OmaProton VPN 1.3
Two new switches on the Protection tab, the Kill Switch fixes they needed, keyboard fixes, a security audit, and a rewritten README.
Split tunneling
Pick apps that skip the VPN, or flip it round so only the apps you pick use it. Turn it on and two rows appear: Mode (Exclude or Include) and Apps, a searchable list of every installed app the widget can point at a real program on disk. Each mode keeps its own list.
Proton has no CLI command for this, so the widget edits one section of Proton's own settings file, atomically, and never touches anything else in it. The rules are in the README under Security and privacy.
Things Proton decides, not the widget: it needs the Kill Switch off, apps already running keep the tunnel until restarted, it covers IPv4 only, and Flatpaks and Snaps can't be listed.
Always On
Whenever Proton isn't connected, connect it. Covers boot, login, joining a new network, and a tunnel that drops. Reconnects to the server you were last on, falls back to Fastest if that one is gone, and backs off for 30 seconds after a failure. Off by default. Never fires while signed out.
Kill Switch
- Works while connected. Proton refuses to change it with a tunnel up, so the widget now drops the tunnel, changes the setting, and reconnects you to the same server. A dialog asks first, with Cancel preselected, because your traffic isn't protected until the tunnel is back.
- Locked against split tunneling, both ways. Proton ignores split tunneling while the Kill Switch is on. Each row now locks the other and says which one to turn off.
- The switches tell the truth. Split tunneling shows off while the Kill Switch is on, since nothing is being split, and never turns itself back on.
- Each row says what a click will cost before you click it.
Keyboard
Keyboard and mouse no longer fight over the cursor: hovering only moves the selection when the pointer actually moves, so scrolling with j/k under a resting mouse no longer walks backwards. Open pickers own the keyboard while they're up.
Security audit
Full read of every file, the git history, and the screenshots. No personal data anywhere. Hardening, none of it changing behaviour:
- Recents in
state.jsonare validated on read before anything reachesprotonvpn connect. - Country codes and server names are checked by shape, including over IPC.
- The state directory is now owner-only, and existing installs are fixed on next load.
README
A contents section, and a new chapter, How the protections work: who owns each switch, one section per switch, why the Kill Switch and split tunneling can't both be on, what changing the Kill Switch while connected does, and a table of which setup fits which need. Fresh Protection screenshots.
Upgrade
omarchy plugin update io.github.grichard99.omaproton-vpn