Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Agents widget: Codex limits never load — collector passes removed `-a untrusted` to app-server
Reported by emergencerising-maker · filed Aug 30, 2026Closed upstream on 2026-09-20 by bjarneo via an automated message, as a duplicate of #8460 (R-1406). GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
What happened
The omarchy.agents bar widget shows Codex usage but never shows Codex rate
limits or the plan tier. The panel reads "Codex limits unavailable" and the
usage record has "limits": [], "tierLabel": "".
The cause is in bin/omarchy-agent-usage-codex. It starts the Codex app-server
with an approval policy that current Codex releases no longer accept:
[codex, "-s", "read-only", "-a", "untrusted", "app-server"]Running that by hand:
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
[possible values: on-request, never]The subprocess exits immediately, so account/rateLimits/read never returns andfetch_codex_rpc() falls through to its unavailable path. Because the collector
sends stderr to DEVNULL, the failure is silent — the widget just looks like it
has no limits data.
Expected
Codex limits and tier appear in the panel, the same way Claude's do.
Steps to reproduce
- Install and sign in to codex-cli 0.151.0.
- Have
omarchy.agentsin the bar with thecodexprovider enabled. - Run
omarchy-agent-usage-codexand inspect the JSON, or open the Agents panel
and switch to the Codex chip.
4. limits is empty and the panel reads "Codex limits unavailable".
Fix
untrusted is no longer a valid --ask-for-approval value; never is the
equivalent non-interactive policy and is correct for a read-only app-server probe:
- [codex, "-s", "read-only", "-a", "untrusted", "app-server"],
+ [codex, "-s", "read-only", "-a", "never", "app-server"],Verified locally with a patched copy of the collector — it immediately returns
the real values:
"tierLabel": "pro",
"usageStatusText": "",
"limits": [{ "label": "Weekly (7-day)", "percent": 0.08, "resetsAt": "2026-09-05T21:42:42+00:00" }]Worth considering alongside the fix: the collector swallows the app-server's
stderr, which is what made this invisible. Surfacing that text inauthHelpText would have named the problem directly instead of reporting a
generic "limits unavailable".
System
- Omarchy 4.0.1-1
- Arch Linux, kernel 7.1.9-arch1-2
- AMD Ryzen 9 3900X / AMD Navi 31 (RX 7900 XTX)
- codex-cli 0.151.0
View raw text
### What happened
The `omarchy.agents` bar widget shows Codex usage but never shows Codex rate
limits or the plan tier. The panel reads "Codex limits unavailable" and the
usage record has `"limits": []`, `"tierLabel": ""`.
The cause is in `bin/omarchy-agent-usage-codex`. It starts the Codex app-server
with an approval policy that current Codex releases no longer accept:
```python
[codex, "-s", "read-only", "-a", "untrusted", "app-server"]
```
Running that by hand:
```
$ codex -s read-only -a untrusted app-server
error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
[possible values: on-request, never]
```
The subprocess exits immediately, so `account/rateLimits/read` never returns and
`fetch_codex_rpc()` falls through to its unavailable path. Because the collector
sends stderr to `DEVNULL`, the failure is silent — the widget just looks like it
has no limits data.
### Expected
Codex limits and tier appear in the panel, the same way Claude's do.
### Steps to reproduce
1. Install and sign in to codex-cli 0.151.0.
2. Have `omarchy.agents` in the bar with the `codex` provider enabled.
3. Run `omarchy-agent-usage-codex` and inspect the JSON, or open the Agents panel
and switch to the Codex chip.
4. `limits` is empty and the panel reads "Codex limits unavailable".
### Fix
`untrusted` is no longer a valid `--ask-for-approval` value; `never` is the
equivalent non-interactive policy and is correct for a read-only app-server probe:
```diff
- [codex, "-s", "read-only", "-a", "untrusted", "app-server"],
+ [codex, "-s", "read-only", "-a", "never", "app-server"],
```
Verified locally with a patched copy of the collector — it immediately returns
the real values:
```json
"tierLabel": "pro",
"usageStatusText": "",
"limits": [{ "label": "Weekly (7-day)", "percent": 0.08, "resetsAt": "2026-09-05T21:42:42+00:00" }]
```
Worth considering alongside the fix: the collector swallows the app-server's
stderr, which is what made this invisible. Surfacing that text in
`authHelpText` would have named the problem directly instead of reporting a
generic "limits unavailable".
### System
- Omarchy 4.0.1-1
- Arch Linux, kernel 7.1.9-arch1-2
- AMD Ryzen 9 3900X / AMD Navi 31 (RX 7900 XTX)
- codex-cli 0.151.0
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.