v1.3.0 - Marketplace Migration & Verification Badges

What's Changed

Marketplace Migration

• All marketplace URLs updated from omarchyplugins.com to plugins.omarchy.org
• Marketplace repo reference updated from HANCORE-linux to omacom

3-State Verification Badge

• Verified (green) — plugin snapshot matches upstream and is verified
• Update unverified (amber) — snapshot is verified but upstream has moved
• Unverified (gray) — plugin is listed but not verified

Update Badge & Context Menu

• Green dot indicator on plugin icon when updates are available
• Update button moved from main page to context menu (three-dot menu)
• Cleaner main page layout with update actions in the menu

Updates Page

• Verification status now shown alongside plugin status on updates page

Bug Fixes

• Handle marketplace fetch failures gracefully with fallback state

v1.2.2

v1.2.2 — Refactor + UI/UX fixes

This is a behavior-neutral refactor with two targeted fixes.

Changed — Refactor

• Panel.qml (~3.2k → ~1.9k lines) split into focused components:
  • panel/Presentation.js — side-effect-free helpers (URLs, SHA labels, kind labels, icon colors)
  • panel/plugin/Row.qml, Actions.qml, ListingLinks.qml, ContextMenu.qml — plugin delegate metadata, toggles, update actions, right-click menu (explicit required property + signals)
  • panel/updates/Page.qml — updates list/progress (lazy-loaded, page state preserved)
  • panel/dialogs/Confirm.qml, Install.qml — reused confirmation + persistent install view
• Enabled bound component behavior, removed actionable unqualified-access / layout-positioning / unused-import diagnostics
• Preserved long-name containment, native-toggle gating, marketplace links, icon provenance, and TapHandler edge placement (eventPoint.position)

Closes #5. Based on PR #8 by @D-Gaspa.

Fixed

• Update all timing (#9) — panel/updates/Page.qml:328 now keeps Update all hidden until the check finishes; footer shows Checking… → Checking… 1 update found interim, then 1 update available after completion. Previously the button appeared disabled mid-scan.
• Icon tile overflow (#7) — Panel.qml:308 adds isStandaloneGlyph() — live bar text containing labels like 1h 58m is now ignored for the tile and falls back to mapped icon/initial; both panel/plugin/Row.qml:82 and panel/updates/Page.qml:174 tiles now clip: true with elide: ElideRight as final safeguard.

Validation

• qmllint clean on all QML files
• omarchy plugin validate . passes
• Existing plugin-state / update-helper suites pass
• Live smoke-tested: updates page, plugin rows/links/filters/toggles, context menu, remove/restart/install dialogs

Full Changelog: v1.2.1...v1.2.2

Plugin Manager v1.2.1

Fixed

• Long plugin names no longer push the action buttons out of the row. The name, description, and author text now shrink and ellipsize instead of reserving their full unwrapped width, so the Toggle / Source / Update buttons always stay visible and inside the container (Fixes #4).

UI

• Reorganized the row metadata for clarity:
  • Verified / Unverified badge and version now hug the plugin name (right side of the name).
  • Plugin type (e.g. BAR WIDGET) now sits beside the author with a · separator, shown in ALL CAPS.

Credits

Thanks to @marlonangeli for the clear report in #4.

Plugin Manager v1.2.0

Plugin Manager v1.2.0

This release makes plugin updates trustworthy: real update states, marketplace
transparency per row, and an update engine that no longer dies halfway through.

✨ New

Marketplace transparency on every row

Rows for listed plugins now show where their code stands against the
marketplace listing:

• Marketplace favicon link straight to the plugin's listing page
• Snapshot commit chip (󰞑 abc1234) linking to the exact commit the
  marketplace's security baseline checked, plus a listing checks shortcut
• Drift indicator (→ def5678 ↗) when your installed code has moved past
  the verified snapshot, with a view changes compare link
• Author names link to the maintainer's GitHub profile

Smarter updates page

• Per-plugin statuses: Up to date · Update available · Local changes · Local · Error
• "What's new ↗" link per update — opens the upstream release notes when
  available, otherwise the GitHub compare of your installed commit vs latest
• Clickable UPDATE pill to update a single plugin from its row
• Local/dev plugins (no git remote, symlinks) are skipped from the list — they
  were never updatable anyway
• "Update all" now reports successes and failures separately

Honest toggles for bar widgets & bar options

• Bar-widget switches now reflect whether the widget is actually placed in the
  bar (not just "enabled")
• Bar options can no longer be toggled off directly — they're placements,
  and the UI now shows them dimmed / as "Active bar"

🛡 Reliability & security

• Updates run through a detached helper that survives shell hot-reloads
  — "Update All" now finishes all plugins even though each merge restarts the
  shell underneath it (#2), with progress reconnect + failure detection
• Update checks classify local modifications and refuse to clobber them
  (dirty worktrees, detached HEADs and symlinked dev repos are reported, not updated)
• Install status file created via mktemp with symlink guard
• Checked against the omarchy-plugin-marketplace automated security baseline:
  no findings

🔧 Fixes

• Fixed "Update All gets interrupted" after the first plugin (#2, via #1)
• Removed constant depends on non-bindable properties log spam (#3)
• Missing divider index declaration caused stray line after last row
• Marketplace icon link: hover tooltip + click scope fixes

❤️ Credits

Huge thanks to @D-Gaspa for the reliable update engine (#1) and
@nixfred for the binding cleanup (#3).

v1.1.1 — Marketplace badges, type filter & performance

New features

• Marketplace verification badge — third-party plugin rows show a ✓ Verified or Unverified pill beside the plugin name, based on the marketplace catalog
• View on marketplace — direct link to each listed plugin's marketplace page
• Type filter — new dropdown (All types / Bar Widget / Panel / Overlay / Menu / Service / Bar / Other) that combines with the scope filter and search; non-canonical kinds group under Other

Performance

• Snappy list scrolling: icon glyphs are memoized (no more per-row bar-tree walks), marketplace lookups reduced to one per row, the updates page now loads lazily, and a hover binding that fired warning bursts on every mouse move was fixed

Fixes

• Descriptions wrap up to 3 lines; row actions (SOURCE / toggle / menu) stay vertically centered and never get pushed off-panel
• Long plugin names elide safely; right margin stays clean
• New preview banner

Full diff: v1.1.0...v1.1.1

v1.1.0 — Security & robustness hardening

Security and robustness hardening release. No new features — everything here makes the plugin safer to run.

Install flow

• Only GitHub repository URLs are accepted (https://github.com/owner/repo or git@github.com:owner/repo.git); whitespace, traversal, and non-GitHub hosts are rejected with a clear error (#925 review)
• Install output is capped at ~8 KB at write time (drain keeps the clone running), the real exit code is preserved, and done is always the final marker so the dialog can never get stuck
• Status file created via mktemp under $XDG_RUNTIME_DIR with 0600 perms; symlink checks on every write (no /tmp race)
• 180 s watchdog ends the install dialog if a detached helper dies

Update / Remove / Scans

• Remove, Update, Update-all, repo-link scan, and update-check outputs are capped (8–64 KB) with drain; failed removals now stop the queue and report failure (real exit codes via PIPESTATUS)

UI hardening

• Every dynamic text sink renders as plain text (Text.PlainText) — plugin-supplied names, descriptions, URLs, and errors can no longer trigger rich-text resource loading
• Tooltips are static strings; the SOURCE button opens only http(s) repository links

Full diff: v1.0.0...v1.1.0