-monitor-clamshell every two
seconds and calls enable_internal unconditionally which re-enabled DPMS
on the internal panel each time. When the lock screen blanks the displays,
the next poll of omarchy-hyprland-monitor-clamshell re-lights the laptop
screen, leaving it showing the lock screen indefinitely while external
monitors stayed off.
Only issue the DPMS wake when the clamshell flag was actually consumed,
i.e. on the lid-open transition the wake was meant for.
If the lid-open even fails to turn on the screen for whatever reason,
then pressing a key or moving the mouse will re-light the screen. This
is configured in `input.lua` via `key_press_enables_dpms = true` and
`mouse_move_enables_dpms = true`
The Copy URL extension was intermittently failing to copy anything, and
its notification looked oversized with no icon. Several distinct problems:
- The MV3 service worker was pinned to stale cached code. Chromium caches
the worker script for a --load-extension command-line extension and does
NOT re-register it when the file changes in place — not on restart, not on
a manifest version bump, not even after a clean shutdown. So updated code
never took effect: the old worker kept calling chrome.scripting.executeScript,
which throws once the scripting permission is gone, and the copy silently
failed. Renaming the worker to a versioned filename (background-2.js) is a
new script URL, which forces a fresh registration for everyone — new
installs and existing installs alike. Rename it again on any future worker
change (see the note at the top of background-2.js).
- Clipboard writes now go through an offscreen document (MV3's sanctioned
path) using a textarea + execCommand('copy'), replacing executeScript +
navigator.clipboard. This works on chrome:// pages and needs no scripting
permission. execCommand is used deliberately: navigator.clipboard.writeText
rejects in an unfocused offscreen document.
- Add a toolbar action (chrome.action.onClicked) so the extension is
clickable, not keyboard-only — it was greyed out in the extensions menu
with nothing to invoke.
- Slim the "URL copied" notification: lead the summary with a glyph so the
omarchy notification shell collapses it to a single-line toast with an
icon, instead of an oversized card with a blank icon slot.
- Guard the Quattro shortcut-repair migration: it edits Chromium Preferences
to move the Alt+Shift+L binding to the new extension id, but a running
browser rewrites Preferences on exit and reverts the edit. Prompt (via gum)
to close the browser first, only when a browser is running and there is
actually a stale binding to repair.
The omarchy-bar command had grown three overlapping ways to inspect the
bar (show/layout/list/options, plus selected/active/available/widgets
aliases) and mixed layout mutation in with bar-level settings. Untangle
it into two focused commands:
- omarchy-bar keeps only the bar-level settings that write shell.json:
use, reset, position, transparent, and settings. reset now delegates
to `use omarchy.bar` rather than duplicating the del(.bar.id) write.
- omarchy-bar-plugin owns all layout mutation: add, move, remove, set,
and replace, with the placement flags and jq resolve/anchor helpers.
`omarchy bar plugin ...` routes here via the dispatcher.
Drop the inspection commands entirely: the layout is visible on the bar,
the config is shell.json, and widget/option ids come from
`omarchy plugin list`. Nothing consumed the show output programmatically
except tests. This also removes omarchy-bar-position, whose jq write was
a duplicate of `omarchy bar position`.
Strip environment-invariant guards (require_command, require_omarchy_path)
that defended against jq or OMARCHY_PATH being absent — neither happens on
a real system. Keep the user-input validation (--section/--index) and the
atomic shell.json write.
Update callers (service install/remove, refresh-shell, plugin-clone,
plugin enable), keybindings, the menu, tests, and docs to the new split.
The weather widgets asked wttr.in to geolocate by IP, which lands on
whatever city the ISP registers its address block under -- Downey when
you're in Malibu. Now the location can be set explicitly:
* Click the location in the weather panel to search via open-meteo
geocoding, pick a suggestion (disambiguated by region), and it sticks.
The X next to the field returns to IP auto-detect, as does committing
an empty search.
* State lives in ~/.local/state/omarchy/settings/weather.json as
{name, latitude, longitude}, owned by the new omarchy-weather-location
command (bare call prints the current location, --set/--clear write).
The panel watches the file, so hand edits apply live.
* Stored coordinates make wttr.in and open-meteo exact. Open-meteo also
now supplies current conditions alongside the daily forecast it
already served, which fills the panel within a second of a location
change instead of waiting out wttr.in's multi-second responses; wttr
results still win once they land. Failed wttr fetches retry instead
of sitting stale until the next refresh cycle.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
9914513a unified internal monitor detection but left the test grepping
for the old jq expression. Since the suite runner stops on first
failure, every test file after monitor-recovery went silently unrun --
281 assertions were being skipped while the suite looked green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
canonical_widget_id was a pure pass-through, making its reserved-id
check a tautology; require_omarchy_path and choose_value were defined
but never called.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Apps like nvim clear the per-pane cursor colour with OSC 112, which made
tmux reset the outer terminal's cursor. Terminals that can't reload their
config (foot) then restore the cursor colour from whatever theme was
active at launch, leaving a mix of old and new cursor colours across
panes. Set the global cursor-colour option as a fallback so cleared panes
land on the current theme instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The `Bar` uses a `Repeater` when building out the models. This has the
effect of marshalling the configuration, and causing JSON arrays to
become sequence wrappers.
A couple of the plugins had been checking for the existence of array
values with `Array.isArray`, which fails for the sequence wrappers,
causing the values to be ignored. This breaks associated functionality
(the "hide" and "pin" actions in the systray had stopped working, as had
exit node selection in Tailscale).
Switching the guards to use `instanceof Array` works correctly for
sequence values (as well as arrays).
The bar supports switching between transparent and opaque. That means we
can't use an opaque surface for it; if we did, it would be unable to
reliably render as transparent when needed.
This fixes a visual glitch where the background of a transparent bar
would flicker, particularly during mouse hover.
The trailing slash from the themes/*/ glob put a double slash in the
path comparison, so stock backgrounds never matched git ls-files output
and were all moved into ~/.config/omarchy/backgrounds.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
With dotglob set, * already matches dotfiles, so the extra dot patterns
made the second ln -s fail and silently skip the legacy hypr shim.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Legacy repos cached omarchy packages under the same name and version as
quattro rebuilds with different bytes, so pacman aborted --noconfirm
transactions with checksum errors.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Weather wraps its panel in a BarWidget that only exposed togglePanel(),
so it couldn't ride the new shell-routed hotkey path and was left on the
stale-prone per-plugin target. Expose open/close/opened on the wrapper
(open maps to the panel's hotkey path so the center hover reveal stays
suppressed) and switch omarchy-notification-weather to the new syntax.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bar-widget panels (audio, bluetooth, network, power, monitor) used to be
toggled via their own per-plugin IpcHandler targets. Quickshell resolves
duplicate targets first-handler-wins, so after a plugin or bar reload the
stale handler of the destroyed widget instance kept claiming the target
and the hotkeys went dead.
The shell root's IpcHandler lives outside the reload cycle, so summon,
hide, and toggle now go through `omarchy-shell shell toggle <plugin>`
and the shell routes to the live widget instance via the bar's slot
registry. Panel plugins that are also panel/overlay/menu kinds keep
using the panel loader path. Failures to find a live widget are logged
so a widget missing from the bar layout stays diagnosable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The slot registry is about to become the routing table for panel
hotkeys, so it has outgrown its debug-only name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A previous submap attempt was brittle because the script owned the
keyboard state: if it died between enter and exit, the submap stuck.
This version lets the compositor own both edges. The Lua config binds
plain Return when a layer surface with slurp's "selection" namespace
opens and unbinds it when the last one closes, so the bind exists
exactly while a pick is on screen. slurp dying for any reason (cancel,
crash, pkill, SIGKILL of the picker) fires layer.closed and the bind
evaporates — there is no code path where it leaks.
Return invokes omarchy-capture-region --take-fullscreen, which flags a
marker in XDG_RUNTIME_DIR and dismisses slurp; the picker treats an
empty slurp result with a fresh marker as the focused monitor, reusing
the existing fullscreen path. Since monitor focus follows the cursor,
that is the monitor under the slurp crosshair. The recording flow gets
monitor:NAME from the existing match, so Return during a recording
pick starts a native full-monitor capture.
The signal mode no-ops unless slurp is actually running, and both the
signal protocol and the layer-scoped bind lifecycle are verified live:
bind present only while slurp is open, real picks resolved by the
signal on both the screenshot and recording paths, no leftover binds.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both capture scripts carried the same pipeline: workspace rectangles
from hyprctl, a hyprpicker freeze, slurp, and the bare-click snap loop.
The copies had already diverged once (rotated-display handling), so the
pipeline now lives in one hidden helper, omarchy-capture-region-pick,
which prints the picked geometry in slurp format.
The two callers differ only in what they layer on top. The screenshot
needs the freeze to outlive the pick so grim captures frozen content:
--keep-freeze leaves hyprpicker running and prints its PID first, with
the caller owning the kill. The recording prefers native full-monitor
capture: --match-monitor prints monitor:NAME when the geometry exactly
matches a display.
One deliberate fix along the way: the screenshot snap regex rejected
negative coordinates, so bare clicks on monitors positioned left of or
above the origin never snapped. The helper uses the recording variant,
which handles them.
Verified with an 11-case shim harness (snap precedence, rotated-monitor
match, freeze ownership, cancellation, negative coordinates) and the
live end-to-end screenshot sanity test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Five scripts each hand-rolled colors.toml parsing plus their own
alias/fallback cascade, and the tables had drifted: theme-osc grew a
divergent color8/color9 chain, tmux and gnome carried private mode
detection, and the preview tool duplicated the lot. The differences
never mattered for shipped themes but were a standing bug factory for
sparse user themes.
omarchy-theme-color is now the single resolver. Its cascade is a
verbatim port of the canonical theme-set-templates logic (semantic
keys, legacy colorN aliases, derived shades, selection/cursor
derivation, mode precedence), exposed as --all, --raw, or single-key
lookup with fallback.
Generated output is byte-identical across all 21 shipped themes on
every surface: 17 template files, OSC byte stream, tmux and gsettings
command logs, and previews. Sparse legacy themes now resolve the same
palette everywhere instead of five slightly different ones.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
cmd_replace fed $PLACEMENT_FROM_SECTION/$PLACEMENT_FROM_INDEX to jq
without ever calling parse_placement, so they were always empty
strings that implied flag support which does not exist. Pass literal
empties with a comment stating replace resolves by widget id only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The screenshot picker swaps monitor dimensions for transform 1/3
displays; the recording copy had drifted and did not, so portrait
monitors got landscape rectangles in the picker. The full-monitor
match had the same blind spot, silently downgrading rotated-monitor
selections to region capture instead of native -w capture.
Both now share the screenshot script's format_geo jq helper, which
also lets the monitor match compare one geometry string instead of
four fields.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Four scripts matched internal panels with contains("eDP") while
omarchy-monitor-state used test("^(eDP|LVDS|DSI)-"), so laptops with
LVDS or DSI panels were internal to monitor-state but invisible to the
clamshell, mirror, and external-active logic. All five sites now share
the inclusive anchored pattern.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
FILES="$*" space-joined multiple CLI path arguments into one bogus
argument before handing them to LocalSend. Build the file list as an
array from the start, which also collapses the single/multi send
branch into one path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The keymap cache parsed xkbcli compile-keymap into a bash associative
array, serialized that array back into a string, and re-parsed it
inside a second awk's BEGIN block. One awk now reads the compiled
keymap directly, seeded with the fallback table so xkbcli failure
still degrades gracefully. (The xkbcli child must read /dev/null or
it consumes the binding records arriving on stdin.)
Also gone: the never-called lookup_keycode_cached, the DEBUG timing
scaffold, the redundant explicit noops in the Lua mock that the
metatable already provides, the walker-era XML entity escaping that
nothing renders as markup anymore, and the monitor-height computation
in favor of a fixed height like every other menu.
The cache key drops the double sha256 and now includes the active
keymap, so switching XKB layout invalidates cached symbol names
instead of serving stale ones.
Binding records are byte-identical before and after: 215 of 215.
686 lines to 573.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Each color lookup spawned a 60-line awk program with a character-by-
character quote-state machine for comment stripping, about 22 spawns
per run counting the dotted-key retries. One pass now tracks the
current [section], normalizes dotted keys to the same path, and emits
key/hex pairs into a single associative array the shell reads once.
The strict value pattern (a lone, optionally quoted and 0x/#-prefixed
six-digit hex, followed by nothing or a comment) makes quote-aware
comment stripping unnecessary. Section form still wins over dotted
form and first valid occurrence still wins, matching the original
search order. Output is byte-identical across fixtures covering both
key forms, comments, prefixes, and fallback paths, plus real themes.
197 lines to 151.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The braille and block renderers were two near-identical awk programs
sharing a verbatim PBM tokenizer, header check, and blank-line trim,
differing only in the per-cell rendering. One awk with a mode variable
now branches where they actually differ.
The option surface served two in-repo callers, both passing constants:
the duplicate positional loop behind --, the undocumented --block and
--braille aliases, and the --flag=value forms all go. The two magick
probes for the alpha range collapse into a single invocation.
Output is byte-identical across images and flag sets for everything
that remains, including both real callers' exact invocations.
353 lines to 243.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The /proc/*/environ scraping, wayland/X11 socket probing, and LANG/DBUS
guessing arrived with the Omarchy 4 live upgrade cutover, whose upgrade
script no longer exists. Every remaining caller runs inside the
graphical session with full env. Keep a five-line guard deriving
HYPRLAND_INSTANCE_SIGNATURE from the newest instance runtime dir so
restarting over ssh still works.
Launching now goes straight to the Lua dispatcher: on quattro, classic
hyprctl dispatch arguments are evaluated as Lua and fail with exit 0,
so the old exec fallback silently did nothing. Check for "ok" output
instead of trusting the exit code, with setsid as the real fallback.
180 lines to 94.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The embedded Perl program parsed instance.lock QString framing and spoke
the Quickshell IPC socket protocol by hand. Quickshell ships this
natively: qs -p <config> ipc call does instance discovery, the call, and
response printing, byte-identical for every in-repo call pattern.
The bash wrapper keeps what qs doesn't do: the -q best-effort mode, the
{} default argument for summon/toggle, and the familiar error wordings.
Two qs quirks are handled: function names like "show" shadow qs's own
CLI subcommands, so arguments are always passed after --, and IPC-level
failures (unknown target/function, bad arguments) are reported on stdout
with exit 0, so those are matched and mapped to stderr with exit 1.
165 lines to 62.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A plugin is now just a git repo cloned into ~/.config/omarchy/plugins/<id>/.
That one idea replaces the entire homegrown package-manager half of the
plugin suite: trusted-source registry, clone cache, catalog scanning,
semver comparison, staging dirs, and timestamped backups — 1,025 lines
across five binaries whose jobs git already does.
Gone:
- omarchy-plugin-source: the trusted-repo registry (sources.json) and its
clone cache under ~/.cache/omarchy/plugin-sources/. The trust decision
now happens once, at add time, with the same unsandboxed-code warning.
- omarchy-plugin-scan + omarchy-plugin-available: the catalog machinery
over cached clones. Discovery belongs on a web page, not in the CLI.
- omarchy-plugin-add: copying folders out of cached source clones with
hand-rolled staging and .bak backups. Replaced by a git clone.
- omarchy-plugin-update: manifest version comparison via sort -V and
re-installs. Replaced by fetch + diff + fast-forward; git is the version
and git is the backup.
- omarchy-plugin-remove and omarchy-plugin-edit as separate binaries:
folded into omarchy-plugin, much slimmer.
The consolidated omarchy-plugin now handles the full lifecycle:
- add <git-url>: warn, clone into a dot-prefixed staging dir (invisible
to the plugin scanner), validate, then move into place named by the
manifest id. Plugins land disabled — enabling is the single consent
moment, replacing the old review-before-copy flow.
- update [id | --all]: fetch origin HEAD, show the diff (delta when
available), confirm, fast-forward. Updates are code the shell will run,
so the result is re-validated and rolled back to ORIG_HEAD if upstream
turned invalid (e.g. smuggled a symlink).
- remove [id]: git checkouts are deleted outright since upstream keeps
the history; hand-made plugin folders still get a backup, and dev
symlinks are just unlinked.
- edit [id]: opens the user plugin directory in a shell.
All commands keep the interactive/unattended split: gum prompts in a
terminal, hard refusal without --yes otherwise, so scripts and agents
never hang on a hidden prompt.
Kept as siblings: omarchy-plugin-catalog (omarchy-bar reads it),
omarchy-plugin-validate (the security boundary, now pruning .git from its
symlink scan since installs are git checkouts), and omarchy-plugin-clone
(local development of built-in widgets, a separate concern).
Trade-offs accepted: one repo = one plugin (no more multi-plugin source
repos), and ref pinning or branch switching is no longer a CLI feature —
an installed plugin is a plain checkout, so that is ordinary git in the
plugin directory.
None of the removed machinery ever shipped: it existed only on this
branch, so there is no migration. The net effect is 11 scripts / 2,040
lines down to 4 scripts / 1,080 lines, and one less concept for users to
learn — everyone already knows what a git repo is.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replace the three-layer process management (trap cleanup, PPID-polling
watchdog subshell, /proc-scanning reaper) with kernel-level lifetime
binding: each wl-paste watcher is spawned under setpriv --pdeathsig TERM,
so it dies with the shell no matter how the shell exits.
- Delete watch.sh: the shell now spawns both watchers directly as
declarative Process commands instead of a wrapper script with traps
and a 1s polling loop
- Delete init.sh: reaping stale watchers from a crashed pre-pdeathsig
shell is a single pkill at startup
- Collapse capture.sh's dual stream/snapshot modes: wl-paste forwards
arguments to its watch command, so the mime rides along as $1 instead
of an env var, letting both modes share one emit_image function
- Turn the six-branch image mime chain into a loop
Net: two fewer files, three fewer runtime processes, and the watch-mode
capture tests now exercise the same argument protocol the shell uses.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omarchy-plugin mixed plugin lifecycle, clone/edit, and bar-layout mutation.
The bar layout was mutated by two separate engines (an embedded Python
mutate_bar here and jq in omarchy-config-shell-bar), each with its own
manifest walker.
- omarchy-plugin is now a ~220-line router; clone and edit move to
omarchy-plugin-clone and omarchy-plugin-edit, matching the existing
plugin-{source,add,update,remove,available,validate,scan} sibling pattern
- omarchy-config-shell-bar is replaced by omarchy-bar, the single bar engine
(show/layout/list/options/use/reset/add/move/remove/set/replace/position/
transparent/settings) with one jq pipeline; the Python mutate_bar and its
python3 dependency are gone
- omarchy-plugin-catalog is the shared manifest scanner used by omarchy-bar
(widget/option enumeration, add validation) and omarchy-plugin-clone
(source enumeration), replacing three find|jq re-implementations
- service install/remove and refresh-shell call omarchy-bar; docs and tests
updated to the new command surface
The May 17 picker performance change made activated thumbnail loads asynchronous, which undid the earlier anti-flicker fix and let carousel movement flash blank thumbnails. Keep lazy activation, but load activated thumbnails synchronously so theme/background picker navigation remains stable. Add regression coverage for the thumbnail loading mode.
Run internal monitor toggle recovery before the sleep lock path and retry recovery after Hyprland monitor removal events. This gives dock/lid-close races time to settle before suspend or external-display reconnects leave the session without a safe internal display fallback.
The launcher resolves each entry's icon through Quickshell.iconPath(),
which bottoms out in Qt's QIconLoader / QIcon::fromTheme. That engine
caches the theme's directory listing — and null results — for the life
of the process, and only re-scans when the icon theme or search paths
change. Nothing in Quickshell 0.3 exposes a way to invalidate it, and a
QML reload doesn't reset it either (QIconLoader is a QtGui process
global, not tied to the QML engine).
So when a user installs a new app while the shell is running, its
.desktop file is picked up live (DesktopEntries is file-watched and the
name appears immediately), but its icon resolves to the cached miss and
renders blank until the whole shell is restarted. That's a poor "I just
installed this" experience.
Fix it without a restart by keeping our own on-disk icon index as a
fallback. When themed lookup returns empty, iconSource() consults a
name->path map built by scanning the XDG icon dirs and /usr/share/
pixmaps (SVGs first, so scalable wins). The scan runs on startup and on
a debounced DesktopEntries change — the same signal that already makes
names appear — and swapping the iconIndex property re-evaluates every
iconSource() binding, so freshly installed icons show up live. Icons Qt
can already resolve are untouched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TEMPORARY: while the omarchy-4 stack is being iterated, the production
edge/stable/rc channels at pkgs.omarchy.org/<ring>/x86_64 don't have the
new omarchy and omarchy-settings packages — only omarchy-keyring and
omarchy-nvim are published. The work-in-progress packages live in the
dev repo at share.heyoodle.com/omarchy/dev/<arch> via
omarchy-pkgs/bin/publish-dev-repo.
To stop hand-editing pacman.conf after every run of this script,
configure_pacman_channel() now emits a [omarchy-dev] block right above
[omarchy] with SigLevel = Never and the share.heyoodle URL. Pacman
honors repo declaration order, so dev packages take precedence when
both ring publish them.
The awk also dedupes any pre-existing [omarchy-dev] block (so rerunning
the script doesn't pile up duplicate entries) and falls back to
appending both blocks at the end if no [omarchy] section was present.
Revert this block once the production rings have caught up.
omarchy-limine no longer exists as a separate package — it was folded
into omarchy-settings (configs) and omarchy (bootloader stack hard dep).
Listing it in install_omarchy_4_packages's pacman -Syu invocation
produced 'error: target not found: omarchy-limine' on every run.
Also fix the now-stale 'shipped by omarchy-settings / omarchy-limine'
comment in the retire-action header (line 1119) — the files come from
omarchy-settings alone now.
The bootloader stack (limine, limine-mkinitcpio-hook, limine-snapper-sync,
snapper) is hard-depended by the omarchy package, so dropping
omarchy-limine from the explicit list doesn't change what gets installed
on a real upgrade.
systemctl --user enable only writes the .wants symlinks; the services
don't actually run until next login. Switching to --now enables AND
starts them, so the first session has bt-agent (bluetooth pairing) and
omarchy-sleep-lock active immediately rather than waiting a reboot.
omarchy-recover-internal-monitor is Type=oneshot with a
ConditionPathExists guard, so --now is harmless for it (it'll skip if
the toggle isn't set).
Reflects the two upstream changes in this work:
- omarchy-dev-tools folds into omarchy (bin/omarchy-dev-* ship with the
main package).
- omarchy-limine folds into omarchy-settings (limine + snapper configs,
mkinitcpio hooks, and the default/{limine,snapper}/ trees ship from
omarchy-settings; the package was always installed in lockstep with
it in the early bootstrap anyway).
Mental-model section: from four packages to two (omarchy +
omarchy-settings), plus the two unchanged independents (omarchy-keyring,
omarchy-nvim).
Build-time map: drop the omarchy-dev-tools and omarchy-limine columns;
add the new limine source files (omarchy_hooks.conf,
thunderbolt_module.conf, omarchy-defaults.conf, omarchy-uki.conf) under
omarchy-settings.
- Add default/bash/env-bootstrap to the build-time map and a dedicated
section describing what it sets, who sources it, and the dev-link gate
on the PATH prepend.
- Drop 'bluetooth' from the install/user/all.sh hardware-quirks list
(the per-hardware install script is gone now that the wireplumber
config ships through /etc/skel and bt-agent enables at first-run).
- Add a first-run section listing the post-login steps, including the
new enable-user-units.sh that defers user systemctl enables.
Reorganizes Omarchy 4 around three layers for populating $HOME:
Seed: omarchy-settings ships defaults to /etc/skel; useradd -m
copies them on user creation
Finalize: omarchy-finalize-user (renamed from omarchy-setup-user)
handles only the runtime tweaks /etc/skel can't do — skill
symlinks, xdg-user-dirs, default browser/mailto, vconsole→hypr
keyboard sync, and install/user/all.sh
Resync: omarchy-reinstall-configs is the explicit, destructive
resync of /etc/skel into an existing user's $HOME
Package-owned files move out of config/ into default/, where the
omarchy-settings PKGBUILD installs them to real system paths:
config/environment.d/fcitx.conf -> /usr/lib/environment.d/
config/fontconfig/fonts.conf -> /usr/share/fontconfig/conf.avail/
config/mimeapps.list -> /usr/share/applications/
config/omarchy.ttf -> /usr/share/fonts/omarchy/
config/systemd/user/*.service -> /usr/lib/systemd/user/
config/uwsm/default -> /usr/share/omarchy/default/uwsm/
config/uwsm/env -> /usr/share/uwsm/env.d/10-omarchy
config/xdg-terminals.list -> /usr/share/xdg-terminal-exec/
omarchy-upgrade-to-4 grows a 'retire' action (renamed from 'move' to
clarify nothing is copied — the system path is owned by the new package
once the user's hash-matched ~/.config copy is removed). Mismatched
copies are kept as backups so user overrides survive the upgrade.
Other simplifications:
- Single env bootstrap at default/bash/env-bootstrap sourced by
/etc/profile.d/omarchy.sh, /etc/skel/.bashrc,
/usr/share/uwsm/env.d/10-omarchy, and default/bash/envs. PATH
prepend only in dev-link mode (production uses /usr/bin/omarchy-*).
- omarchy-refresh-config reads from /etc/skel/.config so refresh
means 'snap to skel'.
- omarchy-reinstall-configs collapses to 'cp -af /etc/skel/. ~/'
plus limine/plymouth/nvim refresh.
- omarchy-font-set uses awk against our own 30-omarchy.conf instead
of xmlstarlet; xmlstarlet dropped from omarchy-base.packages.
- Defer user systemd enables (bt-agent, sleep-lock,
recover-internal-monitor) to first-run via
install/user/first-run/enable-user-units.sh; delete
omarchy-user-systemctl-enable and the per-hardware install
scripts that called it.
- Wireplumber bluetooth-a2dp-autoconnect.conf moves to config/ so
/etc/skel ships it; install/user/hardware/bluetooth.sh deleted.
- Default terminal switched to foot.desktop.
- docs/file-layout.md documents the three-layer model and the
build-time repo→path map.
Introduce a self-contained omarchy-upgrade-to-4 command for legacy installs and remove the 4.0 package-layout transition from the normal migration runner.
Remove legacy online installer entrypoints, collapse migrations for 4.0, and move setup responsibilities into target-side system, hardware, and user commands.
Evaluate NVIDIA session env vars from default/hypr/nvidia.lua during Hyprland startup instead of appending them to each user's envs.lua during setup. This removes the per-user NVIDIA setup script execution while preserving the GSP/non-GSP detection.
The harvest branch already enforces non-empty cmdline + presence of
root=. The pre-populated branch (added in 0d2688a5) was missing the
same validation, so a malformed /etc/default/limine could slip
through and the later cryptdevice= check would silently no-op
because $CMDLINE was empty.
The ISO orchestrator now writes /etc/default/limine directly from the
install config (with the real cmdline already substituted) before the
chroot phase runs. The previous unconditional find+harvest+copy+sed
sequence would (a) find our orchestrator-staged /boot/limine.conf which
has no `cmdline:` line and (b) exit 1 on "failed to extract kernel
cmdline".
Skip the harvest entirely when /etc/default/limine already exists
without the @@CMDLINE@@ placeholder. Parse CMDLINE from the existing
file so the downstream cryptdevice= validation still has it to compare.
The harvest path remains as a fallback for online reinstalls and any
flow where /etc/default/limine wasn't pre-populated by the orchestrator.
The orchestrator only runs on the live ISO, so it lives in omarchy-iso
where the rest of the ISO-specific code (configurator, .automated_script
.sh, archinstall pacman config) lives. omarchy-installer stays the
monorepo of Omarchy source content (configs, themes, default files,
install scripts) without a Python install driver mixed in.
bin/omarchy-install simplifies to a one-liner: it's the online entry
point now, no --config dispatcher. The orchestrator never invokes it;
it runs finalize.sh directly via arch-chroot.
Chunks 2-6 of the C3 refactor. With the adapter in place, the phase
list collapses from 12 stubs to 5 real phases:
prepare_live parse user_*.json into archinstall handlers
arch_install partition + base + bootloader + limine config +
early omarchy + useradd + runtime omarchy (all
inside a single Installer context manager)
run_chroot_finalizer arch-chroot -u $user → finalize.sh
validate_boot halt if /boot/limine.conf, /etc/kernel/cmdline,
or UKI are missing/malformed
finish reboot prompt
Key reordering vs upstream guided.py: write_limine_config runs BETWEEN
add_bootloader and the first add_additional_packages call. By the time
omarchy-limine pulls limine-mkinitcpio-hook (in the runtime package
install), /etc/default/limine and /etc/kernel/cmdline are in place, so
the UKI is built correctly on the first try — no stale-UKI purge,
no follow-up limine-update.
add_additional_packages is split into two calls so /etc/skel is
populated (via omarchy-settings in EARLY_PACKAGES) BEFORE useradd:
EARLY_PACKAGES = base-devel git omarchy-keyring omarchy-settings omarchy-installer
→ installer.create_users(users)
→ runtime: omarchy + omarchy-base.packages
archinstall_adapter.py is the ONLY module that imports from archinstall.
If archinstall's API churns, the blast radius is contained here. Tested
against archinstall 4.3 / Python 3.14.
Limine template lookup tries the new install/assets/limine/ path first
and falls back to the legacy default/limine/ location during the
template-ownership migration (lands in a follow-up chunk).
finalize.sh just does the in-target work: env setup, source helpers,
mark current migrations as done (idempotent), run packaging/config/
login/post-install. No preflight orchestration, no install_mode_is
offline branches.
install.sh (online) inlines the preflight bits that are online-specific:
guard.sh, begin.sh, show-env.sh. The first-run-mode setup that used to
live in preflight (offline-only) moves to an orchestrator phase in a
later chunk; disable-mkinitcpio.sh is obsolete entirely because the C3
phase ordering means the limine UKI hook fires exactly once with
correct config in place.
install/preflight/{all,disable-mkinitcpio,first-run-mode}.sh still
exist on disk but are no longer sourced. They'll get removed in a
later chunk once the orchestrator absorbs first-run-mode.
Chunk 1 of the C3 refactor: replace the two-pass install model (archinstall
CLI + custom shell dance + chroot bash installer) with a single Python
orchestrator that owns phase ordering, using archinstall as a library
subsystem.
Splits the bash entry point into two:
- install.sh: online entry point. Ensures omarchy runtime + base.packages
are installed/up to date, then exec's finalize.sh.
- finalize.sh: the in-target portion (preflight + packaging + config +
login + post-install). Called by install.sh (online) AND by the
orchestrator after arch-chroot -u $USER (offline).
Adds the orchestrator skeleton under install/orchestrator/:
- main.py: entry point, builds + runs the phase list
- context.py: InstallContext (parsed configurator JSON + invocation paths)
- phases.py: phase state machine (logging + state.json + error wrapping)
- phases_impl.py: stubbed phase implementations (filled in by chunks 2-6)
- archinstall_adapter.py: thin compat wall around archinstall lib imports
(only this module imports from archinstall.*)
- ui.py: gum subprocess wrappers so the orchestrator keeps the same
styled-terminal UX as the bash installer
Updates bin/omarchy-install to dispatch:
- --config <json> in args → python -m orchestrator.main (ISO install)
- anything else → bash install.sh (online rerun on installed system)
Concrete phase logic lands in subsequent chunks. All phases currently
raise NotImplementedError; the orchestrator imports cleanly and --help
works as a smoke check.
install/config/hardware/framework/qmk-hid.sh installs the qmk-hid
package on Framework 16 hardware, but it wasn't listed in any of the
ISO builder's package sources, so it wasn't being pulled into the
offline mirror. Adding it under the Framework 16 section in
omarchy-other.packages so the ISO build picks it up.
The omarchy install runs inside an arch-chroot to /mnt, so its log file
(/var/log/omarchy-install.log from the installer's perspective) is at
/mnt/var/log/omarchy-install.log from the live ISO. The previous script
only read /var/log/omarchy-install.log, and 'cat $ARCHINSTALL_LOG
$OMARCHY_LOG 2>/dev/null' swallowed the resulting 'No such file' error,
so uploaded logs from the ISO contained only the archinstall portion.
Prefer the /mnt path when it exists (live ISO post-install), fall back
to /var/log when running on the installed system. Also print a visible
separator between the two log sections and warn on stderr if the omarchy
log is missing entirely (instead of silently producing an incomplete
upload).
The lua-based monitors config (~/.config/hypr/monitors.lua) ships from
skel with sensible defaults (omarchy_gdk_scale = 2, omarchy_monitor_scale
= "auto"). Hyprland handles the dynamic monitor scale at runtime via
"auto"; 'omarchy hyprland monitor scaling <N>' already updates both
omarchy_monitor_scale and omarchy_gdk_scale in monitors.lua when the
user wants to adjust.
The first-run 'detect what hyprland picked and write it back' dance
was leftover from the .conf-based config; it's redundant on the lua
flow and was the script that aborted omarchy-first-run under set -e
when it sed'd a missing monitors.conf.
Two bugs caused fresh users to land without branding files / AI skill
symlinks / nautilus extensions / xdg dirs / etc.:
1. install/first-run/gdk-scale.sh sed-edited ~/.config/hypr/monitors.conf,
but the lua-based config flow uses ~/.config/hypr/monitors.lua. sed -i
on the missing .conf returned non-zero, set -e fired, omarchy-first-run
aborted mid-block AFTER deleting ~/.local/state/omarchy/first-run.mode.
omarchy-setup-user (called at the bottom of the script, outside the
if-block) never ran, so setup-user.done never got written and the
per-user defaults (~/.config/omarchy/branding/*, ~/.agents/skills/omarchy,
xdg dirs, etc.) never got created.
