Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Codex 0.149 breaks Agents panel limit display
Reported by orienw · filed Aug 21, 2026Closed upstream on 2026-08-25 by the merge of PR #7649 (closed by dhh). GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
AMD Ryzen 5 5500GT, NVIDIA RTX 2070, Omarchy 4.0.0-1, Hyprland 0.56.2, Codex CLI 0.149.0.
What's wrong?
After Codex updates from 0.148.0 to 0.149.0, the Agents panel no longer displays Codex subscription limits. Local token and session stats still display, but the limits section reports Codex limits unavailable with help text initialize.
Reproduce with the packaged collector:
$ omarchy-agent-usage-codex --limits-only | jq '{ready,limitCount:(.limits|length),usageStatusText,authHelpText}'
{
"ready": true,
"limitCount": 0,
"usageStatusText": "Codex limits unavailable",
"authHelpText": "initialize"
}The collector launches app-server with the retired approval policy:
[codex, "-s", "read-only", "-a", "untrusted", "app-server"]Codex 0.149.0 rejects that command before app-server starts:
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
[possible values: on-request, never]Codex 0.148.0 accepted untrusted; OpenAI retired the policy in https://github.com/openai/codex/pull/39630.
Because the collector discards app-server stderr and waits for an RPC response, the immediate process failure is surfaced as the misleading timeout text initialize.
Expected behavior
The collector should start app-server with a supported approval policy and continue displaying Codex limits after upgrading Codex.
Changing only untrusted to on-request, while retaining the existing read-only sandbox, restored the authenticated limit response immediately:
[codex, "-s", "read-only", "-a", "on-request", "app-server"]With that substitution, the collector returned one limit window and an empty usageStatusText. No login or credential change was needed.
It would also be useful for the collector to surface an early app-server process exit instead of reporting the pending RPC method name as the error.
View raw text
### System details
AMD Ryzen 5 5500GT, NVIDIA RTX 2070, Omarchy 4.0.0-1, Hyprland 0.56.2, Codex CLI 0.149.0.
### What's wrong?
After Codex updates from 0.148.0 to 0.149.0, the Agents panel no longer displays Codex subscription limits. Local token and session stats still display, but the limits section reports `Codex limits unavailable` with help text `initialize`.
Reproduce with the packaged collector:
```console
$ omarchy-agent-usage-codex --limits-only | jq '{ready,limitCount:(.limits|length),usageStatusText,authHelpText}'
{
"ready": true,
"limitCount": 0,
"usageStatusText": "Codex limits unavailable",
"authHelpText": "initialize"
}
```
The collector launches app-server with the retired approval policy:
```python
[codex, "-s", "read-only", "-a", "untrusted", "app-server"]
```
Source: https://github.com/basecamp/omarchy/blob/ed7bae4ac5a570e9df307486e0202fdafcc6ee24/bin/omarchy-agent-usage-codex#L529-L545
Codex 0.149.0 rejects that command before app-server starts:
```console
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
[possible values: on-request, never]
```
Codex 0.148.0 accepted `untrusted`; OpenAI retired the policy in https://github.com/openai/codex/pull/39630.
Because the collector discards app-server stderr and waits for an RPC response, the immediate process failure is surfaced as the misleading timeout text `initialize`.
### Expected behavior
The collector should start app-server with a supported approval policy and continue displaying Codex limits after upgrading Codex.
Changing only `untrusted` to `on-request`, while retaining the existing `read-only` sandbox, restored the authenticated limit response immediately:
```python
[codex, "-s", "read-only", "-a", "on-request", "app-server"]
```
With that substitution, the collector returned one limit window and an empty `usageStatusText`. No login or credential change was needed.
It would also be useful for the collector to surface an early app-server process exit instead of reporting the pending RPC method name as the error.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.