Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Agents panel runs every provider's collector by default; the Codex collector causes repeated network fetches
Reported by brightwalker25 · filed Sep 23, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Omarchy version: 4.0.4
The Agents bar widget ships with Claude, Codex and Fireworks all enabled in plugins/agents/manifest.json. On each refresh omarchy-agent-usage-update runs the collector for every enabled provider. For Codex, omarchy-agent-usage-codex starts codex app-server to read rate limits, and starting it makes Codex sync its plugin list, which runs a git fetch of github.com/openai/plugins.git.
The result, on a machine that has Codex installed but where only the Claude meter was wanted:
- unrequested fetches to GitHub on every refresh (four were seen in 13 minutes during a network audit)
- a new
~/.codex/.tmp/git-*folder for each fetch; about 680 had built up over a week
Nothing in the panel says that viewing usage causes outbound traffic. The README says a provider only appears once it has recorded usage, but its collector still runs, with these side effects, as long as it is enabled.
Suggested fix:
- ship providers disabled, or enable one only when the user switches it on
- run a provider's collector only if that provider has recorded local usage
- for Codex, start the app-server in a mode that skips the plugin sync if Codex has one, or read rate limits another way
- say in the README that a collector may start the agent's own client, which can contact its vendor
Related but separate: #12702 and #12411 cover the collector's CPU cost, and #12329 proposes a Remove menu.
View raw text
**Omarchy version:** 4.0.4 The Agents bar widget ships with Claude, Codex and Fireworks all enabled in `plugins/agents/manifest.json`. On each refresh `omarchy-agent-usage-update` runs the collector for every enabled provider. For Codex, `omarchy-agent-usage-codex` starts `codex app-server` to read rate limits, and starting it makes Codex sync its plugin list, which runs a `git fetch` of `github.com/openai/plugins.git`. The result, on a machine that has Codex installed but where only the Claude meter was wanted: - unrequested fetches to GitHub on every refresh (four were seen in 13 minutes during a network audit) - a new `~/.codex/.tmp/git-*` folder for each fetch; about 680 had built up over a week Nothing in the panel says that viewing usage causes outbound traffic. The README says a provider only appears once it has recorded usage, but its collector still runs, with these side effects, as long as it is enabled. **Suggested fix:** - ship providers disabled, or enable one only when the user switches it on - run a provider's collector only if that provider has recorded local usage - for Codex, start the app-server in a mode that skips the plugin sync if Codex has one, or read rate limits another way - say in the README that a collector may start the agent's own client, which can contact its vendor Related but separate: #12702 and #12411 cover the collector's CPU cost, and #12329 proposes a Remove menu.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 17:39 UTC