Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Update hooks doc gives the wrong sudo authorization timing for post-update
Reported by Ashwinhegde19 · filed Oct 3, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
manual/31-dotfiles.md and default/agents/skills/omarchy/hooks.md both state that the update hooks run after Omarchy clears its cached sudo authorization, and that a hook using sudo therefore needs its own authorization and may prompt.
That holds for pre-refresh-pacman, which is deliberately run cold between two timestamp revocations behind the no-update wrapper. It does not hold for post-update, which runs inside the update's single shared sudo authorization alongside mise. A sudo call in a post-update hook does not prompt.
docs/update-process.md already describes this correctly, and the test suite asserts it, so the two paragraphs are stale relative to both the reference doc and the tests.
| Hook | Authorization | sudo inside the hook |
|---|---|---|
pre-refresh-pacman | Cold — bracketed by revocations, behind the no-update wrapper | Prompts, and publishes no reusable timestamp |
post-update | Inside the update's single shared window (shared with mise) | Does not prompt |
| AUR build code | Deliberately excluded | Prompts |
Two existing tests encode exactly this behaviour:
test/shell.d/update-hook-security-test.sh— "refresh runs the hook cold between the config re-sync and the transaction"test/shell.d/channel-sudo-boundary-test.sh— "hands off to one update authorization", while requiring cold sudo forpre-refresh-pacman
The consequence matters for anyone hardening hooks from the docs: a post-update hook gets passwordless sudo for the duration of every update, which is the opposite of what the manual says.
Proposed change is documentation only, in both places, keeping manual/ free of codebase internals per AGENTS.md.
View raw text
`manual/31-dotfiles.md` and `default/agents/skills/omarchy/hooks.md` both state that the update hooks run after Omarchy clears its cached sudo authorization, and that a hook using `sudo` therefore needs its own authorization and may prompt. That holds for `pre-refresh-pacman`, which is deliberately run cold between two timestamp revocations behind the no-update wrapper. It does not hold for `post-update`, which runs inside the update's single shared sudo authorization alongside mise. A `sudo` call in a `post-update` hook does not prompt. `docs/update-process.md` already describes this correctly, and the test suite asserts it, so the two paragraphs are stale relative to both the reference doc and the tests. | Hook | Authorization | `sudo` inside the hook | |---|---|---| | `pre-refresh-pacman` | Cold — bracketed by revocations, behind the no-update wrapper | Prompts, and publishes no reusable timestamp | | `post-update` | Inside the update's single shared window (shared with mise) | Does not prompt | | AUR build code | Deliberately excluded | Prompts | Two existing tests encode exactly this behaviour: - `test/shell.d/update-hook-security-test.sh` — "refresh runs the hook cold between the config re-sync and the transaction" - `test/shell.d/channel-sudo-boundary-test.sh` — "hands off to one update authorization", while requiring cold sudo for `pre-refresh-pacman` The consequence matters for anyone hardening hooks from the docs: a `post-update` hook gets passwordless sudo for the duration of every update, which is the opposite of what the manual says. Proposed change is documentation only, in both places, keeping `manual/` free of codebase internals per `AGENTS.md`.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/9474· confirmed
- Fixed bypr/14914· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 02:30 UTC