[Verify]: crmne.hyprmoncfg

[crmne]

Verification action

Verify and publish a newer upstream commit

Plugin ID

crmne.hyprmoncfg

Repository URL

https://github.com/crmne/omarchy-hyprmoncfg

Target commit

39ff6efd4d535f064867d873d6f0ce299c5e1374

Verification acknowledgment

• I understand that only the exact target commit can become a verified marketplace snapshot and that verification is not a security audit.

Standard installation acknowledgment

• I confirm that this listed root plugin supports the standard Omarchy installation path and does not require manual setup.

[crmne]

Released as v2.2.1. This exact commit addresses the review finding from #4382: the panel updater no longer attaches a StdioCollector. Updater stdout and stderr are discarded, and a before/after HEAD comparison communicates a changed checkout through a bounded exit status. The regression test feeds 256 KiB of subprocess output and confirms that none reaches the shell.

The exact target passes 52 Node tests, qmllint, Omarchy plugin validation, and git diff --check.

Diff: crmne/omarchy-hyprmoncfg@v2.2.0...v2.2.1

[github-actions]

Plugin update validation

✅ Existing plugin source confirmed: crmne/omarchy-hyprmoncfg
✅ Exact configured plugin set confirmed: crmne.hyprmoncfg
✅ Quattro compatibility passed at update commit 39ff6ef…

Ready for verified update review. The automated security baseline must complete before a maintainer applies approved-and-verified. The current marketplace snapshot remains unchanged until publication succeeds.

[github-actions]

Automated security baseline

🟡 Manual review required at commit 39ff6ef….

No change is necessarily required. A marketplace maintainer must review these capabilities before applying approved-and-verified.

Capabilities detected

Package management (package-manager)

The plugin can install, upgrade, or remove software outside its own checkout.

• Model.js:2

  return "rm -f \\"$XDG\_RUNTIME\_DIR/hyprmoncfg-panel-install.failed\\" \\"$XDG\_RUNTIME\_DIR/hyprmoncfg-panel-install.complete\\"; status=0; if pacman -Q hyprmoncfg-bin  /dev/null 2 &1; then yay -S --needed --cleanafter hyprmoncfg-bin; elif pacman -Q hyprmoncfg  /dev/null 2 &1; then yay -S --needed --cleana
  

• README.md:84

  yay -S --needed --cleanafter hyprmoncfg-bin
  

• README.md:86

  yay -S --needed --cleanafter hyprmoncfg
  

• README.md:127

  omarchy pkg drop hyprmoncfg
  

• README.md:2

  yay -S --needed --cleanafter hyprmoncfg-bin
  

Service management (service-management)

The plugin can inspect or change a system or user service lifecycle.

• Model.js:2

  return "rm -f \\"$XDG\_RUNTIME\_DIR/hyprmoncfg-panel-install.failed\\" \\"$XDG\_RUNTIME\_DIR/hyprmoncfg-panel-install.complete\\"; status=0; if pacman -Q hyprmoncfg-bin  /dev/null 2 &1; then yay -S --needed --cleanafter hyprmoncfg-bin; elif pacman -Q hyprmoncfg  /dev/null 2 &1; then yay -S --needed --cleana
  

• Panel.qml:399

  enabledProcess.command = \["systemctl", "--user", "is-enabled", "--quiet", "hyprmoncfgd.service"\]
  

• Panel.qml:421

  ? \["sh", "-c", "systemctl --user enable --now hyprmoncfgd.service && hyprmoncfg manage"\]
  

• Panel.qml:432

  serviceProcess.command = \["systemctl", "--user", "restart", "hyprmoncfgd.service"\]
  

• Panel.qml:1378

  activeProcess.command = \["systemctl", "--user", "is-active", "--quiet", "hyprmoncfgd.service"\]
  

This deterministic baseline detects only its documented patterns and is not designed to stop a motivated attacker.

This is not a security audit, certification, warranty, or endorsement.

[HANCORE-linux]

Security review accepted exact commit 39ff6efd4d535f064867d873d6f0ce299c5e1374: package-manager and service-management actions are user-initiated, bounded, and scoped to hyprmoncfg.

[github-actions]

Updated and verified hyprmoncfg: Multi-Monitor Manager for Omarchy: https://omarchyplugins.com/plugin.html?id=crmne.hyprmoncfg

Verification method: maintainer-reviewed. Verification applies only to the exact marketplace snapshot and is not a security audit.