The config panel used a fixed contentWidth of Style.space(250), the
narrowest of all omarchy panels. With a wider font the Filter row (label
"Filter" plus the All keys / Bindings buttons) no longer fit and the
label overlapped the buttons. Derive contentWidth from the Filter row's
implicit width (label + gap + buttons) plus padding and borders, capped
to the available screen via fittedContentWidth, so the panel grows or
shrinks with the font.
debugFont was referenced by debugText and debugFontMetrics before its
declaration, causing "ReferenceError: debugFont is not defined" on panel
load. Move both the debugFont property and the debugFontMetrics FontMetrics
block above the debug overlay so all references resolve in declaration
order; qualify the last use as root.debugFont.
Validate the systemd runtime path using the process effective UID instead of shell ownership probes that fail in Hyprland's embedded Lua runtime. Keep Quickshell FileView watchers live by updating their fixed, private state paths in place and seed both state files when the hook loads.
Workflow missed commits like fix(security): ... because git log
--pretty=format:"%H %s" without trailing newline truncated the last
commit in RANGE (v1.8.0..HEAD), causing "No relevant conventional
commits" for v1.8.1. Switch to --format="%H %s" which handles
newlines correctly and supports optional scope and breaking ! via
regex ^(feat|fix)(\([^)]+\))?!?:
Remove predictable /tmp/omarchy-key-visualizer.json fallback that exposed
captured key combinations and allowed symlink redirection when
XDG_RUNTIME_DIR is absent. Introduce fail-closed behaviour: disable
capture if XDG_RUNTIME_DIR is missing, equals /tmp, is not absolute,
not owned or not 0700.
Add secure_write with O_NOFOLLOW mitigation (test ! -L), atomic
tmp+rename and chmod 600 to prevent world-readable leaks and TOCTOU
races. Apply same guard to QML statePath/superPath and Panel nudge
writes (umask 077, chmod 600, symlink check).
Fixes security review at 790b07c0c9:
key-visualizer.lua:15-17,141-145
Add unit-by-unit manual position control via a four-button D-pad
(left, up/down together, right) under the position dropdown. Nudges
persist as offsetX/offsetY in the shared config and are silently
clamped to the screen edges, so a move that would cross a border is
ignored. Selecting a preset position resets the manual offset. While
the display is hidden, a nudge flashes a directional arrow preview so
the move direction is visible even with no keys on screen.
Co-Authored-By: opencode <opencode@anthropic.com>
The README is for people installing the plugin, not for development: use
https://github.com/felixzsh/omarchy-key-visualizer as the add source,
drop the author-only validate tip, and reword the stale-component note
for end users. Adds the update command for good measure.
Trim the technical detail (state file paths, reload pipeline internals,
scoring formulas) and move the combo mode GIF next to the preview image.
Also fixes stale references: the bar widget section now says Filter and
six placements, and the How it works table is gone.
Releasing a chord made only of modifiers (Super, Super Ctrl Shift...) is
'mods of nothing': it scores nothing in combo mode and now no longer
lingers or occupies a history row either. The mods still show live while
held, which is the useful feedback; on release the entry is removed
instantly instead of entering its linger window.
The Lua emits on every key-down, so a chord pressed key-by-key without
releasing arrives as growing states (Super, Super Ctrl, Super Ctrl
Shift, Super Ctrl Shift 1). The history treated each one as a separate
combo, filling the stack with partial noise. Now a growing state while
the chord is still held (a strict superset of the current entry) updates
the entry in place instead of pushing a history row; only the complete
combo at release ever enters the history.
A 'Combo mode' toggle turns the display into a game-style counter.
Chords containing a modifier (Super/Ctrl/Alt/Shift/Menu/AltGr) are
combos: they build a combo counter, apply a multiplier (x2 at 5, x3 at
10 ... x8 at 50) and escalate the effects. Plain characters and shifted
chars typed alone are hits: +10 score only, they never touch the combo
counter or its window. Scoring: hit = 10, combo = (20 + 15*(mods-1) +
5*(keys-1)) * multiplier.
