Omarchy

I recently saw a compelling review of Omarchy. It’s been a while since I’ve been a diehard *nix user. Owning operations outcomes for corporate environments taught me that constraining variables wherever I could led to more stable environments and less frustration when designing and implementing controls. When I’m asked what my OS and hardware preference is, the legitimate answer is “whatever the user base already uses.” I can run a terminal and browser on anything. Being able to secure the environment more effectively matters a lot more to me than what logo I see every day. Still, I keep the spark of interest in technology alive, despite, or maybe because of, those frustrations designing and implementing controls.

Omarchy really spoke to me with its combination of beauty, ease of deployment, and stability, while retaining what makes Linux great. The AI-first integration also piqued my curiosity. I’ve done a lot of exploring into how to reasonably secure personal agents, and I know the difficulty spans many domains.

The Good

It installed very rapidly, as claimed. It was very straightforward to do the base configuration. The themes are pretty cool, though many of them are a bit dramatic and unlikely to be colors I could have in play for long periods of real work. Fonts in pastels are not that friendly to my eyes anymore. I really love the minimalism, auto-snapping, mouseless navigation, and utilities that expose far richer data than you get on mainstream operating systems, while keeping it looking sharp at the same time.

The AI Integration

I had no idea what to expect here. It was a pleasant surprise to find that it has many agent harnesses pre-wired for lazy installation, including Claude Code, Codex, Grok, Gemini, OpenCode, Pi, and others, with easy setup from the main menu. It also has a handy agents panel in the top bar that helps track token usage. It is insanely easy to get going, and it has skills built in to help agents understand how to interact with and customize Omarchy.

The Bad

While it works fine on older hardware (I’m typing this on a 12-year-old gaming system I dusted off to install it on), it assumes things. For example, Omarchy assumes a 2x-capable, retina-class display by default; its documentation points to 27-inch 5K and 32-inch 6K monitors as examples. You can reconfigure it to work fine at a lower resolution, but you need to RTFM and adjust the scaling through its shortcuts or configuration. I suspect there may be other similar design decisions that assume newer, high-end hardware. Really, this is a nitpick, and it looks fine on the even older monitor I’m using (a 27-inch Apple LED Cinema Display from 2010).

The Ugly

I was not thrilled to see “Permissions: YOLO mode” in the Codex CLI. I reviewed the launch path, and it really is YOLO mode. Omarchy’s default-agent launcher invokes Codex with --dangerously-bypass-approvals-and-sandbox; the cy alias uses -s danger-full-access -a never. That permits commands to use all access available to the host account, disables the command sandbox, and prevents Codex from pausing for normal approval prompts. Under Codex’s current defaults, full-access mode also makes web search live. OpenAI’s CLI documentation says to use the bypass mode only inside an externally hardened environment.

No doubt AI agents are vastly more capable when unconstrained, but on a general-purpose host with personal credentials and access to a trusted LAN, the risk is sky high.

Power It Off?

Not quite. I appreciate the power and the opportunity to continue my research. That said, this system is going to get PATs for GitHub, narrow OAuth grants, and its own accounts when highly restrictive API access isn’t an option. It is also getting its own VLAN, cut off from the rest of my network. I won’t be authenticating to my high-value accounts in this browser.