OmaSend - Zero-Knowledge AirBridge and E2EE Transfer for Omarchy Linux

Cross-device file transfer, encrypted clipboard bridge, Omarchy AirDrop P2P, and global WAN portal with Zero-Knowledge AES-256-GCM encryption for Omarchy Linux.

Author: Ozan Ozdil (ozdil)
License: MIT
Plugin ID: ozdil.omasend

---

Features

• Omarchy AirDrop P2P (PC-to-PC and Mobile Direct Transfer):
  • Zero-Config Discovery: Automatically discovers neighboring Omarchy Linux desktops and Android devices on the same local network using UDP beacons (port 53317).
  • Native Android Companion: Dedicated Kotlin and Jetpack Compose mobile app providing system share sheet integration, bidirectional transfers, and universal clipboard bridge.
  • 3-Tier Visibility Control: Off, Known (Trusted Peers Only - Default), and Everyone (10 Minutes Temporary Discovery).
  • Gatekeeper Consent: No files are accepted silently. Recipient receives an interactive desktop notification and panel prompt with sender name, file list, and total transfer size. Transfer begins only after explicit approval.
  • Universal Clipboard Sync: Bidirectional encrypted Wayland and Android clipboard synchronization between Omarchy desktops and mobile devices with a single click.
• Zero-Knowledge End-to-End Encryption (E2EE):
  • Hardware-accelerated AES-256-GCM encryption via the native Web Crypto API (crypto.subtle).
  • Cryptographic session key is passed strictly inside the URL hash fragment (#key=...), which never reaches HTTP request headers or server logs (RFC 3986).
• Zero-Install Mobile Portal:
  • Scan the QR code with any smartphone camera to open the encrypted web portal in Safari or Chrome. No apps required on mobile devices.
  • Send photos, videos, and documents directly to your desktop.
• Hybrid Network Modes (LAN and Global WAN):
  • Local Area Network (LAN): Full-speed transfer (300-800 Mbps) over local Wi-Fi.
  • Wide Area Network (Global WAN Tunnel): Secure HTTPS tunnel using cloudflared without requiring router port forwarding or static IP.
• Hardened Rust Engine:
  • Compliant with Omarchy Linux Security Standards (AGENTS.md): isolated process groups, monotonic execution deadlines, atomic file operations (mode 0600), and buffer overrun protection.

---

Requirements

• cargo and rustc (Rust toolchain, for building the native engine)
• qrencode (for generating QR codes in SVG format)
• wl-clipboard (provides wl-copy and wl-paste on Wayland)
• libnotify (desktop notifications via notify-send)
• zenity (GTK file selection dialog)
• cloudflared (optional, required for Global WAN Tunnel mode; system package)

---

Installation and Setup

Why Building from Source is Required

Under the Omarchy Linux Security Standards (AGENTS.md Rule 5.3), precompiled binaries are strictly forbidden from Git repositories to guarantee user system integrity. Therefore, the native engine must be compiled from source on your local machine after adding the plugin.

Step 1: Add the Plugin to Omarchy

omarchy plugin add https://github.com/ozdil/omarchy-omasend.git

Step 2: Build the Native Engine

Navigate to the plugin directory and run the automated build script:

cd ~/.config/omarchy/plugins/ozdil.omasend && ./build.sh

This script compiles the engine using cargo build --release --locked, installs the binary (omasend-engine) with proper permissions, and restarts the Omarchy shell automatically.

Step 3: Firewall Configuration (Zero Configuration on Omarchy Linux)

Omarchy Linux pre-configures and permits port 53317 (TCP and UDP) out of the box for local network sharing, meaning OmaSend requires zero manual firewall configuration under standard Omarchy installations.

Step 4: Add to Top Bar (Optional)

If not automatically present in your panel, add ozdil.omasend to bar.layout.right in ~/.config/omarchy/shell.json:

{
  "id": "ozdil.omasend"
}

Then restart the shell:

omarchy-restart-shell

3. OmaSend for Android (Companion Application)

OmaSend features an official native Android companion app built with modern Kotlin, Jetpack Compose, and Material 3. It provides seamless, bidirectional file streaming and clipboard synchronization directly from your mobile device.

• Source Repository: ozdil/omasend-android

🛡️ Official Google Play Closed Beta:

OmaSend for Android is distributed officially via Google Play:

1. Join Tester Community: OmaSend Testers Google Group (Click "Join group")
2. Opt-in to Beta: Google Play Testing Opt-in (Click "Become a tester")
3. Download on Google Play: OmaSend on Google Play

Build from Source:

cd ~/.config/omarchy/plugins/ozdil.omasend && ./build-android.sh

# Install directly via ADB:
adb install -r omasend-debug.apk

---

How It Works and Usage Guide

Click the paper plane icon in the Omarchy top bar to open the OmaSend panel.

