OmaProton VPN 1.4.2

A small one: Tailscale support documentation.

A few of you have asked how this plugin behaves alongside Tailscale. Short answer: they get along out of the box, and the README now has a full section explaining why. It covers what the Kill Switch means for your peer connections, why device names can stop resolving while the VPN is up (and how to tell that apart from a real outage), and exit nodes: which setups work, which one doesn't, and how to route your laptop's traffic through Proton running on a machine at home. That last one is a genuinely nice setup, and Always On is what makes it dependable.

Read it here: Using it with Tailscale

The table of contents also moved to the top of the README, so the whole guide is scannable from the first screen.

In case you missed the last feature release, two things landed recently that are worth turning on:

• Split tunneling. Pick the apps that skip the VPN while everything else stays protected, or flip it around and put only your chosen apps on it. Two modes, a searchable list of your installed apps, and each mode remembers its own picks. Great for the one bank that blocks VPN IPs.
• Always On. Whenever Proton isn't connected, it reconnects you: at boot, on a new Wi-Fi, after a dropped tunnel. Paired with the Kill Switch it closes the gap from both sides: nothing leaks while you're down, and you don't stay down. Off by default, one switch to change that.

No code changes in this release. Update whenever you like:

omarchy plugin update io.github.grichard99.omaproton-vpn

OmaProton VPN 1.4.1

Hardening follow-up to 1.4.0. Every string the widget shows that comes from the Proton CLI or API (error messages, country and city names, server names and load, account details, recent connections, the map hover label) is now rendered as plain text, so markup in that data is displayed literally rather than interpreted. No behaviour change otherwise.

OmaProton VPN 1.4.0

Port forwarding for torrent clients, Secure Core drawn on the map, notifications that look like they belong to the widget, and a hardening pass over all of it.

Port forwarding

A new switch on the Protection tab, under Always On. Turn it on, connect to a P2P server, and a Forwarded port row appears in the connection details. Click it and the number is on your clipboard, ready for your torrent client. Turning it on asks first, the same way the Kill Switch does, because it opens an inbound port on your VPN address.

Proton hands the port out over NAT-PMP and drops it unless something keeps renewing it, which is why Proton's own guide has you run a natpmpc loop in a terminal. The switch is that loop. While it's on and the tunnel is up the widget renews the port every 45 seconds with a small script of its own, nothing to install. It's the one network request the widget makes, to the VPN gateway inside the tunnel and nowhere else, and the README's Security section says so.

Thanks to @CJKaufman and @r8tten for the push on this one.

Secure Core, drawn

On a Secure Core connection the map draws the route: a dashed arc from the entry country (Switzerland, Iceland or Sweden, ringed) to the city you exit from, the way the Proton app does. The header reads Secure Core · CH → US#3, entry country then exit server, the Server row says the same, and the Secure Core quick-connect row shows ACTIVE while you're on it.

After a P2P connect the header and the Server row say P2P too, so you can tell the click landed. Most Proton servers permit P2P, so the panel only makes a point of it when that's what you asked for.

Notifications

The connect and disconnect toasts had a purple and black checkerboard where an icon should be, because the icon name they asked for doesn't exist in most icon themes. Reported and diagnosed by @CJKaufman, thanks CJ. They now show the Proton mark in your theme's accent colour, read VPN Connected with the server and protocol, or VPN Disconnected when the tunnel drops on its own, and stay quiet while the panel is open, since the panel already tells you.

Hardening

A review of everything new in this release. Nothing serious came up; the small things were fixed anyway:

• Notification text that came from the CLI is escaped before the shell renders it.
• The port script only accepts replies from the VPN gateway.
• The forwarded port is checked to be a number before it's shown or copied.
• The README's Security section matches the code again: two files in the state directory, the settings allow-list includes port forwarding, and the notification wording is exact.

README

New Protection tab screenshot, a Port forwarding chapter, the Secure Core and P2P cues, and the notification rules.

Upgrade

omarchy plugin update io.github.grichard99.omaproton-vpn

OmaProton VPN 1.3.2

The split tunneling app picker now skips any program that runs as another user, as a rule, instead of skipping a few of them by name. Same behaviour on a normal system.

See the 1.3.0 notes for what's new in 1.3: split tunneling, Always On, the Kill Switch fixes, keyboard fixes, the security audit and the README rewrite.

Upgrade: omarchy plugin update io.github.grichard99.omaproton-vpn

OmaProton VPN 1.3.1

Wording fixes in the README, SECURITY.md and the hint shown when the Proton desktop app is installed. Same code as 1.3.0.

See the 1.3.0 notes for what's new in 1.3: split tunneling, Always On, the Kill Switch fixes, keyboard fixes, the security audit and the README rewrite.

Upgrade: omarchy plugin update io.github.grichard99.omaproton-vpn

OmaProton VPN 1.3

Two new switches on the Protection tab, the Kill Switch fixes they needed, keyboard fixes, a security audit, and a rewritten README.

