Proof Portal
Omarchy
ProbeLabs73 findings · 87 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
A whole-line comment in a CR-only menu file swallows the rest of the file
Low-severity issue, currently open.
Description
The issue as recorded.
The comment pass in stripJsonc (shell/plugins/menu/MenuModel.js) is /^\s*\/\/[^\n]*(\n|$)/gm. With the m flag, ^ also matches after a lone CR. But [^\n]* stops only at LF. Some editors save a file with CR-only line endings (classic Mac style).
In such a file the first whole-line // comment runs to the end of the file. The pass deletes the rest of the document, JSON.parse fails, and parseMenuJsonc returns an empty item set. We checked this live under Quickshell 0.3.1. FileView keeps CR as read.
The real MenuModel.js parses a CR-only file with one comment line to 0 rows. LF and CRLF files parse correctly, and so do CR-only files without comments. pocs/menu-jsonc-cr-line-endings.sh reproduces it with LF, CRLF and comment-free controls. test/shell.d/menu-test.sh pins it as a green tripwire.
Affected requirements
The requirement(s) this issue violates — click through to the spec.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Risk-rated
- risk area
- Correctness
- CVE surface
- None
Where it is
The code the issue lives in — peek the affected function inline to see it in context.
- MenuModel.stripJsonc comment pass (default and user menu JSONC)
How it's proven
The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.
sh pocs/menu-jsonc-cr-line-endings.sh
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
sh pocs/menu-jsonc-cr-line-endings.sh
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
Save the menu file with LF or CRLF line endings. The defect does not affect a CR-only file without comments.
The fix
End a // comment at any line terminator that the m flag uses: CR, LF, U+2028 and U+2029. Or normalise CR and CRLF to LF before the comment pass. omacom/omarchy#13968 does not change this, because its comment drop also stops only before LF. Close criterion: pocs/menu-jsonc-cr-line-endings.sh exits 0 and the KI-MENU-JSONC-CR-LINE-ENDINGS tripwire in test/shell.d/menu-test.sh flips red.
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.
Touch this finding and you re-check 1 requirements · 2 code files · 2 tests.
- Menu.qml
- MenuModel.js
- menumodel-replay.test.mjs
- menu-test.sh
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- proof/evidence/ki-menu-jsonc-cr-line-endings.yaml
Change history
Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.