Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1335GitHub issuePublicDecided· Out of scope

Rust install leaves unguarded ~/.profile cargo source that can login-loop UWSM

Reported by pkayokay · filed Aug 27, 2026 · open at source

Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Rust install leaves unguarded ~/.profile cargo source that can login-loop UWSMrevision 1 · captured 2026-09-28 21:24 UTC via poll

System details

Apple MacBook Air (M1, 2020), Omarchy 4.0.1-2 (omarchy-mac / Asahi), Hyprland via UWSM + SDDM

What's wrong?

SDDM accepts the password, then immediately returns to the greeter. No useful error on screen. Cause: ~/.profile had an unguarded rustup line sourcing a missing ~/.cargo/env; UWSM’s env preloader sources ~/.profile and aborts the Hyprland session when that fails.

This is relevant to Omarchy because Install → Development → Rust runs stock rustup with -y (no --no-modify-path), which writes that unguarded .profile line. Same script on upstream basecamp/omarchy quattro — not Mac-specific.

What happened

On 2026-08-27, after typing the SDDM password, the session flashed and bounced back to the login screen. This repeated many times.

Observed state while broken:

  • ~/.profile line 1 was exactly:
  . "$HOME/.cargo/env"
  • ~/.cargo/env did not exist
  • ~/.rustup did not exist (Rust not currently installed)
  • ~/.bashrc already had the guarded form [[ -r "$HOME/.cargo/env" ]] && . "$HOME/.cargo/env", so interactive shells were fine; UWSM does not use interactive bashrc for this path

That .profile line is what rustup appends on a default install. Omarchy’s installer invokes that default:

# bin/omarchy-install-dev-env (rust)
bash -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y

Journal

Unit: [email protected] (uwsm_env-preloader)

Aug 27 16:07:15 paulkim uwsm_env-preloader[879]: Loading shell profile.
Aug 27 16:07:15 paulkim uwsm_env-preloader[879]: /home/paulkim/.profile: line 1: /home/paulkim/.cargo/env: No such file or directory
Aug 27 16:07:15 paulkim uwsm_env-preloader[879]: Env output mark "c49cd3e68cbdad36" not found in shell output!
Aug 27 16:07:15 paulkim systemd[839]: [email protected]: Main process exited, code=exited, status=1/FAILURE
Aug 27 16:07:15 paulkim systemd[839]: [email protected]: Failed with result 'exit-code'.

Same failure earlier the same day (first hit ~05:55). About 20 matching failures before .profile was fixed:

Aug 27 05:55:16 paulkim uwsm_env-preloader[985]: Loading shell profile.
Aug 27 05:55:16 paulkim uwsm_env-preloader[985]: /home/paulkim/.profile: line 1: /home/paulkim/.cargo/env: No such file or directory
Aug 27 05:55:16 paulkim uwsm_env-preloader[985]: Env output mark "c14047fc6576a288" not found in shell output!
Aug 27 05:55:16 paulkim systemd[946]: [email protected]: Failed with result 'exit-code'.

UWSM loads the profile here (/usr/lib/uwsm/prepare-env.sh):

[ -f "${HOME}/.profile" ] && . "${HOME}/.profile"

Steps to reproduce

  1. Back up ~/.profile; keep TTY or SSH recovery available.
  2. Put only this in ~/.profile, with ~/.cargo/env absent:
   . "$HOME/.cargo/env"
  1. Fully log out to SDDM (not just lock) and log in.
  2. Expect: password accepted → flash → greeter again; journal matches above.

Realistic leftover path: install Rust via omarchy-install-dev-env rust (or the menu entry), then remove ~/.cargo/env while leaving rustup’s unguarded .profile line. A clean rustup self uninstall may scrub the line and hide the bug — omarchy-remove-dev-env rust only runs that uninstall.

Workaround

[[ -r "$HOME/.cargo/env" ]] && . "$HOME/.cargo/env"

Or delete the cargo line from ~/.profile if Rust is not installed.

Suggestions

Closest fit to how Omarchy already owns session PATH in default/bash/env-bootstrap (mise shims / ~/.local/bin):

  1. Install Rust with rustup --no-modify-path so it does not write ~/.profile.
  2. Append $HOME/.cargo/bin in env-bootstrap with the same idempotent case ":$PATH:" pattern.
  3. Keep rustup self uninstall on remove; a missing cargo dir on PATH is harmless.