Replace the .conf sed with a call to omarchy-hyprland-monitor-scaling
which already knows how to persist into monitors.lua.
2. Move 'omarchy-setup-user || true' to the TOP of omarchy-first-run, before
the privileged first-run block. setup-user is idempotent and gated on
its own marker, so running it first is safe and means a failure in any
of the privileged steps can't prevent user setup from completing.
The edge mirror temporarily lacked a current 1password build (315e60d
hadn't been rebuilt), so install/omarchy-base.packages was pointing at
1password-beta as a workaround. Reverting now that the stable package
is available, and matching the entry in omarchy-remove-preinstalls so
that bin actually drops the package we installed.
The git-era flow installed Omarchy to ~/.local/share/omarchy. In the
package-based flow it lives at /usr/share/omarchy (or, in dev mode, at
the path /etc/omarchy.conf's OMARCHY_PATH points at). Files that hard-
coded the old path broke on package installs:
- default/bash/rc: sourced ~/.local/share/omarchy/default/bash/*, so a
fresh user's terminal logged ENOENT for every line. Now sources from
$OMARCHY_PATH with /usr/share/omarchy as the safe default if the var
is unset.
- config/systemd/user/omarchy-recover-internal-monitor.service:
ExecStart pointed at %h/.local/share/omarchy/bin/. The script ships
to /usr/bin via the omarchy-installer package; point straight there.
- install/config/xcompose.sh: wrote an XCompose include line pointing
at the user-home path; use /usr/share/omarchy/ directly.
- default/hypr/paths.lua and config/hypr/hyprland.lua: fallback when
OMARCHY_PATH is unset is /usr/share/omarchy, not the home path.
Dev-only scripts (omarchy-dev-add-migration, omarchy-reinstall-git) and
the SKILL.md docs still reference the old path; those are separate
cleanups since they don't affect a fresh install's runtime.
Per apollo audit: the /boot/limine.conf assertion grep was firing
BEFORE snapper config setup, btrfs quota disable, service enable, and
the mkinitcpio pacman hook re-enable. A validation failure (the failure
path the validation exists for) would leave the system half-configured.
Move the validation block to after 'mkinitcpio hooks re-enabled' so all
the post-config steps run first. Guard it with LIMINE_CONFIGURED=true so
non-limine setups still pass straight through to efibootmgr cleanup.
mkinitcpio -P alone doesn't trigger limine's UKI pipeline. The
limine-mkinitcpio-hook package installs /etc/pacman.d/hooks/90-mkinitcpio
-install.hook (overriding mkinitcpio's normal hook) which executes
/usr/share/libalpm/scripts/limine-mkinitcpio-install only on pacman
transactions, OR via the limine-mkinitcpio / limine-update CLI wrappers.
The previous fix (mkinitcpio -P) rebuilt initramfs-linux.img but left
the stale empty-cmdline UKI at /boot/EFI/Linux/<machine-id>_linux.efi
untouched. limine-update then booted that file.
Changes:
- Validate the cmdline extracted from /boot/limine.conf: fail loudly if
empty or missing root=
- Delete every alternate /boot/limine.conf so limine-update can't pick
the wrong one
- Delete stale UKIs for every installed kernel pkgbase before rebuilding
- Replace 'mkinitcpio -P' with 'limine-update' (which does
limine-install + limine-mkinitcpio, reading KERNEL_CMDLINE from
/etc/default/limine via limine-entry-tool and embedding it into a
fresh UKI)
- Assert /boot/limine.conf has the Omarchy entry and (for encrypted
installs) the cryptdevice= cmdline before continuing
In the package-based install, omarchy-limine is a hard dep of omarchy,
so archinstall pacstraps limine-mkinitcpio-hook (via omarchy-limine's
depends) early. That triggers a UKI build BEFORE limine-snapper.sh
runs, which means the UKI is built with no kernel cmdline (the
'Kernel command line is not available' warning in the archinstall log).
The system then can't unlock the LUKS root on boot because the encrypt
hook has no cryptdevice= to act on, and drops to an emergency shell.
The previous flow worked because 'pacman -S limine-mkinitcpio-hook'
inside limine-snapper.sh installed the hook for the first time, firing
its post-transaction UKI rebuild AFTER /etc/default/limine had been
written. With it pre-installed, '--needed' makes that line a no-op.
Fix: after writing /etc/default/limine, write the same cmdline to
/etc/kernel/cmdline (the source mkinitcpio --uki reads) and explicitly
run mkinitcpio -P to rebuild the UKIs with the correct cmdline.
fonts.sh: obsolete. omarchy-settings installs omarchy.ttf to
/usr/share/fonts/omarchy/ system-wide and the fontconfig package's
post-install hook updates the cache, so copying it to ~/.local/share/
fonts and re-running fc-cache is redundant. The script was also failing
because omarchy-settings explicitly removes the source path
/usr/share/omarchy/config/omarchy.ttf during package install.
omarchy-setup-lock: the final line was 'omarchy-shell lock status
>/dev/null && echo "..."' which inherits the failed exit code when
omarchy-shell can't reach a running shell (always the case during chroot
install). set -e exempts cmd1 of && from triggering, but the script
still returns that non-zero as its own exit code, which the install
wrapper treated as a script failure. Wrap in an if/then so a failed
status check doesn't poison the script's exit code.
0x0.st has been intermittently down. logs.omarchy.org accepts the same
curl -F 'file=@-' POST and returns the resulting URL in the response
body, so the swap is purely the endpoint. Dropping the -Fexpires=24
parameter since logs.omarchy.org doesn't honour it (and doesn't expire
uploads by default).
omarchy no longer hard-depends on the full install set; ensure_omarchy_runtime
now installs everything in install/omarchy-base.packages in addition to
the omarchy meta. Offline mode's assertion stays the same (the ISO does
the equivalent via .automated_script.sh).
Apollo-recommended dep split:
- omarchy-installer: bash gum jq git only (just the runner)
- omarchy: depends on omarchy-keyring + omarchy-settings + omarchy-limine
+ the runtime stack
- omarchy-settings, omarchy-limine: standalone
install.sh now installs the runtime (pacman -Syu --needed omarchy) before
sourcing preflight/all.sh in online mode, and asserts it's already
present in offline mode (ISO pacstraps it before user creation so
/etc/skel is populated).
boot.sh installs only omarchy-keyring + omarchy-installer (small + fast),
then exec's omarchy-install which handles the full-runtime pull.
User-visible effect: 'pacman -S omarchy-installer' now installs ~5 files
instead of the entire Omarchy stack. Users get a clean choice between
'I just want the installer' and 'I want the full Omarchy desktop'.
User-level files (~/.config, ~/.local/share, ~/.agents, etc.) shouldn't
be written by install.sh — it runs as root or with system-level sudo,
and in offline (ISO chroot) mode the user doesn't exist yet. Moved into
a per-user idempotent command, called from omarchy-first-run.
Moved into bin/omarchy-setup-user (deleted from install/config/):
- omarchy-ai-skill.sh AI skill symlinks
- omarchy-toggles.sh hypr toggle flags
- nautilus-python.sh nautilus extensions
- branding.sh ~/.config/omarchy/branding/{about,screensaver}.txt
- user-dirs.sh xdg-user-dirs-update + gtk bookmarks
- detect-keyboard-layout.sh layout/variant sed into ~/.config/hypr/input.lua
- toggles.sh ~/.local/state/omarchy/toggles mkdir
- mimetypes.sh omarchy-refresh-applications + xdg-mime/xdg-settings
Kept in install/config/ (rely on OMARCHY_USER_NAME / OMARCHY_USER_EMAIL
that only exist during install):
- git.sh git config --global user.{name,email}
- xcompose.sh ~/.XCompose with name/email substituted
omarchy-setup-user:
- Refuses to run as root
- Idempotent via ~/.local/state/omarchy/setup-user.done marker
- --force escape hatch for re-running after dev-link or upstream changes
- Defaults OMARCHY_PATH to /usr/share/omarchy so it works outside install
bin/omarchy-first-run now invokes omarchy-setup-user unconditionally
(it self-gates), so first user login picks up the user setup.
install/config/all.sh: dropped the eight deleted entries.
All three packages (omarchy, omarchy-settings, omarchy-installer) still
build clean.
Old boot.sh cloned the repo to ~/.local/share/omarchy and sourced the
checkout's install.sh. The package refactor moves all of that into the
omarchy-installer package, so boot.sh's job shrinks to:
1. Configure /etc/pacman.d/omarchy.conf for the right channel
(stable, edge for OMARCHY_REF=dev, rc for OMARCHY_REF=rc).
Include it from /etc/pacman.conf if not already.
2. pacman -Sy && pacman -S --needed omarchy-installer (depends pull in
omarchy, omarchy-settings, omarchy-limine).
3. exec omarchy-install (shipped by omarchy-installer at /usr/bin/).
The OMARCHY_REPO and clone logic are gone. The install.sh on disk
under /usr/share/omarchy is now the source of truth, and is invoked via
omarchy-install with OMARCHY_INSTALL_MODE=online (default).
OMARCHY_REF=dev/rc still maps to the right pacman channel for testing
pre-release builds.
Brings back the omarchy-install command as a 5-line shell wrapper that
just exec's /usr/share/omarchy/install.sh. Not the 258-line Python
refactor-poc version — that one stays dropped.
The omarchy package keeps excluding bin/omarchy-install exactly so it
doesn't conflict with the omarchy-installer package's copy at /usr/bin.
All 25+ user-facing omarchy-install-* commands (gaming, browser, etc.)
still ship via omarchy.
Drop online-git: the new world has a single package-backed install path
that's either online (pacman pulls from omacom-pkgs.org) or offline (ISO
chroot pulls from the bundled mirror). The git-clone-and-run-installer
path is gone — boot.sh becomes a thin bootstrap that installs the
omarchy-installer package and invokes its installer.
- install/helpers/mode.sh: two modes, validation message updated. Default
fallback is 'online' (the boot.sh path); OMARCHY_CHROOT_INSTALL=1 still
shims to offline, OMARCHY_ONLINE_INSTALL=true still shims to online.
- install/preflight/all.sh: first-run-mode + disable-mkinitcpio gated on
offline (offline is the from-scratch chroot path; online runs on an
existing system).
- install/preflight/pacman.sh: DELETED. boot.sh now handles repo config
before install.sh runs.
- install/packaging/all.sh: drop base.sh entirely. Both modes have
base packages installed via omarchy-installer's depends before
install.sh runs. base.sh remains on disk in case the ISO mirror build
flow wants to invoke it directly.
- install/helpers/chroot.sh, errors.sh, post-install/finished.sh,
config/mise-work.sh: rename mode checks to use online/offline.
- install.sh: use realpath to follow symlinks when deriving OMARCHY_PATH
from script location. Logical pwd left dev-link symlink chains pointing
at the wrong dir; realpath resolves to the underlying checkout.
- install/helpers/mode.sh: validate explicit OMARCHY_INSTALL_MODE values
and exit on typos. Also export_legacy_mode_flags now UNSETS the
contradictory legacy flag for each mode so unmigrated callers can't
see both OMARCHY_CHROOT_INSTALL=1 and OMARCHY_ONLINE_INSTALL=true.
- install/helpers/errors.sh: retry uses "$OMARCHY_PATH/install.sh"
and preserves OMARCHY_INSTALL_MODE explicitly; the previous hardcoded
~/.local/share/omarchy/install.sh broke package-mode retries.
- bin/omarchy-install-mode: soften the summary; the helper only knows
the current env, not any persisted post-install state.
Three modes the installer now branches on:
iso-chroot Running inside the new system's chroot from the ISO build.
pacman is configured by archinstall; systemd isn't running,
so service enables skip --now.
online-package Running on an existing Arch where the omarchy-* packages
are already installed. Skip base.sh and the bootstrap
preflight steps; only the per-host runtime ops in
config/login/post-install need to run.
online-git boot.sh path: clone into $HOME/.local/share/omarchy and
bootstrap everything from scratch.
install.sh derives OMARCHY_PATH from its own location, so the same script
works whether it's at /usr/share/omarchy/install.sh (package mode) or
$HOME/.local/share/omarchy/install.sh (git mode). install_mode_is helper
replaces direct ${OMARCHY_CHROOT_INSTALL:-} / ${OMARCHY_ONLINE_INSTALL:-}
checks in chroot.sh, finished.sh, errors.sh, mise-work.sh, preflight/pacman.sh.
Legacy vars still work through export_legacy_mode_flags, which sets
OMARCHY_CHROOT_INSTALL=1 / OMARCHY_ONLINE_INSTALL=true based on the
canonical mode for any caller that hasn't been updated.
bin/omarchy-install-mode prints the current mode for scripts/users that
need to introspect.
Smoke-tested all four entry paths (explicit mode, both legacy shims,
auto-detection from OMARCHY_PATH); each resolves correctly and the
legacy flags are exported in matching modes.
Sequential 'dev-link A' then 'dev-link B' previously left A/bin in
PATH because the prepend didn't strip the old one. unlink had the
same issue (it was trying to strip $(dirname $0), which only worked
if you invoked unlink via an absolute path that happened to match
the dev-link bin).
Both now read the previous OMARCHY_PATH from /etc/omarchy.conf before
overwriting/deleting it, and strip that path's bin/ from PATH before
prepending the new one (or nothing, for unlink).
A pass over the install scripts, dev-tools commands, and Hyprland Lua
files that I had stuffed with explain-everything preambles. Most of
those rationales (which files ship where, why hyprctl setenv doesn't
suffice, etc.) belong in commit messages or PR descriptions, not in
code people have to read forever. Kept the few comments that document
genuinely non-obvious behaviour: the keybind-env reason for hl.env in
envs.lua, why the runtime PAM seds stay scripted in
increase-lockout-limit, the chroot/--now distinction in chroot.sh, and
the dev-pkg-test split-install reason.
Mirrors the upstream tightening in install/config/timezones.sh (which
this etc-overrides file replaced): scope the wheel passwordless rule
to 'timedatectl set-timezone *' instead of the whole timedatectl, so
the rule can't be used to flip other system clock settings.
Adopted while rebasing onto current origin/omarchy-shell.
Two related fixes for installing package builds onto a system that has
the legacy script-installed Omarchy files already in place:
bin/omarchy-dev-pkg-test: split makepkg -s (build) from sudo pacman -U
(install) so we can pass --overwrite='*' to pacman. makepkg -i forwards
a fixed flag set to pacman and doesn't expose --overwrite, so dev pkg
tests on an existing script-install fail on every conflicting file
(plymouth themes, /etc drop-ins, sudoers). --overwrite='*' is correct
for the dev use case: the build IS the new authoritative state.
bin/omarchy-update-system-pkgs: add /usr/share/plymouth/themes/omarchy/*
to the transition --overwrite list. The old install/login/plymouth.sh
cp -r'd the theme files into that directory, so existing installs
conflict on the omarchy-settings package's plymouth payload.
The previous format wrote 'export OMARCHY_PATH="${OMARCHY_PATH:-<path>}"'
to /etc/omarchy.conf, intended so install.sh's script-mode OMARCHY_PATH
could win over the dev-link value. But install.sh doesn't source
/etc/omarchy.conf (only profile.d/uwsm/bash do, all post-install), so the
guard was protecting a non-scenario.
It also caused a real bug: paths.lua parses /etc/omarchy.conf as text
and returned the literal '${OMARCHY_PATH:-<path>}' string as the
omarchy_path, breaking dev-link in Hyprland.
Switch to plain 'export OMARCHY_PATH="<path>"'. dev-link is the only
writer, and when it's active, its value should win unconditionally.
Two related fixes for omarchy-dev-link to actually affect Hyprland keybinds:
default/hypr/paths.lua: prefer /etc/omarchy.conf over the process env.
hyprctl setenv updates Hyprland's process env, but the user-reported case
shows it doesn't reach bind-exec dispatchers because their env is
captured at config-load time. Reading the dev-link conf directly means
paths.omarchy_path is correct on every hyprctl reload regardless of
whether the launching Hyprland session re-read its env.
default/hypr/envs.lua: explicitly hl.env("OMARCHY_PATH", ...) and
hl.env("PATH", "$OMARCHY_PATH/bin:$PATH") so keybind dispatchers (and
everything else spawned by Hyprland) inherit the dev-link values. PATH
is built with a dedup pass so reloads don't accumulate the bin/ prefix.
Tested locally: paths.lua reads /etc/omarchy.conf correctly; lua syntax
of both files validates with luac -p.
When the script is run under outer sudo, the environment loses
HYPRLAND_INSTANCE_SIGNATURE, XDG_RUNTIME_DIR, and DBUS_SESSION_BUS_ADDRESS,
so the 'hyprctl version' check silently fails and the live-session
refresh (setenv / import-environment / restart shell / hyprctl reload)
gets skipped. The user is left with /etc/omarchy.conf written but no
session updates — confusing because the env in the current shell still
shows the old value.
Reject EUID=0 invocations with a clear message pointing at the right
pattern: invoke as your user, the script prompts for sudo only when it
needs to write /etc/omarchy.conf.
The four dev-tools commands that complete the developer-ergonomics
story for the package refactor:
- omarchy-dev-link <path>: writes /etc/omarchy.conf so OMARCHY_PATH
resolves to <path> in all new shells, the Hyprland session env, and
systemd --user. Updates the live session via hyprctl setenv +
systemctl --user import-environment, restarts omarchy-shell, and
reloads Hyprland so the changes are visible immediately. Affects
every tree resolved via $OMARCHY_PATH: bin/, default/, shell/,
themes/, applications/, config/.
- omarchy-dev-unlink: removes /etc/omarchy.conf and reverses the live
session updates back to /usr/share/omarchy.
- omarchy-dev-status: reports current dev-link state (configured path,
current shell, hyprland session env).
- omarchy-dev-pkg-test [pkg] [checkout]: builds and installs a package
from the checkout via OMARCHY_SRC + makepkg -si --skipchecksums.
Used for changes that land at fixed system paths (/etc/, /usr/lib/,
udev rule bodies, plymouth themes, /etc/skel) that dev-link can't
shadow. The built package's pkgver is tagged 'dev.<short-sha>[.dirty]'
so 'pacman -Q' makes its source obvious. Defaults: package
omarchy-settings, checkout ~/Work/omarchy/omarchy-installer,
PKGBUILDs read from ~/Work/omarchy/omarchy-pkgs/pkgbuilds/.
All four ship via omarchy-dev-tools (existing PKGBUILD wildcard).
Verified package build picks them up at /usr/bin/omarchy-dev-*.
Lua's require() caches modules in package.loaded; without explicit
invalidation, changes to default/hypr/*.lua or ~/.config/hypr/*.lua
won't take effect after hyprctl reload even though hyprland.lua itself
re-runs.
The clear runs unconditionally — benefits both dev-link workflows
(checkout files re-evaluate after every reload) and normal users who
edit their own ~/.config/hypr/*.lua and run omarchy-restart-hyprctl.
Cost is negligible: package.loaded has a handful of entries.
Pattern matches the require_all.lua reload option (which sets
package.loaded[module] = nil before require()), but applied broadly to
the omarchy module namespace at the entry point so individual modules
don't need to opt in.
omarchy-dev-link (lands in a follow-up) writes OMARCHY_PATH=<checkout>
to /etc/omarchy.conf. Three boot/session entry points now source it
before falling back to /usr/share/omarchy:
- /etc/profile.d/omarchy.sh (login shells, SSH)
- config/uwsm/env (Hyprland session via UWSM)
- default/bash/envs (non-login interactive bash; duplicated for
SSH and similar)
All three use 'export OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"'
so /etc/omarchy.conf wins over the default, and install.sh's script-mode
export wins over /etc/omarchy.conf (because both use the :- guard).
Hyprland updates session env on the fly via hyprctl setenv +
systemctl --user import-environment, so omarchy-dev-link can re-trigger
those to make live sessions pick up the new path without restart.
Sets up the shadow-dir pattern that omarchy-dev-link will use: when
/usr/share/omarchy-dev exists (as a symlink to a local checkout),
$OMARCHY_PATH resolves there instead of /usr/share/omarchy. The PATH
prepend then makes the checkout's bin/ override the package's
/usr/bin copies.
This covers every hot-edit surface that resolves via $OMARCHY_PATH:
bin/, default/, shell/, and themes/. Things that don't go through
$OMARCHY_PATH (udev rules, systemd drop-ins, /etc-installed configs,
plymouth themes, /etc/skel seeds) remain unaffected by dev-link and
require omarchy-dev-pkg-test to verify changes — which is also what
you'd want before shipping any of those anyway.
The previous comment said 'mainly relevant for the script-install path',
but install.sh and default/bash/envs already prepend it there. The real
reason is dev-link: when /usr/share/omarchy is a symlink to a local
checkout, this prepend lets the checkout's bin/ override the /usr/bin/
copies installed by the package.
The previous centralization into enable-services.sh accidentally changed
semantics for three services: docker.socket, iwd.service, and
power-profiles-daemon.service used to be enabled with bare
'sudo systemctl enable' (no --now); chrootable_systemctl_enable promoted
them to 'enable --now' outside chroot.
For iwd this is the riskiest: it's typically what's keeping the installer
online, so starting it mid-install is at best a no-op and at worst can
disrupt the active network connection. For docker.socket and
power-profiles-daemon the change is cosmetic (the socket is already
inactive, the daemon does no harm to start) but the original intent was
deferral to first boot.
New helper in install/helpers/chroot.sh:
chrootable_systemctl_enable_only <unit> # plain enable, no --now
enable-services.sh uses it for the three services that were previously
bare-enabled. The other five (bluetooth, cups, cups-browsed,
avahi-daemon, linux-modules-cleanup) keep the --now behavior they had
under chrootable_systemctl_enable.
The /etc/profile.d/omarchy.sh default for OMARCHY_PATH was being clobbered
by shipped config files that re-export the variable to the old script-mode
path. In package mode, every login shell, UWSM session, and Hyprland
autostart was effectively reversing the migration. Fix:
- default/bashrc: source from $OMARCHY_PATH/default/bash/rc; default
OMARCHY_PATH to /usr/share/omarchy if not set (so the source line
works in any boot order, including non-login interactive shells).
- default/bash/envs: change 'export OMARCHY_PATH=$HOME/...' to
'export OMARCHY_PATH=${OMARCHY_PATH:-/usr/share/omarchy}' so the
profile.d default and install.sh script-mode override both win.
- config/uwsm/env: same defaulting pattern. UWSM may not source
profile.d, so the inline default still matters.
- default/hypr/autostart.lua: quickshell launched from $OMARCHY_PATH/shell
(not literal $HOME path). The bash that runs hl.exec_cmd sees
OMARCHY_PATH propagated from UWSM env.
- config/chromium-flags.conf: --load-extension hard-codes
/usr/share/omarchy/... because chromium doesn't expand env vars or
'~'. The omarchy-dev-link workflow symlinks /usr/share/omarchy to a
checkout.
- bin/omarchy-install-browser: same chromium-flag path correction for
brave-origin-beta-flags.conf.
For shells outside the install flow (login shells, cron jobs, dev work)
the install.sh-set OMARCHY_PATH isn't in scope. Without a system-wide
default, omarchy-* commands shipped at /usr/bin can't find runtime data
under /usr/share/omarchy/.
profile.d sets OMARCHY_PATH=/usr/share/omarchy if not already set, so
install.sh's override (to $HOME/.local/share/omarchy during script-install)
still wins. The omarchy-dev-link workflow manages a symlink at
/usr/share/omarchy that points at a local checkout when active.
Also prepends $OMARCHY_PATH/bin to PATH if the directory exists (mainly
matters for script-install mode; /usr/bin is on PATH for package mode).
Missed in the previous pass:
- bin/omarchy-launch-screensaver: alacritty/ghostty config paths
- bin/omarchy-refresh-applications: source paths for icons and .desktop
- bin/omarchy-refresh-config: docstring/comment references
Still NOT touched (intentional):
- bin/omarchy-reinstall-git: stages '~/.local/share/omarchy-{old,new}' for
the script-mode upgrade dance; needs redesign for package mode.
- bin/omarchy-dev-add-migration: uses 'cd ~/.local/share/omarchy' to read
a git log; only meaningful in dev mode.
- bin/omarchy-install-browser:69: writes a string into a chromium config file.
- install/helpers/errors.sh:125: boot.sh relaunch (separate redesign).
The package-installed paths live at /usr/share/omarchy; the script-install
paths live at ~/.local/share/omarchy. $OMARCHY_PATH is set by install.sh
during the install flow and by /etc/profile.d/omarchy.sh in package mode.
Scripts that hard-code the script-install path don't honour that and will
misbehave once shipped to /usr/bin.
16 files migrated via sed s|~/\.local/share/omarchy|$OMARCHY_PATH|g
and s|$HOME/\.local/share/omarchy|$OMARCHY_PATH|g:
bin/:
- omarchy-plymouth-{preview,reset,set}
- omarchy-refresh-{limine,plymouth}
- omarchy-reinstall-configs
- omarchy-show-logo
- omarchy-games-retro-install
- omarchy-install-gaming-battlenet
install/:
- config/branding.sh
- packaging/{fonts,icons}.sh
- post-install/{finished,pacman}.sh
- preflight/{migrations,pacman}.sh
Deliberately NOT migrated:
- bin/omarchy-dev-add-migration: uses 'cd ~/.local/share/omarchy' to
resolve a git repo for 'git log'. The packaged binary doesn't have a
git repo to read; this command only makes sense in dev mode where
the home path is the right one.
- bin/omarchy-install-browser:69: writes a string into a chromium
config file that chromium itself interprets; not a bash-resolved path.
- install/helpers/errors.sh:125: the boot.sh-style relaunch behaviour
needs a separate redesign.
The previous setup scattered systemctl enables across docker.sh,
printer.sh, bluetooth.sh, network.sh, powerprofilesctl-rules.sh, and
kernel-modules-hook.sh. Some used chrootable_systemctl_enable; others
used bare 'sudo systemctl enable'. Centralizing makes the install-time
service surface auditable in one place and consistent in chroot/non-chroot
behavior.
install/config/enable-services.sh enables:
- bluetooth.service
- cups.service, cups-browsed.service, avahi-daemon.service
- docker.socket
- iwd.service
- linux-modules-cleanup.service
- power-profiles-daemon.service
Each via chrootable_systemctl_enable, which uses 'enable --now' on a live
system and bare 'enable' in chroot (set OMARCHY_CHROOT_INSTALL=1).
Stays in original script (deliberately):
- sddm.sh: bare 'systemctl enable sddm.service' (no --now during install
would log the user out; lives in install/login/)
- limine-snapper.sh: limine-snapper-sync (bootloader-specific path)
- first-run/firewall.sh: ufw (deferred to first-run for UX)
- hardware/{t2,intel/lpmd,intel/thermald,apple/fix-suspend-nvme}: gated
on hardware detection
Side cleanups:
- install/config/kernel-modules-hook.sh: DELETED (sole line was the enable
for linux-modules-cleanup, now in enable-services.sh).
- install/config/hardware/printer.sh: DELETED (sole purpose was the
three cups/avahi enables; nothing else to do).
- install/config/hardware/network.sh: keep the systemd-networkd-wait-online
disable+mask; drop the iwd enable.
- install/config/hardware/bluetooth.sh: keep the AutoEnable=false sed and
the wireplumber/bt-agent user-session setup; drop the system enable.
- install/config/docker.sh: drop the docker.socket enable.
- install/config/powerprofilesctl-rules.sh: drop the
power-profiles-daemon enable.
- install/config/all.sh: register enable-services.sh; remove the two
deleted entries.
- bin/omarchy-wifi-powersave: shopt -s nullglob. Previously, machines
with no wireless interfaces ran the loop once with the literal glob
('iface=*'), failed iw, and exited 237. With the new always-installed
udev rule that invokes this on every AC transition, the failure
would surface as failed transient omarchy-wifi-powersave-* units on
desktops. Now it cleanly no-ops.
- migrations/1779307845.sh: add 'systemctl daemon-reload' so the
plocate-updatedb.service.d/ac-only.conf drop-in is picked up on
upgrade. Arch's systemd pacman hook only triggers on
/usr/lib/systemd/system/*, not /etc/systemd/system/*.
- install/config/powerprofilesctl-rules.sh and wifi-powersave-rules.sh:
rm -f the pre-rename legacy paths before udevadm reload, so the
cleanup is idempotent outside the one-shot migration (matters for
re-install/downgrade testing).
Four scripts that wrote static /etc or /usr files become package-shipped
files. The other config-script audit candidates (omarchy-ai-skill,
nautilus-python, omarchy-toggles, input-group) correctly stay scripts —
they're user-level operations, not /etc writes.
New package-owned files (omarchy-installer/etc/, shipped by
omarchy-settings):
- etc/systemd/system/plocate-updatedb.service.d/ac-only.conf
- etc/udev/rules.d/99-omarchy-power-profile.rules
- etc/udev/rules.d/99-omarchy-wifi-powersave.rules
The two udev rule files are renamed for namespacing (99-power-profile
-> 99-omarchy-power-profile; 99-wifi-powersave -> 99-omarchy-wifi-powersave)
and rewritten to invoke /usr/bin/omarchy-powerprofiles-set and
/usr/bin/omarchy-wifi-powersave instead of $HOME/.local/share/omarchy/bin/...
(both binaries ship in the omarchy package at /usr/bin/).
The battery-present gate from the original scripts is dropped — the rules
trigger on power_supply udev events, which are benign on desktops without
batteries. (The runtime commands no-op on AC-only systems.)
Script changes:
- install/config/plocate-ac-only.sh: DELETED (file ships, daemon-reload
happens via pacman hook).
- install/config/unmount-fuse.sh: DELETED (file ships at
/usr/lib/systemd/system-sleep/unmount-fuse via omarchy-settings).
- install/config/powerprofilesctl-rules.sh: SHRINK to runtime ops
(enable power-profiles-daemon, udevadm reload+trigger).
- install/config/wifi-powersave-rules.sh: SHRINK to udevadm reload+trigger.
- install/config/all.sh: drop the two deleted entries.
bin/omarchy-update-system-pkgs: add --overwrite for plocate-updatedb
drop-in and unmount-fuse paths (the udev rule renames need no overwrite
since the new paths are virgin).
migrations/1779307845.sh: remove the legacy 99-power-profile.rules and
99-wifi-powersave.rules paths on existing installs, then reload udev.
Four corrections to the omarchy-settings transition:
- bin/omarchy-update-system-pkgs: pass --overwrite for the 13 paths
omarchy-settings now owns. Existing Omarchy installs would otherwise
fail pacman conflict checks on the upgrade that ships the package
(the files exist as unowned filesystem entries from the previous
install scripts). The flags are no-ops once the transition release
is everyone's baseline; remove then.
- config/mimeapps.list: drop the HEY.desktop mailto mapping. HEY.desktop
is generated by install/packaging/webapps.sh at install time, not
shipped under applications/, so it isn't valid for a fresh /etc/skel
user before the installer runs.
- install/config/mimetypes.sh: add 'xdg-mime default HEY.desktop
x-scheme-handler/mailto' as a runtime op since the mapping no longer
lives in mimeapps.list.
- install/config/increase-lockout-limit.sh: delete existing
pam_faillock.so authsucc lines before re-adding, so re-running the
installer doesn't duplicate the authsucc entry in
/etc/pam.d/sddm-autologin.
Existing users upgrading from script-installed Omarchy still have files
the install scripts wrote at the OLD paths. The new package can't own
those old paths (they were either renamed or replaced by drop-ins), so
this migration tidies them up:
- /etc/sysctl.d/99-sysctl.conf: strip the appended net.ipv4.tcp_mtu_probing
line (new file is /etc/sysctl.d/99-omarchy-sysctl.conf)
- /etc/modprobe.d/disable-usb-autosuspend.conf: removed
(new file is /etc/modprobe.d/omarchy-usb-autosuspend.conf)
- /etc/sudoers.d/{passwd-tries,asdcontrol}: removed
(new files are /etc/sudoers.d/omarchy-{passwd-tries,asdcontrol})
- /etc/systemd/system/user@.service.d/faster-shutdown.conf: removed
(new file is 10-faster-shutdown.conf)
- /etc/systemd/logind.conf HandlePowerKey=ignore line: reset to its
commented default so the logind.conf.d/ drop-in is the only source
After cleanup, systemctl daemon-reload + sysctl --system to pick up the
new state immediately.
config/mimeapps.list ships at /etc/skel/.config/mimeapps.list (via
omarchy-settings's existing config/** -> /etc/skel/.config copy).
New users get the full Omarchy MIME defaults on first login without
running install scripts.
install/config/mimetypes.sh shrinks to two runtime ops that a static
file can't replace:
- omarchy-refresh-applications: copies .desktop entries and icons into
the user home and refreshes the desktop database
- xdg-settings set default-web-browser chromium.desktop: sets the
system-default browser; omarchy-install-browser overrides this if
the user later picks a different browser.
The three /etc writes (resolved.conf.d drop-in, nsswitch.conf override,
cups-browsed.conf override) now ship via omarchy-settings. The service
enables stay scripted because they need chrootable_systemctl_enable to
work both inside the ISO chroot and on a live system.
Each script's static-file write moves to omarchy-settings. The scripts
keep only the runtime side: reload systemd, restart dirmngr, sysctl --system,
or (for lockout-limit) the PAM seds that have to stay scripted because
/etc/pam.d/system-auth and /etc/pam.d/sddm-autologin are upstream-owned and
need targeted line edits rather than a full-file override.
faillock.conf's deny=10 (formerly inside increase-sudo-tries.sh sed) now
rides through the etc-overrides dance in omarchy-settings.
