Skip to content

docs(prd): 0017 — put the herd on the Omarchy bar - #527

Merged
ralyodio merged 1 commit into
mainfrom
worktree-omarchy-plugin-prd
Sep 22, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-omarchy-plugin-prd

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

PRD 0017: an Omarchy bar plugin for the herd, and the one command it reads.

Why. Everything moshcode knows about a running fleet is behind a prompt. ps, cost, fleet tree are all true and none of them are on screen, so you learn the state of your machine by deciding to ask. The expensive version of that was 2026-09-13 ($131/hour at list, unseen until someone typed moshcode cost); the common version is an agent sitting in blocked for twenty minutes holding a pane and a context window.

What it proposes.

  • moshcode omarchy status --json — one read-only, bounded, cached snapshot (agents, counts, burn windows, fleets, alerts) built from ps --json, cost --all --json and fleet tree --json in a single process boot. Measured at ~210ms each today, so the cache exists for the 1s poll, not for the work.
  • sh.moshcode.herd — a bar-widget + panel plugin in its own repo (manifest.json has to sit at the root, because omarchy plugin add clones a git URL). One glyph with four states, blocked being the one the whole thing exists for; a dense panel that uses the same words as the CLI.
  • moshcode omarchy validate — the documented marketplace checks reimplemented in JS, so the plugin can be verified in CI on a box with no Omarchy on it.

Constraint that shapes it. Omarchy plugins run unsandboxed inside a shared, long-running Quickshell process. A leaked process or an unguarded JSON.parse takes down the whole bar for whoever installed it, so 0.1 is read-only, one Process at a time, no shell, no writes.

Known gap, stated in the PRD. This box is Ubuntu 26.04 with no omarchy, omarchy-shell, quickshell or qmllint. The CLI half is testable here; every QML requirement needs a real Omarchy install, and that gates the plugin half. Two other open questions want an explicit answer before implementation: the separate plugin repo, and whether the blocked alert should also ship as a service kind so it works with no widget placed.

Draft, per the OpenPRD lifecycle. Index regenerated; test/prd.test.mjs + test/prd-index-cell.test.mjs pass (32/32).

🤖 Generated with Claude Code

An Omarchy bar-widget + panel plugin (sh.moshcode.herd) that renders
running agents, blocked agents and the burn windows, fed by a single
new read-only command, `moshcode omarchy status --json`.

Grounded in the develop/publish docs at plugins.omarchy.org: QML under
a shared unsandboxed Quickshell process, manifest.json at the repo root,
install from a git URL, listing by GitHub issue. Shapes and timings for
the snapshot come from the live CLI (`ps`, `cost --json`, `fleet tree`,
~210ms each on this box).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@ralyodio
ralyodio marked this pull request as ready for review September 22, 2026 14:17
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 2 file(s) this pull request changes.

Nothing in the files this pull request changes.

101 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 82 | **LOW**: 11

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928

…and 81 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 83ddfbd into main Sep 22, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant