Omahub
← All plugins
U

Thunderbolt

by unleashed-nick

Approve and manage Thunderbolt devices through bolt, with a bar widget and connect prompt.

GitHub

Security review

No obvious issues detected

Deterministic scan — not a security guarantee

None
Risk level
None
Analyzed commit
c42a3ad
Scanned
1 month ago

No potentially dangerous behavior detected in the analyzed commit.

Automated analysis only — not a security guarantee.

AI advisory review

No obvious issues detected

Language-model assessment · ~deepseek/deepseek-v4-flash-latest — advisory only

Low
AI risk level
Low
Recommendation
install
Model
~deepseek/deepseek-v4-flash-latest
Analyzed commit
c42a3ad
Reviewed
1 month ago

The plugin is a legitimate Thunderbolt device manager that talks to boltd over D-Bus via a readable Python helper. It does not install anything, run sudo, or modify system config, and all actions require explicit user interaction or an opt-in auto-enroll setting. The code is transparent and contains no obfuscation or hidden behavior.

  • The plugin can authorize/enroll Thunderbolt devices, which is a security-sensitive operation, but it is the intended purpose and clearly documented.
  • The auto-enroll option is off by default and explicitly warns about DMA risk without IOMMU.
  • The helper uses busctl and boltctl monitor, but all commands are fixed and no user input is passed to a shell.
How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.

Install
$ omarchy plugin add https://github.com/unleashed-nick/omarchy-thunderbolt --enable
Hardware #bar #quickshell #security

Thunderbolt

Approve and manage Thunderbolt devices from the Omarchy bar.

Omarchy already ships bolt and loads the thunderbolt kernel module early enough for docks to work at boot. Hyprland itself never authorizes a device: until bolt enrolls it, PCIe and DisplayPort tunnels stay down and hyprctl monitors will not show a dock display. This plugin is the missing approval UI — the Hyprland equivalent of GNOME Control Center / Plasma Thunderbolt.

It talks to boltd over D-Bus. It does not write udev rules that authorize every device, and it does not edit Hyprland monitor config.

Needs approval Connect notifications
Needs approval Connect notifications
Remembered devices Bar hover
Remembered devices Bar hover

Install

omarchy plugin add https://github.com/unleashed-nick/omarchy-thunderbolt.git --enable

The widget lands on the right of the bar. Move it if you want:

omarchy bar move unleashed-nick.thunderbolt --section right

Requirements

Omarchy Quattro and the bolt package with bolt.service running. Current Omarchy already installs both. The plugin calls omarchy notification send and omarchy-shell; nothing else is installed.

Updating

omarchy plugin update unleashed-nick.thunderbolt

Removing it

omarchy plugin remove unleashed-nick.thunderbolt

Enrolled devices stay in bolt's store (boltctl list). Forget them from the panel before removal if you want them gone.

Usage
Left click open the device panel
Middle click refresh bolt's state
Escape close the panel
Enter on a pending row Trust
Delete Ignore (pending) or Forget (remembered)
  • A new unauthorized device sends a critical notification and opens the panel.
  • Trust enrolls the device (auto policy) so bolt authorizes it next time.
  • Allow once authorizes this session only.
  • Ignore leaves it unauthorized and stops prompting until unplug.
  • Forget removes a stored enrollment.
  • The header switch is bolt's AuthMode (GNOME called this Direct Access). Off keeps DisplayPort and USB working and blocks PCIe tunnels.

The icon hides on machines with no Thunderbolt controller and no remembered devices. It stays visible when a controller or stored device exists. Turn on Always show in bar if you want the icon everywhere.

Security

Unknown devices are prompted, never auto-enrolled. Automatically trusting new devices is an opt-in setting and a DMA risk on hosts without IOMMU — leave it off unless you want GNOME Shell's behaviour.

Authorize, enroll, and forget go through bolt's polkit actions. The plugin never calls sudo and never writes /etc/udev. On Omarchy, bolt's packaged rule typically allows an active local wheel session to manage devices without a password prompt.

After approval

Displays appear through ordinary DRM hotplug. If a monitor is missing after Trust, check hyprctl monitors all and ~/.config/hypr/monitors.lua. This plugin will not rewrite that file.

License

MIT. See LICENSE.