Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1275GitHub issuePublicDecided· Out of scope

Removing 1Password from app menu leaves native-messaging integrations behind

Reported by stappmus · filed Aug 29, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Removing 1Password from app menu leaves native-messaging integrations behindrevision 1 · captured 2026-09-28 21:24 UTC via poll

System details

  • Omarchy 4.0.0.r1837.geb7ecd1-1
  • Linux 7.1.8-arch1-2-ptl
  • Intel Core Ultra X7 358H
  • Intel Panther Lake Arc B390

What's wrong?

Removing 1Password from the Omarchy app menu removes the Arch packages, but leaves 1Password's per-user data and browser native-messaging registrations behind. Browsers and other applications can therefore continue to detect a 1Password integration even though the desktop app is no longer installed.

Steps to reproduce

  1. Install 1Password through Omarchy.
  2. Launch it at least once so it creates its per-user integration files.
  3. Open the Omarchy app menu, select 1Password, and choose Remove.
  4. Confirm that neither 1password nor 1password-cli is installed.
  5. Observe that ~/.config/1Password still exists.
  6. Observe that com.1password.1password.json still exists under browser NativeMessagingHosts directories, including Chromium, Chrome, Brave, Edge, and Vivaldi profiles. These manifests point to the now-missing /opt/1Password/1Password-BrowserSupport.

Confirmed cause

The app menu calls omarchy-remove-launcher-entry. For a system desktop entry owned by a package, that script executes generic sudo pacman -Rns <package>.

This bypasses the dedicated omarchy-remove-service-1password command. The dedicated remover currently removes the system Chromium extension registration and the 1password / 1password-cli packages, but it also does not clean the per-user native-messaging manifests.

Expected behavior

Removing 1Password from the app menu should use the dedicated Omarchy removal path and remove stale native-messaging manifests so no browser detects a nonexistent native app. If preserving ~/.config/1Password is intentional, the UI should say so or offer a separate purge option; the broken manifests should still be removed.

View raw text
### System details

- Omarchy `4.0.0.r1837.geb7ecd1-1`
- Linux `7.1.8-arch1-2-ptl`
- Intel Core Ultra X7 358H
- Intel Panther Lake Arc B390

### What's wrong?

Removing 1Password from the Omarchy app menu removes the Arch packages, but leaves 1Password's per-user data and browser native-messaging registrations behind. Browsers and other applications can therefore continue to detect a 1Password integration even though the desktop app is no longer installed.

### Steps to reproduce

1. Install 1Password through Omarchy.
2. Launch it at least once so it creates its per-user integration files.
3. Open the Omarchy app menu, select 1Password, and choose **Remove**.
4. Confirm that neither `1password` nor `1password-cli` is installed.
5. Observe that `~/.config/1Password` still exists.
6. Observe that `com.1password.1password.json` still exists under browser `NativeMessagingHosts` directories, including Chromium, Chrome, Brave, Edge, and Vivaldi profiles. These manifests point to the now-missing `/opt/1Password/1Password-BrowserSupport`.

### Confirmed cause

The app menu calls `omarchy-remove-launcher-entry`. For a system desktop entry owned by a package, that script executes generic `sudo pacman -Rns <package>`.

This bypasses the dedicated `omarchy-remove-service-1password` command. The dedicated remover currently removes the system Chromium extension registration and the `1password` / `1password-cli` packages, but it also does not clean the per-user native-messaging manifests.

### Expected behavior

Removing 1Password from the app menu should use the dedicated Omarchy removal path and remove stale native-messaging manifests so no browser detects a nonexistent native app. If preserving `~/.config/1Password` is intentional, the UI should say so or offer a separate purge option; the broken manifests should still be removed.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 02:22 UTC