Split tunneling

Pick apps that skip the VPN, or flip it round so only the apps you pick use it. Turn it on and two rows appear: Mode (Exclude or Include) and Apps, a searchable list of every installed app the widget can point at a real program on disk. Each mode keeps its own list.

Proton has no CLI command for this, so the widget edits one section of Proton's own settings file, atomically, and never touches anything else in it. The rules are in the README under Security and privacy.

Things Proton decides, not the widget: it needs the Kill Switch off, apps already running keep the tunnel until restarted, it covers IPv4 only, and Flatpaks and Snaps can't be listed.

Always On

Whenever Proton isn't connected, connect it. Covers boot, login, joining a new network, and a tunnel that drops. Reconnects to the server you were last on, falls back to Fastest if that one is gone, and backs off for 30 seconds after a failure. Off by default. Never fires while signed out.

Kill Switch

• Works while connected. Proton refuses to change it with a tunnel up, so the widget now drops the tunnel, changes the setting, and reconnects you to the same server. A dialog asks first, with Cancel preselected, because your traffic isn't protected until the tunnel is back.
• Locked against split tunneling, both ways. Proton ignores split tunneling while the Kill Switch is on. Each row now locks the other and says which one to turn off.
• The switches tell the truth. Split tunneling shows off while the Kill Switch is on, since nothing is being split, and never turns itself back on.
• Each row says what a click will cost before you click it.

Keyboard

Keyboard and mouse no longer fight over the cursor: hovering only moves the selection when the pointer actually moves, so scrolling with j/k under a resting mouse no longer walks backwards. Open pickers own the keyboard while they're up.

Security audit

Full read of every file, the git history, and the screenshots. No personal data anywhere. Hardening, none of it changing behaviour:

• Recents in state.json are validated on read before anything reaches protonvpn connect.
• Country codes and server names are checked by shape, including over IPC.
• The state directory is now owner-only, and existing installs are fixed on next load.

README

A contents section, and a new chapter, How the protections work: who owns each switch, one section per switch, why the Kill Switch and split tunneling can't both be on, what changing the Kill Switch while connected does, and a table of which setup fits which need. Fresh Protection screenshots.

Upgrade

omarchy plugin update io.github.grichard99.omaproton-vpn

OmaProton VPN 1.2.3

Mostly a documentation release: the README is rewritten, with a banner and a live GIF showing the map, the traffic graph and four themes.

Changed

• README rewritten, with a banner image, a demo GIF and a "New to Proton?" section.
• Plain punctuation across the UI copy, comments and docs. No dashes.

Fixed

• Map: the hover label no longer sticks on screen when the pointer leaves the map quickly.

OmaProton VPN 1.2.2: UI updates

UI updates. Verified on the Omarchy plugin marketplace once the new snapshot is approved.

Panel

• Connections | Protection tabs under Quick Connect, in Omarchy's own pill style. Connections: Recent, countries and cities. Protection: Kill Switch, NetShield, and a new Account section with a two-step Sign out.
• Live traffic while connected: download / upload rates, a 60-second sparkline, session totals and uptime, from the tunnel interface's kernel counters, read only while the panel is open. Drawn in the theme foreground; download and upload are told apart by shape, not colour.
• Map click switches to Connections, opens the country, scrolls to the clicked city and pulses its row until your next click.

Scrolling

• Fixed wheel steps instead of momentum; opening a country keeps your place; connecting from a row returns to the top.

Repository

• Single-author policy documented (CONTRIBUTING, SECURITY, issue and PR templates). Pull requests are closed for security reasons; issues are welcome and credited.
• RELEASING.md describes the staging → main → verify flow.
• View-only IPC methods (tab, drill, highlight, scroll) for screenshots and tests.

Install / update:

omarchy plugin add https://github.com/grichard99/omaproton-vpn --enable
omarchy plugin update io.github.grichard99.omaproton-vpn

OmaProton VPN 1.2.1

First listed release, verified on the Omarchy plugin marketplace.

Proton VPN, built for Omarchy. All of Proton in one bar widget: install the CLI, sign in, Kill Switch and NetShield, one-click connect, and an interactive world map of every Proton city, none of it in a terminal, all of it in your theme.

• Interactive world map, fully offline (Natural Earth outline + Proton's own server cache)
• One-click connect, quick-connect by feature, country → city picker with live load
• Sign in from the panel; Kill Switch and NetShield switches; one-time Kill Switch prompt
• Recent locations, desktop notifications on unexpected drop
• Tunnel state detected by device and connection type, never by name (1.2.1)

Install:

omarchy plugin add https://github.com/grichard99/omaproton-vpn --enable

Store: https://omarchyplugins.com/plugin.html?id=io.github.grichard99.omaproton-vpn