Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Agents plugin cannot read Codex limits with Codex CLI 0.149.0 because `-a untrusted` is invalid
Reported by josh-weston-g · filed Aug 23, 2026Closed upstream on 2026-08-25 by the bot omarchybot; the closing comment says it was fixed by PR #7649. GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
Omarchy 4.0.0-1, AMD Ryzen 7 7700X (8 cores/16 threads), 32 GB RAM, NVIDIA GeForce RTX 5070 (12 GB VRAM), NVIDIA driver 610.57.04, Linux kernel 7.1.8-arch1-3
What's wrong?
The Omarchy Agents plugin displays:
Codex Limits Unavailable initialize
Local Codex token-usage statistics are displayed, but the subscription limit meters and reset times are unavailable.
Codex itself is authenticated and working normally. codex doctor reports no authentication, installation, database, or connectivity failures.
## Cause
The packaged Codex collector starts the Codex app server using:
codex -s read-only -a untrusted app-server
Codex CLI 0.149.0 no longer accepts untrusted as an approval policy. Running that command directly produces:
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
[possible values: on-request, never]
Because the app server exits before responding to the initialization RPC, omarchy-agent-usage-codex returns:
{
"tierLabel": "",
"limits": [],
"usageStatusText": "Codex limits unavailable",
"authHelpText": "initialize"
}
The relevant command is currently constructed in:
/usr/share/omarchy/bin/omarchy-agent-usage-codex
It appears that the collector needs to replace -a untrusted with a currently supported value, likely -a never, given that it starts the app server in a read-only sandbox solely to query account information.
## Steps to reproduce
1. Install Omarchy 4.0.0-1 and Codex CLI 0.149.0.
2. Authenticate Codex using codex login.
3. Use Codex so that it appears in the Omarchy Agents plugin.
4. Open the Agents panel or refresh its data.
5. Observe “Codex Limits Unavailable” with “initialize” beneath it.
The issue can also be reproduced directly with:
omarchy-agent-usage-codex --limits-only |
jq '{tierLabel, limits, usageStatusText, authHelpText}'
Result:
{
"tierLabel": "",
"limits": [],
"usageStatusText": "Codex limits unavailable",
"authHelpText": "initialize"
}
## Expected behaviour
The collector should start the Codex app server successfully, query account/rateLimits/read, and display the available Codex limit windows and reset times.
If app-server startup fails, it would also be helpful for the panel to display the underlying stderr message instead of only the RPC stage name initialize.View raw text
### System details
Omarchy 4.0.0-1, AMD Ryzen 7 7700X (8 cores/16 threads), 32 GB RAM, NVIDIA GeForce RTX 5070 (12 GB VRAM), NVIDIA driver 610.57.04, Linux kernel 7.1.8-arch1-3
### What's wrong?
The Omarchy Agents plugin displays:
> Codex Limits Unavailable
> initialize
Local Codex token-usage statistics are displayed, but the subscription limit meters and reset times are unavailable.
Codex itself is authenticated and working normally. `codex doctor` reports no authentication, installation, database, or connectivity failures.
## Cause
The packaged Codex collector starts the Codex app server using:
```bash
codex -s read-only -a untrusted app-server
Codex CLI 0.149.0 no longer accepts untrusted as an approval policy. Running that command directly produces:
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
[possible values: on-request, never]
Because the app server exits before responding to the initialization RPC, omarchy-agent-usage-codex returns:
{
"tierLabel": "",
"limits": [],
"usageStatusText": "Codex limits unavailable",
"authHelpText": "initialize"
}
The relevant command is currently constructed in:
/usr/share/omarchy/bin/omarchy-agent-usage-codex
It appears that the collector needs to replace -a untrusted with a currently supported value, likely -a never, given that it starts the app server in a read-only sandbox solely to query account information.
## Steps to reproduce
1. Install Omarchy 4.0.0-1 and Codex CLI 0.149.0.
2. Authenticate Codex using codex login.
3. Use Codex so that it appears in the Omarchy Agents plugin.
4. Open the Agents panel or refresh its data.
5. Observe “Codex Limits Unavailable” with “initialize” beneath it.
The issue can also be reproduced directly with:
omarchy-agent-usage-codex --limits-only |
jq '{tierLabel, limits, usageStatusText, authHelpText}'
Result:
{
"tierLabel": "",
"limits": [],
"usageStatusText": "Codex limits unavailable",
"authHelpText": "initialize"
}
## Expected behaviour
The collector should start the Codex app server successfully, query account/rateLimits/read, and display the available Codex limit windows and reset times.
If app-server startup fails, it would also be helpful for the panel to display the underlying stderr message instead of only the RPC stage name initialize.Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.