1. Omarchy AirDrop P2P (PC-to-PC and Mobile Sharing)

• Device Discovery: Computers and Android phones running OmaSend on the same local network automatically appear under "AIRBRIDGE DISCOVERED DEVICES" with their hostname, device model, and IP.
• Visibility Modes:
  • KNOWN PEERS ONLY (Default): Only previously paired devices can see you.
  • EVERYONE (10M): Temporarily visible to all nearby devices for 10 minutes.
• Sending Files: Click the "SEND" button next to any discovered peer to open the file picker. Selected files will be transmitted directly.
• Syncing Clipboard: Click the "CLIPBOARD" button to instantly sync your current Wayland desktop clipboard to the target computer or phone.
• Recipient Consent: Incoming transfers show an interactive prompt with sender information and file details. Approved transfers are downloaded directly to ~/Downloads/omasend/ (or Downloads/OmaSend on Android).

2. Android System Share Sheet Integration

• In any Android app (Google Photos, Gallery, Files, Chrome), tap "Share".
• Select "Send via OmaSend" from the system share sheet.
• Tap your Omarchy PC (ggs4, jonsbo) to stream the file or photo directly to your desktop.

3. Mobile to PC Transfer via Browser (Zero-Install Web Portal)

1. Open the OmaSend panel and select LAN mode.
2. Scan the displayed QR code with your smartphone camera.
3. The portal automatically pairs with the 4-digit PIN and loads the AES-256 encryption key.
4. Upload files directly from your mobile browser into ~/Downloads/omasend/.
5. Files placed in ~/Downloads/omasend/shared/ on your PC can be downloaded from the mobile portal.
6. Use the clipboard box to send text between mobile and PC in real time.

4. Global WAN Tunnel

• When devices are on different networks or cellular data, switch to "WAN" mode in the panel.
• OmaSend initiates an end-to-end encrypted HTTPS tunnel through cloudflared.
• Transfer files securely across the internet without opening ports.

---

Security and Architecture Standards

OmaSend complies strictly with the Omarchy Linux Security Architecture:

• Subprocess Isolation: Processes run in isolated process groups (cmd.process_group(0)) with non-blocking I/O (fcntl O_NONBLOCK) and bounded polling.
• Strict File Permissions: Sensitive state files (trusted_peers.json, device_id.key) and in-flight staging parts are written atomically with mode 0600. Download and staging directories enforce mode 0700. Symlinks are strictly rejected.
• Concurrency Caps & DoS Protection: Strict global cap (max 32 active connections) and per-peer IP cap (max 4 active connections) enforced at socket accept before spawning worker threads; excess requests are rejected early with HTTP 429.
• Monotonic Socket Deadlines: End-to-end socket reads across both headers and body enforce an immutable monotonic deadline (30s) recalculating remaining durations dynamically, neutralizing Slowloris drip-feeding attacks.
• Strict Supply-Chain & Android Dependency Verification: The Android companion build strictly verifies every direct, plugin, and transitive dependency against committed cryptographic SHA-256 digests in android/gradle/verification-metadata.xml with strict mode enforced (org.gradle.dependency.verification=strict). Building the companion will fail immediately if any downloaded artifact does not match its pinned cryptographic checksum.
• Early Header-First Authentication: Request headers are parsed and strictly authenticated (via PIN rate-limiter or transfer token) before reading or staging any request body bytes. Unauthenticated or forbidden requests are rejected immediately with HTTP 401/403 without touching disk or allocating body buffers.
• Endpoint-Specific Body Ceilings:
  • Clipboard endpoints (/api/clipboard*): strictly capped at 1 MiB.
  • Control and signaling endpoints: strictly capped at 64 KiB.
  • Plain file uploads (/upload, /api/p2p/upload): capped at 100 MiB and streamed directly to disk.
  • Encrypted uploads (/api/upload-encrypted): strictly capped at 25 MiB with a global concurrency ceiling of 2 concurrent decryption workers, bounding server-wide peak decryption RAM to ~100 MiB.
• Atomic Aggregate Staging Reservation: Global aggregate cap of 200 MiB across all in-flight staging files guarded by atomic state and disk space pre-check, eliminating TOCTOU races on filesystem storage.
• Plain Text UI: All dynamic strings in QML use textFormat: Text.PlainText to prevent script and markup injection.

---

Support & Sponsorship

If you find OmaSend useful and want to support independent, open-source Linux development:

---

License

MIT License. See LICENSE for details.