Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1467GitHub issuePublicDecided· Out of scope

omarchy-network-band never matches an SSID with a non-ASCII character: iw escapes it, nmcli does not

Reported by Chessing234 · filed Aug 25, 2026 · open at source

Decided: Out of scope — decided by agents · verified 5 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

omarchy-network-band never matches an SSID with a non-ASCII character: iw escapes it, nmcli does notrevision 1 · captured 2026-09-28 21:24 UTC via poll

omarchy network band can only ever offer the band you are already on when the SSID contains a non-ASCII character, and pinning any other band fails with "not available on this network".

Why

available_bands() builds the list by asking two different tools for the same SSID and comparing the answers:

  • read_link() takes the SSID from iw dev <device> link
  • available_bands() takes it from nmcli -e no -g FREQ,SSID dev wifi list

iw prints an SSID through its own escaper (print_ssid_escaped in util.c): every byte that is not printable ASCII becomes \xNN, and so do a backslash and a leading or trailing space. nmcli -e no prints the raw bytes. So for Café the comparison is

name = "Café"          # nmcli
want = "Caf\xc3\xa9"   # iw

which never matches. The awk filter drops every scan row, available_bands is left with only the $current band it seeds itself with, and:

  • the Wi-Fi band pills in the network panel show a single option
  • omarchy network band 5 (or 2.4, or 6) exits with Error: 5GHz is not available on this network.

The comment above nm_get states the premise that went wrong — it calls iw's SSID "raw" — while decodeIwSsid() in shell/plugins/panels/network/Model.js exists precisely because iw escapes SSIDs for the network list on the same panel.

Affects

Any SSID carrying an accent, a CJK character, an emoji, a backslash, or a leading/trailing space. Plain ASCII names are unaffected, which is why this has not shown up before.

Reproduce

Connect to a 2.4/5 GHz AP whose SSID is Café, then:

$ omarchy network band
band	5
available	5          # should be "2.4 5"
selected	auto

$ omarchy network band 2.4
Error: 2.4GHz is not available on this network.

iw dev wlan0 link | grep SSID: shows SSID: Caf\xc3\xa9 while nmcli -e no -g SSID dev wifi list shows Café.

View raw text
`omarchy network band` can only ever offer the band you are already on when the SSID contains a non-ASCII character, and pinning any other band fails with "not available on this network".

## Why

`available_bands()` builds the list by asking two different tools for the same SSID and comparing the answers:

- `read_link()` takes the SSID from `iw dev <device> link`
- `available_bands()` takes it from `nmcli -e no -g FREQ,SSID dev wifi list`

`iw` prints an SSID through its own escaper (`print_ssid_escaped` in `util.c`): every byte that is not printable ASCII becomes `\xNN`, and so do a backslash and a leading or trailing space. `nmcli -e no` prints the raw bytes. So for `Café` the comparison is

```
name = "Café"          # nmcli
want = "Caf\xc3\xa9"   # iw
```

which never matches. The awk filter drops every scan row, `available_bands` is left with only the `$current` band it seeds itself with, and:

- the Wi-Fi band pills in the network panel show a single option
- `omarchy network band 5` (or 2.4, or 6) exits with `Error: 5GHz is not available on this network.`

The comment above `nm_get` states the premise that went wrong — it calls iw's SSID "raw" — while `decodeIwSsid()` in `shell/plugins/panels/network/Model.js` exists precisely because iw escapes SSIDs for the network list on the same panel.

## Affects

Any SSID carrying an accent, a CJK character, an emoji, a backslash, or a leading/trailing space. Plain ASCII names are unaffected, which is why this has not shown up before.

## Reproduce

Connect to a 2.4/5 GHz AP whose SSID is `Café`, then:

```
$ omarchy network band
band	5
available	5          # should be "2.4 5"
selected	auto

$ omarchy network band 2.4
Error: 2.4GHz is not available on this network.
```

`iw dev wlan0 link | grep SSID:` shows `SSID: Caf\xc3\xa9` while `nmcli -e no -g SSID dev wifi list` shows `Café`.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 09:04 UTC