The three Docker config files (etc/docker/daemon.json,
etc/systemd/system/docker.service.d/no-block-boot.conf,
etc/systemd/resolved.conf.d/20-docker-dns.conf) now ship via the
omarchy-settings package. The script keeps only the actions a static
file can't do:
- restart systemd-resolved so the new drop-in takes effect
- usermod -aG docker $USER (user-specific, can't be packaged)
- systemctl enable docker.socket and daemon-reload
Each of these scripts only wrote a single /etc file (or copied
config/bashrc into the user home). The corresponding files now ship
from the omarchy-settings package — either directly into /etc (drop-ins
the package fully owns) or via the /usr/share/omarchy/etc-overrides
post_install dance (for upstream-owned paths).
Deleted:
- install/config/timezones.sh -> etc/sudoers.d/omarchy-tzupdate
- install/config/sudoless-asdcontrol.sh -> etc/sudoers.d/omarchy-asdcontrol
($USER rewritten to %wheel)
- install/config/increase-sudo-tries.sh -> etc/sudoers.d/omarchy-passwd-tries
(faillock.conf side now in etc-overrides)
- install/config/hardware/ignore-power-button.sh
-> etc/systemd/logind.conf.d/10-ignore-power-button.conf
(replaces sed-edit of logind.conf)
- install/config/hardware/usb-autosuspend.sh
-> etc/modprobe.d/omarchy-usb-autosuspend.conf
- install/config/ssh-flakiness.sh -> etc/sysctl.d/99-omarchy-sysctl.conf
- install/config/config.sh -> /etc/skel seeds ~/.config from config/**;
~/.bashrc seeded from etc-overrides
- install/login/plymouth.sh -> theme files already shipped by
omarchy-settings; etc/plymouth/plymouthd.conf
handled via etc-overrides
A separate migration tidies up the old paths on existing installs.
all.sh entries updated to drop these scripts.
This tree is the source for omarchy-settings to install into /etc
(for paths Omarchy fully owns) or stage at /usr/share/omarchy/etc-overrides
(for paths upstream packages own, which the post_install copies into place).
Package-owned drop-ins (no upstream conflict):
- etc/docker/daemon.json
- etc/systemd/system/docker.service.d/no-block-boot.conf
- etc/systemd/resolved.conf.d/20-docker-dns.conf
- etc/systemd/resolved.conf.d/10-disable-multicast.conf
- etc/systemd/system.conf.d/10-faster-shutdown.conf
- etc/systemd/system/user@.service.d/10-faster-shutdown.conf
(renamed from .../faster-shutdown.conf for consistency)
- etc/systemd/logind.conf.d/10-ignore-power-button.conf
(replaces the previous in-place sed-edit of logind.conf)
- etc/gnupg/dirmngr.conf
- etc/sysctl.d/99-omarchy-sysctl.conf (renamed from the 99-sysctl.conf
appendage; a migration cleans up the old path on existing installs)
- etc/sysctl.d/90-omarchy-file-watchers.conf
- etc/modprobe.d/omarchy-usb-autosuspend.conf
(renamed from disable-usb-autosuspend.conf)
- etc/sudoers.d/omarchy-asdcontrol
(renamed from asdcontrol; $USER -> %wheel for packaging)
- etc/sudoers.d/omarchy-tzupdate
- etc/sudoers.d/omarchy-passwd-tries
(renamed from passwd-tries for namespacing)
Etc-overrides (upstream-owned paths; staged by the PKGBUILD at
/usr/share/omarchy/etc-overrides/ and cp'd in by post_install):
- etc/security/faillock.conf (owned by pam)
- etc/nsswitch.conf (owned by filesystem)
- etc/cups/cups-browsed.conf (owned by cups-browsed)
- etc/plymouth/plymouthd.conf (owned by plymouth)
All sudoers files validate with visudo -cf.
The install scripts that previously wrote these files are updated or
removed in follow-up commits.
Download the current page's video with yt-dlp via Alt+Shift+D or a click
on the toolbar icon. A native-messaging host runs the download, shows live
progress on the Quickshell OSD, and posts a clickable "Download complete"
toast that opens the file in mpv.
- Extension: pinned key for a stable id, green download-video icon,
keyboard command + toolbar action (reads the active tab URL).
- Native host (omarchy-chromium-ytdlp-host): verifies the URL with
yt-dlp --simulate (else "No video found"), streams progress to the OSD
(time-throttled to ~4/s), saves to ~/Videos, opens mpv on click.
- Installer (omarchy-install-chromium-ytdlp) writes the native-messaging
manifest into installed Chromium/Chrome/Brave/Edge profiles; wired into
browser install and chromium refresh, with a migration for existing users.
- omarchy-osd: add -d/--duration so the OSD can persist during a download.
- Add yt-dlp to base packages, load the extension via --load-extension,
and document the Alt+Shift+D binding.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Let users add trusted plugin source repos and add/update/remove plugins
from them, alongside the existing in-shell plugin commands:
omarchy plugin source <add|list|remove|refresh>
omarchy plugin available
omarchy plugin add | update | remove | validate
Each command is interactive (gum/fzf pickers, confirmation, an update
diff) in a TTY and fully flag-driven with --yes for scripts and agents.
Sources live in ~/.config/omarchy/plugins/sources.json and clone into
~/.cache/omarchy/plugin-sources/. The installer only copies files,
validates manifests against the shell's schema, and toggles enabled
state over IPC -- it never runs plugin code, hooks, or sudo.
Also guard 'plugin bar add' so only known bar-widget ids enter the
layout (rejecting typos/non-widgets like a stray '--help').
Restore the clipboard watcher behavior that drops CLIPBOARD_STATE=sensitive events, which password managers use for copied secrets.
Use the same sensitive foreground clipboard path for emoji insertion instead of a custom history marker, and keep the password-manager MIME hint ignored as a fallback.
Keep the first emoji result selected whenever results exist, including after search filtering, so Enter inserts immediately.
Route emoji insertion through a hidden helper that serves a transient sensitive clipboard entry long enough for Shift+Insert, then stops that clipboard owner.
Mark transient emoji inserts so clipboard history skips only that event while continuing to record normal terminal copies.
Update existing terminal configs to encode Shift+Return as CSI-u so Codex and other TUIs can distinguish it from Return without tmux seeing it as Alt+Return. Also ensures Alt+Shift+Return CSI-u bindings remain present for tmux horizontal splits across Kitty, Ghostty, and Foot.
Encode Shift+Return as CSI-u across supported terminals so TUIs such as Codex can distinguish it from plain Return. This replaces Alacritty's ambiguous ESC+Return mapping, which tmux interpreted as Alt+Return and used to split panes, while preserving Alt+Shift+Return as CSI-u for tmux's M-S-Enter binding.
Clipboard history selections passed the full selected text as a process argument to omarchy-clipboard-paste-text. Large entries can exceed Linux's per-argument exec limit, so the helper never starts reliably for big copied blocks.
Pass the original history index instead and have the helper read that entry from clipboard-history.json before wl-copy and Shift+Insert. Also focus the first row when opening the manager, keep filtered rows mapped to their original history indexes, and drop whitespace-only text entries.
The Hyprland gaps_out value (10px out of the box) reads well as a
window-to-window gap but felt cavernous when used as the screen-edge
margin for panels and notifications. Halve it at the source — panels
that anchor via PopupCard.margin, the launcher / clipboard / emojis /
polkit / menu / settings card-width clamps, and the notification popup
margins all read Style.gapsOut, so one tweak moves them in lockstep.
Revert the per-call /2 in the notifications service, since
Style.gapsOut now already encodes the smaller value.
Sit notifications closer to the top and right edges than the default
gapsOut. The bar-height clearance still applies to the top — only the
free gap portion is halved.
Set the default formatAlt to "dd MMMM 'W'ww yyyy" (was "dd MMMM yyyy")
in shell-defaults.json, the bundled settings-panel defaults, and the
form placeholder text — clock's own widget fallback already used this
spec but the shipped config overrode it.
Qt.formatDateTime doesn't recognize `ww` and renders it literally
(`20 May Www 2026`), so add an `isoWeek` helper to clock.qml that
pre-substitutes `ww` with a Qt-quoted literal of the ISO 8601 week
number before handing the format off to Qt. Users get `20 May W21 2026`
without anyone needing to know about the substitution.
Clock and daytime were near-duplicates with different click semantics
(clock toggles between formats on left-click and opens the timezone
selector on right-click; daytime was non-pressable with a hover tooltip).
Standardize on clock, since it's the more capable of the two.
- Delete widgets/daytime.qml and its FirstPartyWidgets entry.
- Migrate shell-defaults.json, shell.qml's builtin fallback, Bar.qml's
fallback bar config, and the settings panel's builtin defaults so the
center anchor and center-section entry both reference "clock".
- Rename the daytimeSettings form to clockSettings and rephrase
"Tooltip format" → "Alternate format (click to toggle)" so the field
label matches clock's actual behavior.
- Update the gallery dropdown options and bar/README docs.
TextField, NumberField, Dropdown, SearchableDropdown, and Toggle all
painted their background, border color, and border width with the same
three-line ternary ladder (`_focused ? focusFill : _hot ? hoverFill :
normalFill`). Five components × three properties × three branches is a
lot of room for one of them to drift from the others when a new state
ever gets added.
Add controlFill / controlBorder / controlBorderWidth on Style and rewrite
each call site as a single binding. No visual change.
OSD reimplemented clamp() inline when Util already has one.
PanelSlider's knob-scale binding read `mouseArea.containsMouse` directly
instead of going through a `_hot` like the other interactive controls
(TextField, NumberField, Dropdown). Mirror them so future style work
has a single property to override.
ModuleButton was a near-duplicate of WidgetButton with the same text /
active / keepSpace / tooltip / fontSize / fixedWidth / fixedHeight /
pressed signal surface, only differing in that it closed over the
enclosing root via QML's scoping rules instead of taking `bar` as a
property. Switch CustomCommandModule onto WidgetButton with
`bar: root` so we have one bar button component to maintain.
Five plugins (menu, launcher, clipboard, emojis, polkit) each looked up
OMARCHY_MENU_FONT with the same env-or-monospace fallback. Hoist the
resolution into Style so plugins read one source of truth, and so the
fallback follows the real fontconfig family Style already tracks instead
of the literal string "monospace".
Five sites hardcoded "#cacccc" or "JetBrainsMono Nerd Font" as the
fallback when no bar context was available. Those magic strings are
the *current* palette defaults — they diverge silently when the theme
changes. Bind to the Color / Style singletons so the fallback tracks
whatever the theme says the foreground / monospace family should be.
Color.qml itself keeps the literal "#cacccc" — that's the seed value
the singleton is bootstrapped with before the theme loads.
Matches the BarWidget extraction in the previous commit. The weather
panel was the only panel reimplementing the helper inline; future
panels with inline settings get it for free.
Six widgets (clock, daytime, keyboardLayout, lockKeys, activeWindow,
media) shipped identical copies of `function setting(name, fallback)`.
Eight widgets reimplemented `readonly property bool vertical`, and
three reimplemented `readonly property int barSize`. Move all three
onto the BarWidget base so widgets read the same wiring everyone else
gets for free.
While in here, drop the dead `setting()` declaration on media.qml — it
was defined but never called.
LockView hardcoded font.family to "monospace" in two places, ignoring
the user's OMARCHY_MENU_FONT / fontconfig choice that every other
summoned surface (menu, launcher, polkit, emojis, clipboard) respects.
Bind to Style.font.family so a font change via omarchy-font-set or
fontconfig propagates to the lock screen too.
CustomCommandModule.update() in Bar.qml called root.parseModuleJson(raw)
but the function was removed in 3b970068 (the indicator split). Any
custom command module emitting waybar-style JSON would have crashed on
first poll.
Hoist the helper into Util so both call sites — the bar's custom command
module and BarIndicator.extractData — share one definition.
Based entirely on the work of @robzolkos in #5711. That attempt was
adapted to better fit the standard templating system while also adding
color mixing for use in other themes.
The udev power_supply rule fires before sysfs `online` is updated on
some laptops (notably Lenovo Yoga Pro 7 14IAH10 with USB-C charging).
The autodetect branch reads the stale value and sets the wrong profile,
so the system stays on `performance` after unplug (or vice versa).
A single plug/unplug typically fires 3-4 udev events within ~1s (ACAD +
each USB-C port). With `systemd-run --unit=omarchy-power-profile
--collect`, duplicate invocations against the same unit name can be
dropped while the first is still running, so the surviving event isn't
guaranteed to be the latest one.
This adds a 0.3s settle delay at the top of the autodetect branch only.
Explicit `ac` and `battery` invocations remain instant.
Tested on Lenovo Yoga Pro 7 14IAH10 (Intel Core Ultra 9 285H, Omarchy
3.8.1).
Co-authored-by: Iqbal Attila <iqbal@kcmon.id>
The custom PositionButtonGroup component wrapped Repeater + Button
directly without setting bordered: true on the delegates. After the
recent Button changes (idle non-bordered Buttons have zero border
width), the non-selected position chips lost their visible chip
structure entirely \u2014 they rendered as floating text labels and read
as unclickable.
Replace the bespoke component with qs.Ui.ButtonGroup (which sets
bordered: true on each chip) inside a Column with a 'Position' label,
and drop the now-unused PositionButtonGroup definition. All four
options now read as clickable chips and the chosen value still paints
the accent fill+border.
Pass a section name to open the gallery with the cursor already on
that component instead of scrolling from the top. Useful when
iterating on a single widget.
omarchy dev ui-preview # default position
omarchy dev ui-preview button # land on the Button section
omarchy dev ui-preview button-group # land on ButtonGroup
omarchy dev ui-preview slider # land on Slider, etc.
The bin script forwards the argument as {"section": "..."} in the
shell summon payload. The gallery's open(payloadJson) parses it,
clamps against visibleSections (unknown names fall back to default),
and sets focusSection + selectedIndex inside the existing Qt.callLater
so the cursor's hasCursor bindings fire ensureCursorVisible
automatically.
Three small fixes around the new Button + ButtonGroup so the cursor is
always visible and the section reads as a single Button showing flag
combinations.
ButtonGroup now exposes cursorIndex + hovered(index, isHovered) so
panels can drive a single Button's hasCursor without reaching past
ButtonGroup's API. Every chip gets bordered: true so the row reads as
a real picker — distinct outlines, not just a tinted fill that vanishes
into the background.
Button's border treatment grows two paths so the cursor is always
visible regardless of other state: bordered + hot recolors the border
to the accent and thickens to the focus-ring width, and selected + hot
thickens the existing accent border to the focus-ring width (so the
cursor landing on the chosen option still reads as cursor presence,
instead of disappearing into the selected fill).
Gallery's Button section pairs each demo button with a small caption
('idle', 'active', 'icon only', 'icon + active', 'bordered +
focusable') so the row reads as one Button with its state flags side
by side rather than five unrelated buttons. The ButtonGroup section
gets the cursor wiring (cursorIndex + onHovered) plus an
onFocusedChanged auto-scroll so the cursor visual is reachable via
j/k h/l from the panel cursor model.
Wide content rows (slider rows in audio / monitor panels) opted out of
the cursor fill by setting fill: "transparent" on their CursorSurface,
which left them with no cursor visual at all — j/k landed there
silently with no way to know what was selected.
Add an `outline: bool` flag to CursorSurface. When true, hasCursor
paints an accent border (Style.focusBorderColor at
Style.focusBorderWidth) instead of a fill, leaving the row's chrome
fully visible underneath. Use for slider rows where a fill would
obscure the track.
Audio output / input slider rows and the monitor brightness row opt
in. The dev gallery's slider section replaces its bespoke Rectangle
wrapper with the same CursorSurface { outline: true }, so what the
gallery documents is what the panels ship.
The three components were three takes on the same shape \u2014 a clickable
rectangle with text/icon, a hot/hover state, an optional persistent
border, and an optional 'selected' or 'active' highlight. CursorPill
was a 30-line PillButton wrapper that added a hovered() signal;
ChoiceButton was effectively PillButton with selected: bool painting
an accent fill+border.
Collapse them into a single qs.Ui.Button. State flags compose
independently:
hasCursor / hover hot fill
active persistent foreground-tint fill
selected accent fill + accent border
bordered: true persistent 1px idle border (form primaries)
focusable: true Tab focus paints the accent ring
pressed pressed fill
The hovered(bool) signal is now built-in, so CursorPill's wrapper is
unnecessary. ButtonGroup wraps a Row+Repeater for the form-style
'pick one of N' pattern; panel-cursor-driven cases still compose
Buttons directly in a Row with per-instance hasCursor wiring.
Theme tokens move into a new [style] section in shell.toml:
border-width = 1
focus-border-width = 3
idle-border-alpha = 0.4
hot-fill-alpha = 0.08
selected-fill-alpha = 0.18
pressed-fill-alpha = 0.22
focus-fill-alpha = 0.22
Style.qml parses these out of the same shell.toml [font] / [bar]
already reads, and exposes pre-computed Style.hotFill / selectedFill /
pressedFill / idleBorderColor / selectedAccentFill / borderWidth +
the existing focusBorder* tokens. Themes that don't ship a [style]
section get the previous defaults unchanged.
Dev gallery consolidates three sections (PillButton, CursorPill,
ChoiceButton) into Button + ButtonGroup, with the cursor model
sections renamed accordingly.
CursorSurface defines the canonical cursor chrome: a tinted fill, no
border. Three components had inconsistent treatments that the recent
standardization pass left half-finished:
- PillButton kept a 1px foreground border on hot (cursor or hover)
via a cursorBordered: true default.
- CursorPill specifically had to override cursorBordered: false to
match the rest of the kit.
- ChoiceButton thickened its border to 2px on hasCursor, which mixed
the cursor visual with the Tab-focus visual.
Drop the cursorBordered escape hatch from PillButton (no caller other
than CursorPill ever used it), drop CursorPill's now-redundant
override, and remove hasCursor from ChoiceButton's border.width
thickening. Update Toggle's class comment (it still claimed cursor
mirrored Tab focus, which f3ba5055 broke without updating the doc).
Now: hot/hasCursor = fill only, activeFocus = accent border ring,
selected/active = stronger fill or accent border per component
semantic. One canonical pattern across the kit.
Themes now drive typography the same way they drive colors: one [font]
base-size in shell.toml is the rem root, and every Style.font.<token>
(caption, bodySmall, body, subtitle, title, heading, display,
displayLarge, iconSmall, icon, iconLarge) derives from it via a fixed
multiplier. Themes can also pin individual tokens for stylistic
emphasis. base-size is clamped 11..13 until row-height tokens exist.
Bar dimensions move to the same singleton: [bar] size-horizontal /
size-vertical replace the hardcoded 26/28 in Bar.qml, exposed as
Style.bar.sizeHorizontal / sizeVertical.
Style.qml also resolves the fontconfig 'monospace' alias via fc-match
and exposes Style.font.resolvedFamily so panels can display the
concrete family. Watches ~/.config/fontconfig/fonts.conf so it tracks
'omarchy font set <name>'.
The qs.Ui kit (PillButton, Dropdown, Toggle, TextField, etc.) and
every first-party plugin (bar widgets, settings, menu, clipboard,
emoji, polkit, notifications, osd, image-picker, dev-gallery) now
bind to Style.font.* instead of pixel literals. Only three deliberate
display-scale outliers remain: the notification empty-state glyph and
the weather flyout's hero temperature pair, all commented.
Background plugin's applyTheme IPC fast-path also pushes shell.toml to
Style so theme swaps update typography and bar size without waiting
for inotify debounce.
Dev gallery (omarchy dev ui-preview) now ships a Typography section
that renders the full scale and theme tokens live, and its summon
command is fixed (omarchy-shell-ipc -> omarchy-shell).
The wifi panel now has full keyboard nav over both sections:
h/l walk the DNS provider pills
j/k walk the wifi network list (j from DNS drops into the
list; k from the top row goes back to DNS)
Enter/Space apply the highlighted DNS provider / connect to the
highlighted wifi network
Esc close the panel
Single-cursor model. The visible cursor lives at the panel root via
focusSection + dnsIndex + selectedIndex. Mouse hover doesn't draw its
own highlight — onContainsMouseChanged on each row/pill MOVES the
cursor instead. Mouse leaving doesn't clear it (the cursor stays where
attention was last; subsequent j/k pick up from there). Last action
wins, whether mouse or keyboard.
New Common.CursorSurface holds the shared chrome (fill + 1px border +
fade) and is the base for both NetworkRow and the new local
DnsProviderPill. Items pass only hasCursor + current and let the
surface render. Contract: items never read containsMouse for visuals.
That's what guarantees exactly one highlight on screen at any time.
DnsProviderPill replaces Common.PillButton for the DNS row because
PillButton's hover > active > background cascade fights the
single-cursor model — its built-in hover would draw a parallel
highlight on whatever pill the pointer is parked on, even after the
cursor moved elsewhere. PillButton stays where it fits (refresh icon,
other bar widgets) and is unchanged here.
The wifi panel was a bar-widget xdg-popup which Hyprland doesn't grant
keyboard focus to until the user clicks or hovers it — keys typed after
a SUPER+CTRL+W summon went to whatever previously had focus.
New shared Common.KeyboardPanel scaffolding: layer-shell PanelWindow
with WlrKeyboardFocus.Exclusive (granted at map time, the protocol-level
equivalent of focus-on-launch for xdg-toplevels), full-screen anchored
with a Region mask that subtracts the bar strip so bar widgets stay
clickable, MouseArea for outside-click dismissal, TransformWatcher for
reactive anchor-position tracking. API is a subset of Common.PopupCard
(no centerOnBar / triggerMode / containsMouse yet — adding when the
other bar popups migrate).
networkPanel.qml uses it. Adds full keyboard navigation:
j/k or Up/Down — move selection
Return/Space — connect (or disconnect if already connected)
x — forget the highlighted network
r — refresh scan
Esc — close
ListView (with positionViewAtIndex on currentIndex) replaces the
Repeater+Column inside Flickable so the selected row stays visible as
j/k walks past the cap. A 1.5s Timer re-polls detailsProc while open
so the connection details (IP, gateway, signal) populate when routing
actually comes up after a connect rather than waiting for re-summon.
Rows: lock glyph on the right for protected-and-not-connected, X
(forget) for connected — aligned to the same 22-wide column. Connect
glyph in the passphrase prompt switched to a check, no separate cancel
(Esc handles it).
SUPER+CTRL+W in utilities.lua now toggles this panel via
omarchy-shell-ipc instead of launching Impala. Right-click on the bar
icon still launches Impala as a fallback for hidden SSIDs / enterprise
auth / iwd edge cases.
quickshell kill currently trips Quickshell #539 (notifyInternal2 event
loop crash via IpcKillCommand::exec), which leaves the Wayland surface
lingering long enough that the new instance starts on top of the dying
one — a duplicate bar. SIGKILL drops the client connection and the
compositor cleans up surfaces immediately; the shell has no persistent
state to flush. Sub-20ms restart, no duplicates.
Keep only the non-obvious bits: the override mechanism, what counts as
"active" on the bar, the flyout text-color constraint, the
notifications-border convention, and the image-picker alpha modulation.
Drop comments that just restated the key names.
Five plugins each owned their own colors.toml watcher with subtly
different parsers, plus two ad-hoc per-theme override files
(notifications.json, image-picker-colors.json). This collapses all of
that into one source of truth: Commons/Color.qml watches colors.toml +
shell.toml and exposes Color.bar.*, Color.popups.*, Color.notifications.*,
Color.menu.*, Color.imagePicker.* for every surface to bind to.
shell.toml is generated by the existing template pipeline from
default/themed/shell.toml.tpl. Themes can ship their own shell.toml to
override individual keys; everything missing falls back to the
foundational palette via root.pick(). Settings panel is intentionally
not themable beyond the foundational tokens.
last-horizon and solitude ship a minimal shell.toml to preserve their
historical 'notification border matches Hyprland active border'
behavior, which previously came from parsing the theme's hyprland.conf
(now removed).
Quickshell's UPowerDevice.percentage is a 0.0-1.0 real (energy /
energyCapacity), not 0-100. The bar was treating it as 0-100, so a 99%
charge picked the lowest icon, the tooltip read "1%", and the
low-battery active state was always true.
Settings dialogs were rendering text/spin/combo controls with Qt's
default light style, which clashed with the dark Omarchy theme — black
text on dark fills, white dropdown popups, rounded corners, and a
pill-style toggle that didn't match the native StyleToggleRow switch.
- Style.qml: collapse all radius tokens to 0 so Noctalia-compat widgets
inherit Omarchy's sharp-corner convention
- NToggle: rewrite to mirror the native 48x22 switch with accent fill
and a sliding 16x16 thumb
- NComboBox: skin contentItem, indicator, popup, and delegate so the
dropdown reads on dark themes
- NSpinBox: add a styled background, contentItem, and up/down indicators
- SettingsPanel calendar form + DynamicSettingsForm string field: drop
default TextField chrome for the same translucent foreground fill used
by WidgetCard, accent border on focus
Replace the inline detail flyout with a two-column hero: location chip
and large temperature on the left, big condition icon on the right.
Stats (Feels / Wind / Humidity) move below as caps-labeled columns,
separated from the forecast by a thin divider. Forecast cells now lead
with the day icon and put the day name above hi/lo temps.
Drop the Refresh and wttr.in pill buttons; a Timer refreshes the
forecast every refreshMinutes (default 15). The interval is exposed
through the Settings panel — Bar -> Weather has a gear that opens a
SpinBox-backed form, persisted as "settings": { "refreshMinutes": N }
in shell.json.
Replace the hover-driven detail flyout with a click-toggled popup that
includes a Noctalia-style row of upcoming days. Switching the wttr.in
fetch to the j1 JSON gives us structured current conditions plus a
3-day forecast; each day's representative icon comes from the hourly
entry nearest noon, mapped through the same code → glyph table as the
bar pill.
Text.implicitWidth/Height can be fractional. Passing those values
straight to the PopupWindow rounded the Wayland surface down, clipping
the 1px right/bottom border of the bubble.
Same logic as the waybar/mako sweep: migration 1778321093 converted the
user's top-level hypr configs (autostart/bindings/hyprland/input/
looknfeel/monitors + envs + apps/*) from hyprlang `.conf` to Lua, so
any earlier migration that seds those files is editing a path that no
longer exists on the new layout.
These were already applied on existing systems and skipped on fresh
installs (preflight marks them done before they would run), so the
change is purely repo cleanliness — the migrations dir stops mentioning
files the new omarchy doesn't have.
Deleted 18 migrations that only touched dead .conf paths:
1754389057 1755870033 1757866485 1757877123 1757877852 1760462260
1763386443 1767138576 1769543550 1770159912 1770375655 1771606249
1771847961 1772293693 1776410469 1776781957 1777620904 1778008689
Stripped dead .conf sed/cp blocks from 5 mixed migrations whose
remaining work still matters (webapp launcher fixup, uwsm env/term
config, xdg-terminal-exec install, Obsidian flags relocation, swayosd
systemd service):
1755507891 1758019332 1762121828 1776434586 1778171768
The four genuinely-alive .conf files (hyprlock.conf, hypridle.conf,
xdph.conf, hyprsunset.conf) are untouched. The converter migration
(1778321093) is untouched. The lua-targeting migration 1757879836 is
untouched.
The dev -> omarchy-shell flip migration (1778743515.sh) uninstalls
waybar and mako and moves both user-config dirs aside, so any older
migration that tweaks ~/.config/waybar/ or invokes
omarchy-{restart,refresh}-waybar / omarchy-restart-mako is editing
something that's about to be removed.
These migrations are already marked applied on existing systems and
skipped on fresh installs (preflight touches every migration name into
the state dir before they would run), so removing/editing them is a
no-op for anyone currently on omarchy. What it does fix is the repo
itself referring to commands that no longer exist on disk.
Deleted 26 migrations that were entirely waybar/mako tweaks:
1752793122 1754228071 1754331529 1756371020 1757279511 1757511571
1760693222 1760787158 1761269603 1763409505 1763560161 1763634099
1763653692 1764067068 1767227973 1767685679 1767716691 1768270644
1771602477 1771602647 1775208227 1777017528 1777464602 1777578316
1778139028 1778539119
Stripped the waybar/mako bits from 10 mixed migrations whose real work
is still relevant (impala install, light themes, wiremix, tzupdate,
xdg-terminal-exec, bluetui, terminal app-ids, voxtype GPU, walker
toggle):
1751887718 1752725616 1752896442 1753495989 1762121828 1762417304
1763386443 1773506226 1775241210 1778405462
Two leftover spots still pointed at command names that were renamed in
this branch:
- default/quickshell/omarchy-shell/README.md:124 said
`omarchy restart quickshell` (renamed to `omarchy restart shell`).
- config/hypr/bindings.lua:35 had a commented-out example using bare
`omarchy-menu`. The wrapper still works that way for now, but the
canonical hot path is `omarchy-shell-ipc menu toggle root` \u2014 update
the example so users copying it learn the right pattern.
`omarchy-shell-ipc menu toggle root` is what the keybinds use \u2014 it
skips the omarchy CLI dispatch hop and stays sub-ms. But humans don't
want to type that. New tiny wrapper restores `omarchy menu …` as the
CLI entry point:
omarchy menu → toggle root (bare invocation)
omarchy menu toggle [route] → toggle, route defaults to root
omarchy menu summon [route] → always open
omarchy menu close → close if open
omarchy menu refresh → re-parse the menu JSONCs
omarchy menu ping → health check
Internally each verb just execs `omarchy-shell-ipc menu …`. The
omarchy-CLI dispatcher overhead measures ~2ms on top of the direct IPC
path (32ms → 34ms keybind-to-visible), so the wrapper is fine for any
human-typed invocation; keybinds and the bar icon stay on
omarchy-shell-ipc to keep that ~30ms hot path.
Sibling `omarchy menu file`, `omarchy menu input`, etc. still resolve
through their own bins \u2014 the dispatcher picks the longest matching
prefix, so longer routes ("omarchy menu file") win over the bare
"omarchy menu" entry.
The old bash bin short-circuited with close_visible_quickshell_menu at
the top of open_quickshell_menu, so pressing any menu keybind while the
menu was open just closed it. The IPC path I introduced summoned every
time, so keyboard shortcuts couldn't dismiss \u2014 only outside clicks did
(which is why the bar icon appeared to toggle: clicking it while the
menu was open hit the menu's outer-click MouseArea, not the icon).
Add a menu.toggle IPC method:
- if root.opened: cancel() and return "closed"
- otherwise: behaves exactly like summon
Switch every Hyprland binding and the two bar-icon click handlers
(omarchy logo, battery right-click \u2192 power menu) to toggle. summon stays
as the always-open primitive for callers that want explicit summon
semantics (rare \u2014 right now nothing internal uses it).
With bin/omarchy-menu gone there's no caller that summons the menu by
writing a JSON tempfile and polling a done file. Drop everything that
existed only to support that handshake:
- menuJsonFile / menuJsonFileView / loadMenuJson / openMenu(json,...)
- pendingSelectionFile / pendingDoneFile / selectionFile / doneFile
- mergeProviderJson (the JSON-wrapper for provider output)
- applyProc / releaseProc / doneFilesToRelease / finishDoneFile /
releaseNextDoneFile / resetRequest / requestActive / closeMenu
- the menuBin property pointing at the deleted bin
applySelected is now four lines (close + execDetached); cancel is two
(close + clear filter). open() takes either {menu: id} or a bare initial
menu name, and hands off to openExistingMenu which uses the cached items
from the JSONC FileViews.
Net: 91 lines smaller, no perf change.
The shell now owns the menu — both data and dispatch. The 821-line bash
bin was carrying the open path (cold spawn + jq pipeline + tempfile dance
+ IPC + poll) and a grab-bag of helpers that only existed inside it. Both
go away in this commit.
New bins for the few composite helpers that were genuinely worth keeping:
- omarchy-install-app NAME PKG
- omarchy-install-and-launch NAME PKG DESKTOP_ID
- omarchy-install-font LABEL PKG FAMILY
- omarchy-launch-config-editor PATH
- omarchy-reminder-set-interactive
- omarchy-capture-screenrecording-with-webcam
Sweep through default/omarchy/omarchy-menu.jsonc rewrites:
- present_terminal X -> omarchy-launch-floating-terminal-with-presentation X
- install_terminal X -> omarchy-launch-floating-terminal-with-presentation 'omarchy-install-terminal X'
- install / install_and_launch / install_font / open_in_editor -> new bins above
- terminal X -> xdg-terminal-exec --app-id=org.omarchy.terminal X
- default_browser_is X -> [[ "$(omarchy-default-browser)" == "X" ]]
- default_terminal_is X / default_editor_is X / haptic_touchpad_is X same shape
- $(hypr_config_file X) -> ~/.config/hypr/X.lua
- show_custom_reminder_input -> omarchy-reminder-set-interactive
- screenrecord_with_webcam -> omarchy-capture-screenrecording-with-webcam
- stop_active_screenrecording -> omarchy-capture-screenrecording --stop-recording
Hyprland bindings switch from `omarchy-menu X` to
`omarchy-shell-ipc menu summon X` (the keybind hot path now skips bash
entirely). The Bar.qml omarchy widget and the battery right-click do the
same. ALT+PRINT becomes a one-liner: stop the recording if one is going,
otherwise summon the screenrecord submenu.
Measured: keybind-to-visible is ~30ms (was ~235ms). The shell's plugin
keepLoaded:true stops being theoretical \u2014 the menu data lives in memory
across opens, and the only work between keypress and paint is the IPC
roundtrip and the layer-shell window mount.
omarchy-menu used to spawn an 821-line bash bin on every keybind: 11 jq
invocations against omarchy-menu.jsonc, mktemp dance, summon, poll. The
shell waited ~235ms (keybind to visible) before painting the first row.
The bar plugin host is already a persistent process with the menu plugin
loaded (keepLoaded: true) — it just wasn't allowed to own the menu data.
