Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Weather panel stores and sends the chosen location at full geocoder precision
Reported by brightwalker25 · filed Sep 23, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Omarchy version: 4.0.4
When a place is picked in the weather panel's location search, locationCommit() in shell/plugins/panels/weather/Model.js keeps the latitude and longitude exactly as Open-Meteo's geocoding API returns them: five decimal places, about one metre. persistLocation() writes them to ~/.local/state/omarchy/settings/weather.json, and every refresh then sends them unchanged to two third parties:
- wttr.in, through
wttrLocationQuery(), which uses the rawlat,lonas the path - api.open-meteo.com, through
refreshDailyForecast()inPanel.qml
A forecast does not need that precision, and it defeats a VPN, because the location is carried inside the request rather than inferred from the IP address. For a named place the geocoder returns a central point, so today the leak is limited to the town. But the stored format accepts any coordinates and omarchy-weather-location takes them from the command line, so a precise point entered there is sent as it is.
Suggested fix: round to two decimal places (about 1 km) in locationCommit() and in omarchy-weather-location before storing, and round again when building the two request URLs so existing settings files are covered too. Optionally send wttr.in only the place name.
Related but separate: #9706 and #12127 are about the label shown, not the precision sent.
View raw text
**Omarchy version:** 4.0.4 When a place is picked in the weather panel's location search, `locationCommit()` in `shell/plugins/panels/weather/Model.js` keeps the latitude and longitude exactly as Open-Meteo's geocoding API returns them: five decimal places, about one metre. `persistLocation()` writes them to `~/.local/state/omarchy/settings/weather.json`, and every refresh then sends them unchanged to two third parties: - wttr.in, through `wttrLocationQuery()`, which uses the raw `lat,lon` as the path - api.open-meteo.com, through `refreshDailyForecast()` in `Panel.qml` A forecast does not need that precision, and it defeats a VPN, because the location is carried inside the request rather than inferred from the IP address. For a named place the geocoder returns a central point, so today the leak is limited to the town. But the stored format accepts any coordinates and `omarchy-weather-location` takes them from the command line, so a precise point entered there is sent as it is. **Suggested fix:** round to two decimal places (about 1 km) in `locationCommit()` and in `omarchy-weather-location` before storing, and round again when building the two request URLs so existing settings files are covered too. Optionally send wttr.in only the place name. Related but separate: #9706 and #12127 are about the label shown, not the precision sent.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 17:39 UTC