Omarchy plugin · ayande.glance

Face unlock.
For Omarchy logo Omarchy.

With the liveness detection that face unlock on Linux usually doesn't have.

Install the plugin Star on GitHub

Arch · Hyprland · PAM · MIT licensed

Why

The gap Howdy left open.

Howdy already does face unlock on Arch. Its well-known weakness is that it has essentially no liveness detection — a printed photo can unlock it. Glance ports the five-cue liveness model from upstream Glance into a Linux-native unlock path.

And Linux is a better platform for this than macOS: PAM lets the unlock authorize the session directly, the same interface sudo and hyprlock use.

  • →
    Stores no password anywhere
    Embeddings are encrypted at rest with AES-256-GCM. The unlock path never sees your login password.
  • →
    Injects no keystrokes
    Authorizes the session through PAM, not by typing into a password field.
  • →
    Needs no accessibility permission
    The macOS version requires input-injection rights to type the stored password. Glance Linux doesn't.
  • →
    Works without the shell
    Unlock lives in PAM and hyprlock's stack. The plugin is presentation only — it can never influence an unlock.

Omarchy integration

A plugin that knows what it can do.

The Omarchy plugin is QML, runs inside the shell, and ships a bar widget plus a control panel. It can show state and run commands as you. It cannot install a PAM module, edit /etc/pam.d, or ship a Python daemon.

So a plugin alone can't deliver face unlock. The intended shape is a package plus one enroll, one setup-pam, and the plugin that ties them together.

Bar widget

Live status — armed, disarmed, scanning, locked — rendered in the top bar alongside the rest of your shell.

Control panel

Arm, disarm, run a test scan. Tells you which of enroll and setup-pam is still missing.

Lock screen capsule

Face ID-style pill drawn into the lock plugin, with a live camera view while it scans.

Liveness

Five cues.
No overall score.

Upstream arrived at this after real-device testing killed an earlier design that averaged ~11 signals into a weighted score: most were noise-limited at webcam resolution, several actively rewarded the smooth motion of a hand holding up a phone, and the resulting number wandered 30–80% on a live face while a phone photo scored about the same.

Only five cues separate a real face from a phone, and each is individually decisive. Averaging them is exactly the wrong combination rule.

Gloss / glare

Deny

One big flat specular blob (glass) rather than the small scattered shine of skin.

Device detected

Deny

A device-shaped rectangle overlaps the face.

Flat vs 3D

Confirm

Held-out nose points miss the best-fit homography — the face has depth.

Depth / pose

Confirm

Nose offset tracks head yaw at a magnitude only a real nose produces.

Blink

Confirm

Eye aspect ratio dipped and recovered during the scan.

Light mode

Runs the deny cues only. "Confirmed unless proven wrong" — never blocks a user who happens to sit still.

Heavy mode

Also requires a confirm cue. Can fail to unlock a motionless, unblinking live user. That cost is pinned in a test so it is never mistaken for a regression.

Setup

Four commands to face unlock.

Run packaging/install.sh first to lay down the user service and the plugin symlink, then enroll, wire PAM, and enable the plugin.

  1. 01
    Install 
    packaging/install.sh

    User service + plugin symlink

  2. 02
    Enroll 
    glancectl enroll --name "$USER" --remember

    5 captures, sets the passphrase

  3. 03
    Wire PAM 
    glancectl setup-pam

    sudo step — keep a root TTY open

  4. 04
    Enable plugin 
    omarchy plugin enable ayande.glance

    Bar widget + control panel

Keep a root TTY open. When wiring pam_glance, a broken PAM stack locks you out of your own machine.

Caveat

Still not Face ID.

A webcam sees a flat 2D image; an iPhone builds a 3D depth map. The liveness cues here defeat a printed photo and a photo on a phone screen with reasonable confidence. They do not reliably defeat a video of you. Glance is a convenience feature, not a security upgrade.

glancectl selftest drives the real decision logic against synthetic faces and prints every cue's reading with no camera involved. glancectl live does the same against real frames.

Open source

Completely open-source.

MIT licensed. Built on top of the liveness model from Glance (macOS, MIT © Jonathan Zhou) and the ArcFace recognition model from InsightFace.

View on GitHub Install steps

ayande.glance · Arch · Hyprland · PAM