Unified typing controls, ARM installation work and plugin security fixes

01Keyboard layouts and input engines share one typing workflow

dhh merged omacom/omarchy#14433 into quattro on October 10. The committed change connects installer keyboard selection to input-engine setup and adds immediate keyboard-layout and input-method selection through the Typing menu. Super+I cycles layouts and composition engines together, while Super+Shift+I cycles backward. These are development-branch changes.

Review by greptile-apps[bot] caught shortcuts losing selections without a focused text field and failed font writes leaving saved input methods inconsistent with menu checks. dhh reported fixes that retain unfocused selections and restore the previous input group after a font-write failure. omacom/omarchy#14433:discussion_r4237897756 and omacom/omarchy#14433:discussion_r4239436913 document those corrections.

xdanger proposed using Shift to leave Chinese input, with similar behavior for Japanese and Korean engines. dhh agreed to address Caps Lock and the Shift behavior in a follow-up, keeping that suggestion separate from the merged typing work. omacom/omarchy#14433:issuecomment-6098200521 and omacom/omarchy#14433:issuecomment-6098373295 record the proposal and response.

02ARM support advances through runtime integration and installation checks

ryanrhughes opened the NVIDIA N1x runtime proposal and aarch64 ISO proposal on October 10. Both subsequently merged into quattro on October 15, outside this issue's coverage interval: omacom/omarchy#14820 and omacom/omarchy-iso#251. Their current descriptions cover broader N1x, Snapdragon and GB10 support; those later descriptions should not be read as the original opening-day scope.

October 10 also brought omarchybot's Mac convergence commit to quattro, introducing platform-aware setup and boot lifecycle integration. omacom/omarchy@e1b0e5e9bb72 records that integration. Separate ISO commits attributed to Emir Beganovic, with emirb among their recorded participants, added unattended generic aarch64 installation and boot checks and changed live-root compression to lz4 because the generic kernel could not read zstd-compressed squashfs.

ryanrhughes also committed target installation of the Arch Linux ARM keyring and signature validation against it. This addresses installed systems rejecting signed packages during their first online package operation. omacom/omarchy-iso@2487d3b1cb7e records the repair; these commits and development merges do not establish a stable ARM release.

03Qt 6.12 plugin breakage gets a package and shell workaround

outfoxxed proposed a temporary Quickshell patch for a Qt 6.12 type-name conflict affecting plugins, and ryanrhughes merged it into the package repository's master branch. github-actions[bot] then reported quickshell 0.3.2-3 live on edge for both x86_64 and aarch64. omacom/omarchy-pkgs#935 and omacom/omarchy-pkgs#935:issuecomment-6096470146 establish the merge and publication.

outfoxxed also merged the companion shell change into quattro through omacom/omarchy#14845. Its committed change enables the workaround for QtQuick imports, avoiding the overlapping Color type by using version 6.11 imports. This is an edge package publication paired with a development-branch shell change.

04Accessory approval lockout report accompanies a rollback proposal

gavrix reported that USBGuard blocked both keyboard and mouse through a Dell monitor used as a KVM, leaving no working input to approve them. The reported recovery required booting a snapshot to disable USBGuard. omacom/omarchy#11874:issuecomment-6102552400 documents the user impact.

omarchybot opened omacom/omarchy#14938 late on October 10 to revert USB and Thunderbolt authorization. Its current description includes migration work to undo installed enforcement and boot restrictions, because removing source alone would leave protection active without its approval controls. omarchybot's in-day validation report described disposable-worker checks while explicitly leaving physical Thunderbolt firmware restoration untested.

The rollback proposal was closed without merging on October 12, outside coverage. Its current state therefore does not establish that the proposed removal reached quattro.

