Prompt freezes with recent NordVPN version — p10k_nordvpn prompt segment hangs

[wlarch]

Problem

After upgrading NordVPN to the latest version, my zsh prompt hangs at startup when using Powerlevel10k and the nordvpn prompt segment. The issue resolves when I comment nordvpn from the segment list in ~/.p10k.zsh.

Steps to Reproduce

1. Update NordVPN to latest version.
2. Open zsh with Powerlevel10k configured and nordvpn in the segment list.
3. Shell does not display prompt and appears stuck, CPU is idle.
4. Removing nordvpn from the segment array fixes the issue.

Diagnostic Steps & Outputs

a. Powerlevel10k debug output:

Run the following from the affected user:

zsh -xv &> p10k-nordvpn-hang.log

+_p9k_set_prompt:46> prompt_nordvpn
+prompt_nordvpn:1> unset P9K_NORDVPN_STATUS P9K_NORDVPN_TECHNOLOGY P9K_NORDVPN_PROTOCOL P9K_NORDVPN_IP_ADDRESS P9K_NORDVPN_SERVER P9K_NORDVPN_COUNTRY P9K_NORDVPN_CITY P9K_NORDVPN_COUNTRY_CODE
+prompt_nordvpn:2> [[ -e /run/nordvpn/nordvpnd.sock ]]
+prompt_nordvpn:3> _p9k_fetch_nordvpn_status

uname -a
Linux 5.15.0-138-generic #148-Ubuntu SMP Fri Mar 14 19:05:48 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

lsb_release -a
Distributor ID: Linuxmint
Description: Linux Mint 21.2
Release: 21.2
Codename: victoria

zsh --version
zsh 5.8.1 (x86_64-ubuntu-linux-gnu)

nordvpn --version
NordVPN Version 3.20.2

ls -l /run/nordvpn/nordvpnd.sock
srwxrwx--- 1 root nordvpn 0 Apr 29 07:46 /run/nordvpn/nordvpnd.sock

ps aux | grep nordvpn
root 1491 0.2 0.1 4963524 67028 ? Ssl 07:46 0:04 /usr/sbin/nordvpnd
user+ 5199 0.0 0.0 2200800 18264 ? Sl 07:47 0:00 /usr/lib/nordvpn/norduserd

nordvpn status
Status: Disconnected

I believe Powerlevel10k prompt is blocking on a call to the new NordVPN daemon/socket or CLI, possibly due to API changes, compatibility, or a delay/hang in detection. Would you like me to try any debugging builds or additional diagnostics?

[hirishh]

I went crazy today after the update of all my systems. Thanks for the debugging

[romkatv]

Thanks for the report!

I've disabled nordvpn prompt segment for now. Anyone affected by the issue will pick up the "fix" if they update. The experience is still going to be awful -- a hanging shell, oof.

[bzeiss]

Is there any way to exit out of the hanging powerline due to this or something like that after xx minutes?? I have a remote machine I cannot login any more unfortunately and it'll be a few weeks until I have physical access again.

[romkatv]

@bzeiss You can get a working shell like this:

ssh -t HOSTNAME zsh -f

You can also do this:

ssh HOSTNAME "sed -i.bak -E '/^[ ]*nordvpn/d' ~/.p10k.zsh"

After this you should be able to ssh HOSTNAME.

[bzeiss]

Ah, of course. Thanks a lot!

[ianitow]

Thanks for debugging.
After commenting on the list (/usr/share/zsh/p10k.zsh), the line with “nordvpn” it worked again.

[kmanwar89]

Might be a +1 here. Recently did a full upgrade on my ZorinOS system, and my shell completely hung. I isolated it to something in .zshrc, further isolating it by commenting out the very last line that references p10k.zsh.

Looking in p10k.zsh, seems there are default prompt elements inherited from p9k, and if they aren't explicitly commented out, they're enabled by default.

I installed the NordVPN client, but hadn't yet logged into the account or used it - it was just installed and running. That, combined with the system upgrade, seems to have been the trigger for this latest issue.

Commenting out this prompt segment, line 89 in my p10k.zsh file (using the default template), allowed my terminal, shell, and customized prompt to return to normal, without uninstalling the NordVPN application from my machine.

[cqqjlxy]

Thank you so much for bringing this up! I had no clue when I got a frozen shell after I updated my packages

[mpierrau]

Commenting out nordvpn in p10k.zsh does prevent the hang on startup, but now doesn't close when attempting to close the terminal with Ctrl+D. The terminal says The child process exited normally with status 0, but doesn't close. I'm on Ubuntu 24.04, with zsh 5.9.

