Release / 11 Sep 2026 / with omarchy-bitwarden-0.7.1, omawarden-0.5.2, omarchy-bitwarden-0.7.2, omarchy-bitwarden-0.7.3, omarchy-bitwarden-0.7.4, omawarden-0.5.3, omarchy-bitwarden-0.8.0, omawarden-0.6.0, omarchy-bitwarden-0.8.1, omawarden-0.6.1, omarchy-bitwarden-0.9.0

Omarchy Bitwarden omawarden-0.7.0

Let the vault lock on idle, screen lock, and sleep without background TOTP refreshes keeping it unlocked.

All of Omarchy Bitwarden

Before you upgrade to omawarden-0.7.0

6 to fix

The vault now locks after a maximum session lifetime of 12 hours even if user activity continues.

Behavior changedLock the vault manually or after inactivity and integrate with screen-lock hooks.Affects: Anyone leaving a vault unlocked continuously.

Read the evidence

icyleaf/omarchy-bitwarden/blob/omawarden-0.7.0/docs/adr/0010-daemon-session-token-and-acc…

Use `Ctrl+Enter` instead of `Ctrl+T` to copy TOTP. `Ctrl+T` now toggles secret visibility, and `Ctrl+H` opens password history.

Action requiredGenerate live TOTP codes from stored vault items.Affects: Overlay users using the old TOTP shortcut.Inferred

Read the evidence

Upgrade the plugin to 0.9.0+ with engine 0.7.0. Ensure Secret Service is available and writable: login and renewal now fail if credentials cannot be stored.

Action requiredConnect to Bitwarden or a self-hosted Vaultwarden account using a master password or personal API key.Affects: Users upgrading only the engine, or running without a usable system keyring.

Read the evidence

icyleaf/omarchy-bitwarden/releases/tag/omawarden-0.7.0

Change remote `server_url` and `identity_url` endpoints to HTTPS; plaintext HTTP is now accepted only for loopback hosts.

Action requiredConnect to Bitwarden or a self-hosted Vaultwarden account using a master password or personal API key.Affects: Self-hosted users with non-loopback HTTP endpoints.

Read the evidence

Changing `server_url` purges credentials, session, vault cache and temporary previews; sign in to the new server afterward.

Behavior changedConnect to Bitwarden or a self-hosted Vaultwarden account using a master password or personal API key.Affects: Users changing the configured server URL.

Read the evidence

icyleaf/omarchy-bitwarden/releases/tag/omawarden-0.7.0

Pipe seeds or URIs to `omawarden totp --stdin`; `--secret` is removed and positional arguments are for vault-item queries.

Action requiredGenerate live TOTP codes from stored vault items.Affects: CLI scripts passing raw TOTP seeds or `otpauth://` URIs as arguments.Inferred

Read the evidence

Replace `--code` with a stdin JSON payload containing `password` and `code` for `auth login-password`.

Action requiredConnect to Bitwarden or a self-hosted Vaultwarden account using a master password or personal API key.Affects: CLI scripts passing the password-login 2FA code through `--code`.Inferred

Read the evidence

icyleaf/omarchy-bitwarden/blob/omawarden-0.7.0/omawarden/src/main.rs

Remove `bw_path` and `max_output_mb` from configuration tooling, including `--bw-path` and `--max-output-mb` CLI flags; these unused options were removed.

Action requiredAffects: Scripts reading or setting obsolete engine configuration options.Inferred

Read the evidence

Preview files are cleaned on close, lock, and logout. Attachment data without a valid HMAC is rejected; unauthenticated fallback formats are no longer accepted.

Behavior changedDownload encrypted vault attachments and preview images or text in the overlay.Affects: Users opening attachment previews or legacy unauthenticated attachments.

Read the evidence

What changed in omawarden-0.7.0

Plugin 0.7.2 adds password history and moves TOTP copying to `Ctrl+Enter`; 0.7.4 adds vault/folder filters. Plugin 0.9.0 and engine 0.7.0 change CLI secret input, require HTTPS for remote endpoints, and enforce keyring availability.

Also: Filter vaults and folders, inspect password history, sync while locked, and disable remote icon requests.

Upgrade omawarden to 0.7.0 together with plugin 0.9.0 or newer; a working Secret Service keyring, secret-tool, and wl-clipboard are required.

New things you can do

Open the history modal with `Ctrl+H`.

AddedInspect earlier passwords for a selected login with the password-history viewer.

Read the evidence

icyleaf/omarchy-bitwarden/releases/tag/omarchy-bitwarden-0.7.2

Cycle vault scope with `Alt+V` and folders with `Alt+F`.

AddedNarrow vault search by personal or organization scope and by folder.

Read the evidence

icyleaf/omarchy-bitwarden/releases/tag/omarchy-bitwarden-0.7.4

Synchronize encrypted vault data while the vault remains locked.

Added

Read the evidence

icyleaf/omarchy-bitwarden/releases/tag/omawarden-0.6.0

Set `identity_url` through CLI configuration or overlay settings.

AddedChoose a separate identity endpoint for a custom Bitwarden server.

Read the evidence

Set `check_updates` or `show_website_icons` to false.

AddedDisable automatic update checks and remote website-icon requests in settings.

Read the evidence

Fixed and improved

Background status and TOTP requests no longer reset the idle timer; the daemon honors configured auto-lock and locks on screen-lock and sleep signals.

Now worksLock the vault manually or after inactivity and integrate with screen-lock hooks.

Read the evidence

API-key sync and unlock failures are fixed; official US/EU cloud endpoints are resolved separately, and password login no longer hangs on stdin EOF.

Now worksConnect to Bitwarden or a self-hosted Vaultwarden account using a master password or personal API key.

Read the evidence

Seeded by @iluxav with Codex, from the release's public sources. Each change links to its evidence.

Before you upgrade to omawarden-0.7.0

The vault now locks after a maximum session lifetime of 12 hours even if user activity continues.

Use `Ctrl+Enter` instead of `Ctrl+T` to copy TOTP. `Ctrl+T` now toggles secret visibility, and `Ctrl+H` opens password history.

Upgrade the plugin to 0.9.0+ with engine 0.7.0. Ensure Secret Service is available and writable: login and renewal now fail if credentials cannot be stored.

Change remote `server_url` and `identity_url` endpoints to HTTPS; plaintext HTTP is now accepted only for loopback hosts.

Changing `server_url` purges credentials, session, vault cache and temporary previews; sign in to the new server afterward.

Pipe seeds or URIs to `omawarden totp --stdin`; `--secret` is removed and positional arguments are for vault-item queries.

Replace `--code` with a stdin JSON payload containing `password` and `code` for `auth login-password`.

Remove `bw_path` and `max_output_mb` from configuration tooling, including `--bw-path` and `--max-output-mb` CLI flags; these unused options were removed.

Preview files are cleaned on close, lock, and logout. Attachment data without a valid HMAC is rejected; unauthenticated fallback formats are no longer accepted.

What changed in omawarden-0.7.0

New things you can do

Open the history modal with `Ctrl+H`.

Cycle vault scope with `Alt+V` and folders with `Alt+F`.

Synchronize encrypted vault data while the vault remains locked.

Renew expired login tokens during background synchronization without signing in again.

Set `identity_url` through CLI configuration or overlay settings.

Set `check_updates` or `show_website_icons` to false.

Fixed and improved

Background status and TOTP requests no longer reset the idle timer; the daemon honors configured auto-lock and locks on screen-lock and sleep signals.

API-key sync and unlock failures are fixed; official US/EU cloud endpoints are resolved separately, and password login no longer hangs on stdin EOF.