OmaVLESS

OmaVLESS is a VPN app for Omarchy that puts everyday connection controls directly in the bar. Import your own compatible VLESS profile or HTTPS subscription, choose Full VPN, Routing or Direct, connect to a profile, switch profiles, or disconnect, and refresh subscription server lists. Free and open source; VPN servers and service subscriptions are not included.

GitHub

Security review

Potentially dangerous behavior detected · 53 findings

Deterministic scan — not a security guarantee

High

Risk level: High
Analyzed commit: d620c30
Scanned: 1 week ago

high permission_ownership …/workflows/native-package.yml:35

Recursively changes file ownership.
```
chown -R packagebuilder:packagebuilder "$GITHUB_WORKSPACE"
```
high permission_ownership …/workflows/native-package.yml:79

Recursively changes file ownership.
```
chown -R packagebuilder:packagebuilder /source
```
high permission_ownership …/workflows/native-package.yml:83

Recursively changes file ownership.
```
chown -R "$(id -u):$(id -g)" "$RUNNER_TEMP/omavless-arm-artifacts"
```
high persistence tests/test-native-no-python.js:62

Registers scheduled or boot-time system tasks.
```
systemd-run", "resolvectl"]) assert(subject.BLOCKED.includes(name));
```
high persistence tests/native_service_acceptance.py:373

Registers scheduled or boot-time system tasks.
```
systemd-run", "--user", "--collect", "--unit=" + unit, "-p", "NoNewPrivileges=no",
```
high persistence tools/run-native-no-python.js:11

Registers scheduled or boot-time system tasks.
```
systemd-run", "busctl", "dbus-send", "resolvectl", "nmcli"]);
```
high persistence …/systemd/omavless-login-prepare.service:1

Bundles a systemd unit file.
```
[Unit]
```
high persistence …/systemd/omavless-runtime.service:1

Bundles a systemd unit file.
```
[Unit]
```
medium sudo tests/installed_native_package.py:216

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman ever sees it.
```
medium sudo tests/test_installed_native_package.py:2

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo or store."""
```
medium sudo tests/installed_python_mask.py:11

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo
```
medium sudo tests/installed_python_mask.py:21

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo findmnt --mountpoint /usr/bin/python3.14
```
medium sudo tests/installed_python_mask.py:23

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo umount /usr/bin/python3.14
```
medium sudo tests/installed_python_mask.py:129

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo occurs unless explicitly opted in from a real terminal."""
```
medium sudo plugin/Panel.qml:470

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo setcap cap_net_admin,cap_net_raw,cap_net_bind_service=+ep "
```
low obfuscation tests/test_vless_transport_parity.py:59

Augments a command with octal/hex escape sequences.
```
\xffprivate")
```
low obfuscation tests/test-native-import.js:70

Augments a command with octal/hex escape sequences.
```
\0b','/tmp/\ud800','/'+'я'.repeat(2048)]) {
```
low obfuscation tests/test-native-import.js:105

Augments a command with octal/hex escape sequences.
```
\0value','\ud800']) assert.equal(parser.importInput(input),false);
```
low obfuscation …/tests/desktop_cli.rs:81

Augments a command with octal/hex escape sequences.
```
\211PNG\\r\\n\\032\\n'\n").unwrap();
```
low obfuscation …/src/isolated_validation.rs:211

Augments a command with octal/hex escape sequences.
```
\x7fELF\x02\x01" {
```
low obfuscation …/cutover_activation/environment.rs:176

Augments a command with octal/hex escape sequences.
```
\x20state",
```
low obfuscation …/src/desktop_helpers.rs:29

Augments a command with octal/hex escape sequences.
```
\x89PNG\r\n\x1a\n") {
```
low obfuscation …/src/desktop_helpers.rs:358

Augments a command with octal/hex escape sequences.
```
\x89PNG\r\n\x1a\n") {
```
low obfuscation …/src/desktop_helpers.rs:1006

Augments a command with octal/hex escape sequences.
```
\000a'",
```
low obfuscation …/src/desktop_helpers.rs:1075

Augments a command with octal/hex escape sequences.
```
\x89PNG\r\n\x1a\n");
```
low obfuscation …/src/desktop_helpers.rs:1092

Augments a command with octal/hex escape sequences.
```
\x89PNG\r\n\x1a\n");
```
low obfuscation …/src/desktop_helpers.rs:1099

Augments a command with octal/hex escape sequences.
```
\211PNG\\r\\n\\032\\n'");
```
low obfuscation …/src/desktop_helpers.rs:1118

Augments a command with octal/hex escape sequences.
```
\211PNG\\r\\n\\032\\n'; /usr/bin/head -c 4194304 /dev/zero",
```
low obfuscation …/src/desktop_helpers.rs:1129

Augments a command with octal/hex escape sequences.
```
\211PNG\\r\\n\\032\\n'");
```
low obfuscation …/src/desktop_helpers.rs:1134

Augments a command with octal/hex escape sequences.
```
\x89PNG")
```
low obfuscation …/src/isolated_validation_tests.rs:121

Augments a command with octal/hex escape sequences.
```
\x7fELF\x02\x01");
```
low obfuscation …/src/native_probe_resolver_tests.rs:264

Augments a command with octal/hex escape sequences.
```
\x03com\0";
```
low obfuscation …/src/native_probe_resolver_tests.rs:267

Augments a command with octal/hex escape sequences.
```
\x03com\0"] {
```
low obfuscation …/src/native_probe_resolver_tests.rs:274

Augments a command with octal/hex escape sequences.
```
\x03com\0".iter().copied());
```
Docs persistence …/user/SECURITY.md:6

Registers scheduled or boot-time system tasks.
```
crontab or download executable code. The user must
```
Docs sudo …/testing/R6_INSTALLED_NO_PYTHON_DOMAIN_2026-09-12.md:20

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo authorization for a reviewed
```
Docs sudo …/testing/R6_PYTHON_DEPENDENCY_AUDIT.md:193

