S
swadhinbiswas
fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal || Qt.quit() } } so Esc dismisses modals then closes standalone quickshell -p plugin-library window - bin/omarchy-plugins:27,204 — ensure_marketplace_catalog curl -sL without TLS pin/fail + eval "$p_cmd" on registry.json:14/catalog.json:15 installCommand (arbitrary remote shell, eval → RCE on omarchy plugins install); harden to curl --proto =https --tlsv1.2 --fail, warn and (cd "$OMARCHY_PATH" && bash -c "$p_cmd") only when repo absent, otherwise prefer omarchy-plugin-add "$p_repo" (validated via bin/omarchy-plugin-validate:115 + PluginRegistry.qml:603 reserved omarchy.* check) - shell/plugins/plugin-library/Panel.qml + manifest.json — delete duplicate copy-pasted Panel.qml:12 moduleName:"deomarchy.plugin-manager"/ipcTarget:"deomarchy.plugin-manager" while manifest.json:3 declares id:"deomarchy.plugin-library" → duplicate IpcHandler registration (Handler was registered but will not be used) and spurious openlayer>>omarchy-plugin-manager / width null at Panel.qml:1021
committed 1 months ago
.github Add issue templates (bug/install/feature) and Discord community links 2 months ago
agents Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
applications Initial de-omarchy: Omarchy UI layer for Arch-based distros 2 months ago
audit Scrub committed API keys and personal paths; enforce secret scan pre-commit 2 months ago
bin fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
config Scrub committed API keys and personal paths; enforce secret scan pre-commit 2 months ago
default SDDM: port upstream Omarchy login theme with Hyprland greeter 2 months ago
display Initial de-omarchy: Omarchy UI layer for Arch-based distros 2 months ago
docs fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
keybindings Add standalone keybindings cheat-sheet window (SUPER+K), register keybindings group 2 months ago
manual Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
monitor-manager Add Monitor Manager app (visual layout, drag arrange, rotate, scale) + SUPER+CTRL+M keybinding 2 months ago
packages fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
plugin-library fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
scripts fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
shell fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
themes Pure Arch: drop polkit-gnome/gnome-themes-extra/yaru, switch quickshell-git -> quickshell (repo Qt 6.11 build), icons Yaru -> breeze 2 months ago
.env.example Initial de-omarchy: Omarchy UI layer for Arch-based distros 2 months ago
.gitignore Scrub committed API keys and personal paths; enforce secret scan pre-commit 2 months ago
AGENTS.md Scrub committed API keys and personal paths; enforce secret scan pre-commit 2 months ago
icon.txt Port upstream user-facing defaults: chromium extensions, XCompose, voxtype/tensaku state, audio tunings, screensaver terminal configs, agent skills, branding art 2 months ago
install.sh fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
LICENSE Initial de-omarchy: Omarchy UI layer for Arch-based distros 2 months ago
LICENSE.upstream Initial de-omarchy: Omarchy UI layer for Arch-based distros 2 months ago
logo.txt Port upstream user-facing defaults: chromium extensions, XCompose, voxtype/tensaku state, audio tunings, screensaver terminal configs, agent skills, branding art 2 months ago
README.md SDDM: port upstream Omarchy login theme with Hyprland greeter 2 months ago
registry.json Plugin marketplace: omarchyplugins.com catalog, Plugin Manager/Library windows, registry.json with bundled plugins 2 months ago
SECURITY.md Initial de-omarchy: Omarchy UI layer for Arch-based distros 2 months ago
uninstall.sh SDDM: port upstream Omarchy login theme with Hyprland greeter 2 months ago
README.md

de-omarchy takes the Omarchy experience — the bar, launcher, theming, notifications, lock screen, screensaver — and installs it as a self-contained desktop layer on top of your existing system. No ISO, no bootloader, no new display manager, no mirrors touched. Everything it adds is additive, marked, and reversible.

Your system stays yours. Your bindings win. Uninstalling puts everything back exactly as it was.

