Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1757GitHub issuePublicDecided· Out of scope

omarchy-launch-spotify can be hijacked by any window whose title contains 'spotify'

Reported by Eidan78 · filed Aug 16, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

omarchy-launch-spotify can be hijacked by any window whose title contains 'spotify'revision 1 · captured 2026-09-28 21:29 UTC via poll

Summary

omarchy-launch-spotify matches windows by class OR `title` using \bspotify\b (case-insensitive):

WINDOW_ADDRESS=$(hyprctl clients -j | jq -r '.[]|select((.class|test("\\bspotify\\b";"i")) or (.title|test("\\bspotify\\b";"i")))|.address' | head -n1)

Any window whose title contains the word "spotify" will steal the SUPER+SHIFT+M shortcut: instead of launching (or focusing) Spotify, the shortcut focuses the unrelated window. In our case, a terminal running an assistant session titled "OC | Diagnosing Spotify issue" hijacked the keybind.

Impact

  • Shortcut becomes unreliable and surprising — it "does nothing" from the user's perspective while silently focusing the wrong window.
  • Very hard to diagnose: the root cause is invisible in config.

Suggested fix

  • Match on class only — class is the canonical Wayland app identifier. Use the title only as a last-resort fallback when no class match exists, or drop the title match entirely.
  • Example: select((.class|test("\\bspotify\\b";"i"))) | .address
View raw text
## Summary

`omarchy-launch-spotify` matches windows by `class` **OR `title`** using `\bspotify\b` (case-insensitive):

```bash
WINDOW_ADDRESS=$(hyprctl clients -j | jq -r '.[]|select((.class|test("\\bspotify\\b";"i")) or (.title|test("\\bspotify\\b";"i")))|.address' | head -n1)
```

Any window whose **title** contains the word "spotify" will steal the `SUPER+SHIFT+M` shortcut: instead of launching (or focusing) Spotify, the shortcut focuses the unrelated window. In our case, a terminal running an assistant session titled "OC | Diagnosing Spotify issue" hijacked the keybind.

## Impact

- Shortcut becomes unreliable and surprising — it "does nothing" from the user's perspective while silently focusing the wrong window.
- Very hard to diagnose: the root cause is invisible in config.

## Suggested fix

- Match on `class` only — class is the canonical Wayland app identifier. Use the title only as a last-resort fallback when no class match exists, or drop the title match entirely.
- Example: `select((.class|test("\\bspotify\\b";"i"))) | .address`

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 04:28 UTC