Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4733GitHub issuePublicReceived

Agents panel: Codex limits show 'initialize' — stale --ask-for-approval flag value

Reported by samkhoo94 · filed Aug 29, 2026Closed upstream on 2026-09-20 by bjarneo via an automated message, as a duplicate of #8460 (R-1406). GitHub close reason: completed.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Agents panel: Codex limits show 'initialize' — stale --ask-for-approval flag valuerevision 1 · captured 2026-10-04 12:03 UTC via poll

What happened

Agents bar panel, Codex tab shows usage status "CODEX LIMITS UNAVAILABLE" and the auth-help card literally reads "initialize" instead of a helpful message.

Root cause

omarchy-agent-usage-codex collector launches the app-server with:

codex -s read-only -a untrusted app-server

-a untrusted is rejected by current codex-cli:

error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
[possible values: on-request, never]

codex-cli process exits immediately, the RPC initialize call never gets a response, and the collector's rpc_request() raises TimeoutError("initialize"). That exception's str(exc) ("initialize") gets stored verbatim in authHelpText and shown in the panel — should instead surface a real "run codex login" / version-mismatch message, and the hardcoded flag value should track the current codex-cli approval-policy enum (on-request/never, no more untrusted).

Steps to reproduce

  1. Install/update codex-cli to a version where --ask-for-approval no longer accepts untrusted (confirmed on codex-cli 0.149.0).
  2. Log in with codex login, run at least one Codex session so local stats populate.
  3. Open the Agents bar panel > Codex tab.
  4. Local token stats show correctly; limits section shows "CODEX LIMITS UNAVAILABLE" and the help text is the bare string "initialize".

Expected

Either the collector uses a codex-cli-version-compatible flag, or the auth-help text explains the real failure (flag/version mismatch) instead of leaking the raw RPC method name.

System details

  • Omarchy version: 4.0.0-1
  • codex-cli version: 0.149.0 (installed via mise)
  • omarchy debug command does not exist in this Omarchy version (checked omarchy commands --all), so no diagnostic log attached.
View raw text
## What happened
Agents bar panel, Codex tab shows usage status "CODEX LIMITS UNAVAILABLE" and the auth-help card literally reads "initialize" instead of a helpful message.

## Root cause
`omarchy-agent-usage-codex` collector launches the app-server with:

    codex -s read-only -a untrusted app-server

`-a untrusted` is rejected by current codex-cli:

    error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
      [possible values: on-request, never]

codex-cli process exits immediately, the RPC `initialize` call never gets a response, and the collector's `rpc_request()` raises `TimeoutError("initialize")`. That exception's `str(exc)` ("initialize") gets stored verbatim in `authHelpText` and shown in the panel — should instead surface a real "run codex login" / version-mismatch message, and the hardcoded flag value should track the current codex-cli approval-policy enum (`on-request`/`never`, no more `untrusted`).

## Steps to reproduce
1. Install/update codex-cli to a version where `--ask-for-approval` no longer accepts `untrusted` (confirmed on codex-cli 0.149.0).
2. Log in with `codex login`, run at least one Codex session so local stats populate.
3. Open the Agents bar panel > Codex tab.
4. Local token stats show correctly; limits section shows "CODEX LIMITS UNAVAILABLE" and the help text is the bare string "initialize".

## Expected
Either the collector uses a codex-cli-version-compatible flag, or the auth-help text explains the real failure (flag/version mismatch) instead of leaking the raw RPC method name.

## System details
- Omarchy version: 4.0.0-1
- codex-cli version: 0.149.0 (installed via mise)
- `omarchy debug` command does not exist in this Omarchy version (checked `omarchy commands --all`), so no diagnostic log attached.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.