Proof Portal

Sign in
Project overview

Omarchy

ProbeLabsviewing a historical run

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Viewing historical run b16f5e6Oct 2, 2026, 01:38 AMpr/10631Back to current
Back to findings
Known issueKI-MENU-MERGE-OVERRIDE-WIPES-DEFAULTS

normalize-before-merge wipes unspecified defaults: a label-only user entry erases action/aliases/guards

OpenOpenLow

Low-severity issue, currently open.

Description

The issue as recorded.

normalizeItem materializes every omitted field as an empty default BEFORE mergeMenuSources' per-key overlay. The user's normalized row therefore carries explicit empty action/aliases/when/checked/disabled/icon keys that overwrite the default row's values (F10: merged action becomes ''). The normalization step in the rebuild pipeline defeats the per-key override contract ('a later source overrides only the keys the author declared').

Affected requirements

The requirement(s) this issue violates — click through to the spec.

SW-REQ-260922-7NPE

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

LowRated severity — the impact if this issue is exploited or hit.
why this rating
Risk-rated
risk area
Correctness
Security classification
Not a security surface
CVE surface
None

How it's proven

The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.

Known issue reproducedprofileknown_issue_reproducerprovesSW-REQ-260922-7NPE
Reproducer test
Run it yourself
node pocs/menu-probes.js ../shell/plugins/menu/MenuModel.js
Covers (2)
Last run Sep 30, 2026, 11:02 PM

Reproduction steps

Technical steps for your engineers to confirm the issue by hand.

node pocs/menu-probes.js ../shell/plugins/menu/MenuModel.js

What protects you, and the fix

What limits your exposure today, and the planned remediation.

What protects you now

Default installs ship no label-only overrides; users who override a row restate the fields they care about, masking the wipe

The fix

merge the RAW user entry over the default before normalizing (or make the merge skip empty-string/empty-array values from the overlay source)

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.

Tracing blast radius…

Touch this finding and you re-check 1 requirements · 2 code files · 2 tests.

Requirements (1)
SW-REQ-260922-7NPE
Code files (2)
  • Menu.qml
  • MenuModel.js
Tests (2)
  • menumodel-replay.test.mjs
  • menu-test.sh

Per-requirement evidence

For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.

SW-REQ-260922-7NPE
Implementing code (2)
  • shell/plugins/menu/Menu.qml
    item
  • shell/plugins/menu/MenuModel.js
    mergeMenuSources
Tests & evidence (2)
  • test/node/menumodel-replay.test.mjs
  • test/shell.d/menu-test.sh

Evidence trail

The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.

  • pocs/menu-probes.js
  • pocs/menu-probes2.js
  • pocs/menu-probes3.js
  • proof/evidence/ki-menu-merge-override-wipes-defaults.yaml

Change history

Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in