[EricDuminil]

If anyone is interested, here's a proof of concept which seems to work on my system. It uses nordvpn status instead of binary protocol with the nordvpn socket:

# Proof of concept for a simplified version of prompt_nordvpn().
# The previous version seemed to rely on binary protocol with the NordVPN socket,
# and stopped working with newer version of nordvpn client.
# This function relies on "nordvpn status", which should hopefully be more stable.
function prompt_nordvpn() {
  local nordvpn_status nordvpn_country_code nordvpn_server nordvpn_tech nordvpn_protocol nordvpn_city nordvpn_ip

  [[ -e /run/nordvpn/nordvpnd.sock ]] || return

  # Use nordvpn CLI instead of socket communication
  local nordvpn_output=$(nordvpn status 2>/dev/null)
  [[ -n "$nordvpn_output" ]] || return

  # Parse the output once and store in variables
  local line key value
  while IFS='' read -r line; do
    if [[ "$line" =~ ^[[:space:]]*([^:]+):[[:space:]]*(.*) ]]; then
      key="${match[1]}"
      value="${match[2]}"
      case "$key" in
        "Status") nordvpn_status="$value" ;;
        "Hostname") nordvpn_server="$value" ;;
        "IP") nordvpn_ip="$value" ;;
        "Current technology") nordvpn_tech="$value" ;;
        "Current protocol") nordvpn_protocol="$value" ;;
        "City") nordvpn_city="$value" ;;
      esac
    fi
  done <<< "$nordvpn_output"

  if [[ "$nordvpn_status" == "Connected" ]]; then
    # Extract country code from server name, keeping the original logic
    if [[ $nordvpn_server == (#b)([[:alpha:]]##)[[:digit:]]##.nordvpn.com ]]; then
      nordvpn_country_code=${(U)match[1]}
    fi

    # Set the same globals that the original function set
    typeset -g P9K_NORDVPN_STATUS="$nordvpn_status"
    typeset -g P9K_NORDVPN_SERVER="$nordvpn_server"
    typeset -g P9K_NORDVPN_COUNTRY_CODE="$nordvpn_country_code"
    typeset -g P9K_NORDVPN_TECHNOLOGY="${nordvpn_tech:u}"
    typeset -g P9K_NORDVPN_PROTOCOL="${nordvpn_protocol:u}"
    typeset -g P9K_NORDVPN_CITY="$nordvpn_city"
    typeset -g P9K_NORDVPN_IP_ADDRESS="$nordvpn_ip"

    # Display country code
    local display_text="$P9K_NORDVPN_COUNTRY_CODE"
    # Uncomment if you want to display more information:
    # [[ -n "$P9K_NORDVPN_CITY" ]] && display_text+=" $P9K_NORDVPN_CITY"
    # [[ -n "$P9K_NORDVPN_PROTOCOL" ]] && display_text+=" $P9K_NORDVPN_PROTOCOL"
    # [[ -n "$P9K_NORDVPN_TECHNOLOGY" ]] && display_text+=" $P9K_NORDVPN_TECHNOLOGY"
    # [[ -n "$P9K_NORDVPN_IP_ADDRESS" ]] && display_text+=" $P9K_NORDVPN_IP_ADDRESS"

    _p9k_prompt_segment $0_CONNECTED blue white '' 0 '' "$display_text"
  else
    # Disconnected. Nothing to show.
    typeset -g P9K_NORDVPN_STATUS="$nordvpn_status"
    local nordvpn_state=${(U)P9K_NORDVPN_STATUS}
    _p9k_get_icon $0_$nordvpn_state FAIL_ICON
    _p9k_prompt_segment $0_$nordvpn_state yellow white '' 0 '' "$_p9k__ret"
  fi
}

Replacing the prompt_nordvpn function in internal/p10k.zsh, which has been disabled in this commit.

I suppose it's a bit slower than the previous one, but at least it shouldn't randomly freeze after a nordvpn update, and should be easier to debug. Worst case scenario should be that it fails and returns an error message.

Please feel free to test it. If it's considered good enough, I could prepare a PR.

[dvjsharma]

Ah, my terminal went blank after a system update. I almost forgot I was using powerlevel10k. Thanks @wlarch! Saved the day for me.

[kmanwar89]

If anyone is interested, here's a proof of concept which seems to work on my system. It uses nordvpn status instead of binary protocol with the nordvpn socket:

Proof of concept for a simplified version of prompt_nordvpn().

The previous version seemed to rely on binary protocol with the NordVPN socket,

and stopped working with newer version of nordvpn client.

