Merge upstream quattro (Claude browser, kernel headers, BBR, security)

[cursor]

Merges 16 new commits (11 non-merge) from omacom/omarchy quattro since last night's check (86a2e583 / PR #21). Upstream HEAD is now 2fbac0c8 (upstream #11934, merged 2026-09-15).

This is everything new since the 2026-09-14 cron. It does not replace PR #21 (linux-omarchy as the default kernel except T2) or draft PR #18 (kyber, pacman scope, qconsole, Cloudflare CLI, 1Password class, omacom URLs).

Fork-only Cursor work is untouched: official-tarball installer, no mise wrapper, usage collector, and the theme-set fix from #22.

Claude browser extension (upstream omacom#11934)

• Choosing Claude as the default agent best-effort installs the official Chromium-family extension (omarchy-install-chromium-claude) for Chromium, Chrome, Brave / Brave Origin, and Edge
• A cancelled password prompt or failed install still selects and launches Claude
• Browser integration settings are left alone (the --chrome launch flag was added and then removed upstream the same day)
• Restart the browser, enable the extension if prompted, and run /chrome in Claude to finish connecting. Firefox and Zen are not supported. Re-select Claude if it was already the default
• Cursor selection still uses the official tarball path and never goes through this installer

Matching kernel headers are a base guarantee (upstream omacom#11897, omacom#11900)

• DKMS hardware installers (Broadcom, Tuxedo, YT6801, Cam Link, NVIDIA, Xbox controllers) no longer install headers themselves
• New migration 1789444024 installs linux-omarchy-headers or linux-t2-headers when those kernels are present; no-ops otherwise
• ISO omarchy-other.packages still keeps this fork's linux / linux-headers / linux-ptl set. Switching the ISO kernel to linux-omarchy stays on PR Merge upstream quattro (linux-omarchy default kernel except T2) #21

BBR + fq (upstream omacom#11658)

• etc/sysctl.d/99-omarchy-sysctl.conf now sets net.core.default_qdisc=fq and net.ipv4.tcp_congestion_control=bbr
• Migration 1789294350 applies it live when the running values differ, and flags a reboot if sysctl -p fails

Security

• RDP password (upstream #7902): omarchy-windows-vm feeds FreeRDP args over stdin (/args-from:stdin) so the VM password is no longer on a world-readable cmdline
• Screen recording state (upstream #8374): recording filename, region, and debug log move out of world-writable /tmp into $XDG_RUNTIME_DIR (or a 0700 state-dir fallback)
• Mise Work PATH (upstream #11336): new installs no longer write ~/Work/.mise.toml with _.path = "{{ cwd }}/bin". Migration 1789095456 removes that stock/unsafe path, revokes leftover Mise trust, and leaves custom ignored configs alone
• Keyring updates (upstream #7807): omarchy-update-keyring now fails the update instead of printing "Keys are correct" after a failed recv or reinstall

Conflict / filename notes

• 1789095456 on this branch is the PATH-injection cleanup. Draft PR Merge upstream quattro (PTL kernel, kyber, pacman scope, qconsole, Cloudflare CLI) #18 still uses that same filename for the PTL kernel migration — do not merge Merge upstream quattro (PTL kernel, kyber, pacman scope, qconsole, Cloudflare CLI) #18 after this without renaming Merge upstream quattro (PTL kernel, kyber, pacman scope, qconsole, Cloudflare CLI) #18's file. Kernel policy remains PR Merge upstream quattro (linux-omarchy default kernel except T2) #21 (1789325478)
• Claude extension install is wired into the fork's omarchy-default-agent after the Cursor/Hermes install branches, so Cursor stays official-tarball

Tests

Focused suites passed: default-agent-test.sh (Cursor still official-tarball, no mise; Claude extension is best-effort), kernel-headers-migration-test.sh, update-keyring-test.sh, screenrecording-test.sh, mise-work-path-test.sh, mise-install-test.sh, and ./test/cli (new omarchy-install-chromium-claude metadata). Isolated Chromium-extension install (chromium-claude-test.sh) skipped here — no user namespaces in this environment.

Still only on other open PRs

• PR Merge upstream quattro (linux-omarchy default kernel except T2) #21: linux-omarchy default kernel except T2, Limine boot order, drop installer PTL override
• PR Merge upstream quattro (PTL kernel, kyber, pacman scope, qconsole, Cloudflare CLI) #18 (draft): pacman systemd-run scope, kyber udev, centered qconsole, Plymouth late-display re-center, Cloudflare cf wrapper, 1Password 8.12 window class, omacom/omarchy URL rewrite, drop CODEOWNERS

  

---

Note

Medium Risk
Touches privileged installers, system-wide sysctl and keyring pre-update behavior, and migrations that modify Mise trust and kernel packages; security fixes are intentional but RDP/BBR/sysctl changes affect all users on upgrade.

Overview
This merge pulls upstream quattro work: security hardening, networking defaults, DKMS/header policy, and Claude-as-default-agent browser setup.

