Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1140GitHub issuePublicReceived

Idle-triggered lock silently no-ops; screen never actually locks

Reported by joshland · filed Aug 31, 2026 · open at source

In the audited area (lock) — decided by agents · verified. Not validated yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaIn the audited arealock· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. So far: in the audited area (lock) — decided by agents · verified; matches no known issue — decided by agents · verified. The outcome (valid, duplicate, not a bug, …) is not decided yet. See the decision.

Original report

Idle-triggered lock silently no-ops; screen never actually locksrevision 1 · captured 2026-09-28 21:24 UTC via poll

What happened

When the idle timer reaches the configured idle.lock timeout, the lock screen is never actually shown — the screen stays fully unlocked and accessible, even though the internal scripts report success. Locking manually (omarchy system lock) and locking via suspend both work correctly. Only the automatic idle-timeout path is affected.

Expected behavior

When idle time exceeds idle.lock (in ~/.config/omarchy/shell.json), the session should lock, same as a manual omarchy system lock.

Steps to reproduce

  1. Set a short idle.lock in ~/.config/omarchy/shell.json for testing (default is 300s).
  2. Leave the machine untouched (no keyboard/trackpad/power-button input) until the configured lock timeout elapses.
  3. Observe: no lock screen appears. Check omarchy-shell lock status afterward — it still reports the state from before the idle period, with no lock-requested/secure=true transition logged.

Compare with:
- omarchy system lock run manually — locks correctly every time.
- Closing the lid / suspending — locks correctly on resume.

Root cause (as far as I could trace it)

  • The idle module's lock-timeout event correctly spawns omarchy-system-lock (confirmed via journalctl --user _COMM=quickshell), which exits with status 0.
  • omarchy-system-lock triggers the lock via omarchy-shell lock lock >/dev/null — an IPC call sent back into the same Quickshell process that just spawned it as a child.
  • On the automatic idle path, this self-referential IPC call appears to fail silently. No lock-requested or secure=true is ever logged by the lock module (the "omarchy lock" log namespace stays completely silent), unlike a manual invocation, which logs the full lock-requested → secure=true sequence within ~1s.
  • The failure is invisible because:
  • omarchy-shell's IPC wrapper treats any output that doesn't match its known failure-string patterns as success (exit 0), per its own comment: "qs reports connection failures with a nonzero exit, but IPC-level failures (unknown target/function, bad arguments) go to stdout with exit 0."
  • omarchy-system-lock redirects that call's output to /dev/null and never checks its exit status.
  • Net effect: the idle-triggered lock script "succeeds" from the shell's point of view, but the lock screen never engages.

Evidence

Log from a clean reproduction (nothing touched during the idle period):

20:21:43.146  omarchy idle: lock-system: lock-timeout
20:21:43.146  omarchy idle: process-start: lock omarchy-system-lock
20:21:44.787  omarchy idle: process-exit: lock exitCode=0 status=0

omarchy-shell lock status immediately after:

{"locked":false,"requested":false,"pending":false,"sessionLocked":false,"secure":false, "lastEvent":"unlocked", "lastEventAt":"<timestamp from an earlier manual lock, unchanged>"}

No lock-requested, secure=, or any other lock-module log line appears between the lock-timeout and this status check — the lock module was never actually engaged.

For contrast, a manual omarchy system lock run from a shell produces the expected full sequence:

lock-requested
lock-pending: screen-stabilizing
secure=true

System info

  • Omarchy channel: dev
  • Omarchy version: dev
  • Hyprland: 0.56.2
  • Quickshell: 0.3.1 (Arch Linux build)
  • Kernel: 7.1.9-arch1-2
  • CPU: Intel Core i7-9750H
  • GPU: Intel UHD Graphics 630 + NVIDIA GeForce GTX 1650 Mobile (Max-Q), hybrid graphics laptop

idle.lock and idle.screensaver in shell.json are set to their working defaults (300 / 150) and fire on schedule — this is not a config/timing issue, the timeout is correctly detected each time, only the resulting lock action fails silently.