This function relies on "nordvpn status", which should hopefully be more stable.

function prompt_nordvpn() {
local nordvpn_status nordvpn_country_code nordvpn_server nordvpn_tech nordvpn_protocol nordvpn_city nordvpn_ip

[[ -e /run/nordvpn/nordvpnd.sock ]] || return

Use nordvpn CLI instead of socket communication

local nordvpn_output=$(nordvpn status 2>/dev/null)
[[ -n "$nordvpn_output" ]] || return

Parse the output once and store in variables

local line key value
while IFS='' read -r line; do
if [[ "$line" =~ ^[[:space:]]([^:]+):[[:space:]](.*) ]]; then
key="${match[1]}"
value="${match[2]}"
case "$key" in
"Status") nordvpn_status="$value" ;;
"Hostname") nordvpn_server="$value" ;;
"IP") nordvpn_ip="$value" ;;
"Current technology") nordvpn_tech="$value" ;;
"Current protocol") nordvpn_protocol="$value" ;;
"City") nordvpn_city="$value" ;;
esac
fi
done <<< "$nordvpn_output"

if [[ "$nordvpn_status" == "Connected" ]]; then
# Extract country code from server name, keeping the original logic
if [[ $nordvpn_server == (#b)([[:alpha:]]##)[[:digit:]]##.nordvpn.com ]]; then
nordvpn_country_code=${(U)match[1]}
fi

# Set the same globals that the original function set
typeset -g P9K_NORDVPN_STATUS="$nordvpn_status"
typeset -g P9K_NORDVPN_SERVER="$nordvpn_server"
typeset -g P9K_NORDVPN_COUNTRY_CODE="$nordvpn_country_code"
typeset -g P9K_NORDVPN_TECHNOLOGY="${nordvpn_tech:u}"
typeset -g P9K_NORDVPN_PROTOCOL="${nordvpn_protocol:u}"
typeset -g P9K_NORDVPN_CITY="$nordvpn_city"
typeset -g P9K_NORDVPN_IP_ADDRESS="$nordvpn_ip"

# Display country code
local display_text="$P9K_NORDVPN_COUNTRY_CODE"
# Uncomment if you want to display more information:
# [[ -n "$P9K_NORDVPN_CITY" ]] && display_text+=" $P9K_NORDVPN_CITY"
# [[ -n "$P9K_NORDVPN_PROTOCOL" ]] && display_text+=" $P9K_NORDVPN_PROTOCOL"
# [[ -n "$P9K_NORDVPN_TECHNOLOGY" ]] && display_text+=" $P9K_NORDVPN_TECHNOLOGY"
# [[ -n "$P9K_NORDVPN_IP_ADDRESS" ]] && display_text+=" $P9K_NORDVPN_IP_ADDRESS"

_p9k_prompt_segment $0_CONNECTED blue white '' 0 '' "$display_text"

else
# Disconnected. Nothing to show.
typeset -g P9K_NORDVPN_STATUS="$nordvpn_status"
local nordvpn_state=${(U)P9K_NORDVPN_STATUS}
p9k_get_icon $0$nordvpn_state FAIL_ICON
p9k_prompt_segment $0$nordvpn_state yellow white '' 0 '' "$_p9k__ret"
fi
}
Replacing the prompt_nordvpn function in internal/p10k.zsh, which has been disabled in this commit.

I suppose it's a bit slower than the previous one, but at least it shouldn't randomly freeze after a nordvpn update, and should be easier to debug. Worst case scenario should be that it fails and returns an error message.

Please feel free to test it. If it's considered good enough, I could prepare a PR.

Excellent work on this! Given p10k is no longer actively developed, maybe a fork would make more sense? I'm not sure the developer will accept the PR (unless this is considered truly "breaking" functionality?)

What's interesting is...on my MacBook, I have the exact same setup, and actually have an active/in-use NordVPN client, and have never had a single issue. The only system impacted was my Linux desktop, where NordVPN was installed but not signed-in/in-use. Strange...

[EricDuminil]

@kmanwar89 Thanks. The dev wrote a small commit to deactivate the plugin, so maybe he could also review a short, related PR.

https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh#L4886 seems to mention that the plugin only works (or at least worked) on Linux.

Is /run/nordvpn/nordvpnd.sock present on your MacBook? If not, the plugin returns directly, just like after the quickfix.

If nordvpn status is available on your MacBook, my proof of concept should hopefully work on it too.

The nordvpn plugin used a while true; do loop, with a few breaks, which apparently relied on specific binary answers of the socket. If the socket doesn't answer, or answers with a slightly different format, the loop apparently never returns, even if nordvpn isn't connected.

[kmanwar89]

@EricDuminil thanks for responding - hopeful the P10k developer approves the PR!!

Neither /run nor nordvpn status are available on my Mac, which may explain why it never "broke". Really appreciate you taking the time to explain what is going on here, because I was definitely going crazy for a bit and ready to wipe my entire machine and start over if I hadn't found this Github issue!