Privacy and security

What runs

• The widget (ArxivPanel.qml, Model.js, Tex.js), inside omarchy-shell.
• fetch.py, which lists and looks up preprints.
• digest.py, when you press S: it downloads the starred papers and runs your AI engine.
• serve.py, when you press v: the local report viewer. It keeps running until you log out.

Network

Requests to arXiv identify themselves as omarchy-arxiv-assistant/1.0 with a link to this project. Nothing else is sent anywhere: no analytics, no accounts.

Files

The plugin writes nowhere else, and never changes your configuration beyond what Omarchy itself stores for the widget.

Other accounts on your computer

Any account can list the command lines of your programs, so nothing personal goes on one. Your settings, including who the reports are for, reach digest.py on its standard input, and digest.log, which records them, is readable by you only. So are the reports, which can quote your own notes, and the scratch folder they are written in; reports from earlier versions are made so the next time you run a summary or open the viewer. A reports folder the plugin creates is yours only too; one you chose keeps the permissions you gave it. What command lines still show is your arXiv categories, the identifiers and links of papers you look up or open, folder paths, the model name, notification text and a custom command itself. The report viewer has its own protection, below.

Untrusted papers

A paper is text written by a stranger and handed to a model that can read files. The plugin defends against a paper that tries to steer the model in four ways:

1. The sandbox (on by default) limits what Claude Code can read to the paper and the folders you allow. See how it works and how it was tested.
2. No writes, no shell and no web for Claude Code, whatever the sandbox setting.
3. The prompt tells the model to treat the paper as material, never as instructions, and to report any attempt.
4. The source archive is filtered: only plain text files (.tex, .bbl, .bib, .sty, .cls, .txt) under 4 MB are extracted, flattened into one folder, and nothing can be written outside it.

The report viewer

Reports are written by a model from untrusted papers, so the viewer treats them as untrusted too:

• It listens on 127.0.0.1 only, and answers only requests addressed to 127.0.0.1 or localhost on its port, which defeats DNS-rebinding pages.
• Every address it serves starts with a secret drawn afresh each time it starts, so the other accounts on your computer, which can reach 127.0.0.1 too, cannot read your reports through it. The secret reaches your browser through a page in your runtime folder that only you can read, never on a command line, where any account could see it. When v finds the viewer already running, it asks the program on the port to prove it holds the secret, without sending it.
• Raw HTML in a report is shown as text. Links keep only http, https, mailto and in-page targets, and images are replaced by their description.
• A Content-Security-Policy allows no script but the viewer's own, no outside images, frames, forms or network requests.
• It serves only the files directly inside the reports folder and its own KaTeX and marked assets.

This was checked with a planted report containing a script tag, an image with an onerror handler, an outside image and a javascript: link: none of them ran or loaded, and the mathematics still rendered.

Limits

• A custom command runs with your permissions; the sandbox does not apply to it. Other accounts can see its arguments, like any program's: keep API keys in its configuration or environment, not in the command.
• The Claude Code sandbox is Claude Code's own --restricted mode: it is as strong as Claude Code makes it.
• The model may quote your extra folders in a report, and what it reads goes to its provider.
• Reports can be wrong. They are a guide to the paper, not a substitute for it.

Found a problem? Please open an issue on GitHub.