Counted once per physical chord on the Lua's empty payload (release),
so the intermediate growing emits of a chord never double-count. The
banner (COMBO 12 x3 - 3,450) sits below the history for bottom
positions and above it for top positions, with a floating +N pop per
press. Effects scale with modifiers and chain length: banner pulse,
hue shift, screen shake (up to 5px), continuous hue cycling at 10+
combos and a constant subtle vibration at 20+. The combo resets after
comboWindowMs (2s) without a new combo; the score accumulates for the
shell session.
Also fixes the README Behavior section: the history bullet was never
applied (a failed multi-edit call), now restored alongside the combo
mode docs. Manifest bumped to 1.7.0.
The last historyCount combos (1-5, default 1) stack on screen instead
of vanishing: each new combo pushes the previous one down the stack and
every older entry fades step by step (entryOpacity gradient). The stack
direction follows the position by default — top positions grow downward
(newest on top), bottom positions grow upward (newest at the bottom
edge) — and is not configurable. The panel gains a History NumberField
for the count.
Middle positions (center-left/center-right/center-center) were removed
from the dropdown and any leftover config value is folded into the
bottom row. With lingerMs 0 entries never expire, so the stack keeps
the last few combos on screen until newer ones push them out.
Manifest bumped to 1.6.0.
The documented plugin manifest contract (docs/omarchy-shell.md) and every
first-party manifest include author; the publishing validation rejects a
manifest without it.
The shared TextMetrics had its text set imperatively inside the width
bindings, which went stale from the third chip on — every container
collapsed to single-char width, so Super/Space/Backspace were illegible
in combos of 3+. FontMetrics.advanceWidth(text) is a stateless method,
so every chip gets its own correct width.
The hint slot is always reserved on the right (fixed width), the field
keeps a constant width, and the row has a fixed height with everything
vertically centered — the hint no longer sits at the top-right corner
and the field no longer resizes when it appears. Hint text is body size
like the other menu labels.
Align the never-hide hint to the SpinBox center
Anchoring the hint to the row container left it offset whenever the
row's implicit height differed from the field's rendered height. Anchor
to lingerField.field (the NumberField exposes the SpinBox) so the hint
always sits exactly beside the field.
Place the never-hide hint right next to the field
Anchor the hint to the SpinBox's right edge with the field's own height
and vertical center, so it reads as part of the control instead of a
floating label at the row edge.
Rebuild the Linger row as a plain RowLayout
NumberField is a Column (label above the field), and anchoring the hint
to its field alias left the text unanchored when the alias did not
resolve, dumping it at (0,0) over the label. A RowLayout puts label,
field, and hint in the flow, vertically centered by Layout.alignment —
no anchors, no aliases. The field comes first, so the hint never moves
it.
Move the Linger label above the field, Position-style
Label above (caption, bold, darkened — identical to the Dropdown label),
the field pinned to the left half, and the never-hide legend on the
right half via a fill-width spacer, so it appears only at 0 without
moving the field.
When lingerMs is 0 (always show), a muted caption appears on the right of
the field so the opt-in is visible at a glance; the field shrinks to make
room. Config unchanged.
Native qs.Ui.NumberField (SpinBox) for lingerMs: mouse wheel, +/- buttons
and typing, 0-10000ms in 500ms steps, writing config.json like Mode and
Position so the display updates live. 0 selects the always-show behavior
from the previous commit.
The hide timer only starts (and only clears) when lingerMs > 0, so 0
means the last full combo stays visible until the next key replaces it
— the keyviz-video look, as an explicit opt-in rather than the previous
behavior where 0 hid instantly.
The three Position buttons (Bottom/Top/Center) overlapped the label in
the menu's width. Use qs.Ui.Dropdown with the full 3x3 grid — top /
middle / bottom by left / center / right — the display panel already
positions all of them.
JS \u takes exactly 4 hex digits, so \uF030C rendered U+F030 (fa-camera
in the Nerd Font's Font Awesome range) followed by a literal C — a camera
with a trailing c, exactly what was on the bar. U+F030C is in PUA-A and
needs a UTF-16 surrogate pair: \uDB80\uDF0C. Also correct the comment
name (it is md-keyboard, not md-keyboard_outline).
felixzsh