OmaSafe v0.3.1 · signed release · 2026-09-09
A bounded, evidence-first review tool for Omarchy. Plugins: exact revisions, shipped payloads, capabilities, and drift from your trust baseline. Host: encryption, firewall, updates, listeners, and persistence, reported as state rather than a score. Candidates: scan a GitHub URL or install command before anything touches your shell.
OmaSafe surfaces unusual patterns, risky capabilities, posture regressions, and source changes for review. It never labels a plugin safe or malicious, and a quiet report means “no new actionable change”, not “proven secure”.
Why
Omarchy plugins are QML and JavaScript loaded unsandboxed, with full user permissions, inside the shared shell process, installed as mutable Git repositories. AUR packages have the same shape: community code, rebuilt often, executed as you. OmaSafe closes the gap between what was validated once and what is running now.
Nearly one in three community listings no longer points at the commit the marketplace checked. OmaSafe records the exact revision on your disk and tells you when it drifts.
Half the AUR has never been vouched for by anyone, and it churns daily. Read-only PKGBUILD review is next on the roadmap; host posture already reports foreign packages and pending updates.
Figures from the public catalog and AUR metadata dumps on the snapshot date. Both sources change continuously; treat them as a point in time.
Three ways in
The CLI owns parsing, identity, findings, coverage, policy, and state. The widget and the agent skill are thin, bounded clients over the same commands. Install what fits your workflow; the evidence is identical.
A single Rust binary. Inventory, marketplace correlation, trust baselines, drift diff, payload analysis, candidate scans, host posture, reviewed updates, and an opt-in daily timer. Every report is versioned JSON with coverage attached.
# pinned to the release you are installing curl --fail --proto '=https' --tlsv1.2 --location \ https://raw.githubusercontent.com/tuthan/omasafe/v0.3.1/scripts/install-cli.sh \ --output install-cli.sh less install-cli.sh bash install-cli.sh --version v0.3.1
A bar chip with a review panel. Five views over two subjects: the plugins on this machine, and the machine itself. Renders CLI reports, keeps stale and incomplete states visible, and never scans on its own.
io.github.tuthan.omasafe · category: Security# from the marketplace or the published repository omarchy plugin add https://github.com/tuthan/omasafe-plugin.git --enable # the marketplace does not install the CLI; add it separately
A portable Agent Skill so Claude Code, Codex, Cursor, or OpenCode can review a plugin through the local CLI: paste a GitHub URL or install command, get a bounded report. Plugin content stays untrusted evidence, never instructions.
# offline, exact-target install from a checked-out release adapters/install.sh --host claude --scope user --symlink adapters/install.sh --host codex --scope project --project-dir . --copy # requires a local omasafe-cli >= 0.3.0; never installs it for you
For AI agents
“Is this plugin OK to add?” now arrives in Claude Code or Codex with the install command attached. An agent that answers by reading the repository is reading untrusted text; a README or AGENTS.md can talk to it. The OmaSafe skill routes the question through the CLI instead: argv-only, read-only, validated JSON back. The agent reports evidence and coverage. It is not allowed to say “safe”. Watch it happen below, unedited.
omarchy plugin add https://github.com/tuthan/omarchy-lunar-calendar.git --enableNot done, and not requested: no install, no enable, no trust, no override. The CLI parsed the command itself; I did not parse or fetch anything.
Zero findings here is not a clean bill of health. It says the scanner did not get far enough to have an opinion.
No, and I am not going to call it safe. That is not evasion; it is the epistemic state of this scan. The honest answer is unknown, with a specific coverage gap identified, not “safe” or “unsafe”. The next concrete step is finding out why those 5 files are unsupported before any enable or trust decision.
Parsing, identity, severity, coverage, and policy are owned by the binary. The agent receives command-validated JSON through a bounded runner, never raw plugin source in its context.
The skill forbids cloning, rendering, sourcing, or executing candidate content, and ignores the target's README, AGENTS.md, CLAUDE.md, hooks, and scripts. Prompt injection has nowhere to land.
Trust, enable, overrides, reviewed updates, and timers require a live operator's confirmation against an exact identity. They are refused in CI, headless, delegated, or full-auto sessions.
Agents and CI read the same versioned report. --fail-on high turns a scan into a gate: exit 4 when the threshold is met, exit 3 for actionable drift, 0 for nothing new.
In the bar
Every marker keeps its word. Incomplete coverage stays amber and non-passing. Cached results say stale. A chip with no count is a tab with no collector, never a clean tab.
What ships in v0.3.1
The v0.2 series made plugin coverage explicit. v0.3 adds the first data not keyed by plugin: the host itself. The trust layer stays small, and every result carries identity, evidence, and coverage.
QML, JavaScript, shell, Python, and native binaries inventoried with digests, invocation edges, and explicit per-file coverage. Bounded dataflow, not guesswork.
Rule-backed findings, capability context, marketplace claims, and candidate updates checked against an immutable commit before the native updater mutates anything.
Advisory and hardened policies, per-file opaque executable reviews, scoped suppressions, exact expiring overrides, and report-only scheduled scans.
LUKS, firewall, listeners, kernel restart, keyring, persistence, PATH hygiene, pending updates, and advisories. Regression notifications deduplicate; a stable machine stays quiet.
Scope
Repository, HEAD, tree OID, dirty worktree, content digest.
Correlated against a commit-pinned catalog snapshot.
Your baseline, an exact diff, a daily quiet sweep.
Payload, capability, and coverage evidence per file.
18 read-only checks with state, not a score.
Roadmap
The analyzer is bounded and evidence-first. Lifecycle controls stay opt-in, explicit, and reportable. No privileges are requested before v0.5.
Inventory, catalog correlation, commit identity, baseline, diff, drift alerts.
Released · 2026-08Payload analyzer, candidate source scans, scan caching, explicit coverage, opaque executable review, hardened lifecycle gates.
Shipped in v0.3.118-check catalog, coverage states, update awareness, post-update hook, support export, daily and weekly timers. Next: posture baselines, windowed digests, bar indicator.
Current · v0.3.1 · 2026-09-09PKGBUILD static analysis and update diffs, never executing a build file.
Per-action polkit helper, first hardening installer, report export.
Secrets sweep, panic workflow, VirusTotal hash lookups, ClamAV, AIDE.
Boundaries
Getting started
Download the signed v0.3.1 CLI, run your first posture scan, pin a baseline for the plugins you already trust, and let the daily timer stay quiet until something changes. The bar widget and agent skill are separate installs with their own lifecycles.
# download the pinned installer, review it, then run it curl --fail --proto '=https' --tlsv1.2 --location \ https://raw.githubusercontent.com/tuthan/omasafe/v0.3.1/scripts/install-cli.sh \ --output install-cli.sh less install-cli.sh bash install-cli.sh --version v0.3.1 # verifies the Sigstore bundle and SHA-256 before installing to ~/.local/bin omasafe-cli --version
# the host omasafe-cli posture scan omasafe-cli posture export --format markdown # a plugin you have not installed yet omasafe-cli scan-plugin --request \ 'omarchy plugin add https://github.com/OWNER/REPO.git --enable' # the plugins you already run omasafe-cli plugins inventory omasafe-cli plugins trust PLUGIN_ID omasafe-cli scan --include-analysis --notify omasafe-cli schedule install --policy advisory
Prefer a UI? Add the bar widget from the Omarchy marketplace. Reviewing with an AI assistant? Install the agent skill and paste a plugin URL.