Now it does:
- parseMenuJsonc / normalizeItem ports the bash bin's jq pipeline to
JS: strip // comments + trailing commas, infer parent from dotted
ids, dedupe keyword tokens across id/aliases/keywords, fill defaults.
- Two FileViews with watchChanges: true on the default and user
extension JSONCs. Edit either file and the in-memory item map
refreshes without a restart.
- IpcHandler exposes menu.summon(initialMenu) / refresh() / close() /
ping(). summon resolves aliases the way the old bash route_target
did, including the leaf-alias-is-an-action shortcut.
- Action dispatch is now direct: when summoned via IPC (no selection
or done file), Quickshell.execDetached(['bash','-lc', action]) runs
the action and the menu closes. The legacy tempfile dance is kept
only for the duration of the migration window.
- provider sub-menus (fonts, power-profiles) are inline: tab-delimited
bash one-liner per provider, parsed by mergeProviderRows.
- when:/checked: bash expressions are batched into one Process at
shell startup (and again whenever the JSONCs change). The menu
opens instantly; visibility/check marks settle within ~50ms.
Measured: keybind-to-visible via the new IPC path is ~30ms (was ~235ms).
The bash bin still works for now and is removed in the next commit.
Replace the mako-only migration with a single "complete the flip"
migration that handles everything needed to bring a dev-channel user
onto omarchy-shell:
- install quickshell if it isn't already on the box
- stop and uninstall mako; pacman -Rns deletes the .service unit too,
so D-Bus activation can't conjure it back into existence
- stop and uninstall waybar with the same uninstall-not-mask approach
- move ~/.config/{mako,waybar} aside (timestamped backup) rather than
rm -rf, so anyone with hand-tuned rules can mine them
- clear the stale toggle-state markers
- call omarchy-restart-shell so the bar and notification daemon come
up mid-session without a relog
Drop migrations/1778715864.sh: shell.json hasn't shipped to any user
yet, so a migration removing widgets nobody has is dead code.
- omarchy-bar-settings.lua is gone: the Hyprland rules it carried for
the old standalone bar-settings window no longer match anything,
since settings is now a panel plugin summoned via IPC. The still-
needed "Widget settings" sub-dialog rules move into
omarchy-shell.lua next to the existing "Omarchy Settings" rules.
- plugins README documents the `bar` plugin kind so third-party
plugin authors aren't surprised to see it on the first-party
omarchy.bar manifest. The note also calls out that they should ship
`bar-widget`s, not replace the host bar.
- omarchy-style-bar-position seeds from shell-defaults.json before
mutating, so a user without a shell.json (or with a malformed one)
no longer ends up with a stub config that blanks the bar layout.
omarchy-font-set already updates ~/.config/fontconfig/fonts.conf, which
is what fc-match, Qt, and every other XDG app reads from. Storing the
same family in shell.json gives the same value two homes that can drift
apart, and stops the bar from picking up font changes without a shell
restart.
- omarchy-font-set stops writing bar.fontFamily to shell.json and stops
poking ~/.config/waybar/style.css. fontconfig + terminals + hyprlock
+ swayosd are still updated as before.
- omarchy-font-current reads fc-match monospace -f '%{family}' and
takes the first comma-separated entry; the old jq-on-shell.json
path is gone.
- Bar / SettingsPanel / NDropdown.qml default fontFamily to
"monospace" and stop reading config.fontFamily. Qt resolves the
family through fontconfig at paint time, so omarchy-font-set updates
the bar live with no reload.
- shell-defaults.json drops bar.fontFamily.
User-visible effect: pick a Nerd Font, the bar follows it. Pick a font
without glyphs and you get tofu — same failure mode the terminals and
hyprlock already had.
The bin names should reflect the thing they manage. `refresh bar` is
misleading because the command resets the entire shell.json (which holds
plugins beyond just the bar), and `restart quickshell` names the runtime
rather than the product. Both now end in `-shell` to match the rest of
omarchy-shell.
Updates every caller in autostart, the menu, voxtype helpers, and the
shell README. No behavior changes.
omarchy-shell's bar plugin replaces waybar on every default path, so the
waybar package, configs, indicator scripts, and toggle/restart/refresh
binaries all go away in this commit.
The four small helper scripts that Bar.qml shells out to (weather.sh and
indicators/*.sh) move with the shell rather than disappear \u2014 they live
at default/quickshell/omarchy-shell/scripts/ now, alongside the rest of
the shell code.
Companion script changes:
- omarchy-shell-ipc gains --if-running so fire-and-forget refresh
callers (toggle-idle, toggle-notification-silencing,
update-available-reset, capture-screenrecording) don't accidentally
spawn the shell when it isn't already up.
- omarchy-theme-set, omarchy-tz-select, omarchy-voxtype-{install,model},
omarchy-toggle-nightlight, omarchy-voxtype-config drop their waybar
branches and comments.
- omarchy-voxtype-status's summary stops claiming it's a Waybar helper.
- omarchy-base.packages drops waybar; install/packaging/fonts.sh's
comment points at the new bar consumer.
- SKILL.md / AGENTS.md / omarchy-menu.jsonc lose their waybar entries.
- test/omarchy-cli-test.sh substitutes a remaining toggle command.
Chat apps (Vesktop, etc.) can rapid-fire the same Notify D-Bus call when
they sync, leaving the pending tab with hundreds of byte-identical rows
because the old handler appended unconditionally and never re-entered the
`markSeenByOriginalId` path for follow-up arrivals.
- addToPending + popup-insert now remove any existing row matching the
same `originalId` before insertion, honoring the freedesktop
"replaces_id" semantics that chat apps rely on.
- loadHistory dedupes by originalId on hydration, so existing on-disk
files with the old duplicate-laden schema collapse on next start.
- loadHistory also guards against re-entry: FileView fires onLoaded
more than once during startup (initial preload + Component.onCompleted
reload), and the old version would double the model each fire.
While in here, move the persistent notifications.json out of `~/.cache`
to `~/.local/state/omarchy` so a "clear cache" habit no longer drops
DND preference and notification history. The image thumbnail cache stays
in ~/.cache where regeneratable artifacts belong.
- Discovered devices now populate via a new `discoveredDevices` filter; the
Repeater was referencing a property that did not exist.
- Pairing chains into trust + connect at root scope, so freshly-paired
devices (especially audio headphones) persist in BlueZ and actually
finish connecting instead of flashing "Connected" and disappearing.
- Wrap the device list in a Flickable capped at 400px with a scroll bar
so crowded RF environments do not grow the popup off-screen.
- Reorder MouseAreas so the per-row X button receives clicks instead of
the full-row click handler swallowing them.
Adds first-party omarchy.notifications service plugin that hosts a
freedesktop notification server and renders popups + a history popup
inside the shell. Uninstalls mako and retargets every helper, keybind,
indicator, and migration entry to the new daemon.
Plugin (default/quickshell/omarchy-shell/plugins/notifications/):
- Service.qml: NotificationServer, popupModel + pendingModel + pastModel
(two-tier history, see below), DND via PersistentProperties +
cache-file backstop, image cache for /tmp screenshots, IpcHandler with
toggleDnd/setDnd/isDnd/showHistory/clear/clearPending/markAllSeen/
dismissAll/dismissOne/invokeLast/dismiss, per-theme override file
~/.config/omarchy/current/theme/notifications.json honoring
borderColor/backgroundColor/textColor/countdownColor.
- components/NotificationCard.qml: theme-driven card (Color.foreground/
background/border tokens from Commons/Color.qml), 32x32 icon slot,
Nerd Font glyph fallback via omarchy-glyph hint, hero image strip
for screenshot/image-path notifications, hover-pause progress bar,
uses bar.fontFamily so all surfaces share one font.
Filtering and DND:
- transient hint and CLI-style senders (app_name in notify-send /
omarchy-action) bypass history but still pop.
- DND only allows omarchy-action toasts and notify-send -u critical
through; real-app urgency=critical (Discord, Slack, Vesktop) is
silenced and lands in pending instead.
- Pending vs past split surfaced via tabs in the bar widget popup;
past tab is auto-pruned at the 15-minute mark.
- Click-to-jump: notifications without a libnotify default action focus
the matching Hyprland window via class lookup.
Shell host:
- shell.qml: generic first-party service loader (mirrors the existing
noctalia-compat path) and an alias for the bar so plugins can read
barSize / barHidden / position for anchoring.
- Commons/Color.qml: parses the theme's hyprland.conf for
$activeBorderColor so notifications match Hyprland window borders;
picks the explicit accent= key over the color4= alias.
Bar widget rebase (plugins/bar/widgets/notificationCenter.qml):
- Drops the chunk-1 stub server, binds count/dnd state to the service,
hosts the history popup via PopupCard so it drops down from the
notification glyph the same way Quick Settings does.
- Pending/Past tabs, dismiss-individual close X, mark-all-as-seen and
clear-recent action buttons, theme-driven palette.
Quick Settings rework (plugins/bar/widgets/controlCenter.qml):
- DND tile binds directly to service.doNotDisturb for instant feedback.
- Drops the volume slider (already in audioPanel) and the no-op Theme
tile; adds a Bluetooth toggle bound to Quickshell.Bluetooth.
- Bigger 44x44 wallet was scaled back to 32x32 for tighter rows.
Notification scripts (bin/omarchy-*):
- omarchy-notification-send: passes glyph as a custom hint instead of
prepending to the summary; adds -a omarchy-action and -u urgency
automatically; supports -e/--transient passthrough.
- User-action toasts in the capture / toggle / hyprland / default-*
scripts and bindings/utilities.lua now tag themselves
-a omarchy-action so DND treats them as intent-based bypass.
- omarchy-toggle-notification-silencing, omarchy-notification-dismiss,
default/waybar/indicators/notification-silencing.sh, and the Hyprland
comma-keybinds all route through omarchy-shell-ipc notifications.
- omarchy-capture-screenshot / -screenrecording set the image-path
hint properly so the hero-image rendering kicks in.
Mako removal (migrations/1778743515.sh):
- pkill -x mako, systemctl --user stop mako.service, pacman -Rns mako
(uninstalling deletes /usr/lib/systemd/user/mako.service so D-Bus
activation can't respawn it). Removes ~/.config/mako/ and the legacy
toggle file. Restarts quickshell so it claims the bus name.
- Drops mako from install/omarchy-base.packages, autostart.lua,
install/config/theme.sh + toggles.sh, default/themed/mako.ini.tpl,
default/mako/, the omarchy-menu Mako restart row, bin/omarchy
GROUP_DESCRIPTIONS, the settings panel catalogue, and the
default/omarchy-skill paths table.
- Removed scripts: bin/omarchy-restart-mako,
bin/omarchy-style-corners-mako.
- bin/omarchy-style-corners summary updated; corner radius for the
notification card reads ~/.local/state/omarchy/toggles/quickshell-menu.json
alongside the rest of the shell.
GitHub's default branch on basecamp/omarchy is no longer master, so
a plain clone pulls the development branch. Pass --branch master so
reinstalls always land on stable regardless of repo default.
GitHub's default branch on basecamp/omarchy is no longer master, so
a plain clone pulls the development branch. Pass --branch master so
reinstalls always land on stable regardless of repo default.
Pad the percent text to 3 chars with printf so " 5%", " 50%", and
"100%" render at identical width in the JetBrainsMono monospace label.
Previously the popup container resized between events because the
label string varied between 2 and 4 characters, which caused the
popup to visibly jump in width on consecutive brightness key presses.
Builds on #5525, which made the percent values themselves step
uniformly; this completes the loop by making the rendered popup match.
Co-authored-by: Mateus Pegorim <14262063+Pegorim@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The tray drawer reserves space for its slide-in animation; placed
mid-section that gap was always visible. Now:
- normalizeLayout moves any tray entry to the section's inner edge
(start of right, end of left/center) so the reserved gap sits next
to the bar center instead of stranded mid-section.
- TrayModule reads its own entry settings to support pinned[] and
hidden[] arrays of SNI ids. Pinned icons render to the right of the
chevron (always visible); hidden icons never render; the rest fall
into the drawer.
- Right-click the chevron opens a management popup listing every
reporting tray item with Pin/Unpin and Hide/Show pills. Toggles
persist via shell.updateEntryInline.
- Bar imports common/ as BarCommon so the tray can reach PopupCard
and PillButton for the popup.
Bar now shows just the chip glyph; hover opens the existing CPU+Memory
graphs popup, left-click launches btop. Removes the inline sparklines,
the right-click→alacritty binding, and the redundant Open btop pill.
Rename apps/quickshell.lua to apps/omarchy-shell.lua and gather every
rule that targets a Quickshell surface owned by the shell:
- menu and image-selector layer rules (image-selector moved out of
apps/system.lua, where it didn't belong with generic floating /
media / idle rules)
- new window rules so the settings panel floats centered at 960x700
instead of tiling
The settings panel is a transient dialog, not a workspace surface, so
tiling it disrupts the layout and leaves it awkwardly tall when it lands
in a half-screen split. Class+title scoping keeps the rule from leaking
into other org.quickshell windows (menu, image picker, etc.).
The previous clearBodyFocus() set focus = false on navRoot.activeFocusItem
and called navRoot.forceActiveFocus(), which works for plain Rectangles
but not for Controls 2 widgets like ComboBox: the combo keeps an internal
focused child that the surrounding FocusScope happily restores, so the
accent focus border on the Position/Center anchor dropdowns lingered
after backing out to the sidebar.
Add an invisible 1x1 navFocusSink Item inside navRoot and force focus
onto it whenever the user leaves the body (h/Esc/Shift-Tab, category
changes from sidebar nav, or panel reopens). The sink reliably owns
activeFocus so every body control \u2014 ComboBox included \u2014 falls back to
its unfocused style.
Two related fixes from user feedback on the keyboard nav:
1. Focused and selected controls were drawing the same 2px accent border
so it was impossible to tell where the keyboard cursor was on a row
that happened to also be the current value. Focused now uses a 3px
accent border plus a translucent accent fill; selected keeps its 2px
border with no fill. Centralized into focusBorderColor /
focusBorderWidth / focusFillColor so all components share the look.
2. Backing out of the body to the sidebar (h/Left/Esc) left the focus
ring lingering on the body item. FocusScope was restoring activeFocus
to its remembered descendant when navRoot reclaimed focus.
exitBodyZone (and onActiveCategoryChanged when not in body mode) now
clears focus from the previously active descendant before forcing
focus back onto navRoot.
Two zones — sidebar and body — with vim-style bindings:
sidebar j/Down next category
k/Up previous category
l/Right/Tab/Enter/Ctrl-L enter body
Esc close panel
body j/Down/Tab next focusable
k/Up/Shift-Tab previous focusable
Enter/Space activate focused control
h/Left/Esc/Ctrl-H back to sidebar
Wraps panel content in a FocusScope with Keys.priority: Keys.BeforeItem
so j/k always reach the nav handler even when a child control has focus.
Body focusables are gathered by walking the visible subtree of the active
category for items with activeFocusOnTab — automatically excluding
hidden category branches. Sidebar shows an accent-tinted highlight when
focused; each interactive control (DefaultsRow, StyleOptionTile,
StyleChip, FontRow, StyleToggleRow, ActionPill, IconButton, PluginRow)
renders an accent focus ring while focused.
Consolidates bar-settings into a single 'settings' plugin with sidebar
categories: Defaults, Style, Bar, System, Plugins. Updates supporting
commands (omarchy-launch-settings, omarchy-style-corners-quickshell,
omarchy-theme-list-with-previews, omarchy-hyprland-monitor-scaling-set)
and refreshes sidebar glyphs to Nerd Font icons.
Network panel now polls 'ip route get 1.1.1.1' for the active interface
and renders a key/value grid with IP/CIDR, gateway, link speed +
duplex (ethernet) or signal/freq/bitrate (Wi-Fi). One bash script
collects everything in TSV.
Wi-Fi list now works on Omarchy's default iwd+impala stack: when
nmcli isn't installed, falls back to 'iwctl station <dev> get-networks'
and parses the connected/SSID/signal/security columns. The list is
hidden entirely when no Wi-Fi station device exists (ethernet-only
machines).
Right-click on the bar widget and the bottom 'Open Wi-Fi manager
(Impala)' button both run omarchy-launch-wifi directly (was wrapped
in extra OMARCHY_PATH= env that wasn't actually doing anything).
Was gated on isConnected; users with paired-but-disconnected devices
(or devices Quickshell hasn't flagged as connected yet) saw no button
at all. Now shows on every known device. Action follows state:
connected -> disconnect, otherwise -> forget. Tooltip label flips to
match.
Bluetooth rows no longer hover-show a tooltip — clicking to connect
or pair is self-evident from the layout. Connected rows now ignore
their own click and surface a small × button on the right that
disconnects (with its own tooltip + urgent-color hover affordance).
Right-click still forgets the device.
PillButton's attached ToolTip is now a styled instance — uses the
widget's foreground color for text + border and a configurable
tooltipBackground (defaults to a near-black, overridable to
bar.background). No more stock OS chrome inside our popups.
Bluetooth panel passes bar.background/foreground through to its
header pills and replaces the row tooltip with the same themed style.
Each device row is now a two-line entry: name on top, status on the
bottom (Connected · 80%, Connecting…, Pairing…, Disconnecting…, Failed,
Available · click to pair, or Paired). Status text and the bluetooth
icon both color-code by state — connected/active draws in foreground,
idle in dim, failed in urgent.
Pending click attempts arm a 10s timer; if the device hasn't reached
the expected state by then the row flips to 'Failed' with an urgent
color so you can see the connect attempt didn't take. State change
listeners clear the pending flag the moment the device actually
connects or pairs.
Hover tooltips and right-click-to-forget moved into the row so the
behavior is self-contained.
- Scan and Manage are now small icon-only buttons in the header beside
the On/Off pill, with hover tooltips via the new PillButton.tooltipText
prop (backed by QtQuick.Controls ToolTip).
- New discoveredDevices list pulls everything in Bluetooth.devices that
isn't paired/connected/bonded/trusted. While scanning, those appear
under a 'Discovered' header. Click pairs and connects.
- Empty-state text only shows when there are no known and no
discovered devices, otherwise it would push down real entries.
- Header now uses anchors so the on/off pill sits cleanly at the right
instead of relying on a fixed-width spacer that drifted as content
grew.
- Discovery toggle moved out of the header and into a labeled action
row alongside a new 'Manage…' button that launches
omarchy-launch-bluetooth (the Impala TUI).
- Empty-state message tells you what to do based on adapter state
(off / scanning / no paired devices) instead of one generic line.
wttr.in query switched from one-blob format to pipe-delimited fields
(location|condition|temp|feels|wind|humidity). The popup parses each
piece into its own property and renders a clean key/value grid:
fort lauderdale, florida, us
Partly cloudy
Temperature +82°F (feels +91°F)
Wind ↗15mph
Humidity 82%
[Refresh] [wttr.in]
PopupCard gains a triggerMode property — "click" stays as the default
(focus-grab dismissal), "hover" skips the grab so the cursor can move
freely between the trigger and the card. PopupCard also exposes a
containsMouse alias for widgets that want to coordinate hover state.
Weather widget now shows on hover and hides 220ms after the cursor
leaves both the trigger and the popup. The redundant tooltip is gone —
the popup is the detail view. Click is still wired for refresh
(middle) and notification dump (right).
PopupCard now uses HyprlandFocusGrab so any popup in the shell closes
when the user clicks outside it (or any other window in the listed set).
Single primitive — every widget gets it for free.
Weather popup rewritten:
- Smaller cloud glyph beside the city name on one row, both vertically
centered.
- Condition string flows on its own line and wraps inside the popup.
- Refresh and wttr.in pills sit side by side instead of stacked, no
more dead vertical space.
- contentHeight tracks the actual content height so the popup is no
taller than it needs to be.
The legacy 'workspaces' built-in renders cleaner than the animated
workspacesPro file widget. Removed the widget file, its first-party
registration in Bar.qml, and updated the default layouts and docs.
'workspaces' loses the (legacy) tag in the catalog since there's no
alternative anymore.
omarchy.bar-settings and omarchy.image-picker are shell infrastructure —
the customizer and image picker themselves. Listing them in 'Other
plugins' with move/remove arrows is misleading: removing the panel
plugin doesn't disable anything (it's summoned on demand via IPC), and
adding them never made sense.
Dropped them from shell-defaults.json's plugins[] and from the inline
builtinShellConfig fallback. normalizeDraft and availableToAdd now skip
manifests with __isFirstParty so existing user shell.json files
self-heal on next load.
Two handlers were declared for the same property-change signal — QML
refuses to load the file with 'Property value set multiple times', so
summoning omarchy.bar-settings failed silently. Merged the debug log
into the existing catalogRevision++ handler.
suppressReload was eating the file-watch callback that would have
called loadConfig and refreshed the draft from disk, so the GUI stayed
on the pre-reset layout even though bar.json was already correct.
Apply the reset payload directly to draft (and bump draftRevision) so
section editors re-render in the same frame.
Every layout mutation (add/remove/reorder, settings dialog Apply,
position or centerAnchor change) now writes ~/.config/omarchy/bar.json
immediately. No more Save button — replaced with an inline 'Auto-saving
to ...' status line next to Reset to defaults.
To stop the FileView feedback loop (write → inotify → reload → set
draft → write again) the shell keeps a one-shot suppressReload flag
that swallows the userFile.onLoaded triggered by our own setText.
Reset previously could zero the bar out when defaultConfig was empty —
either because bar-defaults.json hadn't finished loading or because the
resolved path was wrong. The shell now carries an inline builtinBarConfig
that mirrors bar-defaults.json, and Reset uses it whenever the on-disk
defaults aren't yet populated.
Also: log the resolved omarchyPath / defaultsPath / userConfigPath at
startup, and route FileView load failures through console.warn so the
next time a user hits this they can see why.
The diff serializer would write only the sections the user touched and
rely on the bar merging defaults back in at load time. After a Reset to
Defaults the user file became {}, so the next 'Add widget' diffed
against the section and wrote ONLY the user-added entry, dropping every
default widget the user could see in the GUI.
- Reset to Defaults now writes the merged defaults verbatim so the GUI
and bar.json agree on the full widget list, and any subsequent edit
operates on that explicit list.
- Save writes the full draft, not a diff. The user gets a predictable
what-you-see-is-what-you-save customizer at the cost of Omarchy
defaults changes not silently propagating after the first save.
Quickshell.shellDir points at the directory holding the loaded
shell.qml, so the bar can find its own widgets and bar-defaults.json
without depending on OMARCHY_PATH being set in the environment. The
old behaviour silently fell back to ~/.local/share/omarchy when the
env var was unset, which is fine for the installed shell but caused
'No such file or directory' for every first-party widget when running
quickshell -p straight from the repo.
- firstPartyWidgetSource now uses Qt.resolvedUrl("widgets/<name>.qml")
so the resolution is anchored to shell.qml itself.
- deriveOmarchyPath() in both bar/shell.qml and bar-settings/shell.qml
walks back from Quickshell.shellDir to find the omarchy root, with
OMARCHY_PATH still allowed as an explicit override and the install
default as a final fallback.
CRITICAL:
- Re-inject working entry into the settings form every time the dialog
opens. Previously the Loader's onLoaded only fires when the
sourceComponent identity changes, so reopening the dialog on the same
widget id (or on a second instance of the same id, e.g. two spacers)
showed stale field values.
- 'Add widget' menu and the centerAnchor dropdown both read
draft.layout[section] without depending on the section array
identity. Mutating the array in place did not invalidate those
bindings, so the menu would show a stale availability list and let
non-spacer widgets be added twice. Layout mutations now replace the
whole object so any binding that reads it re-evaluates.
WARNINGS:
- Save now writes only the diff against the merged defaults so future
bar-defaults changes are not silently shadowed by a stale snapshot.
- FileView onFileChanged handlers simplified to a single reload() —
the explicit second loader call was duplicating loadConfig and
bumping barConfigSerial twice per change (visible flicker).
- userFile onLoaded ignores reloads while the user has an unsaved
working draft so external edits during editing do not clobber the
in-progress state.
- SpinBox forms switched from onValueChanged to onValueModified so the
initial-value bind no longer fires fieldChanged.
- Hyprland window-rule sizes aligned with the FloatingWindow
implicitWidth/Height values (720 main, 380 dialog).
- omarchy-launch-bar-settings falls back to initialTitle when focusing,
so a dialog that has not yet had its title applied still surfaces
the existing instance.
Each layout entry is now an object — {id, ...inline settings} — instead
of a (name, separate modules map) pair. Multiple instances of the same
widget are trivially supported (spacer is the main beneficiary). Settings
travel with the entry, so reordering keeps them attached.
shell.qml:
- normalizeLayout converts string entries to {id} and drops invalid ones
- ModuleSlot binds to a full entry; moduleName and moduleSettings derive
from it via entryId/entrySettings helpers
- centerAnchor lookup walks layoutEntries directly
- builtinBarConfig defaults use the object form
- README + bar-defaults.json updated to the new schema
bar-settings/ (new Quickshell config):
- Top toolbar with Reset / Save and Position / centerAnchor dropdowns
- Three section editors (left/center/right) with current widgets shown
as cards: name + description + move up/down/settings/remove buttons
- '+ Add widget' menu per section, sorted alphabetically by display name
(only spacer can repeat; everything else is one per bar)
- Per-widget settings dialog (FloatingWindow) loads an inline schema for
widgets in the catalog. Initial schemas: spacer (size), calendar
(formats), brightness (step)
- FileView { atomicWrites } writes to ~/.config/omarchy/bar.json on Save
omarchy-launch-bar-settings + hypr window rules pin the settings window
to a 760px floating square. controlCenter gains a 'Customize bar…' button
that launches it.
Single bar button (md-tune-vertical glyph) that opens a popup with the
controls most users reach for repeatedly throughout the day:
- Volume slider + mute toggle (Pipewire defaultAudioSink)
- Brightness slider (brightnessctl, coalesced via writeTimer)
- 2x2 tile grid: Do Not Disturb (makoctl mode), Night Light (omarchy-
toggle-nightlight, temperature probed), Keep Awake (hypridle pid
detection), Theme (current symlink + opens omarchy menu themes)
- Power-profile row (Saver / Balanced / Performance), hidden when
power-profiles-daemon is not installed
Polled every 3s via Process + StdioCollector pairs gated by !running
busy checks. Default layout adds it before powerMenu on the right.
- nightLight queries hyprctl hyprsunset temperature to detect state
instead of pgrep, since omarchy-toggle-nightlight keeps the daemon
running across toggles. Adds a 'toggling' busy flag so repeated
clicks do not stack the toggle script.
- lockKeys reads each LED individually and emits 'missing' when the
class is absent, fixing column-shift mislabels on keyboards that
only expose a subset of the locks. Hides + stops polling when no
LEDs are reported. Poll interval relaxed to 2s.
- activeWindow right-click now calls toplevel.close() against the
captured window instead of dispatching killactive against whatever
is focused at click time.
- Drop unused Common imports from activeWindow and lockKeys.
- activeWindow: shows the focused toplevel title from Quickshell.Wayland
ToplevelManager. Left-click activates, middle-click closes, right-click
killactive. Hidden in vertical bars to avoid title rotation noise.
- nightLight: toggles omarchy-toggle-nightlight; status detected via
pgrep hyprsunset. Hides when hyprsunset isn't installed.
- keyboardLayout: shows current xkb layout short code, click cycles via
hyprctl switchxkblayout. Refreshes on Hyprland activelayout events.
- lockKeys: caps/num/scroll lock indicators read from /sys/class/leds.
Uses plain A/1/S letters; hides each indicator when off.
- spacer: configurable blank space (size) for layout tuning.
Defaults add activeWindow to the left section and nightLight to the
right section between audioPanel and brightness.
- powerProfile now hides on machines without power-profiles-daemon by
checking against the published profile set rather than a never-undefined
enum, and uses mdi-scale-balance for Balanced (not battery-charging).
- networkPanel renames the QML-keyword-shadowing 'signal' property to
'signalStrength'; ethernet glyph corrected to mdi-ethernet (not the
access-point icon).
- workspacesPro indicator color guards against null bar during construction.
- Common.Slider keeps an internal liveValue so external value bindings
survive a drag; sliders fed from PipeWire/brightnessctl now follow
external changes after the user interacts.
- audioPanel drops the redundant default-sink PwObjectTracker since the
candidate-sinks tracker already covers it.
- networkPanel guards scan/connect commands against re-entry while the
previous Process is running.
- notificationCenter only instantiates its NotificationServer when the
module is opted in via settings.replaceMako (default off) so it does
not collide with mako out of the box.
- PopupCard fully opaque while open (previously 0.98) — removes a
visible ghost outline on first render.
- Drop dead code: calendar trailing MouseArea, weatherFlyout's unused
parseForecast/forecast property, idleInhibitor's holdSeconds,
media's scrollAnim.position; gate media's scroll animation off in
vertical bar mode.
- Replace nerd font glyphs that were stripped during the initial widget
writes with verified codepoints sourced from the JetBrains Mono Nerd
Font cmap (cpu-64-bit, scale-balance, notification-clear-all, etc).
- systemStats now switches to a Column layout when the bar is vertical
so the widget no longer overflows a 28px-wide side bar.
- Remove notificationCenter from defaults: it registers a notification
server and would collide with the mako daemon Omarchy autostarts.
- PopupCard owns the popout coordinator lifecycle and delegates close to
its widget owner when provided; calendar and media now pass owner.
- brightness debounces brightnessctl writes through a coalescing timer
to avoid spawning a process per slider tick.
- audioPanel tracks unfiltered Pipewire sinks/streams via PwObjectTracker
so audio metadata becomes available before filtering.
- ModuleSlot re-injects bar/moduleName/settings whenever the bar config
serial changes so widget settings update live with bar.json.
- Guard null bar references in workspacesPro and systemStats components
that are constructed before bar injection.
Introduces a widgets/ directory of first-party QML modules and a common/
helpers library. Widgets auto-load by name from
default/quickshell/bar/widgets/<name>.qml — no edits to shell.qml needed
for additions beyond the firstPartyWidgets registry.
New widgets (all orientation-aware, top/bottom/left/right):
- media: MPRIS now-playing with scrolling label, cover art popup,
play/pause/skip controls
- audioPanel: master volume slider, output device picker, per-app mixer
- networkPanel: Wi-Fi scan + connect, current connection details
- bluetoothPanel: paired device list, connect/disconnect, battery
- calendar: month grid popup keyed to today
- notificationCenter: live notification feed, DND toggle, clear all
- brightness: slider popup with scroll-to-adjust
- powerProfile: power-saver/balanced/performance picker (UPower)
- systemStats: inline CPU + RAM sparklines, expanded popup with btop
- weatherFlyout: weather popup with refresh and full report
- workspacesPro: animated focus indicator that slides between workspaces
- powerMenu: lock/suspend/log out/reboot/shutdown popup
- idleInhibitor: coffee-cup toggle wired to omarchy-toggle-idle
- microphone: mic state + mute toggle + scroll volume
Common helpers (default/quickshell/bar/common/):
- WidgetButton: hover/press scale animation, tooltip integration
- PopupCard: orientation-aware anchor + slide-in opacity transition
- Slider: drag/wheel-able linear slider with knob hover bump
- PillButton: rounded action button with icon + label
Bar root gains requestPopout/releasePopout so only one popup is open at
a time across widgets.
Updates bar-defaults.json to ship the new widgets out of the box while
keeping the legacy modules available.
* Agents should use the notification helper
* Turn a single RetroArch game into its own application launcher
* Tweak installer
* Extract selection logic into cli
* Use consistent glyph
* One more
* Persist Bluetooth power state across reboots
BlueZ defaults to AutoEnable=true, which forces controllers on at boot
regardless of the last user-set state. Setting AutoEnable=false makes
bluetoothd respect the persisted Powered state, so toggling off in
bluetui (or any DBus client) survives a reboot.
Adds the change to the install path and a migration for existing setups.
* Set reboot-required in Bluetooth persistence migration
Per review feedback, the AutoEnable=false change only takes effect on
bluetoothd startup. Without setting reboot-required, omarchy-update-restart
won't prompt the user to reboot, so the fix would only kick in at their
next organic reboot — by which time the bug may appear unfixed.
Matches the convention in migrations/1776346552.sh and similar.
* No need to ask for a reboot when this is available on the next one
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Fires after the channel template is copied to /etc/pacman.conf and before
`pacman -Syyuu` runs, letting users layer custom Pacman repositories or
IgnorePkg directives onto the freshly-written config so they're respected
by the upgrade. Useful for users running on overlay distros (CachyOS,
Chaotic-AUR, internal company repos) where a wipe-and-reinstall would
otherwise pull vanilla Arch versions.
Ships with `pre-refresh-pacman.d/add-custom-repo.sample` showing the
pattern.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Change monospace match from mode="assign" binding="strong" to
mode="append" binding="same" so the system font acts as a fallback
instead of overriding explicit app font configs like Ghostty's font-family.
Add migration to fix existing user configs.
Fixes#5675
* Trash imv deletes; add Ctrl+E to edit in Satty
Ctrl+X / Ctrl+Shift+X now move the image to the freedesktop trash via
`gio trash` instead of unconditional `rm`, so accidental presses are
recoverable from the file manager's Trash.
Adds Ctrl+E to open the current image in Satty (already in
omarchy-base.packages) and quit imv, mirroring the typical
screenshot → annotate workflow.
* Add -- separator to gio trash invocations
Prevents filenames starting with - from being parsed as options.
* Scope branding image pickers to ~/Pictures, fix About transcode mode
The "Set From Image" path in both Style → About and Style → Screensaver
was scanning all of $HOME for *.svg / *.png and feeding the result into
Walker dmenu. On a populated home directory this can be tens of thousands
of entries, leaving the picker effectively unusable.