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo slice
```
Docs sudo …/testing/NATIVE_080_RC_PREPARATION_2026-09-13.md:134

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman -U`, after a single acknowledged semantic Disconnect and service
```
Docs sudo …/testing/R6_NATIVE_IPC_FILE_IMPORT.md:67

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo or polkit request was initiated.
```
Docs sudo …/testing/R6_INSTALLED_PACKAGE_RECOVERY_2026-09-12.md:54

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman -U`, with its own
```
Docs sudo …/testing/R6_INSTALLED_PACKAGE_RECOVERY_2026-09-12.md:61

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman -R` with its
```
Docs sudo …/testing/R6_INSTALLED_PACKAGE_RECOVERY_2026-09-12.md:89

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman -U` of that exact
```
Docs sudo …/testing/R6_INSTALLED_NO_PYTHON_LOGIN_OFF_2026-09-11.md:21

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo in a visible terminal. It created a
```
Docs sudo …/testing/MARKETPLACE_FIRST_RUN_2026-09-15.md:196

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo confirmation remain. Never
```
Docs sudo …/testing/R6_ATTENDED_PYTHON_ABSENCE.md:23

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo authorization for a temporary bind mount of a root-owned
```
Docs sudo …/roadmap/KILL_SWITCH.md:192

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo or pkexec. Administrator setup/recovery is
```
Docs sudo …/roadmap/KILL_SWITCH.md:322

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo omavless-netguard recover
```
Docs sudo …/user/INSTALL.md:80

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo setcap cap_net_admin,cap_net_raw,cap_net_bind_service=+ep "$mihomo_bin"
```
Docs sudo …/user/NATIVE_INSTALL.md:72

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman -U` installs the application. Setup prepares a new empty
```
Docs sudo …/user/NATIVE_INSTALL.md:183

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman -U -- /absolute/path/to/reviewed-omavless.pkg.tar.zst
```
Docs sudo …/user/NATIVE_INSTALL.md:335

