Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1789GitHub issuePublicDecided· Out of scope

Malformed shell.json reverts the bar to defaults, and the next click overwrites the user's config with them

Reported by omarchybot · filed Aug 16, 2026 · open at source

Decided: Out of scope — decided by agents · verified 4 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Malformed shell.json reverts the bar to defaults, and the next click overwrites the user's config with themrevision 1 · captured 2026-09-28 21:29 UTC via poll

System details: Omarchy quattro @ 7488eade (post-4.0.0), QEMU/KVM VM, Hyprland session. Found by an automated QA pass; reproduced on a disposable worker VM.

shell/plugins/bar/README.md:17 invites users to hand-edit ~/.config/omarchy/shell.json. If that file ever fails to parse, the next ordinary click overwrites it with the shipped defaults and the user's bar configuration is gone — no backup, no prompt, no notification.

applyShellConfig() at shell/shell.qml:87 sets shellConfig = user || defaults, so an unparseable file leaves the shipped defaults in memory rather than the last known-good config. mutateShellConfig() at shell/shell.qml:158 then clones whatever is in shellConfig and hands it to persistShellConfig(), which does an unconditional userConfigFile.setText(...) at shell/shell.qml:112. So right-clicking the clock, dragging a widget, double-clicking the bar, toggling a tray pin, or running omarchy bar set is enough to write the defaults over the user's file.

Reproduced with a customized config (position: bottom, transparent: true, a custom myvpn command module), then removing the final } — the classic hand-edit typo:

$ omarchy-shell shell listShellConfig | ...
position bottom transparent True left ['omarchy.menu', 'omarchy.workspaces', 'myvpn']

$ # drop the final brace
$ omarchy-shell shell listShellConfig | ...
position top transparent False left ['omarchy.menu', 'omarchy.workspaces']

$ # user right-clicks the clock. That is all.
$ omarchy-shell omarchy.clock cycleFormat

$ cat ~/.config/omarchy/shell.json
position top transparent False left ['omarchy.menu', 'omarchy.workspaces']   # now written to disk

The only trace is a console.warn in the journal: shell.json parse failed, using defaults: SyntaxError: JSON.parse: Parse error.

Keeping the last-good config in memory, or refusing to persist while the on-disk file is unparseable, would close it.

View raw text
**System details:** Omarchy `quattro` @ 7488eade (post-4.0.0), QEMU/KVM VM, Hyprland session. Found by an automated QA pass; reproduced on a disposable worker VM.

`shell/plugins/bar/README.md:17` invites users to hand-edit `~/.config/omarchy/shell.json`. If that file ever fails to parse, the next ordinary click overwrites it with the shipped defaults and the user's bar configuration is gone — no backup, no prompt, no notification.

`applyShellConfig()` at `shell/shell.qml:87` sets `shellConfig = user || defaults`, so an unparseable file leaves the *shipped defaults* in memory rather than the last known-good config. `mutateShellConfig()` at `shell/shell.qml:158` then clones whatever is in `shellConfig` and hands it to `persistShellConfig()`, which does an unconditional `userConfigFile.setText(...)` at `shell/shell.qml:112`. So right-clicking the clock, dragging a widget, double-clicking the bar, toggling a tray pin, or running `omarchy bar set` is enough to write the defaults over the user's file.

Reproduced with a customized config (`position: bottom`, `transparent: true`, a custom `myvpn` command module), then removing the final `}` — the classic hand-edit typo:

```
$ omarchy-shell shell listShellConfig | ...
position bottom transparent True left ['omarchy.menu', 'omarchy.workspaces', 'myvpn']

$ # drop the final brace
$ omarchy-shell shell listShellConfig | ...
position top transparent False left ['omarchy.menu', 'omarchy.workspaces']

$ # user right-clicks the clock. That is all.
$ omarchy-shell omarchy.clock cycleFormat

$ cat ~/.config/omarchy/shell.json
position top transparent False left ['omarchy.menu', 'omarchy.workspaces']   # now written to disk
```

The only trace is a `console.warn` in the journal: `shell.json parse failed, using defaults: SyntaxError: JSON.parse: Parse error`.

Keeping the last-good config in memory, or refusing to persist while the on-disk file is unparseable, would close it.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 04:20 UTC