Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
$HOME/.local/bin added to $PATH twice (pam_env.conf + omarchy-zsh shell envs)
Reported by devloberto · filed Sep 21, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Description
$HOME/.local/bin appears twice in $PATH because it is added by two independent sources, neither of which checks whether the directory is already present:
/etc/security/pam_env.conf(PAM session setup, shipped by Omarchy):
PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin/usr/share/omarchy-zsh/shell/envs(shell init, packaged by Omarchy):
export PATH="$PATH:$HOME/.local/bin"So the session $PATH (visible in the Hyprland compositor environment) already contains $HOME/.local/bin, and every interactive zsh/bash session appends it a second time.
This is harmless at lookup time (the second entry is just redundant), but it is noisy for debugging and for tooling that displays or parses $PATH.
Steps to reproduce
- Fresh Omarchy 4.0.4 install, zsh as default shell.
- Run:
echo "$PATH" | tr ':' '\n'- Observe that
$HOME/.local/binappears twice.
Expected behavior
$HOME/.local/bin should appear only once. A guard like the one /etc/profile already uses would prevent the duplicate:
case ":$PATH:" in
*":$HOME/.local/bin:"*) ;;
*) export PATH="$PATH:$HOME/.local/bin" ;;
esac(Alternatively, drop the PAM entry or the shell entry so there is a single source of truth.)
System details
- Omarchy: 4.0.4-1
- Shell: zsh
- Session: Hyprland
- Debug log: https://logs.omarchy.org/hmCzXk
View raw text
### Description
`$HOME/.local/bin` appears twice in `$PATH` because it is added by two independent sources, neither of which checks whether the directory is already present:
1. `/etc/security/pam_env.conf` (PAM session setup, shipped by Omarchy):
```
PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
```
2. `/usr/share/omarchy-zsh/shell/envs` (shell init, packaged by Omarchy):
```sh
export PATH="$PATH:$HOME/.local/bin"
```
So the session `$PATH` (visible in the Hyprland compositor environment) already contains `$HOME/.local/bin`, and every interactive zsh/bash session appends it a second time.
This is harmless at lookup time (the second entry is just redundant), but it is noisy for debugging and for tooling that displays or parses `$PATH`.
### Steps to reproduce
1. Fresh Omarchy 4.0.4 install, zsh as default shell.
2. Run:
```sh
echo "$PATH" | tr ':' '\n'
```
3. Observe that `$HOME/.local/bin` appears twice.
### Expected behavior
`$HOME/.local/bin` should appear only once. A guard like the one `/etc/profile` already uses would prevent the duplicate:
```sh
case ":$PATH:" in
*":$HOME/.local/bin:"*) ;;
*) export PATH="$PATH:$HOME/.local/bin" ;;
esac
```
(Alternatively, drop the PAM entry or the shell entry so there is a single source of truth.)
### System details
- Omarchy: 4.0.4-1
- Shell: zsh
- Session: Hyprland
- Debug log: https://logs.omarchy.org/hmCzXkValidation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 19:25 UTC