Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1406GitHub issuePublicReceived

Agents widget: Codex collector hardcodes stale --ask-for-approval value, breaks limits fetch

Reported by robertxxiv · filed Aug 26, 2026Closed upstream on 2026-10-04 by the bot omarchybot. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Agents widget: Codex collector hardcodes stale --ask-for-approval value, breaks limits fetchrevision 1 · captured 2026-09-28 21:24 UTC via poll

What happened

The Agents bar widget's Codex collector (/usr/share/omarchy/bin/omarchy-agent-usage-codex) always shows "Codex limits unavailable" / authHelpText: "initialize", even with a logged-in, working Codex CLI.

Root cause

The collector launches the app-server RPC with a hardcoded approval-policy flag value that no longer exists:

proc = subprocess.Popen(
  [codex, "-s", "read-only", "-a", "untrusted", "app-server"],
  ...
)

Current Codex CLI (0.149.1) only accepts on-request or never for -a/--ask-for-approval:

$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]

Because the collector redirects the subprocess's stderr to DEVNULL, this failure is invisible — the process just exits immediately, the initialize RPC call never gets a reply, and rpc_request raises TimeoutError("initialize") after its 8s timeout. That exception message ends up as the record's authHelpText, which is why the panel shows the confusing literal string "initialize" instead of a real auth/version hint.

Expected

Codex limits/plan should populate for an authenticated codex CLI, the way the Claude collector does. At minimum, -a untrusted should be updated to -a never (or on-request), and ideally subprocess stderr shouldn't be fully swallowed so future CLI-flag drift surfaces a real error instead of a bare TimeoutError message.

Steps to reproduce

  1. Have Codex CLI 0.149.1+ installed and authenticated (codex login status → "Logged in using ChatGPT").
  2. Run omarchy-agent-usage-update (or open the Agents panel and refresh).
  3. ~/.local/state/omarchy/agents/usage/codex.json shows "limits": [], "usageStatusText": "Codex limits unavailable", "authHelpText": "initialize".
  4. Manually confirm: codex -s read-only -a untrusted app-server → error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'.

System details

  • Omarchy version: 4.0.1-1
  • Codex CLI: codex-cli 0.149.1 (installed via mise)
  • omarchy debug command does not exist in this Omarchy version, so no auto-generated diagnostic log is attached.

Suggested fix

In omarchy-agent-usage-codex, change:

[codex, "-s", "read-only", "-a", "untrusted", "app-server"]

to use "never" (or "on-request") in place of "untrusted".

View raw text
## What happened

The Agents bar widget's Codex collector (`/usr/share/omarchy/bin/omarchy-agent-usage-codex`) always shows "Codex limits unavailable" / `authHelpText: "initialize"`, even with a logged-in, working Codex CLI.

## Root cause

The collector launches the app-server RPC with a hardcoded approval-policy flag value that no longer exists:

```python
proc = subprocess.Popen(
  [codex, "-s", "read-only", "-a", "untrusted", "app-server"],
  ...
)
```

Current Codex CLI (0.149.1) only accepts `on-request` or `never` for `-a`/`--ask-for-approval`:

```
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]
```

Because the collector redirects the subprocess's `stderr` to `DEVNULL`, this failure is invisible — the process just exits immediately, the `initialize` RPC call never gets a reply, and `rpc_request` raises `TimeoutError("initialize")` after its 8s timeout. That exception message ends up as the record's `authHelpText`, which is why the panel shows the confusing literal string `"initialize"` instead of a real auth/version hint.

## Expected

Codex limits/plan should populate for an authenticated `codex` CLI, the way the Claude collector does. At minimum, `-a untrusted` should be updated to `-a never` (or `on-request`), and ideally subprocess stderr shouldn't be fully swallowed so future CLI-flag drift surfaces a real error instead of a bare `TimeoutError` message.

## Steps to reproduce

1. Have Codex CLI 0.149.1+ installed and authenticated (`codex login status` → "Logged in using ChatGPT").
2. Run `omarchy-agent-usage-update` (or open the Agents panel and refresh).
3. `~/.local/state/omarchy/agents/usage/codex.json` shows `"limits": []`, `"usageStatusText": "Codex limits unavailable"`, `"authHelpText": "initialize"`.
4. Manually confirm: `codex -s read-only -a untrusted app-server` → `error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'`.

## System details

- Omarchy version: 4.0.1-1
- Codex CLI: codex-cli 0.149.1 (installed via mise)
- `omarchy debug` command does not exist in this Omarchy version, so no auto-generated diagnostic log is attached.

## Suggested fix

In `omarchy-agent-usage-codex`, change:

```python
[codex, "-s", "read-only", "-a", "untrusted", "app-server"]
```

to use `"never"` (or `"on-request"`) in place of `"untrusted"`.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.