Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-219GitHub issuePublicDecided· Out of scope

$HOME/.local/bin added to $PATH twice (pam_env.conf + omarchy-zsh shell envs)

Reported by devloberto · filed Sep 21, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

$HOME/.local/bin added to $PATH twice (pam_env.conf + omarchy-zsh shell envs)revision 1 · captured 2026-09-28 21:23 UTC via poll

Description

$HOME/.local/bin appears twice in $PATH because it is added by two independent sources, neither of which checks whether the directory is already present:

  1. /etc/security/pam_env.conf (PAM session setup, shipped by Omarchy):
   PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
  1. /usr/share/omarchy-zsh/shell/envs (shell init, packaged by Omarchy):
   export PATH="$PATH:$HOME/.local/bin"

So the session $PATH (visible in the Hyprland compositor environment) already contains $HOME/.local/bin, and every interactive zsh/bash session appends it a second time.

This is harmless at lookup time (the second entry is just redundant), but it is noisy for debugging and for tooling that displays or parses $PATH.

Steps to reproduce

  1. Fresh Omarchy 4.0.4 install, zsh as default shell.
  2. Run:
   echo "$PATH" | tr ':' '\n'
  1. Observe that $HOME/.local/bin appears twice.

Expected behavior

$HOME/.local/bin should appear only once. A guard like the one /etc/profile already uses would prevent the duplicate:

case ":$PATH:" in
  *":$HOME/.local/bin:"*) ;;
  *) export PATH="$PATH:$HOME/.local/bin" ;;
esac

(Alternatively, drop the PAM entry or the shell entry so there is a single source of truth.)

System details

View raw text
### Description

`$HOME/.local/bin` appears twice in `$PATH` because it is added by two independent sources, neither of which checks whether the directory is already present:

1. `/etc/security/pam_env.conf` (PAM session setup, shipped by Omarchy):
   ```
   PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
   ```
2. `/usr/share/omarchy-zsh/shell/envs` (shell init, packaged by Omarchy):
   ```sh
   export PATH="$PATH:$HOME/.local/bin"
   ```

So the session `$PATH` (visible in the Hyprland compositor environment) already contains `$HOME/.local/bin`, and every interactive zsh/bash session appends it a second time.

This is harmless at lookup time (the second entry is just redundant), but it is noisy for debugging and for tooling that displays or parses `$PATH`.

### Steps to reproduce

1. Fresh Omarchy 4.0.4 install, zsh as default shell.
2. Run:
   ```sh
   echo "$PATH" | tr ':' '\n'
   ```
3. Observe that `$HOME/.local/bin` appears twice.

### Expected behavior

`$HOME/.local/bin` should appear only once. A guard like the one `/etc/profile` already uses would prevent the duplicate:

```sh
case ":$PATH:" in
  *":$HOME/.local/bin:"*) ;;
  *) export PATH="$PATH:$HOME/.local/bin" ;;
esac
```

(Alternatively, drop the PAM entry or the shell entry so there is a single source of truth.)

### System details

- Omarchy: 4.0.4-1
- Shell: zsh
- Session: Hyprland
- Debug log: https://logs.omarchy.org/hmCzXk

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 19:25 UTC