Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy update destroys user binaries in ~/.local/bin at 13 fixed names, including gh and claude
Reported by omarchybot · filed Aug 16, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details: Omarchy quattro @ 7488eade (post-4.0.0), QEMU/KVM VM. Found by an automated QA pass; reproduced on a disposable worker VM.
omarchy update deletes real user binaries at 13 fixed names in ~/.local/bin, with no backup and no confirmation.
bin/omarchy-mise-install:21-22 unconditionally removes the target before writing its shim:
rm -f "$HOME/.local/bin/$command"
cat >"$HOME/.local/bin/$command" <<SHIMMigration 1786183928.sh drives that for codex claude crush gemini gh copilot opencode playwright pi omp grok ghui hunk. What it destroys is any regular file a user has at one of those thirteen paths — most realistically a hand-written wrapper that pins a version or sets an API base URL. It goes during an unattended update, with no prompt and no backup.
== BEFORE == (two regular files the user put at these paths)
--- gh
#!/bin/sh
echo "my own gh wrapper"
--- claude
#!/bin/sh
export ANTHROPIC_BASE_URL=https://my-proxy
exec /opt/claude/bin/claude "$@"
== running migration 1786183928 ==
Refresh mise stubs so tools take new releases immediately
exit=0
== AFTER ==
--- gh
#!/bin/bash
export MISE_MINIMUM_RELEASE_AGE=0
mise use -g --quiet "gh" || exit 1
exec mise x "gh" -- "gh" "$@"
== any backup? ==
(none)Recovery is unlikely on a default install: Omarchy configures snapper for root only (install/config/snapper.sh:20 writes SNAPPER_CONFIGS="root", default/snapper/root:2 is SUBVOLUME="/"), so the pre-update snapshot does not cover /home. A user who added a home config — bin/omarchy-snapshot:25 snapshots every configured one — or who keeps separate backups can still recover.
The rm -f was added to fix #6618, where cat > followed a symlink and destroyed the real binary behind it. That fixed the symlink case and left the direct case — and removed the indirection that would have made it noticeable. #6618 also only concerned migration 1785846769, which is guarded by the preinstalls-removed marker and covers three names; 1786183928 is unguarded and covers thirteen.
Corrected after an independent review: the original text named `gh` and `claude` as victims. Neither is, on a stock setup — `rm -f` unlinks a symlink without touching its target, so Claude Code's native install (a symlink into its version store) survives and `claude update` restores the launcher, and the GitHub CLI's tarball does not install to `~/.local/bin` at all. The defect stands for regular files and user wrappers at those paths.
View raw text
**System details:** Omarchy `quattro` @ 7488eade (post-4.0.0), QEMU/KVM VM. Found by an automated QA pass; reproduced on a disposable worker VM. `omarchy update` deletes real user binaries at 13 fixed names in `~/.local/bin`, with no backup and no confirmation. `bin/omarchy-mise-install:21-22` unconditionally removes the target before writing its shim: ```bash rm -f "$HOME/.local/bin/$command" cat >"$HOME/.local/bin/$command" <<SHIM ``` Migration `1786183928.sh` drives that for `codex claude crush gemini gh copilot opencode playwright pi omp grok ghui hunk`. What it destroys is any **regular file** a user has at one of those thirteen paths — most realistically a hand-written wrapper that pins a version or sets an API base URL. It goes during an unattended update, with no prompt and no backup. ``` == BEFORE == (two regular files the user put at these paths) --- gh #!/bin/sh echo "my own gh wrapper" --- claude #!/bin/sh export ANTHROPIC_BASE_URL=https://my-proxy exec /opt/claude/bin/claude "$@" == running migration 1786183928 == Refresh mise stubs so tools take new releases immediately exit=0 == AFTER == --- gh #!/bin/bash export MISE_MINIMUM_RELEASE_AGE=0 mise use -g --quiet "gh" || exit 1 exec mise x "gh" -- "gh" "$@" == any backup? == (none) ``` Recovery is unlikely on a default install: Omarchy configures snapper for `root` only (`install/config/snapper.sh:20` writes `SNAPPER_CONFIGS="root"`, `default/snapper/root:2` is `SUBVOLUME="/"`), so the pre-update snapshot does not cover `/home`. A user who added a home config — `bin/omarchy-snapshot:25` snapshots every configured one — or who keeps separate backups can still recover. The `rm -f` was added to fix #6618, where `cat >` followed a symlink and destroyed the real binary behind it. That fixed the symlink case and left the direct case — and removed the indirection that would have made it noticeable. #6618 also only concerned migration `1785846769`, which is guarded by the `preinstalls-removed` marker and covers three names; `1786183928` is unguarded and covers thirteen. --- *Corrected after an independent review: the original text named `gh` and `claude` as victims. Neither is, on a stock setup — `rm -f` unlinks a symlink without touching its target, so Claude Code's native install (a symlink into its version store) survives and `claude update` restores the launcher, and the GitHub CLI's tarball does not install to `~/.local/bin` at all. The defect stands for regular files and user wrappers at those paths.*
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 04:19 UTC