Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Tailscale panel: account switcher labels every profile with the same nickname, hiding which tailnet is which
Reported by tarpediem · filed Aug 30, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
The Tailscale bar widget's account switcher renders one identical row per
profile when the user belongs to several tailnets with the same Tailscale
account, making the switcher unusable — you cannot tell which row is which
tailnet.
accountLabel() in shell/plugins/panels/tailscale/Model.js prefersnickname over tailnet:
function accountLabel(account) {
if (!account) return "Unknown account"
if (account.nickname) return String(account.nickname)
if (account.tailnet) return String(account.tailnet)
if (account.account) return String(account.account)
return String(account.id || "Unknown account")
}tailscale switch --list --json returns the same nickname for every profile
of a given user — it is the account identity, not the tailnet identity. Onlytailnet differs:
[
{
"id": "1982",
"nickname": "[email protected]",
"tailnet": "[email protected]",
"account": "[email protected]",
"selected": false
},
{
"id": "8833",
"nickname": "[email protected]",
"tailnet": "acme.com",
"account": "[email protected]",
"selected": true
}
]So both rows render as [email protected].
What I expected
Each row labelled by its tailnet, so the personal tailnet and acme.com are
distinguishable.
Steps to reproduce
- Be a member of two tailnets with the same Tailscale account (e.g. a personal
tailnet plus an organisation one you were invited to).
2. sudo tailscale login --accept-routes and authenticate into the second
tailnet, so two profiles exist locally.
3. sudo tailscale set --operator=$USER (otherwise the panel only shows the
operator-permission message).
4. omarchy plugin enable omarchy.tailscale, open the panel.
5. The accounts section lists two rows with identical text.
Reproduces reliably; tailscale switch --list --json above is the exact input.
Suggested fix
Prefer tailnet over nickname, keeping the rest of the chain as a fallback:
function accountLabel(account) {
if (!account) return "Unknown account"
if (account.tailnet) return String(account.tailnet)
if (account.nickname) return String(account.nickname)
if (account.account) return String(account.account)
return String(account.id || "Unknown account")
}Verified locally on a clone of the plugin: the two rows then read[email protected] and acme.com. Note that a personal tailnet is genuinely
named after the account e-mail, so that row still shows an address — but the
rows become distinct, which is the point.
Happy to open a PR if useful.
System
- Omarchy 4.0.1-1
- Kernel 7.1.9-arch1-2
- CPU AMD Ryzen AI 9 HX 370 (Radeon 890M) / GPU NVIDIA RTX 3080 Ti
- tailscale 1.102.3
View raw text
### What happened
The Tailscale bar widget's account switcher renders one identical row per
profile when the user belongs to several tailnets with the same Tailscale
account, making the switcher unusable — you cannot tell which row is which
tailnet.
`accountLabel()` in `shell/plugins/panels/tailscale/Model.js` prefers
`nickname` over `tailnet`:
```js
function accountLabel(account) {
if (!account) return "Unknown account"
if (account.nickname) return String(account.nickname)
if (account.tailnet) return String(account.tailnet)
if (account.account) return String(account.account)
return String(account.id || "Unknown account")
}
```
`tailscale switch --list --json` returns the same `nickname` for every profile
of a given user — it is the account identity, not the tailnet identity. Only
`tailnet` differs:
```json
[
{
"id": "1982",
"nickname": "[email protected]",
"tailnet": "[email protected]",
"account": "[email protected]",
"selected": false
},
{
"id": "8833",
"nickname": "[email protected]",
"tailnet": "acme.com",
"account": "[email protected]",
"selected": true
}
]
```
So both rows render as `[email protected]`.
### What I expected
Each row labelled by its tailnet, so the personal tailnet and `acme.com` are
distinguishable.
### Steps to reproduce
1. Be a member of two tailnets with the same Tailscale account (e.g. a personal
tailnet plus an organisation one you were invited to).
2. `sudo tailscale login --accept-routes` and authenticate into the second
tailnet, so two profiles exist locally.
3. `sudo tailscale set --operator=$USER` (otherwise the panel only shows the
operator-permission message).
4. `omarchy plugin enable omarchy.tailscale`, open the panel.
5. The accounts section lists two rows with identical text.
Reproduces reliably; `tailscale switch --list --json` above is the exact input.
### Suggested fix
Prefer `tailnet` over `nickname`, keeping the rest of the chain as a fallback:
```js
function accountLabel(account) {
if (!account) return "Unknown account"
if (account.tailnet) return String(account.tailnet)
if (account.nickname) return String(account.nickname)
if (account.account) return String(account.account)
return String(account.id || "Unknown account")
}
```
Verified locally on a clone of the plugin: the two rows then read
`[email protected]` and `acme.com`. Note that a personal tailnet is genuinely
named after the account e-mail, so that row still shows an address — but the
rows become distinct, which is the point.
Happy to open a PR if useful.
### System
- Omarchy 4.0.1-1
- Kernel 7.1.9-arch1-2
- CPU AMD Ryzen AI 9 HX 370 (Radeon 890M) / GPU NVIDIA RTX 3080 Ti
- tailscale 1.102.3
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 10:10 UTC