05Stale lock state can prevent subsequent screen locks

The currently open omacom/omarchy#14816 was opened by dsundt on October 10. In an in-day follow-up, dsundt reported that every completed unlock on the tested machine left the shell believing it remained locked, causing the next lock request to do nothing. Restarting the shell was the reported workaround. omacom/omarchy#14816:issuecomment-6100203282 supplies that observation independently of the issue body's later edits.

scottadair reported the same state on another laptop, including two lid-close suspends without a secure lock and nonfunctional manual locking. rafalyovson connected the report to an existing Quickshell investigation and competing fixes, while reporting reproduction on the latest tested edge build. These are contributor reports and diagnosis, rather than evidence of a merged repair. omacom/omarchy#14816:issuecomment-6097484047 and omacom/omarchy#14816:issuecomment-6099485761 document the progression.

06Small USB netinstall proposal closes over maintenance cost

Tsurgcom proposed network installation media small enough for a nominal 4 GB USB stick in omacom/omarchy-iso#256. The author reported a roughly 1.41 GiB image by omitting the bundled package mirror, trading offline installation for a working internet connection.

Live testing exposed keyring seeding and Wi-Fi scan-parsing defects. Tsurgcom reported correcting those, then fixing agent sockets accidentally carried inside the keyring seed. A rebuilt image subsequently completed an unattended network install and reboot with no failed units, according to the author's test report in omacom/omarchy-iso#256:issuecomment-6101577594.

dhh declined adding another installation mode because of the existing ISO maintenance burden, while leaving room for independent maintenance. The proposal closed unmerged on October 10. omacom/omarchy-iso#256:issuecomment-6103168854 records the decision.

07Piphone listing follows phone-access and app-scope repairs

Piphone, submitted by areu01or00, adds iPhone control through an Omarchy widget and panel backed by WebDriverAgent and a Pi extension. github-actions[bot] reported its publication as a verified marketplace snapshot after maintainer review. omacom/omarchy-plugin-marketplace#10915:issuecomment-6098503193 records publication.

HANCORE-linux's review identified unauthenticated local access to phone-control endpoints and private profile exposure. areu01or00 replaced the direct endpoints with owner-only Unix sockets, tightened profile handling and isolated the underlying tunnel in a private network namespace. Subsequent fixes checked the live foreground app before actions, checked again after posting approval, and stopped watchers when their app left the permitted scope.

HANCORE-linux accepted the reviewed endpoint, profile, tunnel and app-scope fixes, while requiring manual setup for the local build, signed WebDriverAgent and Pi/model configuration. omacom/omarchy-plugin-marketplace#10915:issuecomment-6098467632 records that decision. The marketplace verification applies to the reviewed snapshot and is not a security audit.

08Omabump verification exposes a privileged Voxtype upgrade-hook flaw

Vladkarok's request to verify a newer Omabump snapshot remains open in omacom/omarchy-plugin-marketplace#10910. During review, HANCORE-linux identified a Voxtype package hook that read a handoff file from a shared temporary directory without checking ownership and accepted an attacker-controlled executable as the system launcher.

Vladkarok confirmed the mechanism and explained that the same hook ran through ordinary package upgrades, placing the repair in the package rather than the plugin. The author described a proposed change using root-only storage and restricting restored executable paths, then planned to update Omabump's pinned recipe after that fix merged. omacom/omarchy-plugin-marketplace#10910:issuecomment-6098036843 records that response; the supplied discussion does not establish completion of the package repair.

09Ward review questions disclosure through read-only directory grants

jacob-vincent-mink's Ward proposal remains open as omacom/omarchy#10974. Its current description proposes isolated third-party Quickshell workers with revision-specific approvals and selected grants, while identifying native packaging, registry routing and broader acceptance work as unfinished.

On October 10, reviewer SorenHJohansen reported that read-only grants could expose protected host configuration even where writable grants were rejected. The reviewer described an end-to-end approval reproduction and requested either rejection of those roots for both access modes or an explicit disclosure contract. The same review raised compiler-path and graphics-environment problems in optional tests. omacom/omarchy#10974:issuecomment-6102074229 adds a concrete confidentiality question to the still-open isolation proposal.