Scope the picker to ${XDG_PICTURES_DIR:-$HOME/Pictures}, matching the
pattern already used in omarchy-capture-screenshot.
While here, drop the hardcoded --mode block from omarchy-branding-about
so the About transcode falls back to the default braille mode, matching
what omarchy-branding-screensaver does and what stock about.txt ships
with. The reduced --width 54 stays so the result fits the fastfetch
logo column.
* Explain the scope of the picker
---------
Co-authored-by: Gavin Nugent <245706154+28allday@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Waybar positioning and shape
* Reveal weather again on left/right
* Fix indicators moving bar left/right
* Clean it up
* Cleanup
* One step forward, one step backwards
* Fix styles
* More style massage
* More tweaks
* Just position for now
* Fix keys
* No longer needed
* No need to reset
* Simplify
* Reset but protect waybar configs
* Not needed
* Fix glyph
* Not needed
* Cleanup
* Better wording
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
It was comparing NextElapseUSecMonotonic against /proc/uptime, but those
values aren’t in the same monotonic timeline for user timers, so valid
upcoming reminders were being skipped.
* Configure Dell XPS haptics directly
* Use packaged Dell XPS touchpad haptics service
* fix: keep one Dell haptics migration
* We already have a dedicated Trigger > Hardware menu
* Name for action
* Moved
* Need to make the package available for offline
* Simplify
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Split fido2 and fingerprint setups into setup and remove
Don't make one thing do two things
* Extract helpers and clean up
* No need to hide them
* Don't need these
* fix(weather): Use local units for temperature and wind
Remove the metric-to-imperial temperature conversion and display
temperature and wind values as returned for the current locale.
* Don't need this comment
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
`DefaultLimitNOFILESoft` is not a valid systemd configuration key.
systemd silently ignores it and emits this warning on every boot,
for both the system manager (PID 1) and the user manager:
Unknown key 'DefaultLimitNOFILESoft' in section [Manager], ignoring.
The consequence is that the script's stated goal of raising the soft
fd limit from 1024 to 65536 has not actually been happening: dev
tools (VS Code, Docker, dev servers, databases) continue to run with
systemd's default 1024 soft limit.
The valid key is `DefaultLimitNOFILE`, which accepts either a single
value (sets both soft and hard) or `SOFT:HARD`. Using `65536:524288`
raises the soft limit while preserving systemd's typical 524288
hard-limit default — using the bare `=65536` form would lower the
hard limit, which would be a regression.
After this change and `systemctl daemon-reexec` on both managers,
`systemctl show | grep DefaultLimitNOFILE` reports:
DefaultLimitNOFILE=524288 (hard)
DefaultLimitNOFILESoft=65536 (soft, derived display attribute)
and the boot-time "Unknown key" warnings disappear.
(The typo likely originated from someone reading `systemctl show`
output, where `DefaultLimitNOFILESoft=` appears as a read-only
display attribute for the soft component of the parsed limit.
It looks like a config key but isn't.)
* Extract notification command for using the correct spacing
* Add easy to set reminders
* More human
* Clear and direct hotkeys
* Split
* Bake reminders into the skill
* Run SwayOSD as a session service
* Restart SwayOSD after clean exits
* We don't need the input backend (as we manage the hotkeys in Hyprland)
* Ensure we cleanup the old service starter
* Not needed
* Not needed either
* Clean up migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Adjust condition to also match non-X series Panther Lake GPUs.
* Add migration to install GPU acceleration on non-X Panther Lake systems.
* Update comment with Non-Arc Panther Lake GPUs mentioned.
* Simplify conditions in the migration
* Set default terminal, browser, editor explicitly
* Consistent glyphs and setup
* Tweaks
* Always there
* Proper order
* Don't make a browser the default just because it's getting installed
* Extract ASUS Expertbook B9406 display backlight fix and apply it for Zenbook ux5406aa too
* Add migration for Panther Lake Asus display bakclight fix
* Check if limine-update exists before executing it in the migration
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add bass speaker fix for Lenovo Yoga Pro 7 14IAH10
The ALC287 codec on Yoga Pro 7 14IAH10 requires the alc287-yoga9-bass-spk-pin
quirk to properly route audio to both amplifier speakers. Without this fix,
only one speaker works and bass output is missing.
This adds:
- Hardware detection script (omarchy-hw-lenovo-yoga-pro7-bass)
- Audio fix that creates /etc/modprobe.d/lenovo-yoga-pro7-bass.conf
Tested on Lenovo Yoga Pro 7 14IAH10 (Intel Core Ultra 9 285H).
Reference: https://wiki.archlinux.org/title/Lenovo_Yoga_9i_2022_(14AiPI7)
* Add Lenovo Yoga Pro 7 bass fix to install flow
Addresses review feedback: the hardware fix script was not invoked
during installation. Add it to install/config/all.sh so it runs
automatically on matching hardware.
* Fix implementation
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Hardcoded -l eng makes SUPER+CTRL+PRINT produce garbage on any
non-ASCII English text. Read the language list from
OMARCHY_OCR_LANGS instead, defaulting to eng for backward
compatibility.
* Add Transcode entry to Nautilus context menu
Right-click on image or video files in Nautilus to send them to
omarchy-transcode in a presentation terminal, mirroring the existing
LocalSend integration.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Use shlex.quote for shell-safe command construction in transcode.py
Quote both the resolved binary path and file paths via shlex.quote
instead of a custom escaper. Addresses Copilot review on #5635.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Style changes
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add live weather
* Just use jq
* Add Weather app and make it click target
* Simplify
* Looks better
* Nicer flow
* Simplify
* Move to using the notification instead of tooltip
* No longer needed
* Fix helix theme's word selection colors
Without this fix, if users enabled `editor.cursorline`, the word
selection would not be visually distinct from the cursorline selection.
Closes: https://github.com/basecamp/omarchy/issues/5580
Signed-off-by: Luke Hsiao <luke@hsiao.dev>
* Make Retro-82 color0 visually distinct from background
Signed-off-by: Luke Hsiao <luke@hsiao.dev>
* Make matte-black selection background distinct from color0
Signed-off-by: Luke Hsiao <luke@hsiao.dev>
---------
Signed-off-by: Luke Hsiao <luke@hsiao.dev>
* Install sof-firmware on Intel Panther Lake for DSP audio
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Need to have the sof-firmware package available during original offline install
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Install Zed Editor with omazed for themes syncing
* Move Zed theme switching into Omarchy
* Launch zed after install
* revert
* forgot omazed!
* omazed is now on OPR
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Enable middle-click primary paste for GTK/Chromium apps
gsettings-desktop-schemas 50.x ships gtk-enable-primary-paste=false as
the default. GTK4 apps (Ghostty 1.3.0+) and Chromium-family browsers
honor that setting and silently no-op middle-click paste, even though
the primary selection itself works (wl-paste --primary returns text,
Firefox/LibreOffice paste fine because they implement primary paste
themselves rather than going through GTK).
Flip the GSetting to true so middle-click paste behaves the way Linux
desktop users expect across Ghostty, Brave, and Chromium.
Closes#5371
* Address Copilot review on #5577
Move install-time GSetting from install/config/ to install/first-run/
so it runs after login when a session D-Bus is guaranteed (matching the
existing gnome-theme.sh convention). Make the migration's gsettings
call best-effort with `|| true` so a missing dconf service doesn't
trigger the omarchy-migrate skip prompt.
* Add dynamic theming for gum.
* Add migration.
* Fix migration script.
* Add omarchy-theme-reset utility.
* Move env variables into seperate file and update migration script.
* Migration adds the new hyprland config file to the users hyprland.conf.
* Add gum.env.conf to default env.conf instead.
* Reuse new omarchy-theme-refresh and update migration.
* Ensure no errors are thrown if the file can't be loaded
* Just apply this on the next theme selection
So it's not disruptive
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add script to capture screenshot, perform OCR, and copy text to clipboard
* Add binding for screenshot-ocr
* Update OCR binding description
* Add tesseract OCR and language data installation
* Update bindings to current dev
* Refactor screenshot capture method to use wayfreeze and slurp for region selection
* Refactor OCR text extraction to simplify error handling
* Bring up to date
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix power profile auto-switching on USB-C only machines
* Small nits
* Stick with single unit name
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Make color0 distinct from background/foreground
The majority of themes have color0 available as a subtle offset from
the background. For flexoki-light, because color0 matched foreground, it
wasn't subtle, and would cause invisible text when used as a background
color (e.g., in text editor rulers). For vantablack, ethereal,
hackerman, and white, color0 matched background and would cause
invisible text when a theme wanted text to be de-emphasized.
This patch makes it consistently a subtle offset from background.
* Make helix selection theme colors more subtle
Helix is more usable if the selection background is subtle. This is
primarily because of [[1]], which makes a bright selection like we had
before often make the foreground text unreadable in the picker preview.
[1]: https://github.com/helix-editor/helix/issues/12405
Helix had no theme integration. Installing it from the menu just ran
omarchy-pkg-add and left the editor on whatever default theme it shipped
with, regardless of the active Omarchy palette.
This adds `default/themed/helix.toml.tpl` so the template
renderer produces a helix.toml on every theme switch, and
`omarchy-install-helix` that wires Helix up:
- install the package
- symlink `~/.config/helix/themes/omarchy.toml` at the rendered theme
- seed a config.toml selecting that theme when the user has none
The install menu routes Helix through this script. omarchy-restart-helix
joins omarchy-theme-set and signals Helix with SIGUSR1 so theme changes
are live [[1]], the same way as other packages. Arch-based distros
package the binary as 'helix' rather than upstream 'hx', so the new
scripts target 'helix' and the installer ends with a hint about aliasing
'hx'.
[1]: https://docs.helix-editor.com/configuration.html
Ref: https://github.com/basecamp/omarchy/discussions/4986
* Add minimum brightness cap to prevent OLED displays turning off
* Revert "Add minimum brightness cap to prevent OLED displays turning off"
This reverts commit fe855ecf9aeacfa1b9ffcff3d43adb10908435e5.
* Add touchscreen toggle support
* Use finger glyph
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Implement non-uniform brightness step adjustments
Add logic for non-uniform step size adjustments based on current brightness level.
* Ensure percentages are moved in a consistent manner so we don't get rounding errors
* Ensure we don't go below 1%
To prevent screen from turning off entirely on some models
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Migrated branding and help text color definitions to the new hexadecimal RRGGBB format in accordance with the latest Limine specifications. This update also introduces the interface_help_colour_bright parameter to ensure consistent visual aesthetics during the auto-boot sequence.
For the time being, a green palette has been implemented to maintain the traditional visual identity of Omarchy.
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix: read files from symlink directory in background selector menu
* safely parse the path to avoid option injection
* Simply use -L flag with find to resolve symlinks
Detect the internal monitor name dynamically at runtime instead of
hardcoding eDP-1 in a static toggle conf file. Uses the same pattern
as omarchy-hyprland-monitor-internal-mirror.
Fixes#5443
* Don't use the names here since they break the all-themes setup in omarchy-nvim
* Fix refresh-config when target directory is missing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add check for active external monitors before disabling internal display
Co-authored-by: Copilot <copilot@github.com>
* Revert "Add check for active external monitors before disabling internal display"
This reverts commit e20b3da87e3df0f084c0bca232a61ba58fab4cdc.
* feat(hyprland): add toggle for internal monitor mirroring
- Implement `omarchy-hyprland-monitor-internal-mirror` to dynamically mirror the internal eDP display to external monitor.
- Update `omarchy-hyprland-monitor-internal` to prevent disabling the laptop screen if mirroring is currently active.
- Add "Mirror Display" toggle to omarchy hardware Menu
* Ensure there is also a laptop monitor available to mirror before we do it
* Fix toggle use
* Recover from mirror mode gracefully
* Add hotkey to mirroring
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* add generation of colors.toml via alacritty.toml
* Shorter command name
* Fix perms
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Adds dosfstools to default installs and migrates existing systems so fsck.fat and mkfs.fat are available for Omarchy’s FAT32 /boot partition. This also helps with recovery from dirty or corrupt FAT filesystems after unclean shutdowns or power loss.
* Don't use the names here since they break the all-themes setup in omarchy-nvim
* Pin Omarchy npx wrappers to matching node+npx binaries
* Fix npx wrappers when mise node is missing
* Pin npx wrappers to matching mise node runtime
* Isolate npx wrapper runtime from project PATH
* Clarify npx wrapper bin resolution
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
libfprint-git provides+conflicts libfprint, so pacman -S --noconfirm
defaults the conflict prompt to N and the install aborts. Pre-remove
libfprint with -Rdd; libfprint-git's provides=libfprint re-satisfies
fprintd's dep immediately after install.
replaces=(libfprint) on the OPR PKGBUILD was considered and rejected:
it does not affect direct -S installs (only -Syu repo scans), and on a
published package it would silently swap libfprint for libfprint-git
on every -Syu including machines with no FocalTech sensor.
Verified on B9406CAA non-interactively; fprintd-list and fprintd-verify
continue to work against existing enrollments.
Follow-up to #5454.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The B9406CAA ships with a Focal Tech FT9349 ESS sensor on USB 2808:a97a.
Mainline libfprint at 1.94.x lacks the open-source focaltech_moc driver
entirely; the driver is in libfprint master under LGPL but no upstream
release has shipped with PID 0xa97a in id_table[]. OPR carries
libfprint-git with both the driver and the PID patch.
Inline detection in omarchy-setup-fingerprint via /sys/bus/usb so we
don't introduce a one-off hardware-match script just for this case.
The check is cheap and runs only when the user opts into fingerprint
setup (lazy install pattern). Once upstream libfprint catches up, the
extra branch becomes harmless because libfprint-git provides=libfprint.
Tested end-to-end on B9406CAA: fprintd-enroll completes, fprintd-verify
matches enrolled fingers and rejects others, survives suspend/resume.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Fix disable-while-typing on ASUS ROG Flow Z13 detachable keyboard
* Replace lsusb with DMI detection for Z13 keyboard
* Use omarchy-hw-match instead of custom z13_present function
* Add ASUS ExpertBook B9406 display and touchpad fixes for Panther Lake
* Drop B9406 migration
Per DHH's review: the migration's audience is essentially nobody.
Anyone running Omarchy on B9406 today is doing so via nomodeset
manually at every boot, not via a working unmodified install. Fresh
installs after this PR ships will pick up the fixes through the
hardware-match install hook; no migration needed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Omarchy 3.5.1 shipped hardware-specific mic mute handling for Dell XPS
(bin/omarchy-cmd-mic-mute-xps) which made the original PR #4938 approach
obsolete — that PR added a global omarchy-cmd-mic-mute that handled the
toggle inline, but upstream now owns that dispatcher.
This follows the same pattern to add ThinkPad support by extending
omarchy-hw-match to also check product_family (ThinkPad systems report
"ThinkPad T14s Gen 2a" there, not in product_name) and adding
omarchy-cmd-mic-mute-thinkpad which uses brightnessctl to sync the
platform::micmute LED, simpler than the ALSA approach needed for XPS.
Note: as more vendors are added this per-vendor dispatcher will get
unwieldy. A future refactor could move hardware LED sync into
install/config/hardware/ scripts that drop a hook or config file,
keeping omarchy-cmd-mic-mute thin and vendor-agnostic.
pactl set-default-sink only updates PipeWire's default.audio.sink
metadata, but WirePlumber immediately overrides it back because
default.configured.audio.sink remains unchanged. wpctl set-default
updates both, making the switch actually persist.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Normalize screen recording audio
Screen recordings capture audio at whatever the system level is set to,
which often results in very quiet audio. Add a post-processing step that
normalizes audio to -14 LUFS using ffmpeg loudnorm after the first-frame
trim. Video is copied without re-encoding. Silently skipped for
recordings with no audio track.
* Do both trimming and normalizing in a single step so we don't have to process the video twice
* Simplify conditional
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
chromium/brave --refresh-platform-policy blocks forever when the
browser is not already running, hanging omarchy-update entirely.
Guard both calls with pgrep so the policy file is still written
(picked up on next launch) but the blocking refresh is skipped.
Closes#4772
omarchy-refresh-hyprland overwrites input.conf with the default
template, which has kb_layout and kb_variant commented out. Non-US
users lose their keyboard layout with no obvious recovery path.
Re-run detect-keyboard-layout.sh after the refresh so the system
layout from /etc/vconsole.conf is re-applied, matching what the
initial install does.
Closes#2507
* feat: add touchpad toggle keybinding and script
Binds XF86TouchpadToggle/On/Off to a new leenium-toggle-touchpad script
that enables/disables the touchpad via hyprctl and shows OSD feedback.
* fix: make XF86TouchpadOn/Off enforce state instead of toggling
Add on/off/toggle argument support to omarchy-toggle-touchpad.
XF86TouchpadOn now always enables and XF86TouchpadOff always disables,
so firmware that emits separate On/Off keysyms behaves correctly regardless
of current state. XF86TouchpadToggle retains the invert behavior.
* feat: add touchpad toggle to menu and persist state as hyprland config
- Show touchpad option in toggle menu only when a touchpad/trackpad device is detected
- Replace /tmp state file with a persistent hyprland device config at
~/.local/state/omarchy/toggles/hypr/touchpad-disabled.conf
* fix: avoid unsafe && || toggle logic for Touchpad state
Replace `[[ -f $STATE_CONF ]] && enable || disable` with an explicit if/else.
The previous logic was not a true ternary: if `enable` failed (e.g. OSD command error),
`disable` would run unintentionally, causing unreliable toggle behavior.
* Clean up orphaned voxtype status processes on exit
Waybar's custom/voxtype module runs omarchy-voxtype-status, which spawns
a long-lived `voxtype status --follow` child. When Waybar reloads (config
change, display hotplug, Hyprland reload), it kills the wrapper but the
child survives as an orphan. Over time dozens accumulate.
`trap 'kill 0' EXIT` signals the entire process group when the wrapper
exits, ensuring the voxtype child is cleaned up.
* Explain purpose of trap
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add keybindings to cycle through monitors
* Unified language around focus
* Group focus keybindings
* More natural sounding
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Pauses MPRIS media players when recording starts so music
doesn't bleed into dictation. Adds the setting to the default
config for new installs and a migration for existing users.
* Migrate existing waybar configs to pin battery to BAT0
Follow-up to #4918: that PR updated the default template, but
existing users keep their copy at ~/.config/waybar/config.jsonc
and won't pick up the fix without running omarchy-refresh-waybar
(which wipes local customizations). Patch the existing file in
place and restart waybar.
* Make battery-pin migration tolerant of whitespace variants
Per Copilot review: grep/sed patterns now match "battery" : {,
"battery":{, and "bat" : "..." variants that hand-edited configs
may use. Also only restart waybar when a battery block actually
exists to edit.
* Disable PSR1 on XPS IPS and OLED. IPS uses PSR2
* Improve conditional flow
* Simplify the migration logic
* We don't actually need this
We are using += everywhere
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Don't use the names here since they break the all-themes setup in omarchy-nvim
* Fix AC power udev rules to use systemd-run
* Migrate AC power udev rules to systemd-run
* Add --collect and stable unit names to systemd-run udev rules
* Add unit name, replace, and After ordering to power profile udev rules
* Remove invalid --replace flag from systemd-run power profile rules
* We don't need --replace becuase it's not needed
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Redirect stderr to /dev/null alongside stdout when refreshing
browser platform policy, preventing shared_memory_switch errors
from cluttering the terminal.
* If on XPS, enable XPS mute mic key with LED and fallback to original mic mute flow
* fix hardcode of alsa card 0 to resolved id
* Extract omarchy-hyprland-monitor-focused
* Extract dedicated xps mute script
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Create pictures dir if non existent
* Simplify
Don't need to guard against mkdir failing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add migration for tuned fan curve on existing T2 installs
* Make sure it's clear to all what migration is being run (even if it doesn't apply to them)
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Enable GPU support in Voxtype installation if Vulkan is available
* Restart Voxtype and Waybar after enabling GPU support in setup
* fix: revert changing existing migration
* fix: add new migration
* Refactor Vulkan availability check in voxtype installation and migration scripts
* Extract vulkan availability check
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Detect Intel BE200/BE211 WiFi cards and disable WiFi 7 (EHT) via
modprobe config. The iwlwifi driver has broken EHT RX adaptation
causing APs to drop to MCS 0, making WiFi unusable.
Falling back to WiFi 6 (HE) restores full performance.
Temporary fix: remove when Intel fixes the firmware/driver.
Signed-off-by: Spencer Bull <Spencer.Bull@Dell.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Some users may choose to disable notification timeout for normal-level
notifications to ensure no notifications are missed when the user is
away from the screen. However, there are several Omarchy notifications
that only serve as an immediate feedback for a user action, such as
"Screensaver enabled" or "Editing config file foo.conf", for which
disabling the timeout is not desirable. This commit drops the urgency
level for such notification to low, allowing configuring a different
timeout value for them.
Notifications with an explicitly set timeout are excluded from this
commit.
The whole git history of the omarchy repository is not required to, for example, run omarchy-reinstall.
If needed, additional history can be fetched manually
The hook prevents gvfsd-fuse from blocking suspend, not just
hibernation. Install it during the config phase so every system
gets it, not only those that run hibernation setup.
/proc/mounts uses octal escaping for special characters (e.g. \040 for
spaces). Decode with printf before passing to fusermount so paths with
spaces are handled correctly.
Add disown after backgrounding the gvfs restart so it survives
systemd-sleep's cgroup cleanup when the hook script exits.
The post-sleep hook runs before systemd thaws user.slice, so a
synchronous systemctl --user restart hangs for ~90 seconds waiting
for the frozen user manager to respond — blocking the entire resume.
Background the restart with a short delay so it executes after
user.slice is thawed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
cp -p preserves the original user ownership from ~/.local/share/omarchy,
which would allow an unprivileged user to modify a script that runs as
root during suspend/hibernate.
gvfsd-fuse is spawned by gvfsd during init and not respawned if it
dies. After lazy-unmounting in pre-sleep, restart gvfs-daemon.service
in post-sleep so the FUSE mount at /run/user/*/gvfs is restored.
Some find windows like "find everywhere" has initial title that consists of a singular space. Update title matching expression to capture that case as well.
* Fix nvim transparency to preserve foreground colors
The old approach used `vim.api.nvim_set_hl(0, name, { bg = "none" })`
which replaces the entire highlight definition, wiping out foreground
and other attributes. This breaks snacks.nvim's GitHub integration
(gh_pr/gh_issue pickers) which reads the foreground color from Normal
and NormalFloat at module load time, gets nil, and crashes in
Snacks.util.blend().
The fix uses nvim_get_hl to fetch existing attributes first, removes
only bg, then sets the highlight back — preserving all other attributes.
* Drop fallback that reintroduces the highlight-wiping bug
If nvim_get_hl fails for a group, skip it rather than falling back to
the old { bg = "none" } approach that clears all attributes.
* Use tmux native method of renaming windows
This uses tmux's built in method of renaming windows, and it even works
with pane switching rather than relying on cd to change the window name
* Update config/tmux/tmux.conf
I agree with the copilot suggestion
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Jadon Brutcher <jadon.brutcher@deltamobile.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Use lmstudio-bin in the AI install menu so installs and reinstalls stay on the current LM Studio package stream instead of reverting to legacy lmstudio.
The White theme's vscode.json specified "White Omarchy" as the theme
name, but the Bjarne.white-theme extension registers the theme as
"White". This mismatch caused omarchy-theme-set-vscode to set
workbench.colorTheme to a non-existent theme name.
`try init` defines a shell function named `try`. On subsequent
`source ~/.bashrc`, `try init` calls the function (interactive
selector) instead of the binary. Adding `command` bypasses the
function and always calls the binary.
Fixes#4876
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The Realtek ALC285 defaults to capture switch off. With
api.alsa.soft-mixer enabled, PipeWire no longer manages the hardware
mixer, so the switch stays off and the internal mic records silence.
Adding `unmute` to the amixer set command ensures the hardware capture
path is enabled.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
It's more broadly compatible with older hardware which is otherwise left
in a bad/confusing situation where nothing works. And it's easy to
switch to Ghostty for those where it works.
Look up device.id first for Bluetooth friendly names, falling back to
object.id for non-Bluetooth devices. Also fix conditionals to use [[ ]].
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Support single-key keyboard backlight cycling (like Asus F4) and add keyboard specific OSD icon
* We don't need an alias
---------
Co-authored-by: Ryan Latimer <ryan@example.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Simplified battery percentage retrieval command
Simplified the battery percentage extraction command.
* Used int instead of adding 0, put exit back in
Changed to use int.
Put exit back in to only return first battery in case of systems with multiple batteries.
* Add full OSC 52 support to Alacritty configuration
* Simplify OSC 52 support addition in Alacritty config
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
The try command detects shell type from $SHELL variable. When bash is
launched from fish, $SHELL is still set to /usr/bin/fish, causing try
to output fish syntax which fails in bash with syntax errors.
Explicitly set SHELL=/bin/bash for the try init call to ensure correct
shell detection.
* UPDATE: select background method
* ADD: migration file for background selector
* Add symlink for background selector in walker-elephant.sh
Forgot about this file. Should be added to make sure the background selector feature available in the fresh install
* clean up the code a bit
Updated omarchy background selector to hide from provider list and removed subtext from entries.
* Make the background selector the default
* Fix migration
* FIX: typo on background symlink target
* UPDATE: add ~/.config/omarchy/backgrounds/theme.name
* UPDATE: Cache = false
* Fix escaping for all extensions
* Extract omarchy-theme-bg-set
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Instead of choosing exclusively between the official or user theme
directory, copy the official theme first, then overlay any user
customizations on top. This allows users to override specific files
(e.g. colors, backgrounds, keyboard backlight) without having to
duplicate the entire theme.
Maintainer keys might have been added/revoked, let's ensure that we have
the latest before updating the packages, otherwise users might have to
do this manually.
Fixes https://github.com/basecamp/omarchy/issues/4608
* disable opencode auto-update feature as we rely on pacman
* Refreshing already produces a .bak, so that's enough
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
- Unifies screenshot to a single shortcut
- Provides easy override for screenshot editor of choice via env var or
flag
- Edit screenshots via clicking the notification
- Screenshots are copied to clipboard + saved by default
* Add Tmux
Being able to use a unified terminal setup between local and remote
hosts has some real advantages.
* Renaming is more important than reloading
* Self-explanatory, really
* Add alias for it
* Attach to last used session or start a new if we have none
* Just stick to n/p
* Make it a clean 10x
* We don't need this
* Keep similar fixes together
* Keep bindings together
* Hate looking at that 0
* Add way to refresh theme from its templates (when they've changed)
* Fix
* Enable Synaptics InterTouch for confirmed touchpads if not already loaded
* fix echo message
* remove shebang and echo messages
* check for synaptics intertouch and enable it only if available
This adds the `--force` option to `fwupdmgr refresh` so that this script will not exit, due to `set -e`, when `fwupdmgr refresh` exits non-zero due to the metadata being up-to-date, i.e.,
```
Metadata is up to date; use --force to refresh again.
```
Another option would be to use `|| true` but that might hide a legitimate error.
This was motivated when I cancelled a run of this script and then later invoked it again, via Update > Firmware, and it would not run `sudo fwupdmgr update` because `fwupdmgr refresh` was exiting non-zero with the above metadata up-to-date "error".
- Add omarchy-install-nordvpn script that:
- Installs nordvpn-bin from AUR
- Enables nordvpnd daemon
- Adds user to nordvpn group
- Optionally installs NordVPN GUI with TUI entry
- Detects existing GUI installation to avoid conflicts
- Add NordVPN option to Install > Service menu with icon
* feat: Open Nautilus (files) in cwd of terminal using omarchy-cmd-termina-cwd
* feat: Add SUPER+ALT+SHIFT+F shortcut to open nautilus in cwd
* added migration script for nautilus keybind
The steam class for opacity is missing the `.*` regular expression. Just `steam` does not match launched steam apps. Therefore, currently, steam apps have the default opacity of `0.97` of omarchy. This is usually not noticable, but very distracting on an OLED Screen and Games with dark/black scenes / menues and a brigher / any app opend 'behind' the game.
* Set Power Profiles Rules when plugged in (balanced) and unplugged (power-saver)"
* Check for battery presence before installing power profile rules
* Add battery presence check script and update powerprofilesctl rules
* fix indentation
* Simplify power profile rule creation logic
If it is not run as a sub-shell, using open and then subsequently closing the app will pollute the existing terminal with messages like:
[1] 287915
[1]+ Done xdg-open "$@" > /dev/null 2>&1
Making it a subshell removes this noise and keeps it more like the open command in macOS.
* Replace yq with pure bash for TOML parsing
The yq-based parsing only worked with jq/yq v3 and broke with go-yq v4.
This change removes the yq and uses bash for parsing. Some additional improvments:
- Handles single and double quoted values
- Strips inline comments (e.g. "#hex" #comment)
* Remove the no-longer-needed yq packages
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add missing icons to Development remove menus
The Install > Development menu shows icons for each language, but the
Remove > Development menu was missing them (only Ruby on Rails had its
icon). This adds the matching icons to:
- show_remove_development_menu
- show_remove_javascript_menu
- show_remove_php_menu
- show_remove_elixir_menu
---------
Co-authored-by: incpo <nixusnekit>
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
* Toggle hybrid GPU mode via supergfxctl
Very useful for Asus G14 and other laptops with NVIDIA + AMD iGPU
combos.
* Use correct exit
* Simplify
* Wording
* Revise switching process
* Spacing
* These are sudo actions
* Make it exe
* No need for extensions
Matches existing style
* Relying on the new config should be enough since we are restarting anyway
* Prevent race condition
* Reminder to add to OPR
For Bluetooth audio devices, the friendly name (e.g., "Shawn's AirPods Max")
is stored on the Device entry in wpctl, not the Sink entry. The previous fix
looked up object.id (the sink), which shows the raw bluez ID like
"bluez_output.90:9C:4A:EE:01:1C".
This fix looks up device.id first to get the friendly name from the Device
entry, falling back to object.id for non-Bluetooth devices.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add --webcam-device argument to omarchy-cmd-screenrecord
- Auto-detect first available webcam if none specified
- Add webcam selection UI in omarchy-menu when multiple cameras available
- Skip selection UI when only one webcam is detected
When a kernel upgrade is taken in, we replace current modules with new
ones and they are not available until we reboot. This can cause the
system to appear broken, especially when plugging new hardwaare like a
pen drive or odd input device.
This patch adds kernel-modules-hook which keeps the current modules even
if the package is replaced. A one-off clean-up service runs on startup
to remove older modules.
The current 5-second sleep is not enough for all hardware. On my PC (and
likely many others), Windows takes longer to initialize. If the script
tries to connect via RDP before Windows is fully ready, the connection
fails or hangs.
I replaced the fixed sleep with a dynamic loop that checks the Docker
logs for the "Windows started successfully" message. This ensures the
RDP client only starts once Windows has confirmed it's ready, making the
launch process much more reliable across different hardware specs.
Fixes#2599
* Replace yq with pure bash for TOML parsing
The yq-based parsing only worked with jq/yq v3 and broke with go-yq v4.
This change removes the yq and uses bash for parsing. Some additional improvments:
- Handles single and double quoted values
- Strips inline comments (e.g. "#hex" #comment)
* Remove the no-longer-needed yq packages
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
The sed expression for converting scrolltouchpad syntax to Hyprland 0.53
format was broken across two lines, causing the second substitution
pattern to fail silently. Split into separate sed commands to ensure
both class:(pattern) and class:pattern formats are migrated correctly.
Redirect hyprctl output in exit_screensaver() to prevent SIGABRT crash
when the screensaver window is closed externally (via keybind or lock screen).
The crash occurs because hyprctl's std::println() throws when writing to
a broken stdout after the terminal is killed.
Voxtype v0.4.9 adds a --no-post-install flag that suppresses the
"Next steps" instructions after downloading the model. Since Omarchy
handles systemd setup, hotkey configuration, and displays its own
success notification, these generic instructions are redundant and
potentially confusing to users.
The flag still shows download progress, just suppresses the
post-download instructions.
* Add option to enable/disable hibernation
* Actually do it
* Match hibernation toggle words
* Both enable and disable
* Match the tense
* Match options
* Remove excess CR
* Try with voxtype
* Update delay to prevent skipped characters
* Add removal of voxtype
* Use -bin package
* Fix for yay
* Nerdicons!
* Use new, subtle nerdfont glyphs instead of standard icons
* Do this in the waybar config instead
* Make voxtype a permanent fixture so it is not lost on waybar resets
* Record purpose
* Add Dictation hotkeys
* Tweak wording and point to config
* Reuse the same help
* Better communication
* Anticipate moving the package to OPR
* Clarify where the packages are coming from
* input group not needed when using hyprland hotkey
* Explain hotkey off
* Allow for changing of the model on right click
* Allow config on right click
* Be more specific
* Focus on config editing with waybar clicks
---------
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
* Attempt to templaterize the theme specific files
* Cleanup
* Slim down
* Combine render into -set
* Pull out the dynamic template rendering again, but simpler
* Fix vars
* Variables are lowercase
* Better presentation
* Fix missing colors
* Provide stripped values too
* Fix colors for regular hex format
* Bring back explicit btop themes
They're too involved to derive from a basic color set
* Make an atomic swap of the theme directories
* No longer used by walker to cancel
* Explain why
* Remove redundant const
* Consistent const naming
* No longe have $THEMES_DIR
* Correct the blue
* Set opencode colors too
* Fix colors for readability
* Move the templates together with the others in default
* Split user themes and default themes
* Fix paths
* Look for both user themes and default themes
Plus speed things up
* Migrate to the new setup where default themes live inside omarchy
* Explicitly store the name of the current theme
* Cleanup
* No longer need omarchy-theme-next since themes are now fully rendered, not symlinks
* Get current theme name from the new theme.name file
* Look for user background images in dedicated directory
* Need yq for toml
* Need yq to parse colors.toml
* Look for backgrounds matching the new theme.name
We no longer have symlinks
* Migrate existing user backgrounds to the new proper location
* Install user backgrounds in the correct path
* Fix quoting
* Just rely on the system theme for opencode and get ready for USRSIG2 being available to live reload
* Fix template generation for rgb colors
* Add github-copilot-cli to the AI install menu
* Mark the copilot package as coming from AUR
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* fix: stop paging git diff output when running omarchy-update
* Keep option list similar between the two
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Also, move waybar-less information notifications to Super + Ctrl + Alt +
T/B to make room. These are very specialized and probably not broadly
used.
Closes#3909
Co-authored-by: @ddVital
This was done in a migration in 0588cc8e5b but the menu entry was never updated. So, installs after the migration will get the outdated version.
Added a new migration as well for those that installed after the
previous one.
Screensaver launch is broken when Walker is open: It will fail to go fullscreen and exits right after input read's first iteration, due to the screensaver_in_focus() check. See https://github.com/basecamp/omarchy/issues/2992 for an example report.
This addition will silently quit an opened Walker menu before launching the screensaver terminal. It is mildly intrusive, alas, as a return from screensaver will not present the pre-screensaver state exactly.
The following options are no longer recognized by Kitty and caused warnings during startup:
window_padding_height
show_window_resize_notification
single_instance
They have been removed to keep the configuration compatible with current Kitty versions.
Updated the `omarchy-cmd-screensaver` script to allow screensaver effects to run independently on each monitor in multi-display configurations.
Previously, the effect loop waited for all animations on all monitors to finish before starting the next effect. With this change, each monitor handles its own effect cycle independently, improving smoothness and responsiveness in multi-monitor setups.
Turns out there are control codes for tracking mouse actions in xterm-compatible terminal emulators (mind blown).
This patch adds mouse action awareness to our beloved screensaver setup:
- on setup it sends the respective control codes for movement and click detection
- in the main loop it opens up the input reader to read raw bytes and, thus, enable to detect even so much as a mouse's squeak
Personally, I love swiping my trackpad to exit screensaver. But the explicit pressing-a-key to exit is nice, also.
And I don't know if many people have jitter issues with their mouses or trackpads. Reckon, if they had they wouldn't get to see the glory that TTE is anyway, ever :)
This is tested and working in Ghostty. Sorry for the low-effort testing.
* feat: silently move active window to target workspace
Adds a quality-of-life keybind:
SUPER + ALT + SHIFT + [1-9, 0]
This silently moves the active window from the active workspace to the
chosen destination workspace. The destination workspace re-tiles
correctly upon receiving the window.
The currently active workspace remains active, and the moved window
retains focus throughout the operation (no workspace switch, no
animation, no extra UI noise).
Why:
- Provides fast, silent window reshuffling during multitasking.
- Avoids disruptive workspace switching.
- Matches Omarchy’s focus on efficient Hyprland ergonomics.
- Keeps the user anchored to their current workflow while reorganizing.
Testing:
1. Open multiple windows across several workspaces.
2. Focus a window on the active workspace.
3. Press SUPER + ALT + [1–9, 0].
4. Verify the window appears on the target workspace and re-tiles.
5. Confirm the **source workspace stays active**.
6. Confirm **focus remains on the moved window**.
7. Repeat with multiple applications and workspace combinations.
* We've frozen this old tiling config
* Put on Super + Shift + Alt
This is an alternative version of an existing move
* Fix description
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update version
* feat: show link to changelog in update confirm window
* Link to scrollable changelog
You may be updating more than one version at the time.
---------
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Exec=$TERMINAL the omarchy-tui-remove wont find newly created TUI-Apps. This fixes it and ensures backwards compability.
Co-authored-by: Gerrit Dolderer <gerrit.dolderer@hey.com>
* feat: fullscreen for ghostty/kitty screensaver
* feat: add ghostty screensaver config
* Remove the extra two bottom lines as well
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Use desktop portal capture option which allows capturing monitors
connected to external gpus (common on laptops with dedicated gpus)
and supports capturing properly when hdr is enabled.
Desktop portal capture allows selecting capture of a window, monitor
or screen region.
Add -fallback-cpu-encoding yes to use cpu encoding if the system
doesn't support gpu encoding. Ideally omarchy should install vaapi
drivers which would fix this issue for most users, but some users
have a gpu that dont support gpu encoding at all so this option is still
needed.
Use pgrep with ^ as is done in waybar indicator screen-recording.sh
to only grep for gpu-screen-recorder program.
Update omarchy-menu to reflect not selecting region/display capture
and instead allow capturing only desktop audio or desktop + microphone
audio.
Fixes#3367 and #3303
* Update style.css
Fixes the uneven spacing between icons on waybar by updating styling.css with Propo font family.
However, Propo introduces a small issue as the volume icons don't have the same with. As a consequence, icons left of volume will move based on the displayed volume icon. To solve this, I added a non-Propo font to the pipewire module as well - this way the volume icons have fixed length but eats a bit into the spacing towards the CPU icon. But I see this as the best trade-off.
* Update waybar config.jsonc
* Update tray spacing in waybar config
* Modify margins in style.css
Adjusted margins for various elements.
* Update waybar css for even spacing
* Update Waybar config tray spacing
* Change expand-icon format character
* Adjust margin-right for custom-expand-icon
* added optional argument for floating a window
* added sample comment
* Style
* This file isn't meant to be changed so not a good place for commented out recommendations
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add theme Ethereal
* Update to follow the Omarchy hot reload
* Add aether to all themes
* Add a vscode theme
* Revert "Add aether to all themes"
This reverts commit 421f467e213150254ab10dbe09dd6382bf6c54eb.
* Format the kitty file
* Make available to all via migration
* Fix
* Add hot reload
* Change the background image to something of higher quality
This looks a lot better on a 6K monitor
* Highlight border color should be brighter than inactive color
* Add preview.png for new visual theme selector
* Add the ethereal nvim variant of aehter
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add a new theme called hackerman
* Update to follow the Omarchy hot reload
* Add high res wallpapers
* Add an initial vscode color scheme
* Excess CR
* Set the colorscheme name to aether
* Change the nvim plugin name back to aether
* Add hot reload
* Use a variant of aether
* Swap the starting background
* Add migration
* Add preview.png
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add bluetui integration and launch script
- Add omarchy-launch-bluetooth script to launch bluetui TUI
- Create migration scripts for bluetui installation
- Update omarchy-menu and waybar configuration for bluetui support
- Add bluetui to base packages
* Move unblock into launchers and reuse existing launch or focus setup
* Fix installer to remove blueberry and be more surgical with waybar changes
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add optional xpadneo driver prompt to Steam installer
Prompts users during Steam installation to optionally install the xpadneo driver, which fixes common Xbox/Bluetooth controller issues including detection problems and missing rumble support.
* Install xpadneo controller driver by default
* Add idempotency checks and relaunch state
* Remove Steam launch since relaunch required
* Extract xbox controller installer into separate step
* Bring back launch
* Force reinstall
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* improve: uniquely identify btop when launched from waybar.
* align btop app id
* add migration to uniquely identify btop
* also add unique app ids to lazydocker and terminal editor
* introduce new omarchy-launch-tui that sets class.
* align all the tuis and behaviour in waybar
* update migration accordingly
* fixes
* separate terminal from tui
* fix: double setsid uswm-app --
* Standardize namespace on org.omarchy and lowercase
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add new script for themes menu
* remove icons from the themes menu
* Make theme titles human readable and add spacing at the end
* Migrate to using a link for the new menu generator
* Retain consistent width
But we still do have movement when filtering the menu down to a
shorter-than-longest name. Should try to stabilize that.
* Update all previews to 2K resolution and same dimensions
* Update script to use first bg file if theme preview file doesn't exist
* Add padding to preview box instead of spaces to theme name
* Consistent formatting/indenting
* Prevent height jump
* Revert padding change and remove background color
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* hypr: Adding xdph token default of true
The `allow_token_by_default` configuration option under `screencopy` within
`xdg-dektop-portal-hyprland` (xdph) enables the "Allow restore token" checkbox
by default in the screen sharing section dialog. Enabling it to `true` ensures
the checkbox is pre-ticked, which can help avoid repeated selection prompts
during screen sharing sessions, such as those reported with Slack, Google Meet,
Zoom, etc. on Hyprland.
Signed-off-by: Larry Dewey <larry.j.dewey@gmail.com>
* Enable the XDPH config on existing installations
---------
Signed-off-by: Larry Dewey <larry.j.dewey@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
In basecamp@4c97a31, a migration was added to fix this option on
existing installs, but I think the default config was never updated with
the new option.
* Revert "improve: add image/video share and run share commands silently (#3330)"
This reverts commit 03cbbd2f7f.
* Refactor share menu to remove terminal command
* Fix: Jetbrains popup dialog would not get focus automatically
The config shipped with omarchy misbehaves with popups. Opening a popup
would not shift the focus automatically to it, requiring manual click on
it to start typing into it.
You can reproduce with by trying to open any popup dialog (for example
CTRL+T on Rider, or CTRL+SHIFT+F)
This config with `-Dawt.toolkit.name=WLToolkit` in the custom VM options
fixes all the issues I have with jetbrains. I am also making a dedicated
workspace which float all windows just for jetbrains.
* Use existing formatting conventions
* More tweaks
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* improve: add image/video share and run share commands silently
- Added 'image' and 'video' modes to omarchy-cmd-share to quickly send
the most recent screenshot or video without selecting manually.
- Updated show_share_menu to run share commands in the background using
'nohup' to avoid opening a terminal window.
- Comments added to explain each section for clarity and maintainability.
* Match names with folders
* Correct here too
* Don't need to keep this around
* Fix these up for what's needed only
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
AAC provides better cross-platform compatibility compared to Opus when
using MP4 containers. While Opus is supported in MP4, compatibility
varies across different media players and platforms.
In testing, screen recordings with Opus codec sent to Windows users
played without audio in Windows Media Player, while recordings with
AAC codec worked immediately without issues. AAC ensures recordings
are playable out-of-the-box across all platforms without requiring
users to install additional codecs or use alternative media players.
This additional bind lets the user follow the default action of a notification with a keystroke in the same position `,` as the other notification binds.
Replace hardcoded --class flag with xdg-terminal-exec --app-id to properly
support kitty and other terminals. This aligns with the rest of the codebase
and ensures floating window rules work correctly across different terminals.
Solves the issue from ae10133b5e the right
way using the actual xdg-terminal-exec package and provides resillient
fallbacks no matter what the user might do.
This also removes the need to restart after changing terminals at all.
fixes#2198fixes#2329fixes#2673fixes#1754
Because of [hardcoded terminals in
glib](https://gitlab.gnome.org/GNOME/glib/-/blob/main/gio/gdesktopappinfo.c#L2755)
the previous fix still doesn't work well with Alacritty and Kitty.
Using our `omarchy-launch-terminal` aliased to `xdg-terminal-exec` does
the trick and doesn't introduce any new dependencies or rely on a lib
that isn't stable.
* Apply Omarchy theme; Install Neovim extension (automatically scoops up LazyVim config).
* Just set the Omarchy theme
Removed installation of Neovim extension from script.
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* fix(jetbrains.conf): allow focus for Android Studio’s first dialog by unsetting nofocus rules for empty-title windows
* Refactor window rules for JetBrains apps
Updated window rules for JetBrains applications to allow focus and interaction with dialogs.
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Ghostty will only use the last `shell-integration-features` line found
in the config, so multiple options need to be presented as a
comma-separated list. Including them on separate lines meant that only
the `ssh-env` option was getting set, causing the `no-cursor` option to
be ignored. This prevented the cursor from going into the `block` style.
* Fix auto-generated everforest obsidian theme
* Update `--text-muted` and `--text-faint` to be readable against
background color
* Add contrast detection and color correction logic
* Remove dedicated Obsidian CSS file
* Add dedicated text color variables to obsidian theme generation
* Replace closest color logic with generated color for code bg in Obsidian
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* imv: add default Ctrl+P binding to print current image via CUPS
* Add imv config migration with backup
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add bindings for scratchpad support
This is great for hiding windows temporarily and bringing them up when
needed in an overlay, I'm using it to hide away my webcam control in
meetings. ;)
* Change shortcut to move window to scratchpad
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Some applications (e.g. Aether) use xdg-desktop-portal-gtk to open folder chooser dialogs titled "Choose Export Directory" or similar. These were not matched by the previous floating-window regex, causing them to tile instead of float.
This change expands the title regex to include "Choose …" patterns, ensuring these dialogs float and center properly in Hyprland
Derives the list of required modules for the installer from Chris
McLeod's manual installation steps. His instructions say to use the
surface-linux kernel however the default kernel has the right set
of modules already (as noted by the fact that the right modules are
loaded for the keyboard to work during the install and after the LUKS
unlock screen).
I only have a Surface Laptop 3 to test this on but based on the guide
where Chris is using a newer laptop and the only difference is the
pinctrl module which I attempt to autodetect I think it should "just"
work for others but definitely "use at your own risk".
* New window replaces the current fullscreen or maximized window
Currently if we are in fullscreen or full-width mode and either
start a new application OR
create a new window of an existing application. Like an incognito window
Then those new windows/apps start in the background. There is no indication that something new has been created.
IMHO, if I am opening an application then I want to switch to it. I cannot think of any common use case for having new applications open in the background.
This change will cause new application to replace current application as the fullscreen / fullwidth window
Please see docs: https://wiki.hypr.land/Configuring/Variables/#misc
Option:
new_window_takes_over_fullscreen
Desc:
if there is a fullscreen or maximized window, decide whether a new tiled window opened should replace it, stay behind or disable the fullscreen/maximized state. 0 - behind, 1 - takes over, 2 - unfullscreen/unmaxize [0/1/2]
Type:
int
Default:
0
* fix the setting name
* fix(hyprland): match Brave portal dialogs in floating-window rule
Brave on Wayland uses xdg-desktop-portal-gtk for permission and file dialogs.
These windows use website-based titles (e.g. "chatgpt.com wants to open")
instead of "Open File" or "Save File", so they were not matched by the
floating-window rule. This commit expands the title regex to include those
patterns, ensuring Brave dialogs float properly.
* Shrink scope
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Corrected a typo and fixed grammar in the comment regarding web app URLs. (changed hyperland to hyprland and fixed grammar in the same line)
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
adding /sound and /microphone to omarchy-windows-vm
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* fix: make RAM detection compatible with all locales (free output in any language)
* Look at total RAM, not just free
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
This seems niche, but you might like it. Binds Super + Ctrl + F to force-tile a fullscreen app. It works nice for things including running games in a tile or watching YouTube in a pip tile without needing to configure these apps specifically to do so.
Google Chrome reports itself as google-chrome in `hyprctl clients` but
the matching for the windowrule did not work, probably because since
hyprland 0.46.0 the regex matching needs to span the entire string.
This change makes "google-chrome" get recognized so that windows of that
browser receive the chromium-based-browser tag, which in turn provides
better opacity settings for Chrome windows. Since "chrome" was matched
by the regex before, this fix now should restore the originally intended
behavior for Google Chrome.
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update style.css
Fixes the uneven spacing between icons on waybar by updating styling.css with Propo font family.
However, Propo introduces a small issue as the volume icons don't have the same with. As a consequence, icons left of volume will move based on the displayed volume icon. To solve this, I added a non-Propo font to the pipewire module as well - this way the volume icons have fixed length but eats a bit into the spacing towards the CPU icon. But I see this as the best trade-off.
* Update waybar config.jsonc
* Update tray spacing in waybar config
* Modify margins in style.css
Adjusted margins for various elements.
* Update waybar css for even spacing
* Update Waybar config tray spacing
* feat: obsidian theme to tie into Omarchy theme
* better color matching for search result matches
* feat: simplify install flow
* Removed install/remove scripts and flow
* First `omarchy-theme-set-obsidian` run will look for vaults in
Documents and Dropbox folders and add them to
`/.local/state/omarchy/obsidian-vaults`
* Point of this is such that we assume a couple locations to look for
vaults but allow people to add vaults to the file for custom locations.
Subsequent theme-set invocations aren't impacted by find/search on large
systems
* Each `omarchy-theme-set` invocation will install the themes on all
found/registered vaults if missing and update the live theme
* Added an option of `omarchy-theme-set-obsidian --reset` to wipe out
themes in registered vaults and remove the registry file. This would be
the option to re-run to the automatic vault registration.
* Added migration to trigger install immediately in Obisdian, note that
you still need to pick Omarchy theme.
* Add smart snapshot selection
* Add wayfreeze
* Update to only include current workspace in rectangles
* Fix if there are no windows on screen
* Add option to sidestep slurp and copy straight to clipboard
* Update capture menu
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* adding TUI for starting up windows VM
* updating to use docker-compose
* adding possibility to set windows product-key
* ram and cpu settings
* first time run notes
* add two needed pacman packages
* key and package install
* Revert "add two needed pacman packages"
This reverts commit 04dc96cee0d3e37103b9866d9140ba47133db7ad.
* add install and remove scripts
* install icon
* rename scripts and menu to Windows VM
* rename also launch script to windows vm
* update nameing
* remove quotes
* fix paramter and quiting after installation
* fix launch script
* update
* certificate acceptance and remove of desktop app
* move desktop app
* rename app from "Windows VM" to "Windows"
* add example of sharing local share with Windows
* merge 'dev' into windows-docker-vm
* exchange rdesktop with freerdc
* accept certificates automatically so user don't fail first try
* remove certi during normal launch (handled in install process)
* remove volumes and orphans to have clean state (avoids hang on login)
* /cert option still needed
* Simplify package installs
* Fix icon + desktop to prevent creation on initial install
* omarchy-windows-vm in working form
* Don't need this anymore
* Fix commands
* Always use uwsm-app
* We are generating it instead
* Make omarchy-pkg-add quiet when the packages are already there
* Improve the questionnaire
* Show where you change resource usage
* Add default Windows share
---------
Co-authored-by: sspaeti <simon@ssp.sh>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Improve theme-set-vscode to support jsonc and respect symlinks (#1756)
* Ghostty needs a very different scrollfactor than Alacritty and Kitty
cc @mitchellh
* Hide hyperland cursor while typing (#1812)
* Fix Matte Black theme ghostty and vscode configs (#1801)
* Update Matte Black ghostty.conf with more color settings
* Rename theme from 'MatteBlack' to 'Matte Black'
* Catch obsidian vault dialog too
* Add Update > Hardware > Audio for restarting pipewire service
* Give output on what's intended to happen
* Ensure libyaml is available for installs made before that was on the ISO
* Limit pattern to prevent incorrect matches
* fix: ghostty config typos
* No longer used
Closes#1815
* Revert "Ensure libyaml is available for installs made before that was on the ISO"
This reverts commit ad01082a86.
* Add Helium browser to supported browsers list in omarchy-launch-webapp
* Fix Helium browser detection in launch script
* feat: Added MacBook10,1 to the fix-apple-spi-keyboard.sh
* Suggest how to have a smaller-than-max-width single window aspect ratio
* Add more Mac models to SPI keyboard support
Added:
MacBook 8,1
MacBook 9,1
MacBook 8,1 uses slightly different moduels from what I can tell, so I’ve added a case statment. Please tweak as needed.
* Fix conflict + rearrange
* Added fix for ealy 2013 macbook pro's using an older chipset, BCM4331
* Tried with a different approach for cleaner code
* Clean up
Tested the logic on the MacBook. It worked and the install of the
drivers are reenabled.
* Combine ifs
* Update install script name
* Fix for '(null)' display on AirPod source selection
* Use output display or region geometry to record
The previous code did not identify the output display correctly,
leading to wf-recorder asking the user to select the region when the
user requested the display output to be selected.
With this change the bash script will use slurp with the -o flag to
identify the display output.
This has not been tested with wl-screenrec as no change has been made to
its call signature in omarchy-cmd-screenrecord and the wl-screenrec
binary is not included in the default omarchy installation.
* Fix TUI install script
- $TERMINAL should remain variable
* Add migration to fix Docker and Disk Usage TUIs
* Replace "--class" with "--class="
* Revert "Fix for '(null)' display on AirPod source selection"
* Typo
* Fix comment
* Change up firewall setup
* Enable ufw
* Disable ufw-docker (isolation test)
* Add some reboot on done debugging
* Debug firewall install/config
* Add first-run logging
* Don't suppress output from apparently-failing systemctl reboot command
* Fix logging
* Use old reboot. Still chrooted so probably won't work.
* Allow systemctl on first run
* Revert logging and other changes
---------
Co-authored-by: Omar Skalli <omar.skalli7@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Johan Sørensen <johan@johansorensen.com>
Co-authored-by: Taha <paprikataha@gmail.com>
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
Co-authored-by: Che-Wei Lin <linton.tw@gmail.com>
Co-authored-by: Patrick Byrne <pby.software@byrne.dk>
Co-authored-by: Eduardo Mínguez <e.minguez@gmail.com>
Co-authored-by: Joel Gaff, Jr <joelga@hey.com>
Co-authored-by: Michael Larsen <michaelarsen@gmail.com>
Co-authored-by: Shawn Yeager <shawn@shawnyeager.com>
Co-authored-by: observable <hello@observable.art>
Co-authored-by: Djordje Kovacevic <djordjek65@gmail.com>
* fix: prevent Chromium crash when moving windows between monitors
Adds --disable-features=WaylandWpColorManagerV1 to Chromium and Brave
flag configs to prevent crashes when moving windows between monitors or
workspaces on Hyprland. This is a workaround for a Chromium/Wayland
color management conflict.
Upstream Chromium fix exists but won't reach stable for ~a month. This
provides a temporary bridge until the fix lands in stable releases.
Fixes#2384
Refs #2184
Refs: https://github.com/hyprwm/Hyprland/issues/11957
Refs: https://github.com/hyprwm/Hyprland/discussions/11961
Refs: https://issues.chromium.org/issues/40263183
Refs: https://chromium-review.googlesource.com/c/chromium/src/+/7003036
* Add migration to update existing Chromium/Brave configs with crash fix
Adds migration script to append --disable-features=WaylandWpColorManagerV1
to existing users' chromium-flags.conf and brave-flags.conf files.
The script:
- Checks if config files exist before attempting to modify them
- Uses grep to verify the flag isn't already present
- Only adds the flag and explanatory comment if needed
- Handles both Chromium and Brave configurations
This ensures existing Omarchy users get the Hyprland crash workaround
without needing to manually update their configs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix warnings and make conditional explicit
---------
Co-authored-by: Derek Castillo <d-cas@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
When we call `omarchy-launch-walker` with `-w`, we get the following
error.
echo -e $'Adwaita Mono\nBerkeley Mono\nBerkeley Mono Variable\nCaskaydiaMono Nerd Font\nCaskaydiaMono Nerd Font Mono\niA Writer Mono S\nIosevka Fixed\nJetBrainsMono Nerd Font\nJetBrainsMono Nerd Font Mono\nJetBrainsMonoNL Nerd Font\nJetBrainsMonoNL Nerd Font Mono\nLiberation Mono\nNimbus Mono PS' | omarchy-launch-walker --dmenu --width 295 --minheight 1 --maxheight 600 -p Font… -w 350 -c 3
Error parsing option -w
Instead, we now pass `--width`, to properly override the default
`--width 295` for fonts.
Closes: https://github.com/basecamp/omarchy/issues/2404
Signed-off-by: Luke Hsiao <luke@hsiao.dev>
* alacritty.toml wity proper bg and fg
background = "#1e1e2e"
foreground = "#cdd6f4"
are the proper colors for terminal bg and fg when themeing with Catppuccin
* Update alacritty.toml with proper Catppuccin Mocha colors
* vscode.json to use Proper Catppuccin Mocha
* Add firmware update script and include in update process
* typo
* type 2
* add sudo
* Add firmware update option to update menu
* Remove firmware update command from update process
* Lazy-install firmware updater
* Move option down and change icon
* Only lazy install if missing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix placeholder position and adjust fail text on lock screen
* Expand input field to fully fit fingerprint authentication failure message
* Better explain what's happening
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* fix: remove theme-flag
* migration: walker 1.0.0-beta
* Fixups
* Add elephant and walker
* Update for new layout.xml
* Clean up some styling
* add unicode and todo providers
* remove default quick activate keybinds
* Update keybinds and remove defaults to prevent conflict
* Fix menu option
* Fixes
* Remove
* Update height
* Add elephant service
* Remove from hyprland
* Restart service now
* Trim
* Update height
* Fix keybindings style
* Fix install location
* Add walker restart
* Fix indention
* Fix indention
* Fix indention
* Fix indention
* Advance to present
* Need to refresh to bring over the new config
* style adjustments
* Correct the installation of the 1pw policy installer
* Skip the prebuilt for a second while we test
* Need libyaml to build ruby
* No longer needed, gcc-15 compatibility has been added
* Let's just stick to the official path
* GCC15 compatibility for Ruby has been achieved
* No longer necessary
The other mise option is set on Ruby on Rails install
* Added ZLS - Zig's Language Server when installing Zig (#1718)
* style adjustments
* styling changes
* add only_search_title
* css adjustments to fix broken styles
* Be tall again
* Remove for future variable height menu
* Update height / width params
* fix: remove theme-flag
* Fix spacing..again
* Remove service and add launch util
* Fix
* fix: wrong emojis flag
* remove flag, its dmenu only
* set min content width to prevent flickering if the item list contains shorter items
* Remove unused service
* Megakill needed
* Remove any old themes too
* Remove min-width
* Style adjustments
* changes for walker/elephant updates
* Match current width
* Add a little more space between icon and text
* fix: bluetooth find bind
* remove archlinux provider, fix migration with missing providers
* fix: css import
* Fix theme path
* fix: add new error label to layout
* Fix migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
Co-authored-by: DoKoB0512 <123281216+DoKoB0512@users.noreply.github.com>
* Change DM to SDDM
* Move to custom named UKI
* Skip creation on Mac
* Add entry to make sure VSCode uses gnome keyring
* Fix order for UKI generation
* Limine only
* BTRFS only
* Add checks for possible issues
* Remove
* Add verification to omarchy-pkg-add and speed up installs
* Use omarchy-pkg-add
* Update files to include dirs
* Fix relaunch
* use helix instead of hx in omarchy-launch-editor
fixes#1739
* add both hx and helix
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Prevent false positives when another window title contains 'Obsidian'.
The helper script matches with a case-insensitive regex against class+title,
so anchoring to '^obsidian$' ensures we only target the Obsidian window class.
Before: SUPER+O could focus a YouTube webapp/FreeTube titled 'Obsidian is great!'.
After: SUPER+O focuses Obsidian or launches it if not running.
* Configure grouping functionality
* Change google message shortcut to CTRL + SUPER, fix typo
* Standardize all group hotkeys around SUPER ALT
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix comment
* Use systemd-resolved's stub resolver
On first run, symlink systemd-resolved's resolver into /etc/resolv.conf
Matches migration 1754984623
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Move common mako settings to `core.ini`
* Use monospace font, set font size in px
* Increase line height
* Adjust paddings
* Add 10px width so the Welcome notification fits on one line
* Remove extra whitespace
* Remove extra whitespace, adjust wording
* Improve text-to-bg contrast in Tokyo Night
* Follow the system font
* Use sans-serif font
* Restore width and extra space characters
* Adjust vertical paddings
* Remove `omarchy-restart-mako` (no longer needed)
* fix: change uwsm app to uwsm-app for performance
* Do not run uwsm-app in parallel as it's not supported
* Fix comment
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
This resolves the issue where extra arguments like Chromium's --profile-directory were ignored when launching a web app via omarchy-launch-or-focus-webapp.
The script now uses 'shift' to isolate the window pattern ($1) and passes all remaining arguments ($@), which include the URL and flags, to the omarchy-launch-webapp function.
Closes#1977
* Imitating VSCode omarchy-theme-set
* Changed VSCode theme setter take arguments to Cursor theme setter could call it.
* All omarchy commands are in path
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: @adelplace
* Fix comment
* fix(presentation-terminal): Ensure consistent ASCII logo alignment
The presentation terminal's ASCII logo, displayed by 'omarchy-show-logo',
would misalign if the user had a non-default font size set in their
global Alacritty configuration.
This change fixes the issue by explicitly setting the font size to 9
for this specific terminal instance using the flag.
This approach guarantees correct rendering of the logo without overriding
the user's personal font preferences for their regular terminal sessions.
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix comment
* added gnome-disk-utility next to nautilus in install/omarchy-base-packages
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Change DM to SDDM
* Move to custom named UKI
* Skip creation on Mac
* Add entry to make sure VSCode uses gnome keyring
* Fix order for UKI generation
* Limine only
* BTRFS only
* Add MVP variant of nvim switcher
* Update nvim configs
* Remove config
* Add migration for the new live themeing
* Fix plugin
* Remove theme
* Update to actually work
* Make it faster
* Fix quirks
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Added:
MacBook 8,1
MacBook 9,1
MacBook 8,1 uses slightly different moduels from what I can tell, so I’ve added a case statment. Please tweak as needed.
The previous code did not identify the output display correctly,
leading to wf-recorder asking the user to select the region when the
user requested the display output to be selected.
With this change the bash script will use slurp with the -o flag to
identify the display output.
This has not been tested with wl-screenrec as no change has been made to
its call signature in omarchy-cmd-screenrecord and the wl-screenrec
binary is not included in the default omarchy installation.
* Install libyaml before attempting to install ruby
* Use omarchy helper
And unsafe -Sy
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add 1Password extension policy configuration for Chromium and Brave
- Added policy files in config/chromium/policies/managed/ and config/brave/policies/managed/
- Created migration to copy policies to system directories /etc/chromium and /etc/brave
* I don't want to push it into existing installations at the moment
We just leave it for new installs
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Themeing for ghostty
* Fix theme name
* Set font for ghostty too if its on the system
* Use correct class for ghostty styling
* Uniformity
* Need to keep this alacritty until we have it fully working for other terminals
* Stick to alacritty so we can control font size
* Stick with alacritty for system terminals
* Add menu to install different terminal
* Use taha approved colors
* update to use $TERMINAL instead of alacitty
* revert
* move env to hyprconfig
* Only set if we have alacritty
* Add launcher for wifi settings so it can be used in mako config
* Set system terminal in config/uwsm/env to ensure its available everywhere
* Ensure that $TERMINAL is available after update
* Didn't work to have the TERMINAL env in Hyprland
* Configure terminal settings against a full set of options
* Make About usable with any terminal
* One more alacritty-specific setting
* Use the new wifi launcher bin
* Only require the update/relaunch if TERMINAL isn't already set in config/uwsm/env
* More alacritty usage converted to $TERMINAL
* Use new launcher
* Change scrolltouchpad input rule to apply to all terminals
* Its a singular match
* Take current font from waybar, in case we don't have alacritty
* Only set font for alacritty if its being used
* Get ready to be terminal agnostic on the refresh of config too
* Use new launcher
* Note the last reliance we have on alacritty
* Make theme setting for terminals generic and include kitty
* Set font_family for kitty as well
* Quiet grep
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
The branch message had an incomplete ANSI escape sequence that was
cutting off the first character and breaking the display formatting.
Before: \eUsing branch: master (displayed as 'sing branch: master')
After: \e[32mUsing branch: master\e[0m (displayed as 'Using branch: master' in green)
This fix ensures the complete message is displayed with proper green coloring.
* exit if screensaver not in focus
* Extract explaining function
* Consistent function style
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* add themes from https://github.com/eza-community/eza-themes
* init eza theme during install
* add migration
* refactor migration script to only link eza theme if it exists for current theme
* only link to eza theme if current theme supports it
* only link to eza theme if current theme supports it
* Cleanup
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Automatically change VS Code theme along with Omarchy themes
* Create a way to skip vscode auto-theming
* Make theme setting resilient to different states of the settings.json
* Improve setting and removing theme and notify when waiting on install
* Explain what we're doing
* Extract dedicated bin for vscode theme change
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* add: omarchy-cmd-share-files script
* add: call script from main menu
* add: hyprland binding for sharing files
* fix: dispatcher syntax
* fix: make script executable
* fix: script name on main menu
* fix: show share menu call
* fix: dispatcher order
* fix: script call via shorcut
* fix: share shortcut and share class for alacritty
* add parameters to share files, folders and clipboard content
* do not clean tmp files in clipboard mode
* make tmp file txts for clipboard sharing
* add menu options for folder and clipboard sharing
* rename script
* shortcut opens walker share menu
* fix spacing in share menu
* fix: share menu calls
* Files with spaces in the path were breaking 'send' action
* Add Trigger menu to house capture/share/toggle
* Style
* Fix going straight to share menu on Ctrl + Super + S
* Combine
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Copy current URL to clipboard with browser extension
In Omarchy web apps it's impossible to get the curent URL to share it in
another applications. This commit adds a browser extension which is
included by default via the chromium-flags.conf config. With this
extension you can get the current URL via a keyboard shortcut.
The default shortcut for getting the current URL is `Ctrl+Shift+L`, this
shortcut can be changed via this page: chrome://extensions/shortcuts.
* Change the shortcut to Alt+Shift+L
In my testing and research I found out that not all shortcuts
are available as suggested_key. We still want to use L because
that's easy to remember because we associate it with the location bar.
* Improve notification language
* Move it to just Alt + L since that's not used
Better mirrors Ctrl + L as well
* Move this under default/chromium
* Fix symlink
* It didn't like Alt+L alone after all
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add focus or launch script
* Replace eval with exec
* Use eval so it properly expands the variables
* Apply to the apps where it makes most sense
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* First swing at t2 support
* Remove unnecessary enables
* Trim up
* Trim
* Need to use official mirror until we have our own setup
* Use GitHub mirror for now
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add Chrome and Brave browser policy support for theme colors
Replace chromium --set-theme-color commands with managed policies
- Add RGB to hex conversion function
- Create /etc/chromium/policies/managed/color.json for Chrome
- Create /etc/brave/policies/managed/color.json for Brave
- Remove deprecated chromium command line theme setting
* force reload
* remove sudo
* renamed flag due to code review on google side
* Add the required directories
* Cleanup
* Slim down
* Unnecessary
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update waybar config with proper sized mute icon
Update waybar config with proper sized mute icon - same size as the two volume indicators. Current mute icon is smaller.
* Update config.jsonc
* Feed the image folder to the Image Viewer so the next/previous image navigation works
When double clicking an image in Nautilus, my expectation is that I can navigate to the other images in the folder with the arrow keys.
This doesn't happen currently because the imv command receives only the filename as a parameter.
However, if we use:
`imv -n /myfolder/image.jpg /myfolder`
works becasue we're opening the folder starting at the image given by the -n parameter.
* add migration for imv.desktop update
* Simplify migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Support for exec and mime types. Zoom integration
In order to better support webapp zoom:
- Added optional params for omarchy-webapp-install
- exec, defaults to omarchy-launch-webapp
- mimetypes, defaults blank
- added zoom webapp launcher that parses meeting links and transforms
them and calls launch webapp to join meeting links
- migration to convert existing zoom installs to the new custom
handler
- updated the base installer to call new zoom handler and set
mimetypes
* default should be in the else
* Add new line at end of file
* Missed new line on migration
* Updated conditionals to be a little more clean
* This is a rare setup so let's just save it for the direct CLI
* Use new bash conditionals
* Rename to fit under the existing namespace of cmds
* Fix after merge
* Use new syntax and add missing segment comments
* Cleanup a bit
* Use local icon for zoom with migration
* Fix regexp
* Refer to raw local icon references
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Create ~/Work with ./bin in the path for contained projects
* Split out the mise work setup as its own configurator
* Fixup the migration to reuse config logic
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* macbook: enable internal keyboard at LUKS by loading applespi in initramfs
- Detect T1 models (MacBookPro13,2/13,3 and 14,2/14,3)
- Add mkinitcpio drop-in: MODULES+=(applespi intel_lpss_pci spi_pxa2xx_platform)
- Add HOOKS+=(keyboard) for early input
- Prefer in-kernel applespi; fallback to DKMS via AUR helper if needed
* macbook: expand SPI keyboard support to include 12-inch MacBook
- Add support for MacBook12,1 (12-inch MacBook 2015-2017) with SPI keyboards
- Rename configuration from T1-specific to SPI-keyboard-specific terminology
- Update mkinitcpio drop-in filename: omarchy-macbook-t1.conf -> omarchy-macbook-spi.conf
- Clarify that this fix targets SPI keyboard interface, not just T1 chip models
- Improved detection: covers all models with SPI keyboards needing applespi
- Update comments and messages to reflect broader hardware support scope
* Integrate MacBook SPI keyboard detection into limine-snapper.sh
- Move MacBook detection from separate hardware script into limine-snapper.sh
- Add comprehensive error handling with systemd journal logging
- Ensure persistent MacBook SPI module loading for every boot
- Remove redundant separate macbook-keyboard.sh file
- Consolidate terminal and log output using tee with process substitution
* Add support for MacbookPro13,1 and 14,1 models
* change log tags
from “omarchy” to “macbook” which is more appropriate.
* Slim down and rearrange code
* Unrelated change
* More specific naming and make sure its actually run
---------
Co-authored-by: Ryan Hughes <1630358+ryanrhughes@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Change lazyvim and asdcontrol to packages
* Remove asdcontrol and lazyvim
* Add lazyvim setup
* Don't trigger rebuild. We already rebuild later.
* Add new pacman.conf after install
* Update config to keep mirrors in mirrorlist
* Add lazyvim setup back
* Make webapp installer work with local images
* Update tuis to work offline
* Update pacman config situation
* Extract the reboot segment into its own file
* Explainer
* Can't return in executed scripts
* Add post-install
* Extract the reboot segment into its own file
* Fix rebase doubling up
* Add run wrapper function for feedback
* Redirect output to log
* Move gnome updates to first-run
* Add theme to first-run
* Updat to try to get logging working
* Create the file and give permissions
* Test gsettings
* Revert "Test gsettings"
This reverts commit 49c27d319407f6c95fcbb4c5a2646e54b50c9ab4.
* Stop logging
* Add time outputs to end of logs
* Rearrange some scripts to cleanup
* Cleanup
* Add timing to run script
* Don't enable multilib for offline
* Add prebuild ruby
* Try spinner setup
* Prevent exit 1 due to grep not matching
* Update limine config to work for USB installs as well
* Add offline install to env report
* Fix grep pipefailure
* Update logs exports to work with subshells
* Fix backward logic
* Attempt to fix logging again
* Export chrootable for subshells
* Clean up outputs
* Move chrootable up
* Source chroot instead
* Changes for logging
* Center up reboot notice
* Update fixed paths
* Update trap
* Revert reverting precompiled ruby due to issues
* Revert "Revert reverting precompiled ruby due to issues"
This reverts commit c159e7dc51cfdd2fb750c49c66bc4468e1208446.
* Remove junk to cleanup fixed paths now that we have relative
* Add git branch check to transition beta to main
* Log output
* Add time output on summary screen
* We don't need sudo here
* Add ansi helpers to make code cleaner
* Add dry-run helpers for testing
* Split out some common / reused items
* Add log output function
* Use gum log to output cleaner
* Cleanup
* Update trap with options
* Fix reboot and pad it
* Cleanup
* Add dry-run for testing
* Use default $PADDING for gum
* More styles
* Styles and really exit
* Update to new format
* Add ansi vars
* Update log output to prevent flickering
* Fix logo exporting
* Trap updates
* Add exit handler
* Prevent double-trapping
* Update traps
* Consolidate logic
* Update reboot to work in chroot
* Eliminate double-guard
* Attempt to speed up by removing mkinitcpio hooks
* Add multilib for nvidia users
* Add back wireless-regdom
* Remove dryrun items
* Fix to be offline
* Set fonts for plymouth to solve freetype2 issue
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
* Update omarchy-refresh-plymouth to account for limine changes (#1575)
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update modes
* Remove direct executions of .sh files
* Add variable safety
* Add omarchy-upload-log
* Add broadcome fix for MBP
* Prevent printing on screen when rebooting
* Make packages list universal
* Rename
* Remove retry message
* Fix packages target
* Add system info to upload
* Update variable name
* Remove unnecessary executable statuses
* Remove gesture default
* Add bcm4360 fix to install
* Add useful debug info
* Add OMARCHY_PATH
* Only look locally offline
* Rename / rearrange files
* Export so they're available to subshells
* Update for alternate
* Rearrange
* Log install time if no arch
* Add limine to packages list
* Update comments
* Update sizing method
* Update mode switcher
* Move icons to be embedded in installer
* Set install mode to online
* shebang and sudo
* Remove deleted branch check
* Elim banners
* Elim verbosity
* Rename LOG_FILE
* Multilib on by default
* Flip to positive
* Switch to gnome-theme.sh for first run
* Elim ansi-codes helper
* Move guard up to be the first thing that's hit
* Extract a couple of functions
* Trim
* Trim
* Move back to trap
* Update to single gum file
* Just show total
* Pulled function to a helper
* Extract explaining function
* Use complete conditional flows where possible
* Reference variable close to its use
* Use modern bash conditional syntax
* Comment before function
* Use a simpler shared exit headline
Doesn't matter how we stopped, just that we did
* CRs
* Keep constants together
* Style on comment
* Explain QR Code
* Modern bash conditional and use lowercase for all local variables
* Use bash calculation syntax for numbers
* Use calculation syntax where possible
* cleanup was not intention revealing enough imo
* Spacing
* Retry won't produce something different in offline mode
* Not needed
* Use modern bash conditional style
* String-wrapping not needed in [[ ]]
* Might as well use constants for all of these
* Don't need the wrapping
* Move the output saving into where we're working with it
* Not needed as long as we just source this
* Gum is a helper
* Slim down logging setup
* Reflect broader scope of work
* Everything should live in file
* Simpler
* Ordering
* Style
* Better separation of concerns
* Stop pretending these are meant to run directly
* Move all packaging execution together
* No longer used in an offline centric setup
* None of these are directly executable any more either
* Modern bash conditional
* Better name
* Explain what's going on
* Use modern bash conditional
* Use modern bash styule
* No need for bashing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: DoppioJP <jakub@doppio.jp>
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Set fonts for plymouth to solve freetype2 issue
* Fix typo in plymouth theme update message
Clarified the reason for the plymouth theme update.
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Set fonts for plymouth to solve freetype2 issue
* Fix typo in plymouth theme update message
Clarified the reason for the plymouth theme update.
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* init
* remove comment
format
* add pulse animation
* change to signals
* Move file to an internal location, match signal with what's being sent
* Need to sleep a second to ensure that the recording has either started or stopped before we render config
* Put it in a more prominent place
* Use OMARCHY_PATH
* Sharpen icons and add on-click to stop
* Drop animation but reserve space
* Lean entirely on waybar indicator rather than notification when starting
* Use an explaining function instead of comments
* Give time to ensure the process is dead before updating the indicator
* No longer needed
* Don't need to repeat the on-click
* Don't need a full second
* Naming
* SIRGTMIN shouldn't be here
* Don't need any of this that isn't seen or used
* Explain the sleep
* Mirror start/stop functions
* Go all-in on explaining functions
* Inline audio toggle
* Better just to move the clock rather than have it be permanently offset
* Fix all parameters and name them
* Add migration
* There is now a later omarchy-refresh-waybar offer
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* fix: implement proper hierarchical menu navigation
Add intelligent exit behavior that respects menu hierarchy and direct access:
**Direct Access Behavior:**
- When menus are accessed via command line arguments or keybindings
- Pressing Escape/Cancel exits the application completely
- Example: `omarchy-menu theme` → Escape → exits completely
**Hierarchical Navigation:**
- When navigating through menu system (Main → Style → Theme)
- Pressing Escape/Cancel returns to parent menu
- Examples:
- Theme menu → Style menu (not main menu)
- Font menu → Style menu (not main menu)
- Power menu → Setup menu (not main menu)
- Update Process/Config menus → Update menu (not main menu)
**Implementation:**
- `DIRECT_ACCESS` global variable tracks access method
- `handle_exit(parent_menu)` provides consistent behavior
- Applied to theme, font, power, and update submenus
- Maintains backward compatibility for all existing navigation
* Naming and add to system menu too
* Naming
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add wireless-regdb alongside iwd
Needed for regulatory compliance for Wi-Fi and enabling some bands on some chipsets
* Add wireless-regdb
* Changed location of wireless-regdb install
* configure the wireless-regdom during install
* remove extra newline
* don't unset the variable too early
* also set the region as part of the script
* writing to wireless-regdom requires root
* need to use tee
* changing logic since this is brought in as source
* handle timezones that start with country code already
---------
Co-authored-by: Nirav Patel <eclecticc@users.noreply.github.com>
* install the needed packages for intel GPUs
* keep forgetting that this is included by source
---------
Co-authored-by: Nirav Patel <eclecticc@users.noreply.github.com>
* add visual feedback for super + mute
- show visual feedback (device name and volume icon) when super+mute is pressed
- avoid reassigning the sink when only one is available, since this prevents devices (e.g. headphones) from regaining audio after reconnect
* cleanup
* changes needed
* fix: remove hardcoded channel reference
* Added Clojure to the Development Omarchy Menu
also implemented it in omarchy-install-dev-env
* Update the icon to use the Clojure logo from Nerd Fonts
Thanks to @Sgierek106
* Use omarchy-pkg-add
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Empty DNS= and FallbackDNS= in resolved.conf were blocking VPN DNS
servers when VPN clients replaced /etc/resolv.conf.
Removing these empty values allows systemd-resolved to:
- Use DHCP DNS from network interfaces (existing behavior)
- Fall back to system defaults when needed
- Switch to 'foreign' mode for VPN DNS override
Fixes#1509
* Added a core.ini file for setting persistent notification settings
* migration
* remove: max-icon-size from core.ini
* rearranging mako files
* moving core.ini mako config inside omarchy
* added core.ini to migration
* We don't actually need this
Mako is already loaded. The new config will get picked up automatically
on next reboot.
* Don't change
* No change required here
---------
Co-authored-by: robert stringer <bitmap+github@gmail.com>
Co-authored-by: xz <xz>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
While working in a non-trivial feature, debugging support was needed.
Since Xdebug is the official PHP debugger, is available in Arch's
official repositories, and is trivial to configure, it makes sense to
include it in the PHP development environment.
This addition improves the overall development experience for PHP
developers by enabling easier inspection and troubleshooting.
With this PR, the debugger now shows up an enabled extension:
```
$ php -v
PHP 8.4.12 (cli) (built: Aug 27 2025 06:23:40) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.12, Copyright (c) Zend Technologies
with Xdebug v3.4.4, Copyright (c) 2002-2025, by Derick Rethans
```
I believe this is a sensible default for those that have keyboards with num pads. Whenever I want to enter a number I reach for the numpad, just to realize that numlock is off and it doesn't do what I expect it.
The cursor and text color in the ristretto alactritty theme config are currently the same. This change sets the cursor text color to match the background color. This should be the expected behavior.
I'm creating dotfiles that as soon as Omarchy is installed, allow me to
perform my own customizations to get the system up and running in no
time according to my own needs.
One of them for example runs:
~/.local/share/omarchy/bin/omarchy-install-dev-env laravel
However, something like that is not possible with the Docker databases
because it assumes interactivity via `gum`.
This PR fixes that by either taking the choices as arguments or
providing interactivity when that's not the case.
~/.local/share/omarchy/bin/omarchy-install-docker-dbs MySQL
I tried to install `Minecraft` through Omarchy's menu, however it fails
with the following error message:
error: target not found: minecraft-launcher
This occurs because, according to Arch's documentation, the package is
available through AUR rather than the official repositories.
Reference: https://wiki.archlinux.org/title/Minecraft#Installation
* Quick fix for lazyvim bufferline error when using catppuccin
* This is a slightly better fix
* Adding the fix in theme, actually messed up the theme colors
* Adding the migration file
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* install ollama from the official website
* installing ollama-cuda if nvidia-smi exists
* add check for rocminfo installation for AMD GPUs
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
As well as installing the `emacs-wayland` package, we enable and start
the `emacs` systemd service. A GUI Emacs client can then be started
using e.g. `emacsclient -c`.
* fix: symlinks to default icons to prevent text chevron fallbacks
* consistent symlink syntax
* Needs sudo and had extra quotes
* Add migration
* added gtk-update-icon-cache for symlinked files
* pkill any running Files windows
* Cleanup and ensure successful exit so as not to halt migrations
* Excess CR
---------
Co-authored-by: xz <xz>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: robert stringer <bitmap+github@gmail.com>
* Allow failed migrations to be skipped
Failed migrations can be now be skipped by a prompt. This means that if
a migration is "stuck" then a user can opt to store it in a separate
skipped directory. Skipped migrations will be considered for the
purposes of running the pending migrations, however in future, we can
allow the user to run their skipped migrations with a flag.
To allow the script to continue and prompt for failed migrations, the
`set -e` has been removed. A manual check on the exit code is used
instead.
* Cleanup implementation a bit
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* add gvfs-smb to packages
gvfs-smb and its dependencies (smbclient, samba, and cifs-utils) afford access to Samba servers in Nautilus/Files.
* Add migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix DNS migration to handle UseDNS=no in network files
Issue #1246: Migration 1755109182.sh only fixes resolved.conf but doesn't
remove UseDNS=no from network files. When UseDNS=no persists, it blocks
DHCP DNS and forces fallback to Cloudflare after reboot.
Fix: Remove UseDNS=no from all network files, matching omarchy-setup-dns DHCP behavior.
* Add new migration 1756491748.sh for existing users
Fixes DNS issue for users who already ran migration 1755109182.sh.
Removes UseDNS=no from network files to enable DHCP DNS.
* Apply requested changes
- Revert 1755109182.sh to original state
- Consolidate all fixes in new migration 1756491748.sh
- Follow migration style guidelines
* No using custom chromium.desktop any more
* Spacing
* Rely on $OMARCHY_PATH
* Add common pkg and cmd functions for use in migrations and elsewhere
* Simple pkg-adds
* Later migration does it
* Ensure running migrations on older installs have the new pkg/cmds available
* Spacing
* Use new abstractions
* Installed in later migration
* Needless comment
* Use new commands
* Fix package name from 'batt' to 'bat'
* Use ttf-jetbrains-mono-nerd font instead of the non-nerd variant.
* Update font installation script for JetBrains Mono
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Drop Chaotic AUR repo
Now that we have the AUR packages we need on the OPR, we don't need this
as a default.
* Fix escape issue and rename so it will run again
When running `laravel new`, if a starter kit like `React` or `Vue` are
selected, the installer will ask:
```
Would you like to run npm install and npm run build?
```
And in order for it to work, `npm` should be available.
Having this installed will definitively smooth out the experience from
install to up-and-running!
* Get rid of -Sy and -Syy
* Get rid of all naked -Sy usage
* Don't need a full system update for this
* Combine
* Does not need a full system update
* Need to refresh even just for Omarchy repository
* Does not warrant a full system update
* No longer need the sudoless pacman runs
* We have already added the Omarchy repo before getting to here
So fine to just do a straight install
* Don't update system packages to prevent issues from something too new at the wrong time
* Add system to pin and ignore bad packages
To deal with the abseil-cpp issue
* include more chromium browsers in chromium rules
* Use tag to avoid declaring the match twice
* Fix the match to actual browser class names as reported by hyprctl clients
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Replace Google DNS fallback with Quad9 (9.9.9.9, 149.112.112.112)
for better privacy consistency. Users choosing Cloudflare likely
value privacy, so Quad9 is a more appropriate fallback than Google.
As discussed in #752 and approved by @dhh in #1043.
Implements DHH's requirement to ensure wlan0 and ethernet interfaces
respect the DNS configuration while excluding docker/loop interfaces.
When using Cloudflare or Custom DNS:
- Sets UseDNS=no in DHCPv4 sections
- Sets UseDNS=no in IPv6AcceptRA sections
- Only configures primary interfaces (en*, eth*, wl*)
- Restarts both systemd-networkd and systemd-resolved
When using DHCP:
- Removes UseDNS=no to allow DHCP provided DNS
- Restores default behavior for all interfaces
Script size increased from 58 to 89 lines to properly handle all
network interfaces as requested.
* Add omarchy-setup-cloudflare-dns script
Addresses issue #745 by providing user choice for DNS configuration.
Features:
- Makes Cloudflare DNS opt-in instead of forced default
- Preserves local development environments with DHCP option
- Includes custom DNS configuration support
- Provides backup/restore functionality
- Follows Omarchy naming conventions
Fixes#745
* Address DHH feedback on DNS configuration script
Changes based on maintainer review:
- Rename script to omarchy-setup-dns (more generic name)
- Remove /usr/local/bin installation (use PATH instead)
- Add migration to reset automatic Cloudflare DNS to DHCP
- Force DNS on physical interfaces only using systemd-networkd
- Exclude docker/virtual interfaces from forced DNS
Fixes local development environment issues while making Cloudflare DNS opt-in.
* Use timestamped backups and remove restore function
Follow Omarchy backup standards by using timestamped backup files
instead of fixed names. Remove restore function since backups now
have unpredictable names - users can manually restore if needed.
This matches the pattern used in omarchy-refresh-config.
* Add DNS over TLS support for enhanced security
Enable opportunistic DNS over TLS when using Cloudflare DNS. This
encrypts DNS queries when possible while falling back to regular DNS
if TLS isn't available, providing security without breaking compatibility.
Thanks to the suggestion in #696 for highlighting this improvement.
* Add certificate validation for DNS over TLS
The DNS servers now include their proper hostnames for certificate
validation (cloudflare-dns.com and dns.google). This ensures we're
actually talking to the real DNS servers when using encrypted DNS,
not some imposter.
Completes the implementation suggested in #696.
* Prevent backup file accumulation
Clean up old backup files before creating new ones to prevent the
accumulation of .bak.* files over time. Keeps only the most recent
backup while maintaining the timestamped naming pattern.
This ensures the system doesn't get cluttered with countless backup
files from repeated script runs.
* Simplify DNS setup script per review feedback
Reduced script complexity from 227 to 58 lines while maintaining core functionality.
Removed unnecessary backup system and systemd-networkd configuration.
Kept essential features: Cloudflare DNS with TLS, DHCP mode, and custom DNS option.
Script now follows established Omarchy conventions for simplicity and size.
* Allow setup from omarchy-menu
* Integrate into Omarchy Menu
* Align parameter
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
This will allow us to change GitHub's default branch to `dev`, so that
PRs will target the correct branch by default, but new installations
will still default to using the stable `master` branch.
* Add Omarchy icon to waybar
* Add step to fonts.sh to install omarchy icon font
* Style and fixup
* Fixup installation of the omarchy font
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Abstract default browser to omarchy-browser (a wrapper)
* Fix the omarchy-browser command as it used to loop. Extract info from the browser .desktop files.
* Clean up and fix bugs
* Cleanup unused change
* Fix indentation
* Separate out omarchy-browser from omarchy-webapp so that we don't break webapps for browsers other than Chromium or Google Chrome.
* Fix incorrect function call
* Add a migration script
* Migration script fixes
* Simplify the browser and webapp commands. Rename commands to align with launch terminology.
* Add support for Microsoft Edge, Opera and Vivaldi
* Fix errors
* Remove --name and --class -- They're not respected when --app is defined
* We don't ship with Chrome
* Simplify launchers
* Use launch commands everywhere
---------
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
* Persist urgent notifications
* Create omarchy-snapshot
* Create snapshot before pulling
* Extract alternative bootloader configs
* Add limine-snapper config
* Fix check
* Update login scripts
* Make chroot friendly
* Extract cmdline instead of using blkid due to error
* Add restore command
* Export $TERMINAL so we get clickable restore notifications
* Remove sync -- causes errors...we have nothing to sync yet
* Executable
* Minor cleanup and compatibility for non-ISO
* Give login its own section
* Give no-arg guard and inline commands
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* feat: Add notification status indicator to waybar
Adds a visual indicator in the waybar to show when notifications are silenced (do-not-disturb mode).
- Shows a red dot when notifications are disabled
- Shows a dimmed dot when notifications are enabled
- Clicking the indicator toggles do-not-disturb mode
- Syncs with the existing SUPER+CTRL+, keyboard shortcut
This provides immediate visual feedback about notification status, making it easier for users to know when they've silenced notifications.
* feat: Convert to unified status cluster that only shows active states
- Only displays indicators when states are actually active
- Supports multiple status types: DND, night light, screen recording, idle lock
- Uses distinct symbols: • for DND, ◐ for night light, ● for recording, ◯ for idle lock
- Completely hides module when no states are active (no visual clutter)
- Extensible design for future status indicators
- Improved performance with better error handling
* Implement lightweight hybrid status monitoring
* Enhance notification status cluster with modular design
* Add waybar configuration for status cluster
* Add recording click handler and fix process detection
- Add wl-screenrec detection for non-nvidia systems
- Add click handler to start/stop recording
- Fix idle lock toggle functionality
* minor alignment tweaks
* improved recording detection to be more specific
* Rely on Omarchy bin in PATH and lower interval to feel more snappy
* Seperate out screencording stop so it doesn't start when trying to stop OBS
* Add migration to add the status notifications
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Include VerbosePkgLists for better pacman -Syu
* Add migration for the verbose package lists
* Amend comment
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add omarchy icon to fastfetch config
* Add migration file for fastfetch update
* Use consistent branding placement for spots you can change
* Allow editing the about icon
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add SUPER + MUTE for audio output switching
* Fix migration bc stupidness
* Simplify implementation and ensure the new sink is not muted
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Use power button to open omarchy-menu system
* Added migration script
* setsid so it doesn't exit with the terminal
* Spacing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix multi-package removal in omarchy-pkg-remove
The script already had multi-selection enabled with --multi flag,
but wasn't handling multiple selections correctly. When users
selected multiple packages with Tab, they wouldn't all get removed.
Fixed by using xargs to properly convert newline-separated package
names from fzf into individual arguments for yay.
Fixes#805
* Add multi-select explainer
* Fix multi install like we did for remove
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add safeguard to prevent omarchy-update from beginning an update during an AUR ddos
* Fix spacing
* Update omarchy-update
Return a non-zero error code when failing to reach AUR
* Add user-agent string
Good courtesy that makes it easier for the AUR folks to interpret the HEAD requests and tell us if there is an issue.
* Ensure entire icon will fit
* Migration to fit entire icon for update-available in waybar
* feat: add precise media control shortcut
* Fix a handful of typos
* Add state based app restarts for migrations (#637)
* Look for app restart state files and restart them after update
* Convert existing migrations to set states
* Revert "Convert existing migrations to set states"
This reverts commit 1eb8a56b075cab5652a028202dc9dc81e556c4dc.
* Fix waybar update icon spacing (#672)
* Fix waybar update icon spacing
Remove clock from margin rule and add custom-update to prevent horizontal cutoff and reduce excessive spacing between clock and update icon.
* making the update icon smaller, looks better in the center
* Fixed this in CSS instead
* We now have a global $OMARCHY_PATH
* Fix screen recording on Intel graphics (#669)
* Fix screen recording on Intel graphics
Use wf-recorder for Intel graphics instead of wl-screenrec due to VAAPI compatibility issues that prevent recording from starting.
* combining greps for nvidia and intel graphics
* Update omarchy-cmd-screenrecord
* Force working version of uwsm until we get the fixed one from upstream
* Split upgrading system packages into two steps
* uwsm was already fixed upstream with 0.23.2
* Add burst limit to login to prevent endless retries (#690)
* Fix kernel update detection for alternative kernel variants (#585)
* Fix omarchy-update kernel update message to support alternative kernel variants
* fix: omarchy-update-restart kernel update message to support alternative kernel variants
* Add elan to the keywords used to detect if a fingerprint reader exists (#692)
* fix pgrep and pkill (#687)
* Make a function to create a smaller webshare version
* Set sudo max tries to 10, binary for easy lockout reset (#686)
* set sudo max fail count to 10, bin for easy reset
* Slim down
Let the failure just fail in the shell
* Rename to be more descriptive
* No need for the 00- prefix
* Add migration to raise sudo try limit
---------
Co-authored-by: Manuel <manuel.ramsaier@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Install `gum` prior to the preflight guard (#684)
* Use `read` instead of `gum` in the preflight guard
* Revert "Use `read` instead of `gum` in the preflight guard"
This reverts commit 759dbb70454dccc27b78b198bf077e076750fefc.
* Install `gum`, if required, at the beginning of `install.sh`
* `gum` is already installed by the `presentation.sh` stage
* Use existing structure
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Always install `base-devel` in case `yay` needs to build a package (#710)
* chore: Enable Walker list cycling (#709)
Enable the `cycle` behaviour for Walker lists; this allows one to
quickly jump from the default-selected first item in a list, to the
last item, simply by pressing the "up" arrow key (or other key
sequence bound to "previous").
Refs: https://github.com/abenz1267/walker/wiki/Basic-Configuration
* Add one wallpaper for nord (#707)
* Use `pacman` instead of `yay` to install `gum` (#705)
* Direct access to Walker clipboard + emojis with hotkey
* Turn off the walker service until the memory leak is fixed
See https://github.com/basecamp/omarchy/issues/698
* Can't use clipboard module when Walker is not running as a service
See https://github.com/basecamp/omarchy/issues/698
* pacman needs sudo
* Add disable chaotic aur env flag (#746)
* Add missing modifier combinations to omarchy-menu-keybindings (#715)
While these aren't currently used directly in the Omarchy code, when the
user adds custom bindings they are not properly displayed by the
omarchy-menu-keybindings script.
Co-authored-by: Chris Miller <chris@diddado.com>
* Make this resilient to file already being removed
* Use omarchy-chromium-bin to give live theme changes
* Transcoding is really from any image format
* Include Brave in the same opacity treatment as chromium
* Only ask for the identification if it has not already been provided
* Need to make the new disk writeable too
* Stop using tte until package is fixed
* Use host's DNS resolver in Docker containers (#812)
* Symlink /etc/resolve.conf to systemd-resolved's stub
Since systemd-resolved is managing the DNS configuration, ensure that
/etc/resolv.conf uses it.
* Use systemd-resolved from Docker containers
* No longer needed now that we have .config/chromium-flags.conf
* Add brave-flags.conf as a new default to ensure that anyone using Brave as their browser runs it under wayland
* Must restart waybar when timezone is changed to have it reflect immediately
* Add migration for adding .config/brave-flags.conf
* Only do system package updates if there is a network connection
This prepares us for offline ISO install
* Catch both cases of brave-browser identification
* Skip pinta until we can resolve the certificate issue on manual build
cc @Torxed
* Add dust to reveal used space
Co-authored-by: @tobi
* Add minimal starship prompt to terminal
Co-authored-by: @tobi
* Always noconfirm
* If NOT starship, install it
* Add `--force` when enabling ufw to bypass prompt (#794)
* Add current theme to fastfetch config (#889)
* Turn off tte until the package is fixed
* Turn off auto-launching screensaver until tte is fixed
* Add current theme to fastfetch config
fastfetch has a module for displaying colors, which is often used by
default. It shows the current colors in use by the terminal. Given that
themes are core to Omarchy, I thought it made sense to show the current
theme in fastfetch. I've also added a compressed version of the palette
(similar to the circle config of the colors module).
* Add migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Don't fail in case chromium package is not there
In case another package has been used to provide chromium
* No prefix needed
* Lines up better with the new starship prompt
* fix: missing python-poetry-core make Omarchy install fail (#862)
* fix: missing python-poetry-core
* added migration
* Flesh out migration to fix all tte issues
* Turn TTE back on
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add color to install / remove to differentiate (#858)
* Add color to install / remove to differentiate
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Ensure Zoom is not made transparent
* Ensure the directory is present
* No double logo
* fix: add python-object to make installation of Omarchy work (#806)
* Explicitly add python-object to make powerprofile work
* added migration
* Explain the why, not the how
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Turn screensaver back on now that we have fixed the tte install
* Add migration to turn on screensaver again
* Even more minimal and theme matching
* Use italic instead of bold for git branch
* Minimal git status too
* Correct spacing
* Less aggressive untracked icon
* Consistent color before the >
* Stick to color
* Really just stick to one color everywhere
* Force the link
* Make resilient towards it already being the same file
* Offer install scripts a way to know if they're in chroot
* Different iwd needed on chroot install
* Address installation inside a chroot
* Can't reuse when needing to set for user
* Simplify
No other args
* Get the latest indexes if online
* Now available as an official package instead of AUR
* Add single server for mirrorlist for now
* Try a different mirror for testing and need to use pacman for pkg update before we have yay
* Use same shebang as everywhere
* Let it roll for testing
* Add debug to failure
* Force wifi to unblock when we go to set it up
Wifi can sometimes get turned off by computers when running on low power
or in some sleep modes
* Fix positive exit
* Put chroot provision into its own preflight
* Restore to the global mirror
* Clean up after ISO install without sudo
* Reduce ceremony -- a start and an end is enough
* If we installed from the installer, we should remind user to unplug USB
* Extra CR not needed
* Bring uwsm out of the doghouse
* Ensure latest uwsm is installed now that we have lifted the lock
* Fix JetBrains IDEs flickering and focus issues in Hyprland (#888)
* Fix JetBrains IDEs flickering and focus issues in Hyprland
Add window rules to prevent tooltip and tab dragging flickering issues
in JetBrains IDEs when running under Hyprland compositor.
* Fix JetBrains IDEs flickering and focus issues in Hyprland
Add window rules to prevent tooltip and tab dragging flickering issues
in JetBrains IDEs when running under Hyprland compositor.
Uses the new windowrule syntax (Hyprland v0.48.0+) instead of deprecated windowrulev2.
# Conflicts:
# default/hypr/apps/jetbrains.conf
* Fix JetBrains floating popup size issue in Hyprland
* Style
---------
Co-authored-by: Mike Veerman <mike@nonect.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Don't need wget, since curl is already part of arch
* This is still a problem
* Feature/screensaver toggle instead of launch (#784)
* sceensaver-toggle and run if enabled using state file
* replace commands in menu and hyperidle
* migration file
* sed corrections
* added backup of changed files in migration
* review comments implemented
* hypridle config restore
* Use normal path style
* Use nerdfont icon for notification
* Make executable
* Allow a force start of screensaver so it can run even when disabled when manually triggered
* Add screensaver to system menu now that the toggle actually means toggle
* Known path without expansion spaces
* It should be an error return when it doesn't start
---------
Co-authored-by: Manuel <manuel.ramsaier@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add 60 second inactivity timeout to Walker launcher (#701)
* Add 60 second timeout to Walker launcher
This will close the launcher after 60 seconds of inactivity.
* Update 1754929737.sh
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* adding mongodb docker install (#972)
* Add suggestion for eu keyboard layout for iso
Closes#937
Co-authored-by: @chriopter
* Add Super + Tab to go forward through workspaces and Super + Shift + Tab to go backwards
Co-authored-by: @rafaelbernard
Closes#652
* move import to bottom (#917)
* Add missing package for Intel Graphics Card based device (#910)
* Add missing package for Intel Graphics Card based device
* Add migration to add the missing package
* Fix USB autosuspend causing peripheral disconnection issues (#906)
* Fix USB autosuspend causing peripheral disconnection issues
Add configuration to disable USB autosuspend by setting usbcore.autosuspend=-1
in modprobe.d configuration. This prevents USB devices from being automatically
suspended which can cause keyboards, mice, and other peripherals to disconnect
unexpectedly.