PR with this approach: https://github.com/basecamp/omarchy/pull/8670

View raw text
### System details

Apple MacBook Air (M1, 2020), Omarchy 4.0.1-2 (omarchy-mac / Asahi), Hyprland via UWSM + SDDM

### What's wrong?

SDDM accepts the password, then immediately returns to the greeter. No useful error on screen. Cause: `~/.profile` had an unguarded rustup line sourcing a missing `~/.cargo/env`; UWSM’s env preloader sources `~/.profile` and aborts the Hyprland session when that fails.

This is relevant to Omarchy because Install → Development → Rust runs stock rustup with `-y` (no `--no-modify-path`), which writes that unguarded `.profile` line. Same script on upstream `basecamp/omarchy` `quattro` — not Mac-specific.

#### What happened

On 2026-08-27, after typing the SDDM password, the session flashed and bounced back to the login screen. This repeated many times.

Observed state while broken:

- `~/.profile` line 1 was exactly:
  ```bash
  . "$HOME/.cargo/env"
  ```
- `~/.cargo/env` did not exist
- `~/.rustup` did not exist (Rust not currently installed)
- `~/.bashrc` already had the guarded form `[[ -r "$HOME/.cargo/env" ]] && . "$HOME/.cargo/env"`, so interactive shells were fine; UWSM does not use interactive bashrc for this path

That `.profile` line is what rustup appends on a default install. Omarchy’s installer invokes that default:

```bash
# bin/omarchy-install-dev-env (rust)
bash -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y
```

#### Journal

Unit: `[email protected]` (`uwsm_env-preloader`)

```
Aug 27 16:07:15 paulkim uwsm_env-preloader[879]: Loading shell profile.
Aug 27 16:07:15 paulkim uwsm_env-preloader[879]: /home/paulkim/.profile: line 1: /home/paulkim/.cargo/env: No such file or directory
Aug 27 16:07:15 paulkim uwsm_env-preloader[879]: Env output mark "c49cd3e68cbdad36" not found in shell output!
Aug 27 16:07:15 paulkim systemd[839]: [email protected]: Main process exited, code=exited, status=1/FAILURE
Aug 27 16:07:15 paulkim systemd[839]: [email protected]: Failed with result 'exit-code'.
```

Same failure earlier the same day (first hit ~05:55). About 20 matching failures before `.profile` was fixed:

```
Aug 27 05:55:16 paulkim uwsm_env-preloader[985]: Loading shell profile.
Aug 27 05:55:16 paulkim uwsm_env-preloader[985]: /home/paulkim/.profile: line 1: /home/paulkim/.cargo/env: No such file or directory
Aug 27 05:55:16 paulkim uwsm_env-preloader[985]: Env output mark "c14047fc6576a288" not found in shell output!
Aug 27 05:55:16 paulkim systemd[946]: [email protected]: Failed with result 'exit-code'.
```

UWSM loads the profile here (`/usr/lib/uwsm/prepare-env.sh`):

```sh
[ -f "${HOME}/.profile" ] && . "${HOME}/.profile"
```

#### Steps to reproduce

1. Back up `~/.profile`; keep TTY or SSH recovery available.
2. Put only this in `~/.profile`, with `~/.cargo/env` absent:
   ```bash
   . "$HOME/.cargo/env"
   ```
3. Fully log out to SDDM (not just lock) and log in.
4. Expect: password accepted → flash → greeter again; journal matches above.

Realistic leftover path: install Rust via `omarchy-install-dev-env rust` (or the menu entry), then remove `~/.cargo/env` while leaving rustup’s unguarded `.profile` line. A clean `rustup self uninstall` may scrub the line and hide the bug — `omarchy-remove-dev-env rust` only runs that uninstall.

#### Workaround

```bash
[[ -r "$HOME/.cargo/env" ]] && . "$HOME/.cargo/env"
```

Or delete the cargo line from `~/.profile` if Rust is not installed.

#### Suggestions

Closest fit to how Omarchy already owns session PATH in `default/bash/env-bootstrap` (mise shims / `~/.local/bin`):

1. Install Rust with rustup `--no-modify-path` so it does not write `~/.profile`.
2. Append `$HOME/.cargo/bin` in `env-bootstrap` with the same idempotent `case ":$PATH:"` pattern.
3. Keep `rustup self uninstall` on remove; a missing cargo dir on PATH is harmless.

PR with this approach: https://github.com/basecamp/omarchy/pull/8670

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 09:40 UTC