Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1677GitHub issuePublicDecided· Out of scope

Zen installer writes policies to unused /opt/zen-browser path

Reported by Awlaursen · filed Aug 18, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Zen installer writes policies to unused /opt/zen-browser pathrevision 1 · captured 2026-09-28 21:29 UTC via poll

System details

AMD Ryzen 5 5500U with Radeon Graphics, AMD Radeon Lucienne, Omarchy 4.0.0-1, kernel 7.1.8-arch1-3

What's wrong?

omarchy install browser zen writes Omarchy's Firefox-derived preferences to a directory Zen does not read.

The current installer calls:

setup_firefox_preferences /opt/zen-browser/distribution

But the current zen-browser-bin AUR package installs and launches Zen from /opt/zen-browser-bin:

exec /opt/zen-browser-bin/zen-bin "$@"

Zen reads distribution/policies.json relative to its actual installation directory; it does not search the sibling /opt/zen-browser directory. As a result, Zen can install and run, but the preferences from default/firefox/policies.json are silently ignored.

Steps to reproduce

  1. Run omarchy install browser zen.
  2. Open about:policies in Zen.
  3. Observe that Omarchy's Preferences policy is not active because it was copied to /opt/zen-browser/distribution/policies.json, outside Zen's installation directory.

I also verified this directly with the current Zen 1.21.14b binary: a unique test policy placed in a sibling zen-browser/distribution/policies.json left the Enterprise Policies service inactive. Moving the same file to the actual install root's distribution/policies.json made it active immediately.

Expected

Omarchy's Zen preferences are applied from a policy location Zen reads.

Important implementation detail

zen-browser-bin already ships /opt/zen-browser-bin/distribution/policies.json, currently containing package policies such as DisableAppUpdate and DefaultSerialGuardSetting. Changing only the path while retaining cp -f would overwrite those policies. The fix should preserve/merge the package's existing policies and account for package upgrades.

Current upstream installer source still contains the mismatched path:
https://github.com/basecamp/omarchy/blob/quattro/bin/omarchy-install-browser

AUR package:
https://aur.archlinux.org/packages/zen-browser-bin

View raw text
### System details

AMD Ryzen 5 5500U with Radeon Graphics, AMD Radeon Lucienne, Omarchy 4.0.0-1, kernel 7.1.8-arch1-3

### What's wrong?

`omarchy install browser zen` writes Omarchy's Firefox-derived preferences to a directory Zen does not read.

The current installer calls:

```bash
setup_firefox_preferences /opt/zen-browser/distribution
```

But the current `zen-browser-bin` AUR package installs and launches Zen from `/opt/zen-browser-bin`:

```bash
exec /opt/zen-browser-bin/zen-bin "$@"
```

Zen reads `distribution/policies.json` relative to its actual installation directory; it does not search the sibling `/opt/zen-browser` directory. As a result, Zen can install and run, but the preferences from `default/firefox/policies.json` are silently ignored.

#### Steps to reproduce

1. Run `omarchy install browser zen`.
2. Open `about:policies` in Zen.
3. Observe that Omarchy's `Preferences` policy is not active because it was copied to `/opt/zen-browser/distribution/policies.json`, outside Zen's installation directory.

I also verified this directly with the current Zen `1.21.14b` binary: a unique test policy placed in a sibling `zen-browser/distribution/policies.json` left the Enterprise Policies service inactive. Moving the same file to the actual install root's `distribution/policies.json` made it active immediately.

#### Expected

Omarchy's Zen preferences are applied from a policy location Zen reads.

#### Important implementation detail

`zen-browser-bin` already ships `/opt/zen-browser-bin/distribution/policies.json`, currently containing package policies such as `DisableAppUpdate` and `DefaultSerialGuardSetting`. Changing only the path while retaining `cp -f` would overwrite those policies. The fix should preserve/merge the package's existing policies and account for package upgrades.

Current upstream installer source still contains the mismatched path:
https://github.com/basecamp/omarchy/blob/quattro/bin/omarchy-install-browser

AUR package:
https://aur.archlinux.org/packages/zen-browser-bin

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 04:43 UTC