* Add migration to apply autosuspend to existing systems
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* retry cmd on failed install should take into consideration bare mode (#904)
* retry cmd on failed install should take into consideration bare mode
* A little duplication beats too much indirection
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Switch from lazydocker-bin to lazydocker
It's now in the official repo as a compiled version!
* add reverse window cycling with cycleprev (#874)
* add reverse window cycling with cycleprev
* Include the bringactivetotop fix
---------
Co-authored-by: observable <x@observable.art>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Stop using SIGUSR1 with Waybar to prevent stacking
Closes#873
* Omarchy install - capture install log (#868)
* Omarchy install log
* Slim down the logging setup a bit, put it in a known directory, tell user about it
* Stick to what was
* Not needed here
* Prefer the duplication
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Allow customizing the screensaver logo (#863)
* check for custom screensaver logo or fall back to default
* move logo location to omarchy config folder
* fix missed location check
* add menu item to copy logo.txt and open in editor
* move to setup menu
* Just always use a user-editable screensaver.txt file
* No longer needed
* Be clearer
---------
Co-authored-by: Christopher Moore <cmoore@yozu.co.uk>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Visual improvements for pkg-install and pkg-remove (#852)
* Shorten it up a bit
* Extract precondition into its own file and use it for the package installer too
* But don't actually fail unless it is down!
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Michal Zaborowski <zaborowskimchl@gmail.com>
Co-authored-by: Richard Macklin <code@rmacklin.dev>
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
Co-authored-by: Alan Sikora <alansikora@gmail.com>
Co-authored-by: Eric Swanson <960576+ericrswanny@users.noreply.github.com>
Co-authored-by: not-NEK0 <86556080+not-NEK0@users.noreply.github.com>
Co-authored-by: Maximiliano Guzenski <maxguzenski@gmail.com>
Co-authored-by: Manuel <manuel.ramsaier89@gmail.com>
Co-authored-by: Manuel <manuel.ramsaier@gmail.com>
Co-authored-by: Dylan Bridgman <light@ether.org.za>
Co-authored-by: Simon Dawson <spdawson@gmail.com>
Co-authored-by: Swarnim <134050970+Swarnim114@users.noreply.github.com>
Co-authored-by: Bruce <hi+gh@bruceroettgers.eu>
Co-authored-by: Chris Miller <github@reaperville.com>
Co-authored-by: Chris Miller <chris@diddado.com>
Co-authored-by: Kevin McConnell <kevin.mcconnell@gmail.com>
Co-authored-by: Gary Rennie <gazler@gmail.com>
Co-authored-by: Shigeto Kumagai <shk@all.daynight.jp>
Co-authored-by: David Anderson <kataqatsi@gmail.com>
Co-authored-by: MikeVeerman <mike.veerman@gmail.com>
Co-authored-by: Mike Veerman <mike@nonect.com>
Co-authored-by: Rob Zolkos <rob@zolkos.com>
Co-authored-by: Valberto Enoc <valbertoenoc@gmail.com>
Co-authored-by: Saeed Vaziry <61919774+saeedvaziry@users.noreply.github.com>
Co-authored-by: Brosseau Valentin <c4software@gmail.com>
Co-authored-by: jw <jw@codasite.ai>
Co-authored-by: michaldziurowski <mdziurowski@gmail.com>
Co-authored-by: Observable Art <123117871+iamobservable@users.noreply.github.com>
Co-authored-by: observable <x@observable.art>
Co-authored-by: Chris24680 <moore12321@gmail.com>
Co-authored-by: Christopher Moore <cmoore@yozu.co.uk>
Co-authored-by: Luis Daniel Casais <71148501+rajayonin@users.noreply.github.com>
* check for custom screensaver logo or fall back to default
* move logo location to omarchy config folder
* fix missed location check
* add menu item to copy logo.txt and open in editor
* move to setup menu
* Just always use a user-editable screensaver.txt file
* No longer needed
* Be clearer
---------
Co-authored-by: Christopher Moore <cmoore@yozu.co.uk>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Omarchy install log
* Slim down the logging setup a bit, put it in a known directory, tell user about it
* Stick to what was
* Not needed here
* Prefer the duplication
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* retry cmd on failed install should take into consideration bare mode
* A little duplication beats too much indirection
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix USB autosuspend causing peripheral disconnection issues
Add configuration to disable USB autosuspend by setting usbcore.autosuspend=-1
in modprobe.d configuration. This prevents USB devices from being automatically
suspended which can cause keyboards, mice, and other peripherals to disconnect
unexpectedly.
* Add migration to apply autosuspend to existing systems
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add 60 second timeout to Walker launcher
This will close the launcher after 60 seconds of inactivity.
* Update 1754929737.sh
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* sceensaver-toggle and run if enabled using state file
* replace commands in menu and hyperidle
* migration file
* sed corrections
* added backup of changed files in migration
* review comments implemented
* hypridle config restore
* Use normal path style
* Use nerdfont icon for notification
* Make executable
* Allow a force start of screensaver so it can run even when disabled when manually triggered
* Add screensaver to system menu now that the toggle actually means toggle
* Known path without expansion spaces
* It should be an error return when it doesn't start
---------
Co-authored-by: Manuel <manuel.ramsaier@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix JetBrains IDEs flickering and focus issues in Hyprland
Add window rules to prevent tooltip and tab dragging flickering issues
in JetBrains IDEs when running under Hyprland compositor.
* Fix JetBrains IDEs flickering and focus issues in Hyprland
Add window rules to prevent tooltip and tab dragging flickering issues
in JetBrains IDEs when running under Hyprland compositor.
Uses the new windowrule syntax (Hyprland v0.48.0+) instead of deprecated windowrulev2.
# Conflicts:
# default/hypr/apps/jetbrains.conf
* Fix JetBrains floating popup size issue in Hyprland
* Style
---------
Co-authored-by: Mike Veerman <mike@nonect.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Explicitly add python-object to make powerprofile work
* added migration
* Explain the why, not the how
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* fix: missing python-poetry-core
* added migration
* Flesh out migration to fix all tte issues
* Turn TTE back on
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Turn off tte until the package is fixed
* Turn off auto-launching screensaver until tte is fixed
* Add current theme to fastfetch config
fastfetch has a module for displaying colors, which is often used by
default. It shows the current colors in use by the terminal. Given that
themes are core to Omarchy, I thought it made sense to show the current
theme in fastfetch. I've also added a compressed version of the palette
(similar to the circle config of the colors module).
* Add migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Symlink /etc/resolve.conf to systemd-resolved's stub
Since systemd-resolved is managing the DNS configuration, ensure that
/etc/resolv.conf uses it.
* Use systemd-resolved from Docker containers
While these aren't currently used directly in the Omarchy code, when the
user adds custom bindings they are not properly displayed by the
omarchy-menu-keybindings script.
Co-authored-by: Chris Miller <chris@diddado.com>
Enable the `cycle` behaviour for Walker lists; this allows one to
quickly jump from the default-selected first item in a list, to the
last item, simply by pressing the "up" arrow key (or other key
sequence bound to "previous").
Refs: https://github.com/abenz1267/walker/wiki/Basic-Configuration
* Use `read` instead of `gum` in the preflight guard
* Revert "Use `read` instead of `gum` in the preflight guard"
This reverts commit 759dbb70454dccc27b78b198bf077e076750fefc.
* Install `gum`, if required, at the beginning of `install.sh`
* `gum` is already installed by the `presentation.sh` stage
* Use existing structure
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* set sudo max fail count to 10, bin for easy reset
* Slim down
Let the failure just fail in the shell
* Rename to be more descriptive
* No need for the 00- prefix
* Add migration to raise sudo try limit
---------
Co-authored-by: Manuel <manuel.ramsaier@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Fix omarchy-update kernel update message to support alternative kernel variants
* fix: omarchy-update-restart kernel update message to support alternative kernel variants
* Fix screen recording on Intel graphics
Use wf-recorder for Intel graphics instead of wl-screenrec due to VAAPI compatibility issues that prevent recording from starting.
* combining greps for nvidia and intel graphics
* Update omarchy-cmd-screenrecord
* Fix waybar update icon spacing
Remove clock from margin rule and add custom-update to prevent horizontal cutoff and reduce excessive spacing between clock and update icon.
* making the update icon smaller, looks better in the center
* Look for app restart state files and restart them after update
* Convert existing migrations to set states
* Revert "Convert existing migrations to set states"
This reverts commit 1eb8a56b075cab5652a028202dc9dc81e556c4dc.
* omarchy-version alias
* instead of alias, created command omarchy-version
* remove previously added alias, use omarchy-version command, instead
* set OMARCHY_PATH in the script
* updated OMARCHY_PATH
* Fix missing default PHP extensions to create laravel Project
* iconv is required for Symfony project
* Add PHP only installation
* Add PHP only option in the menu
* Extract logic to avoid adding composer in the path multiple times and add Symfony
* Add missing usage
* Use the official script to install Symfony installer
* Use AUR package
* Move PHP and Composer install in function to avoid duplication.
* Add explicit usage for symfony-cli
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Added Zig because it uses "mise use" install so very easy to add-in
My first ever commit woohoo!
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add omarchy to system path
* Remove unnecessary duplicate
* Remove path def since it's global now
* Migration for system-wide path
* Remove debug code
* Refresh after update
* Add common state script
* Restart on state detected
* Set state instead
* Export own path for menu
* instead of alias, created command omarchy-version
* Revert "instead of alias, created command omarchy-version"
This reverts commit 87e45db6d54a3441c7d544a2d054f2823bce271e.
wrong commit to dev
* Fix font size of About so it will stay in similar size
* Add OCaml
Add OCaml according to https://ocaml.org/install#linux_mac_bsd
I included also the development environment (LSP and some tools) as I figured this would be actually omakase but I can also remove it if we want to keep it clean.
* small fix
* better pkg manager with shotcuts
* removed ctrl-d, it conflict with terminal
* reveal keybinds to user
* We don't need yayf any more now we have full integration in Omarchy menu
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* add sceensaver alacritty config file and changed screensaver cmd
* Move the screensaver config into defaults
Since its not meant to be user edited
---------
Co-authored-by: Manu <manuel.ramsaier@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add Osaka Jade Theme
* Use jpg for bg for lower size with no quality difference
---------
Co-authored-by: Justin Lowry <j.lowry@hey.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Add Osaka Jade Theme
* Use jpg for bg for lower size with no quality difference
---------
Co-authored-by: Justin Lowry <j.lowry@hey.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* fix: Use dynamic bindings list in omarchy-menu-keybindings
We can use `hyprctl binds` to get a dynamic list of the currently-set
key bindings. This allows for a custom user configuration that is
split into arbitrary config files, and which makes use of `unbind` to
remove default Omarchy key bindings.
* chore: Support optional description for key bindings
If the description is present, use it in the key
bindings menu, instead of displaying some version
of the dispatched command.
* chore: Add some key binding description strings
* install hyprsunset when installing other hypr packages
* add hyprsunset to autostart
* add default hyprsunset config to make it do nothing by default
* waybar: add hyprsunset shortcut next to bluetooth shortcut to quickly toggle blue light filtering
* waybar: fix icon switching for hyprsunset widget
* add migration for hyprsunset
* waybar: rename "Blue Light Filter" to "Nightlight"
* waybar: make nightlight module appear next to bluetooth module
* waybar: do not include nightlight module by default
* add omarchy-toggle-nightlight script
* add default keybinding for toggling hyprsunset nightlight (SUPER + CTRL + N)
* waybar: remove nightlight module from config entirely
* waybar: remove nightlight from css
* update hyprsunset migration to skip yay install if already installed
* omarchy-toggle-nightlight: use `omarchy-restart-waybar` script instead of pkill with -SIG
* omarchy-toggle-nightlight: only restart waybar if nightlight is in the waybar config
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Create omarchy-cmd-restart-waybar
* Replace -SIGUSR2 waybar instances
* Add migration
* Add or statment in case waybar is dead
* Just use omarchy-restart-waybar
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Opacity for indicators of empty waybar workspaces
Adds opacity to the workspace indicators on waybar, if the workspace is empty. Makes the indicator appear dimmer to make it easier to find empty workspaces. Purely cosmetic UI tweak.
* Bump up opacity to be easier to read on light themes
* Add migration
* Apply grep to something!
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update migration that looks for prefix with '.' as it matches the other prefixes in the file. Also mod walker prefix to use double quotes for consistency to match the others.
* Rename fixed migration to ensure it runs again for all users
* Update location of sourced install script
* Add OMARCHY_PATH for easy access
* Formatting
* Enable using finder in walker (#396)
* Enable using finder in walker
* capitalize name property
* Hot reload theme for quick switching
* Use fonts from AUR instead of downloading them directly like an animal
* Include the common JetBrains substitution
* Add a very basic font selector for terminal
* Give the new font selector a bit of room to breathe
* Swap Spotify GUI to TUI
* Correct package name
* Add theme update script (#391)
* Move updating themes from Updates to theme menu
Yeah, it could go in either spot, but since we have one entire category
dedicated to themes, lets keep it there.
* Revert "Correct package name"
This reverts commit 4c46c2208a.
* Revert "Swap Spotify GUI to TUI"
This reverts commit b09d2d68cd.
* Added backup timestamps to various omarchy-refresh-* files to prevent clobbering (#402)
* Added backup timestamps to omarchy-refresh-[hyprlock|swayosd|walker|waybar] scripts to prevent data loss if ran multiple times
* Added new script (omarchy-refresh-config) for refreshing various config files with automated backup creation
* update plymouth logo (#406)
* Track migrations via state files to avoid running migrations that have already been performed. (#411)
* Just use set -e instead of manually checking for return values
* Fix migration
* Unused
* Migrate fonts to packages
* No longer needed
* Use fd for better performance on walker finder
* Add walker config refresh to enable the finder
* Dropbox is now an optional setup
---------
Co-authored-by: Shigeto Kumagai <shk@all.daynight.jp>
Co-authored-by: Mohamedsayhii <63726183+Mohamedsayhii@users.noreply.github.com>
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
Co-authored-by: Andy Davis <developer.andy@gmail.com>
Co-authored-by: Taha <paprikataha@gmail.com>
* Added backup timestamps to omarchy-refresh-[hyprlock|swayosd|walker|waybar] scripts to prevent data loss if ran multiple times
* Added new script (omarchy-refresh-config) for refreshing various config files with automated backup creation
Update fzf completion source path from /usr/share/bash-completion/completions/fzf
to /usr/share/fzf/completion.bash to match the actual file location on Arch Linux.
This is the case with Typora which will retain its ugly menu bar when
Hyprland does the fullscreening, but be beautifully bare when its doing
its own fullscreening. The best would be if we could make F11 work such
that the app got a shot at fullscreening first, then if it wasn't
capable, we let Hyprland do it. But not sure there's a way to do that?
* use wf-recorder instead of wl-screenrec
wl-screenrec does not support NVIDIA drivers as of now
* install wf-recorder and migration for it
* use wl-screenrec for non-nvidia and wf-recorder otherwise
* useless comment
* only use one of the screen recording features
* Make these executable
* Replace pavucontrol with wiremix (#225)
Add to install
* Revert "Replace pavucontrol with wiremix (#225)"
This reverts commit 620b397859.
* Add swayOSD to show brightness and volume status
* Add swayOSD migration
* Move swayosd from desktop to hyperlandia
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Roeland <roel4d@webding.org>
Previously, `omarchy-update` used the timestamp of the most recent git
commit to determine which migrations are "new" and should be executed.
Unfortunately, that strategy can (and did) fail in certain scenarios. If
a migration was generated at time T1 but not merged until time T3, and
meanwhile omarchy's `master` branch was updated to a new release with
commit timestamp T2 (where T1 < T2 < T3), then anyone who runs
`omarchy-update` between T2 and T3 would end up with `last_updated_at`
equal to T2; thus, on their next `omarchy-update` it would fail to
detect the migration with timestamp T1 as a "new" migration that should
be executed.
This commit changes the strategy for detecting "new" migrations to avoid
that problem. Rather than recording the most recent commit's timestamp,
we record its SHA. Then, after pulling the new changes, we can leverage
`git diff --name-only --diff-filter=A $SHA.. migrations/*.sh`
to return precisely the list of migration files that were introduced by
our `git pull`. It doesn't matter if any of those migrations have a
timestamp that was earlier than the timestamp of the commit we started
on - we will always execute *every* migration that didn't exist before
our `git pull`!
* Change launcher from wofi -> walker
* Add migration
* More wofi -> walker locations
* Add rose pine theme
* Rename refresh script
* Minor improvements to walker + add uwsm
* Back out running as service
* Make these executable
* Add plugins dir for now to resolve open issue 355 from v0.13.0 release
* Replace pavucontrol with wiremix (#225)
Add to install
* Revert "Replace pavucontrol with wiremix (#225)"
This reverts commit 620b397859.
* Fix reference
* Add libqalculate so calc works out of the box
* Actually add libqalculate
* Re-add media
* Add catppuccin-latte
* Final cleanup
* Remove partially baked theme
* Remove failing migration
* Remove failing migration
* Fix refresh script
* Simplify css setup
* Rearrange walker theme files
* Change theme name
* Remove unnecessary file
* Clear everything
* Only worry about the config file now
* Disable load in animation for walker
* Run walker as service
* Make sure we have fresh package db
* Add keybindings theme
* Remove history
* Explain section
* Assume wofi is gone, only run if walker isn't there
* Move as the latest
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Roeland <roel4d@webding.org>
If the worktree has conflicts after applying the user's changes from the
autostash, we should reset them before proceeding to ensure we are in
a working state. When there are conflicts, git still keeps the stash
entry, so the user will still be able to manually re-pop the stash and
resolve the conflicts after `omarchy-update` has finished.
In the case of conflicts, the output will look something like this (I've
omitted most of the normal `git pull` output, hence the `[...]`):
```
Updating 729cd6a..45b5d3e
Created autostash: 91853c4
Fast-forward
bin/omarchy | 10 +++++++---
[...]
create mode 100644 themes/tokyo-night/backgrounds/2--Milad-Fakurian-Abstract-Purple-Blue.jpg
Applying autostash resulted in conflicts.
Your changes are safe in the stash.
You can run "git stash pop" or "git stash drop" at any time.
bin/omarchy:65: leftover conflict marker
```
before proceeding with the rest of the `omarchy-update` script from a
clean state. So the user will see 1) that there were conflicts when
applying the autostashed changes, 2) that their changes are still safe
in the stash, and 3) which files (and lines) had conflict markers.
This is a minor follow-up to dcc4071979
to leverage the `--autostash` flag of `git pull` which does the same
thing we were doing in three separate commands.
This also avoids the possibility of popping something from the stash
that `omarchy-update` didn't actually stash. In other words, if the
initial `git stash` was a no-op (because there were no changes in the
working tree), it's actually not desirable for `omarchy-update` to
`git stash pop` at the end, since that potentially pops something the
user had manually stashed (we only want `omarchy-update` to pop its own
stash entry). Using `--autostash` handles this correctly.
Ref:
https://git-scm.com/docs/git-pull#Documentation/git-pull.txt---autostash
* Add main CLI interface for Omarchy
Introduces the omarchy script, providing a command-line interface with options for current version, update, and waybar configuration refresh. Includes help documentation.
* Add really cool Omarchy ASCII art to help menu in cli
* Refactor Omarchy CLI to include a TUI menu with system, theme, and tools options.
* Add .desktop for Omarchy TUI
* Make omarchy script executable
* Refactor omarchy cli and add new theme tools
* Add help menu
* Add omarchy theme remove
* Add theme installer
* Add migration to make theme management scripts executable
* Refactor theme installation script to simplify directory structure and remove unnecessary symlinks.
The script now directly clones themes into the ~/.config/omarchy/themes directory and updates paths accordingly for backgrounds and fonts.
* Update permissions for theme scripts and remove unnecessary migration file
* Refactor theme installation script to always use swaybg-next
* Remove fonts from omarchy-theme-install
* Refactor omarchy-theme-remove by swiitching to theme dir and removing unnecessary symlink checks
* Refactor theme installer to use omarchy-theme-set
* Fix Omarchy theme remove removing current theme and throwing error
* Making theme management scripts quiet
* Add theme menu for quick theme switching
* Bind theme menu
* Fix current theme being selected
* Replace omarchy-theme-next binding with theme menu
* Add omarchy-theme-set and refactor theme menu script
* Add solid black fallback if background image does not exist in current theme
* Add override to only require one network interface online
* refactor: extensible, evenly spaced waybar style.css
- Use @define-color directive to define colour variables for each theme
(@foreground for text, @background for background-color)
- apply the colour variables in the main theme config, making it more
extensible
- make waybar elements more evenly spaced with consistent margin and
padding values
- add migration to apply the above changes to existing users
* Update style.css
better pixel spacing
---------
Co-authored-by: Ryan Hughes <1630358+ryanrhughes@users.noreply.github.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Working concept with SDDM
* Working concept without SDDM dep
* Working concept w/o SDDM and w/ UWSM
* Cleanup and UWSM tweaks
* Cleanup
* Remove call to seamless-login.sh
* Don't allow the progress to go backwards
* Add refresh to migration
* feat: Add a keyboard shortcuts helper
This commit:
* Changes keybinds to use `bindd` and adds descriptions for each one
* Changes the keybinds script to use `hyprctl binds` to inspect runtime keybinds
and generate a wofi menu to search/inspect keybinds
* Rely on 'order defined' for sorting
Using `hyprctl binds` lets us get the binds in the order they're
defined. This lets us be deliberate about what keybinds we want to show
up at the top of the presented window.
* Skip cache file for keybinds
* Strip extra newline causing double spacing
* install: explicitly install iwd
When archinstall is run using an ethernet connection, iwd will not be
installed. Explicitly install and enable the service
* Just a slight indication of the current audio volume with 3 diffrent icons
---------
Co-authored-by: Tim Culverhouse <tim@timculverhouse.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
- For strings/paths with spaces, quote them instead of escaping spaces with `\ ` (e.g., `"$APP_DIR/Disk Usage.desktop"`, not `$APP_DIR/Disk\ Usage.desktop`)
- Shebangs must use `#!/bin/bash` consistently (never `#!/usr/bin/env bash`)
- Scripts under `install/` and `migrations/` may be sourced and intentionally omit shebangs
# Command Naming
All commands start with `omarchy-`. Prefixes indicate purpose.
The authoritative list of user-facing command groups lives in `bin/omarchy` in `GROUP_DESCRIPTIONS`. Keep `GROUP_DESCRIPTIONS` updated when adding a new command prefix users are meant to browse to.
A group whose commands are all `# omarchy:hidden=true` gets no entry. That table drives the top-level group listing on its own, so an entry there advertises the group even when every command in it is hidden. `apply-` and `provision-` are deliberately absent for that reason; both still route, and `omarchy <group>` still prints a group header without one.
Common prefixes include:
-`cmd-` - check if commands exist, misc utility commands
-`capture-` - screenshots, screen recordings, and other capture tools
-`pkg-` - package management helpers
-`hw-` - hardware detection (return exit codes for use in conditionals)
-`refresh-` - copy default config to user's `~/.config/`
-`restart-` - restart a component
-`launch-` - open applications
-`install-` - install optional software
-`setup-` - interactive setup wizards
-`toggle-` - toggle features on/off
-`theme-` - theme management
-`update-` - update components
Do not maintain a second exhaustive prefix list here. Consult
`GROUP_DESCRIPTIONS` when selecting or checking a command group so this
guidance does not drift from the router.
# Runtime Environment
-`$OMARCHY_PATH` is set at the top level by the uwsm session environment and is always available to Omarchy runtime code.
- Commands in `bin/` and Quickshell QML should rely on `$OMARCHY_PATH` / `Quickshell.env("OMARCHY_PATH")`; do not derive fallback paths from `HOME`, `Quickshell.shellDir`, or re-export/default `OMARCHY_PATH` manually.
# Privileged Commands
- Follow the "Privilege Escalation" section of `default/agents/skills/omarchy/SKILL.md`. It draws the
`sudo`/`pkexec` line by whether the caller has a terminal to enter a password in, and the repo's
own scripts follow it.
# Git
- Commits should be atomic: include only one coherent change or fix, and do not mix unrelated work.
- Commit messages should be succinct and describe the change being made.
# Helper Commands
Use these instead of raw shell commands:
-`omarchy-cmd-missing` / `omarchy-cmd-present` - check for commands
-`omarchy-pkg-missing` / `omarchy-pkg-present` - check for packages (don't use these if you can just use `omarchy-pkg-add`/`omarchy-pkg-drop`)
-`omarchy-pkg-add` - install packages (handles both pacman and AUR)
-`omarchy-pkg-drop` - remove packages; use this instead of raw `pacman -R*`
-`omarchy-notification-send` - send desktop notifications; do not call `notify-send` directly
-`omarchy-hw-asus-rog` - detect ASUS ROG hardware (and similar `hw-*` commands)
Commands installed by Omarchy's default package set are runtime invariants. Invoke them directly; do not add defensive `omarchy-cmd-present` / `omarchy-cmd-missing` checks around them. Use command-presence helpers only for genuinely optional dependencies or code that can run before the default package set is installed.
Exceptions are allowed for migration and package-helper scripts where the helper may not be available yet, where the helper itself is being implemented, or where direct package-manager behavior is required.
# Menu
- The menu definition lives in `default/omarchy/omarchy-menu.jsonc`.
- Do not add `aliases` to new menu entries. Aliases are reserved for
established alternate names users already type, kept for compatibility.
# Config Structure
-`config/` - default configs copied to `~/.config/`
-`default/themed/*.tpl` - templates with `{{ variable }}` placeholders for theme colors
-`themes/*/colors.toml` - theme color definitions (accent, background, foreground, red/green/yellow/blue/magenta/cyan and bright_* variants)
# Tests
Run focused automated tests for the area you changed. Current test entry points:
-`./test/all` - aggregate runner for CLI and shell tests; it intentionally does not run graphical acceptance tests
-`./test/shell` - all Omarchy shell tests under `test/shell.d/`
New Omarchy shell tests should live in `test/shell.d/*-test.sh` so `./test/shell` picks them up automatically. Source `test/shell.d/base-test.sh` for shared root-path discovery, assertions, and Node test helpers.
The graphical acceptance suite runs in a disposable VM, not in the active
development session; see [`agents/skills/acceptance-tests.md`](agents/skills/acceptance-tests.md).
Visual changes must be verified in the running UI in addition to automated
Turn a fresh Arch installation into a fully-configured, beautiful, and modern web development system based on Hyprland by running a single command. That's the one-line pitch for Omarchy (like it was for Omakub). No need to write bespoke configs for every essential tool just to get started or to be up on all the latest command-line tools. Omarchy is an opinionated take on what Linux can be at its best.
Omarchy is a beautiful, modern & opinionated Linux distribution by DHH.
Read more at [omarchy.org](https://omarchy.org).
Read more at [omarchy.org](https://omarchy.org).
## The Omarchy Manual
The manual lives in [`manual/`](manual/), which is its authoritative source. It's
mirrored to [learn.omacom.io](https://learn.omacom.io/2/the-omarchy-manual), where
its screenshots are also hosted.
- [Welcome to Omarchy!](manual/01-welcome-to-omarchy.md)
**The Basics**
- [Getting Started](manual/02-getting-started.md)
- [Coming From Mac or Windows](manual/03-coming-from-mac-or-windows.md)
Then confirm it in the running menu per [`visual-verification.md`](visual-verification.md). Avoid leaving two fonts with the `omarchy` family registered: Qt can use an old copy in `~/.local/share/fonts` even when `fc-match omarchy` reports the packaged font. For a preview, either replace the packaged file in the disposable VM or temporarily exclude it with a `<rejectfont>` rule in `~/.config/fontconfig/conf.d/` before loading the candidate.
Refresh the font cache and restart the shell afterwards — Qt reads the font database at startup, so `omarchy menu refresh` alone will not pick up a changed font. Remove temporary fonts and rules after verification.
Read this before working under `install/` or on the system/user setup commands.
The ISO owns installation orchestration. This repo ships target-side setup
commands and reusable setup leaves:
-`bin/omarchy-apply-system` runs root-owned system setup during ISO finalization.
-`bin/omarchy-apply-hardware` runs idempotent hardware-specific setup and is called by `omarchy-apply-system`.
-`bin/omarchy-finalize-user` runs the per-user runtime finalization (skill symlinks, xdg-user-dirs, mime defaults, `install/user/all.sh`). Shipped user defaults are seeded by `/etc/skel` from `omarchy-settings`, not by this command. `bin/omarchy-reinstall-configs` is the explicit destructive resync of those defaults into an existing user's `$HOME`.
- leaf scripts under `install/` are sourced by `run_logged $OMARCHY_INSTALL/path/to/script.sh` and intentionally do not have shebangs.
- use `$OMARCHY_INSTALL` and `$OMARCHY_PATH` instead of hard-coded Omarchy paths.
- keep root-scoped hardware setup under `install/hardware/` and orchestrate it through `install/hardware/all.sh`.
- keep every per-user setup leaf under `install/user/` (including `install/user/hardware/` and `install/user/first-run/`) so it is clear what must run for each user.
- The base install supplies matching kernel headers before hardware setup. DKMS installers should install their driver packages and assume the headers exist.
- prefer helper commands for package and command checks where available.
Raw `command -v`, `pacman`, and `pacman-key` are acceptable in package-helper
contexts where direct package-manager behavior is the point of the script.
Read this before editing the Quickshell desktop under `shell/`.
The Quickshell desktop runs as a single long-running process out of
`shell/`. Hyprland autostart launches it directly with `quickshell -n -p`;
do not start additional standalone Quickshell instances for individual
components.
Run `omarchy-restart-shell` after making changes to QML files.
## Plugin contract
- First-party plugins live directly under `shell/plugins/` or one category
level deeper, such as `shell/plugins/panels/weather/`. First-party bar-only
widgets may use adjacent `*.manifest.json` files. Third-party plugins live
at `~/.config/omarchy/plugins/<id>/` with a `manifest.json` at the root.
- Every plugin manifest declares `schemaVersion`, `id`, `name`, `version`,
`kinds`, and `entryPoints`. See
[`docs/omarchy-shell.md`](../../docs/omarchy-shell.md) and
`shell/services/PluginRegistry.qml` for the current contract; fields such as
`activation` are optional.
- Entry-point QML files are `Item`s (not `ShellRoot`), and accept the shell-injected properties `omarchyPath`, `shell`, `manifest`, and `pluginRegistry` / `barWidgetRegistry` as appropriate. First-party plugins receive the host objects. Third-party plugins receive capability-scoped facades: ordinary plugins may look up and control only their own service and lifecycle, built-in clones retain narrow source-specific configuration and UI compatibility, menu plugins receive an application-library facade, and plugins can read detached scalar bar state; full-bar plugins additionally receive detached bar configuration and widget-catalog snapshots, narrow proxies for the non-authentication services used by built-in bar widgets, and lifecycle control over configured non-authentication UI plugins. Authentication capabilities must be stamped from trusted first-party manifests, and third-party registry views and bar configuration must be detached snapshots rather than shared objects. These facades reduce accidental authority but are not a same-process QML sandbox: a visual bar widget can walk its parent hierarchy to ordinary host objects. Authentication services must therefore remain outside both `ShellRoot._services` and the host QObject tree. Do not expose authentication services through new third-party-facing properties.
- Panel / overlay / menu plugins must expose `open(payloadJson)` and
`close()` lifecycle methods for `shell summon` and `shell hide`.
## IPC
-`bin/omarchy-shell` is the canonical IPC entry point. It forwards to
the running shell and does not start it. Prefer it over re-implementing
direct Quickshell socket calls in every CLI.
- The `shell` IPC target exposes lifecycle and configuration methods including
# omarchy:summary=Configure the bar and its widget layout
# omarchy:group=bar
# omarchy:args=use <id> | reset | defaults | position <top|bottom|left|right> | transparent <true|false|toggle> | put <id> [placement] | move <id> [placement] | set <id> <key> <value> [--json] [placement]
# omarchy:examples=omarchy bar use local.neon-bar | omarchy bar put omarchy.keyboard-layout --after omarchy.clock | omarchy bar move omarchy.clock --section center --index 0 | omarchy bar set omarchy.clock format HH:mm
set -euo pipefail
source omarchy-shell-config
usage() {
cat <<USAGE
Usage: omarchy bar <command> [args...]
use <id> Use a bar option as the active bar
reset Return to the built-in Omarchy bar
defaults Restore the default bar and service widgets
position <top|bottom|left|right> Bar position
transparent <true|false|toggle> Bar transparency
put <id> [placement] Put a widget on the bar, leaving one
that is already there where it is
move <id> [placement] Move a widget within or between sections
set <id> <key> <value> [--json] [placement]
Set a per-widget option
Placement:
--section <left|center|right> Target section
--index <n> Target index
--before <id> Insert before a widget
--after <id> Insert after a widget
--from-section <section> Source section
--from-index <n> Source index
Enable and disable widgets with 'omarchy plugin enable' and
'omarchy plugin disable'.
'put' places a widget the way 'plugin enable' does, but leaves one that is
already on the bar where it is, and falls back to the widget's usual spot when
--before / --after names a widget the bar does not carry.
Examples:
omarchy bar use local.neon-bar
omarchy bar put omarchy.keyboard-layout --after omarchy.clock
omarchy bar move omarchy.media left
omarchy bar move omarchy.clock --section center --index 0
# omarchy:summary=Returns true if a battery is present on the system.
for bat in /sys/class/power_supply/BAT*; do
[[ -r $bat/present ]] &&
[[ $(cat $bat/present) == "1" ]] &&
[[ $(cat $bat/type) == "Battery" ]] &&
exit 0
done
exit 1
Loaded 100 of 1926 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
