Omahub
← All plugins
G

Snapman: Snapshot Manager

by Grenco

Keep Snapper recovery points visible, useful, and under control from the Omarchy bar, without memorizing commands or letting old snapshots fill your disk.

GitHub

Security review

Potentially dangerous behavior detected · 9 findings

Deterministic scan — not a security guarantee

High
Risk level
High
Analyzed commit
e086c47
Scanned
4 weeks ago
  • high persistence scripts/snapman-retention.service:1

    Bundles a systemd unit file.

    [Unit]
  • high persistence scripts/snapman-retention.timer:1

    Bundles a systemd unit file.

    [Unit]
  • medium sudo Panel.qml:332

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo limine-snapper-restore --kernels " + String(number)
  • medium sudo scripts/snapman-apply-retention:36

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo sed -i \
  • medium sudo scripts/snapman-apply-retention:40

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo snapper -c root cleanup number
  • medium sudo scripts/install-support.sh:18

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo snapper -c root set-config ALLOW_USERS=\"$USER\"" >&2
  • Docs sudo README.md:80

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo snapper -c root create-config /          # only if /etc/snapper/configs/root is missing
  • Docs sudo README.md:81

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo snapper -c root set-config ALLOW_USERS="$(whoami)"
  • Docs sudo README.md:82

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo snapper -c root set-config SYNC_ACL="yes"

Automated analysis only — not a security guarantee.

AI advisory review

No obvious issues detected

Language-model assessment · ~deepseek/deepseek-v4-flash-latest — advisory only

Low
AI risk level
Low
Recommendation
install
Model
~deepseek/deepseek-v4-flash-latest
Analyzed commit
e086c47
Reviewed
4 weeks ago

The plugin is a well-documented Snapper snapshot manager for the Omarchy bar. It uses sudo only for explicit user-initiated retention config changes, installs a user-level systemd timer for cleanup, and includes input validation and safe file handling. The deterministic scan flags are expected for this functionality and do not indicate malicious behavior.

  • Uses sudo to edit /etc/snapper/configs/root, but only when the user explicitly changes retention settings and with a password prompt.
  • Installs a user systemd timer for retention cleanup, which is benign and user-scoped.
  • Update mechanism fetches a catalog over HTTPS and only applies verified updates.
How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.

Install
$ omarchy plugin add https://github.com/Grenco/omarchy-snapman --enable
System #bar #quickshell

Snapman

Snapman brings Snapper snapshot management to the Omarchy shell bar. It keeps recovery points visible and cleanup easy to manage without requiring Snapper commands for everyday tasks. View, diff, create, restore, boot into, and delete snapshots from a compact, keyboard-first panel.

Features

Browse and inspect

A compact, filterable list of every stored snapshot with its age, used space, and Limine bootable marker. Selecting a snapshot previews the changed paths against the live filesystem, and F filters the list.

Snapshot list

Retention policy & bulk cleanup

Press S, or the header Cleanup button, to open the cleanup view. Set a persistent retention policy — keep the newest N snapshots (written to snapper's config and enforced on every omarchy update), or keep snapshots newer than X days (trimmed by a daily background timer). The same view runs one-shot bulk deletes, with a live count and a confirmation dialog before anything is removed.

Retention & bulk cleanup

Per-snapshot actions

Create, full diff, boot next, restore, and delete any snapshot directly from the panel, with vim bindings throughout — including H/L to switch the choice on confirmation dialogs. A standalone TUI (omarchy-snapman-tui, requires fzf

  • less) is included as a bonus.

Pinned snapshots

Pin a snapshot (P, or the Pin button) to protect it from retention cleanup. Snapper marks it important, so it survives the count-based policy and the daily age-based timer skips it. Unpin to let it age out normally.

Update awareness

Snapman offers Diff, Update, and Store only when the fetched commit exactly matches the marketplace's verified snapshot. Updates without that verification are not offered from the panel, and the check is repeated just before an update starts.

Requirements

  • snapper with a root config, and your user in ALLOW_USERS (so deletes and creates run without a password — see the setup below).
  • limine-snapper-sync for the bootable marker and boot-to-snapshot.
  • jq (used by the retention timer).
  • omarchy-launch-floating-terminal-with-presentation (ships with Omarchy).

Retention config writes run through sudo and prompt for your password once.

Install

omarchy plugin add https://github.com/Grenco/omarchy-snapman.git --enable

The plugin id is grenco.snapman. Enable it later with omarchy plugin enable grenco.snapman.

Snapper user access (one-time, with sudo)

Snapman performs create/delete/bulk operations without a password, but snapper only grants that to users listed in the root config's ALLOW_USERS. This is broad access to snapshots for the root config, including creating, deleting, and changing snapshots. Add only trusted local accounts. SYNC_ACL="yes" propagates that access to snapshots; it is not a substitute for restricting who can use the machine.

Snapman never changes ALLOW_USERS, sudoers, Polkit, or PAM. Omarchy does not add this access by default, so choose and run this one-time setup yourself:

sudo snapper -c root create-config /          # only if /etc/snapper/configs/root is missing
sudo snapper -c root set-config ALLOW_USERS="$(whoami)"
sudo snapper -c root set-config SYNC_ACL="yes"

snapperd is D-Bus-activated and starts on demand — there is nothing to enable. If this step is skipped, snapshot actions can fail or prompt for authorization. Editing the retention policy still prompts for sudo, because it rewrites /etc/snapper/configs/root.

Removal

omarchy plugin remove grenco.snapman

The retention timer and helper scripts are user-owned, so the plugin command does not remove them. To clean those up as well:

systemctl --user disable --now snapman-retention.timer
rm -f ~/.local/bin/omarchy-snapman-tui \
       ~/.config/systemd/user/snapman-retention.service \
      ~/.config/systemd/user/snapman-retention.timer
rm -f ~/.config/omarchy/snapman.conf   # saved retention policy (optional)
systemctl --user daemon-reload

Keys

J/K select   C new   D/Enter diff   X delete   B boot   R restore
S cleanup   F filter   G refresh   Q/Esc close

In the Cleanup view: H/L switch tabs, Esc or ← Close goes back.

Notes

  • Applying age-based retention installs a small user systemd timer (snapman-retention.timer, daily at 06:00). Its unit executes the retention script from the installed plugin, so plugin updates take effect without a stale copied helper. Count mode disables the timer.
  • Policy state is kept in ~/.config/omarchy/snapman.conf.
  • Run tests/security-regression.sh to exercise the verified-update gate and retention input bounds.

License

MIT — see LICENSE.