Claude default agent now best-effort runs omarchy-install-chromium-claude (new privileged installer) to register the official Web Store extension under Chromium, Chrome, and Edge; failures are silent and Claude still becomes the default. Docs in manual/17-ai.md describe restart, /chrome, and re-selecting Claude if it was already default.

Kernel headers are documented and assumed from the base install (install-scripts.md); hardware DKMS scripts (NVIDIA, Broadcom, Tuxedo, YT6801, Cam Link, Xbox) no longer pull linux-headers themselves. Migration 1789444024 adds linux-omarchy-headers / linux-t2-headers when those kernels are present.

TCP defaults add BBR + fq in 99-omarchy-sysctl.conf; migration 1789294350 applies them live or flags reboot if sysctl -p fails.

Security / privacy fixes: omarchy-windows-vm passes FreeRDP args (including password) via /args-from:stdin instead of world-readable cmdline; screen recording state, region, and debug logs move from /tmp to $XDG_RUNTIME_DIR (0700 state-dir fallback) with matching omarchy-capture-webcam-resize paths; omarchy-update-keyring uses set -euo pipefail and verifies keys before printing success. Mise ~/Work PATH injection is removed from new installs and cleaned up by migration 1789095456 (untrust, strip unsafe _.path, preserve custom/ignored configs); manual/19-shell-tools.md notes project bin/ is not on PATH.

Shell tests cover Chromium-Claude install, default-agent extension behavior, screenrecording paths, keyring failures, kernel-headers migration, and mise PATH migration.

^{Reviewed by Cursor Bugbot for commit 3d79638. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 114761a5-aee2-4898-8c0e-7a933956b5c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mark-groves]

Independent shipping verifier. I did not write this PR. Worktree is /tmp/omarchy-verify-23 on nexus-reborn after Cloud NEW_VM verifiers failed.

Verdict. PASS+NOTES

Identity.
Head SHA is 0dc59da07d755e73d52a896d42b0e38587f96cc8.
Parent SHA is e3ac2da538c7f5a27b9f0786aa82bc957e0c233f, the quattro base used for the patch-id.
Immediate commit parent is f13387b73032b58bfc9f2c8c29cb7c34d62487ee.
Stable git patch-id --stable of e3ac2da538c7f5a27b9f0786aa82bc957e0c233f to 0dc59da07d755e73d52a896d42b0e38587f96cc8 is c5848ffd69346660c608af8e2a71c202a61656e4.

Forge.
origin is on PATH. origin pr view 23 returned "Origin pull request #23 not found". Comment path is GitHub MCP.
Every git command used env -u GIT_INDEX_FILE because this worker env leaked GIT_INDEX_FILE=/tmp/omarchy-cherry-check.index.

Static checks.
install/hardware/nvidia.sh deletes the KERNEL_PACKAGE=$(pacman -Qqs '^linux(-zen|-lts|-hardened|-t2|-ptl)?$' | head -1 || true) selector and the matching headers omarchy-pkg-add.
install/hardware/fix-elgato-camlink-4k.sh deletes mapfile -t kernel_headers < <(pacman -Qqs '^linux(-zen|-lts|-hardened|-t2|-ptl|-omarchy-bore)?$' | sed 's/$/-headers/').
Neither file still contains that header-selector regex.
migrations/1789444024.sh installs linux-omarchy-headers or linux-t2-headers when those kernels are present.
migrations/1789095456.sh on this head is the Mise Work PATH cleanup from upstream omacom#11336. Draft PR #18 still adds a different migrations/1789095456.sh that installs the Panther Lake kernel. I read PR #18 files only. I did not comment, edit, or merge it.

bin/omarchy-theme-set-vscode calls set_theme for code, code-insiders, and codium only. It does not invoke /usr/bin/cursor. A comment states this fork does not theme Cursor.
bin/omarchy-default-agent runs omarchy-install-chromium-claude after the Cursor and Hermes install branches. default-agent-test.sh passed "default agent selects and opens every supported provider and alias" and "extension installation failure silently continues selecting and launching Claude".

Tests, all from /tmp/omarchy-verify-23, all exit 0.
bash test/shell.d/default-agent-test.sh
bash test/shell.d/kernel-headers-migration-test.sh
bash test/shell.d/update-keyring-test.sh
bash test/shell.d/screenrecording-test.sh
bash test/shell.d/mise-work-path-test.sh
bash test/shell.d/mise-install-test.sh
./test/cli

control-cli, tmux session pr23-verify-cli.
OMARCHY_PATH=/tmp/omarchy-verify-23 /tmp/omarchy-verify-23/bin/omarchy-version printed dev (0dc59da0) and exited 0.
omarchy install chromium-claude --help printed the summary and binary name and exited 0. It did not install packages.
omarchy commands --json selected omarchy-install-chromium-claude with requires_sudo true and route omarchy install chromium claude.

Notes.
HEAD stayed 0dc59da07d755e73d52a896d42b0e38587f96cc8.
I did not merge, rebase, or push. I did not run the linux-omarchy host migration. I did not theme Cursor.
Cursor Security Agent on this head concluded success. That is not this verdict.
Landing after this PR still has to rename draft PR #18's 1789095456.sh before that branch can merge.