At a glance

Quickshell desktop Bar, launcher, menus, notifications, clipboard, emojis, lock screen, OSD
10 bar styles Classic → Floating Islands → Glass → OLED Black… cycle live with SUPER+CTRL+Y
22 themes One TOML file each; live switching across terminal, GTK, and shell
System monitor widget CPU, RAM, disk, GPU temp, network — sampled every 2 s, click opens btop
Notification center History panel + do-not-disturb, SUPER+ALT+N
Plugin marketplace Browse and install community plugins (SUPER+SHIFT+I)
Monitor Manager Visual multi-monitor arrangement, SUPER+CTRL+M
Animated screensaver Terminal-text-effects at 120 fps — the real upstream behavior
Omarchy login screen SDDM greeter themed like upstream, running on a bare Hyprland session
~440 CLI commands One omarchy entry point; every command self-documents for humans and AI agents

Installation

git clone https://github.com/swadhinbiswas/de-omarchy.git ~/de-omarchy
cd ~/de-omarchy

./scripts/diff-preview.sh    # dry run — see exactly what would change
./install.sh                 # targeted backup first, then apply
hyprctl reload               # or log out and back in

[!TIP] Already installed and re-running later? The installer preserves your current theme, skips packages you already have, and refreshes the runtime — then tells you to run omarchy-restart-shell.

What the installer does, in order:

  1. Backs up every file it could touch (plus .ssh, zsh stack, starship) to ~/.de-omarchy-backups/<timestamp>/
  2. Installs missing UI packages only — never upgrades what you have
  3. Deploys the runtime to /usr/share/de-omarchy
  4. Installs four additive hooks — symlinks into ~/.config/hypr/ and ~/.config/zshrc.d/, pointing at runtime copies, never at your git checkout
  5. Appends one clearly-marked block to hyprland.lua (pre-change copy saved beside it)
  6. Initializes state and applies a default theme on first install only

Idempotent. Safe to re-run any time.

[!IMPORTANT] The safety contract

Never touched: pacman.conf, mirrors, repos, kernel, bootloader, display-manager binaries and PAM stack, monitors layout, .zshrc, .zshenv, starship.toml, kitty.conf, SSH keys. Nothing in $HOME is deleted or overwritten.

Added: the runtime dir, the four symlinks, the marked Hyprland block, /etc/environment.d/10-de-omarchy.conf, a PAM stanza for the lock screen, /usr/bin symlinks for a dozen commands — and, when SDDM is already installed, an Omarchy login theme plus its own drop-in config (remove it to fall back to your previous login screen).

To undo completely:

./uninstall.sh    # then restore anything else from ~/.de-omarchy-backups/<timestamp>/

Keybindings

Your existing bindings win — de-omarchy only claims keys that are free.

Key Action
SUPER + SHIFT + M Omarchy menu
SUPER + K Keybindings cheat sheet window
SUPER + CTRL + Y Cycle bar style
SUPER + ALT + N Notification center
SUPER + CTRL + M Monitor Manager
SUPER + SHIFT + I Plugin Library
SUPER + CTRL + A/B/W Audio / Bluetooth / Network panel
SUPER + CTRL + SPACE Background switcher
SUPER + PRINT / ALT + PRINT Screenshot / screen recording
SUPER + CTRL + T Activity (btop)
SUPER + ` Scratchpad

The full map — including preserved host bindings and every conflict decision — lives in keybindings/KEYMAP.md.

The CLI

One router, ~440 self-documenting commands. Every command carries machine-readable metadata (# omarchy:summary=…), so --help, menus, and AI agents all read the same source of truth.

$ omarchy --help                  # grouped, searchable command index
$ omarchy theme list              # 22 themes
$ omarchy theme set catppuccin    # live switch
$ omarchy bar style list          # the 10 bar presets
$ omarchy bar style set glass     # repaint the bar
$ omarchy plugins marketplace     # browse the community catalog
$ omarchy plugins install <name>  # install a plugin headlessly
$ omarchy shell toggle omarchy.audio   # IPC into the running shell

Plugins

Plugins are Quickshell components with a manifest.json; kinds are bar-widget, panel, or service. First-party plugins ship inside the runtime and load automatically. User-installed ones live in ~/.config/omarchy/plugins/ and merge in at scan time — anything under the reserved omarchy.* namespace always resolves to the first-party version.

Open Plugin Library (SUPER+SHIFT+I) for a GUI over the bundled catalog plus the omarchyplugins.com marketplace.