View raw text
## What happened

When the idle timer reaches the configured `idle.lock` timeout, the lock screen is never actually shown — the screen stays fully unlocked and accessible, even though the internal scripts report success. Locking manually (`omarchy system lock`) and locking via suspend both work correctly. Only the automatic idle-timeout path is affected.

## Expected behavior

When idle time exceeds `idle.lock` (in `~/.config/omarchy/shell.json`), the session should lock, same as a manual `omarchy system lock`.

## Steps to reproduce

1. Set a short `idle.lock` in `~/.config/omarchy/shell.json` for testing (default is 300s).
2. Leave the machine untouched (no keyboard/trackpad/power-button input) until the configured lock timeout elapses.
3. Observe: no lock screen appears. Check `omarchy-shell lock status` afterward — it still reports the state from before the idle period, with no `lock-requested`/`secure=true` transition logged.

Compare with:
- `omarchy system lock` run manually — locks correctly every time.
- Closing the lid / suspending — locks correctly on resume.

## Root cause (as far as I could trace it)

- The idle module's `lock-timeout` event correctly spawns `omarchy-system-lock` (confirmed via `journalctl --user _COMM=quickshell`), which exits with `status 0`.
- `omarchy-system-lock` triggers the lock via `omarchy-shell lock lock >/dev/null` — an IPC call sent back into the same Quickshell process that just spawned it as a child.
- On the automatic idle path, this self-referential IPC call appears to fail silently. No `lock-requested` or `secure=true` is ever logged by the lock module (the `"omarchy lock"` log namespace stays completely silent), unlike a manual invocation, which logs the full `lock-requested` → `secure=true` sequence within ~1s.
- The failure is invisible because:
  - `omarchy-shell`'s IPC wrapper treats any output that doesn't match its known failure-string patterns as success (exit 0), per its own comment: *"qs reports connection failures with a nonzero exit, but IPC-level failures (unknown target/function, bad arguments) go to stdout with exit 0."*
  - `omarchy-system-lock` redirects that call's output to `/dev/null` and never checks its exit status.
- Net effect: the idle-triggered lock script "succeeds" from the shell's point of view, but the lock screen never engages.

## Evidence

Log from a clean reproduction (nothing touched during the idle period):

```
20:21:43.146  omarchy idle: lock-system: lock-timeout
20:21:43.146  omarchy idle: process-start: lock omarchy-system-lock
20:21:44.787  omarchy idle: process-exit: lock exitCode=0 status=0
```

`omarchy-shell lock status` immediately after:

```json
{"locked":false,"requested":false,"pending":false,"sessionLocked":false,"secure":false, "lastEvent":"unlocked", "lastEventAt":"<timestamp from an earlier manual lock, unchanged>"}
```

No `lock-requested`, `secure=`, or any other lock-module log line appears between the `lock-timeout` and this status check — the lock module was never actually engaged.

For contrast, a manual `omarchy system lock` run from a shell produces the expected full sequence:

```
lock-requested
lock-pending: screen-stabilizing
secure=true
```

## System info

- Omarchy channel: `dev`
- Omarchy version: `dev`
- Hyprland: 0.56.2
- Quickshell: 0.3.1 (Arch Linux build)
- Kernel: 7.1.9-arch1-2
- CPU: Intel Core i7-9750H
- GPU: Intel UHD Graphics 630 + NVIDIA GeForce GTX 1650 Mobile (Max-Q), hybrid graphics laptop

`idle.lock` and `idle.screensaver` in `shell.json` are set to their working defaults (300 / 150) and fire on schedule — this is not a config/timing issue, the timeout is correctly detected each time, only the resulting lock action fails silently.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

  • Related PRpr/9429· confirmed
  • Related PRpr/14911· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Decided by agents · verified: in the audited area (lock)
  • Decided by agents · verified: matches no known issue

The outcome (valid, duplicate, not a bug, …) is not decided yet.