Proof Portal
Omarchy
ProbeLabs73 findings · 87 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
pendingInitialMenu is stored and never read: a route summoned before the JSONC loads opens root and stays there
Low-severity issue, currently open.
What this means for you
Plain-language impact — what this issue could mean for your users and your system, before any of the technical detail.
A menu key pressed while the shell is starting opens the main menu instead of the menu you asked for. This happens right after login, or after omarchy-restart-shell, which omarchy update runs. An action shortcut such as Super+Ctrl+R also opens the main menu, and its action never runs. Pressing it again a second later works.
Technical description
openRoute stores the resolved id in pendingInitialMenu (Menu.qml:975) and nothing reads it (anchor PIM1: exactly two occurrences). With items still empty at summon time, resolveRoute returns the literal, item() misses, openExistingMenu rewrites to root, and after onLoaded nothing applies the stored route. A misspelled route also silently becomes root, undoing resolveRoute's documented literal fallthrough in the same turn.
Affected requirements
The requirement(s) this issue violates — click through to the spec.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Risk-rated
- risk area
- Correctness
- CVE surface
- None
How it's proven
The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.
known_issue_reproducerpocs/menu-qml-static.sh
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
pocs/menu-qml-static.sh
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
The race needs a summon landing before the JSONC loads (a sub-second window at session start); reopening lands on the intended route
The fix
Apply pendingInitialMenu once both menu files have loaded, or block the first open until they load. PR #14055 does the first.
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.
Touch this finding and you re-check 2 requirements · 1 code files · 3 tests.
- Menu.qml
- menumodel-replay.test.mjs
- menu-test.sh
- menu-compositor-test.sh
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- pocs/menu-qml-static.sh
- proof/evidence/ki-menu-pending-initial-menu-dead.yaml
Change history
Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.