Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy-update-mise forces MISE_MINIMUM_RELEASE_AGE=0 and ignores npm min-release-age
Reported by berenddeboer · filed Sep 1, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Summary
omarchy update runs MISE_MINIMUM_RELEASE_AGE=0 mise up. That override asks mise for brand-new releases, including npm-backed tools. If ~/.npmrc has min-release-age set (npm's supply-chain delay), npm refuses those packages and the mise step fails.
The same MISE_MINIMUM_RELEASE_AGE=0 export is baked into mup and the wrappers written by omarchy-mise-install.
Why this is a problem
npm min-release-age exists so a freshly published package is not installed for a few days. Forcing mise's cooldown to zero fights that on purpose: the update path wants "latest now". The result is either:
- the update fails (npm rejects the package), or
- if npm's delay is also cleared, the supply-chain window is bypassed
Omarchy currently hits the first case and does not mention npm's setting at all.
Where
bin/omarchy-update-mise:MISE_MINIMUM_RELEASE_AGE=0 mise updefault/bash/aliases:alias mup='MISE_MINIMUM_RELEASE_AGE=0 mise up'bin/omarchy-mise-install: wrappersexport MISE_MINIMUM_RELEASE_AGE=0
Expected
Either honor the user's npm min-release-age (set mise's minimum release age to match, and stop forcing 0), or treat a npm cooldown failure as non-fatal after packages/migrations have already succeeded.
Forcing 0 on every wrapper and on omarchy update looks like the wrong default if the user has opted into a release delay.
View raw text
## Summary `omarchy update` runs `MISE_MINIMUM_RELEASE_AGE=0 mise up`. That override asks mise for brand-new releases, including npm-backed tools. If `~/.npmrc` has `min-release-age` set (npm's supply-chain delay), npm refuses those packages and the mise step fails. The same `MISE_MINIMUM_RELEASE_AGE=0` export is baked into `mup` and the wrappers written by `omarchy-mise-install`. ## Why this is a problem npm `min-release-age` exists so a freshly published package is not installed for a few days. Forcing mise's cooldown to zero fights that on purpose: the update path wants "latest now". The result is either: - the update fails (npm rejects the package), or - if npm's delay is also cleared, the supply-chain window is bypassed Omarchy currently hits the first case and does not mention npm's setting at all. ## Where - `bin/omarchy-update-mise`: `MISE_MINIMUM_RELEASE_AGE=0 mise up` - `default/bash/aliases`: `alias mup='MISE_MINIMUM_RELEASE_AGE=0 mise up'` - `bin/omarchy-mise-install`: wrappers `export MISE_MINIMUM_RELEASE_AGE=0` ## Expected Either honor the user's npm `min-release-age` (set mise's minimum release age to match, and stop forcing 0), or treat a npm cooldown failure as non-fatal after packages/migrations have already succeeded. Forcing 0 on every wrapper and on `omarchy update` looks like the wrong default if the user has opted into a release delay.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Fixed bypr/11514· confirmed
- Fixed bypr/14914· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 10:22 UTC