Themes

Each theme is one file — themes/<name>/colors.toml. Templates consume its variables and render into your terminal, GTK, and shell configs at switch time. Making a theme is making one TOML file:

cp -r themes/rose-pine themes/my-theme && $EDITOR themes/my-theme/colors.toml
omarchy theme set my-theme

Screensaver

The real Omarchy screensaver: your branding art rendered by terminal-text-effects at 120 fps, a random effect each idle, cursor hidden, exits on any input. Provided by python-terminaltexteffects (AUR) — installed automatically; without it the screensaver degrades gracefully to static art rather than failing.

Architecture

~/de-omarchy (source, yours)         /usr/share/de-omarchy            your session
┌──────────────────────────┐  rsync   ┌──────────────────────┐   symlinks  ┌─────────────────┐
│ bin/      shell/  themes/│ ───────▶ │ OMARCHY_PATH (root)  │ ──────────▶ │ ~/.config/hypr/ │
│ default/  config/ docs/  │          │                      │             │ ~/.config/zshrc.d/
└──────────────────────────┘          └──────────────────────┘             └─────────────────┘
        edit here                     the desktop runs HERE                override slot

Three layers, one direction of truth:

  • Source repo — where you edit. Never referenced at runtime.
  • Runtime (OMARCHY_PATH) — the authoritative copy every process reads: Hyprland Lua modules, the Quickshell shell, all omarchy-* commands, plugin manifests.
  • Live config — ~/.config/hypr/deo-*.lua are override slots: plain symlinks you may replace with your own files. Modules resolve ~/.local/state/ → ~/.config/ → $OMARCHY_PATH/, so user state beats fork defaults beats nothing.

Because the runtime is authoritative, deleting or breaking the source checkout cannot hurt a running desktop.

Development loop

You changed Deploy Apply
a bin/omarchy-* script sudo cp bin/omarchy-x /usr/share/de-omarchy/bin/ nothing needed
Hyprland Lua (default/hypr/, config/hypr/) same pattern into the runtime hyprctl reload
QML under shell/ same pattern omarchy-restart-shell
a user dotfile template omarchy-refresh-config <relpath> immediate

To try unreleased UI without touching the installation, run it straight from the checkout — e.g. quickshell -p ~/de-omarchy/plugin-library.

Repository layout

de-omarchy/
├── install.sh / uninstall.sh    deploy / fully revert the layer
├── bin/                         ~440 omarchy-* commands; router: bin/omarchy
├── shell/                       Quickshell desktop: Commons/, Ui/, plugins/
│   └── plugins/                 bar/, panels/, services/, notification-center/, …
├── default/                     deployed defaults: hypr/ (Lua), themed/ (tpl), agents/skills/
├── config/                      live-config hooks: hypr/, omarchy/shell.json, pam/, zshrc.d/
├── themes/                      22 × colors.toml
├── registry.json                plugin catalog shown in the Plugin Library
├── monitor-manager/             standalone visual monitor arrangement app
├── plugin-library/              standalone Plugin Library window
├── keybindings/                 KEYMAP.md + cheat-sheet window source
├── docs/ manual/ agents/        vendored references (51-chapter manual included)
└── audit/PARITY-AUDIT.md        fork-vs-upstream audit trail

Documentation

The full Omarchy Manual ships vendored — 51 chapters covering navigation, theming, plugins, updates, troubleshooting, and more. Start at manual/01-welcome-to-omarchy.md. Fork-specific deltas live in docs/FORK-NOTES.md; where the two disagree, FORK-NOTES wins.

Community

Questions, screenshots, theme shares, and help live on the de-omarchy Discord — usually faster than an issue for "how do I…" questions. Bug reports and feature requests belong on the issue tracker; templates are provided for bugs, installation problems, and features. Anything that reproduces in upstream Omarchy itself should go upstream instead.

Before committing, run scripts/scan-secrets.sh — it's wired up as a pre-commit hook and blocks secrets or personal paths from entering history.


About

Beautiful, Modern & Opinionated Linux for non omarchy Users

None license
Updated 22 days ago

Languages

  • Lua 63.2%
  • JavaScript 25.4%
  • Shell 9%
  • Python 1.6%
  • CSS 0.8%