Skip to content

feat(omarchy): the herd on the Omarchy bar (PRD 0017) - #529

Merged
ralyodio merged 1 commit into
mainfrom
worktree-omarchy-build
Sep 22, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-omarchy-build

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Implements PRD 0017. Two halves: the command the bar polls, and the plugin that polls it.

moshcode omarchy

verb what it does
status the snapshot: agents, counts, burn windows, fleets, alerts
validate the marketplace's manifest and layout checks, in JS, with no Omarchy installed
install copy the plugin into ~/.config/omarchy/plugins and rescan (backs up what it replaces)
doctor what is present on this box, and what that rules out

status is read-only and never exits non-zero for something the bar should render — "no herd", "no rates", "cost was slow" are answers, not failures. The cost half is cached for 5s under ~/.moshcode/herd/omarchy-status.json (0600); a reading that took over 2s marks itself slow and is held for a minute; a reading that throws serves the last good one and marks the snapshot partial. The herd and cost module graphs load lazily, so the three cheap verbs never pay for them.

Real output on this box: 4 agents · $85.56/h, with the fleet and blocked counts from the live herd.

The plugin

omarchy/manifest.json (sh.moshcode.herd, schemaVersion 1, bar-widget + panel), BarWidget.qml, Panel.qml, Model.js, README, LICENSE. One Process at a time, no shell, guarded parses, theme-driven colours, zero writes. Blocked agents are the one thing that changes colour and pulses, because that is the state this exists for.

What measurement changed

The PRD said 5s/1s polling on the strength of a 210ms reading of moshcode ps --json. Measured properly, a moshcode process costs 0.66s to 4.2s on a box busy running the agents it reports on, and nearly all of it is node's start-up plus the CLI's — omarchy validate, which reads one manifest, costs the same. So the cadence is now 10s closed / 3s open, and the success metric bounds the snapshot's own work (roster 215ms, fleets 1ms, cost 5ms cached) instead of wall clock. Both corrections are written into the PRD with the reason, and 0017 moves Draft to Accepted.

Not verified

Anything QML. This box is Ubuntu 26.04 with no omarchy, omarchy-shell or qmllint, which moshcode omarchy doctor says plainly. R13 (qmllint clean, omarchy plugin validate, the widget in a real bar, an hour with no leaked processes) and R14 (the marketplace listing) stay open until there is an Omarchy box. R3's separate moshcoder/omarchy-moshcode repo is not created either — the source ships here and moshcode omarchy install places it, so nothing is blocked on that decision.

Tests

test/omarchy.test.mjs, 28 new tests: snapshot shape and vocabulary, counts for states nobody is in, blocked-only alerts, a roster that throws, unpriced engines counting as unpriced rather than free, the cache's ttl / slow-ttl / error paths and its 0600 mode, and every validator rule including the symlink and path-escape rejections. Full repo suite: 2533 pass, 0 fail, 4 skipped.

🤖 Generated with Claude Code

`moshcode omarchy` — status, validate, install, doctor — plus the QML bar
widget and panel the snapshot feeds.

status is the one command the plugin runs: agents, counts, burn windows,
fleets and alerts in a single process, read-only, with the cost half cached
(5s, or a minute when a reading was slow) and a partial snapshot rather than
a failure when cost throws. The herd and cost module graphs load lazily, so
validate/doctor/install never pay for them.

The plugin is deliberately small: one Process at a time, no shell, guarded
parses, theme-driven colours, and no writes at all. It runs unsandboxed in
Omarchy's shared Quickshell process, where a leak or a throw is everyone's
bar, not just ours.

Measured during implementation and fed back into the PRD: a moshcode process
costs 0.66-4.2s on a loaded box, almost all of it node and CLI start-up, so
the poll is 10s closed / 3s open rather than the 5s/1s the PRD first claimed,
and the success metric now bounds the snapshot's own work instead of wall
clock. PRD 0017 moves Draft -> Accepted.

Not verified: anything QML. This box is Ubuntu with no omarchy, omarchy-shell
or qmllint, so R13 (qmllint, omarchy plugin validate, a real bar) and the
marketplace submission are still open.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

7 finding(s) in the 14 file(s) this pull request changes.

MEDIUM: 7

Severity Rule Location
MEDIUM sql-string-concatenation src/cli-schema.mjs:180
MEDIUM sql-string-concatenation src/cli-schema.mjs:239
MEDIUM sql-string-concatenation src/cli-schema.mjs:611
MEDIUM sql-string-concatenation src/cli-schema.mjs:644
MEDIUM sql-string-concatenation src/cli-schema.mjs:751
MEDIUM sql-string-concatenation src/cli-schema.mjs:1504
MEDIUM sql-string-concatenation src/cli-schema.mjs:1522
94 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 75 | **LOW**: 11

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928

…and 74 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 8c7f422 into main Sep 22, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant