Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Malformed shell.json reverts the bar to defaults, and the next click overwrites the user's config with them
Reported by omarchybot · filed Aug 16, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details: Omarchy quattro @ 7488eade (post-4.0.0), QEMU/KVM VM, Hyprland session. Found by an automated QA pass; reproduced on a disposable worker VM.
shell/plugins/bar/README.md:17 invites users to hand-edit ~/.config/omarchy/shell.json. If that file ever fails to parse, the next ordinary click overwrites it with the shipped defaults and the user's bar configuration is gone — no backup, no prompt, no notification.
applyShellConfig() at shell/shell.qml:87 sets shellConfig = user || defaults, so an unparseable file leaves the shipped defaults in memory rather than the last known-good config. mutateShellConfig() at shell/shell.qml:158 then clones whatever is in shellConfig and hands it to persistShellConfig(), which does an unconditional userConfigFile.setText(...) at shell/shell.qml:112. So right-clicking the clock, dragging a widget, double-clicking the bar, toggling a tray pin, or running omarchy bar set is enough to write the defaults over the user's file.
Reproduced with a customized config (position: bottom, transparent: true, a custom myvpn command module), then removing the final } — the classic hand-edit typo:
$ omarchy-shell shell listShellConfig | ...
position bottom transparent True left ['omarchy.menu', 'omarchy.workspaces', 'myvpn']
$ # drop the final brace
$ omarchy-shell shell listShellConfig | ...
position top transparent False left ['omarchy.menu', 'omarchy.workspaces']
$ # user right-clicks the clock. That is all.
$ omarchy-shell omarchy.clock cycleFormat
$ cat ~/.config/omarchy/shell.json
position top transparent False left ['omarchy.menu', 'omarchy.workspaces'] # now written to diskThe only trace is a console.warn in the journal: shell.json parse failed, using defaults: SyntaxError: JSON.parse: Parse error.
Keeping the last-good config in memory, or refusing to persist while the on-disk file is unparseable, would close it.
View raw text
**System details:** Omarchy `quattro` @ 7488eade (post-4.0.0), QEMU/KVM VM, Hyprland session. Found by an automated QA pass; reproduced on a disposable worker VM. `shell/plugins/bar/README.md:17` invites users to hand-edit `~/.config/omarchy/shell.json`. If that file ever fails to parse, the next ordinary click overwrites it with the shipped defaults and the user's bar configuration is gone — no backup, no prompt, no notification. `applyShellConfig()` at `shell/shell.qml:87` sets `shellConfig = user || defaults`, so an unparseable file leaves the *shipped defaults* in memory rather than the last known-good config. `mutateShellConfig()` at `shell/shell.qml:158` then clones whatever is in `shellConfig` and hands it to `persistShellConfig()`, which does an unconditional `userConfigFile.setText(...)` at `shell/shell.qml:112`. So right-clicking the clock, dragging a widget, double-clicking the bar, toggling a tray pin, or running `omarchy bar set` is enough to write the defaults over the user's file. Reproduced with a customized config (`position: bottom`, `transparent: true`, a custom `myvpn` command module), then removing the final `}` — the classic hand-edit typo: ``` $ omarchy-shell shell listShellConfig | ... position bottom transparent True left ['omarchy.menu', 'omarchy.workspaces', 'myvpn'] $ # drop the final brace $ omarchy-shell shell listShellConfig | ... position top transparent False left ['omarchy.menu', 'omarchy.workspaces'] $ # user right-clicks the clock. That is all. $ omarchy-shell omarchy.clock cycleFormat $ cat ~/.config/omarchy/shell.json position top transparent False left ['omarchy.menu', 'omarchy.workspaces'] # now written to disk ``` The only trace is a `console.warn` in the journal: `shell.json parse failed, using defaults: SyntaxError: JSON.parse: Parse error`. Keeping the last-good config in memory, or refusing to persist while the on-disk file is unparseable, would close it.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 04:20 UTC