Omarchy 4 replaces its Linux desktop stack with a programmable Quickshell shell

Omarchy 4.0.0 (Quattro), released August 14, 2026, re-architected the distribution around one long-running Quickshell process for the bar, launcher, menus, notifications, on-screen displays, control panels, lock screen and polkit agent, replacing Waybar, Walker, Mako, SwayOSD, hyprlock, hypridle, swaybg and polkit-gnome. The project moved internals from a git-managed layout into system packages and exposed plugin and IPC extension surfaces. Two fast-follow releases have since landed. Omarchy 4.0.2, released August 31 and currently marked latest, adds another substantial security pass: signed Omarchy repository packages, fixes for shell injection in theme/application installers, SSH and sudo hardening, safer browser policy permissions, protection against remote-image injection in shell text, and other privilege-boundary fixes. Current issue reports also show Quickshell-specific failures on 4.0.2, including a reported runaway memory allocation that exhausted RAM and swap on one Framework laptop and a separate hibernate-resume shell crash. Those are individual reports, not a measured failure rate.

The unified shell changes both extension ergonomics and failure concentration. Builders can customize one themed runtime through plugins and IPC instead of synchronizing many independent components, while Omarchy’s rapid security follow-ups show the project is hardening the larger privileged workstation surface created by an opinionated distribution. But because the bar, launcher, notifications, lock-related UI and other services share Quickshell, a severe shell failure can affect more of the desktop at once than a single daemon failure. The correct takeaway is not that Quickshell is unreliable; it is that a unified shell makes version pinning, rollback and observability more important.

Omarchy 4’s Quickshell process owns the bar, launcher, menus, notifications, on-screen displays, control panels, lock screen and polkit agent. Waybar, Walker, Mako, SwayOSD, hyprlock, hypridle, swaybg and polkit-gnome are no longer the default architecture.

The long-running shell is plugin-based and exposes IPC controls, allowing users to package widgets and behaviors against one themed runtime. The project’s system-package move also separates Omarchy-owned files from user modifications more cleanly than the older git-managed arrangement.

The August 31 v4.0.2 release adds additional security fixes validated by the Omarchy Security team. Release notes include signed repository packages, shell-injection fixes in theme and application installers, hardened SSH and browser-policy permissions, safer privilege paths, remote-image-injection protection and secure handling of several workstation integration surfaces. This follows the first v4.0.1 fast-fix release on August 25.

Fresh GitHub issue reports on 4.0.2 include a Quickshell SIGSEGV after hibernate/resume and one reported runaway Quickshell memory event that consumed more than 43 GB of resident memory plus swap before the kernel intervened. These are anecdotal issue reports rather than systematic reliability evidence, but they demonstrate why a shell process that owns many desktop functions deserves explicit crash/restart and rollback testing.

Omarchy is a visible independent example of a Linux workstation treating the desktop shell as a programmable product surface. Its package separation, plugin/IPC design and rapid security response are useful implementation evidence for other projects considering a coherent shell rather than a stack of independently configured daemons.