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo pacman -U -- /absolute/path/to/reviewed-omavless.pkg.tar.zst
```

Docs sudo …/user/NATIVE_INSTALL.md:350

Command runs with sudo, elevating the process beyond the plugin environment.

sudo pacman -R -- omavless` | Removes the native package. Use only after verified shutdown, no other user's active runtime, and with the recovery archive retained. Does not remove the plugin or delibe

Docs sudo DEVELOPMENT_ROADMAP.md:245

Command runs with sudo, elevating the process beyond the plugin environment.
```
sudo work adds 51-alias launcher conformance, 45 actual Rust executable
```

Automated analysis only — not a security guarantee.

AI advisory review

No obvious issues detected

Language-model assessment · ~deepseek/deepseek-v4-flash-latest — advisory only

Low Recommends install

AI risk level: Low
Recommendation: install
Model: ~deepseek/deepseek-v4-flash-latest
Analyzed commit: d620c30
Reviewed: 1 week ago

The plugin is a QML bar widget that wraps a native Rust VPN runtime; the plugin code itself is a strict dispatcher (backend.sh) with a whitelist of commands and benign QML UI. The deterministic scan's high findings are largely false positives: chown in CI workflows, systemd units in packaging, and sudo mentions in documentation/tests are not part of the executable plugin path. The plugin install script requires the native package and does not start a tunnel or run destructive commands.

The plugin depends on an external native `omavless` binary and Mihomo core; users must ensure these are from a trusted source and that the native package is reviewed separately.
The plugin's Panel.qml may display or guide the user to run `sudo setcap` for Mihomo capabilities, but it requires explicit user confirmation and is not executed automatically by the plugin.
The plugin's install script (install.sh) modifies the user's Omarchy plugin directory and enables the plugin; it is non-destructive but does require the native owner to be installed first.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.

Install


        $ omarchy plugin add https://github.com/k-kostin/omavless --enable

System #bar #quickshell #security

OmaVLESS

OmaVLESS is a VPN app for Omarchy that puts everyday connection controls directly in the bar.

Bring your own compatible VLESS profile or HTTPS subscription, choose Full VPN, Routing or Direct, and connect from the panel. Switch between profiles or disconnect without leaving the desktop; one VPN connection is active at a time.

Expand subscriptions and refresh their server lists beside your profiles. Profile management, routing tools, English/Russian language settings and privacy-safe support reports stay close at hand in a compact, terminal-style interface.

Free and open source. OmaVLESS is not a VPN provider: VPN servers, accounts and service subscriptions are not included.

OmaVLESS panel, disconnected, showing demonstration profiles and the three connection modes

Native interface with demonstration data; no live connection is shown.

Installation

OmaVLESS 0.8.2 is available. New users: add the plugin, then open its panel. Already using 0.7.0? Follow the migration guide before updating.

omarchy plugin add https://github.com/k-kostin/omavless --enable

If the application or Mihomo is missing, Required components offers guided installation. Confirm the steps in its terminal, return to the panel and follow onboarding. You can finish setup later; it never connects a VPN automatically.

This command follows upstream main. The marketplace's reviewed snapshot is updated separately; its older 0.7.0 listing is not the native release.

Follow the installation and upgrade guide, including migration instructions before updating an existing 0.7.0 installation. It covers the matching application package, Mihomo VPN core, TUN permissions and optional clipboard, file-picker and QR tools. Package installation and permission changes require your confirmation.

For manual downloads, use the matching 0.8.2 application and frontend from GitHub Releases. Do not pair this frontend with older 0.8.0/0.8.1 packages.

Everyday use

Import a profile link or subscription URL from the clipboard or a file. Review the preview before saving.
Choose Full VPN, Routing or Direct.
Press Connect beside the profile you want. Selecting a profile for management is not the same as connecting it.

On the native main screen, expand a subscription to browse its profiles. Press ↻ beside the subscription's server count to download its updated server list. Profile management stays in the separate action bar below the list.

Full VPN sends traffic through the connected profile.
Routing uses the selected country policy and your domain/IP rules.
Direct keeps the TUN running while bypassing the proxy.

Settings contains language selection, routing tools, diagnostics, subscription management and shutdown controls. Changing the UI language does not restart the VPN. Automatic connection at login is Off by default; see the usage guide for its current limitations.

See controls and everyday use.

View the expanded subscription · View Settings

Supported inputs

Family	Status
VLESS	Supported; includes TCP, WebSocket, HTTP, H2, gRPC and XHTTP, with TLS/REALITY where compatible
Trojan, Hysteria2, TUIC v5	Experimental; real-server coverage is incomplete
Subscriptions	HTTPS raw/base64 lists of supported profile links

Advanced VLESS Encryption/REALITY PQ and XHTTP combinations retain their experimental limitations. WireGuard, AmneziaWG and vpn:// inputs are not currently supported by the application.

See protocol support and limitations.

Privacy and help

Profiles and subscription URLs stay in a private local store. Imports accept supported profile links, not arbitrary remote configuration or executable content.

For support, use Copy report or Save report in Settings. Do not post profile files, subscription URLs, private configuration or unredacted screenshots.

Credits and license

Maintained by kdk. Community project; not affiliated with Omarchy, MetaCubeX or a VPN provider.

The interface builds on Omarchy VPN by Justin Köstinger. Routing data comes from RoscomVPN, MetaCubeX and Chocolate4U. See third-party notices.

MIT License · Contributing.

Stars: 1
Forks: 1
Open issues: 7
Version: vv0.8.2
License: MIT
Default branch: main

Last pushed 1 week ago. Last indexed 24 minutes ago. Checking GitHub…

@ d620c30