Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy-launch-webapp fails silently for browsers missing from its allowlist (e.g. Zen)
Reported by TowhidMolla-Dev · filed Oct 3, 2026 · open at source · 2 revisions
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
Summary
omarchy-launch-webapp silently fails for any default browser that is not on its hardcoded allowlist. When the allowlist misses, it falls back to chromium.desktop, and if Chromium is not installed the resolved command is empty — so uwsm-app is invoked with no binary and reports a misleading error about a nonexistent file path.
This breaks every Omarchy webapp shortcut (omarchy-launch-webapp .desktop entries) for affected users.
Steps to reproduce
- Set a default web browser whose
.desktopfilename is not on the allowlist (Zen is the common case:xdg-settings get default-web-browser->zen.desktop). - Do not have
chromiuminstalled. - Launch any webapp shortcut that uses
omarchy-launch-webapp, e.g.~/.local/share/applications/Google Maps.desktopor the ones Omarchy generates for third-party web apps. - No window opens.
Actual
$ gtk-launch "Google Maps.desktop"
$ journalctl --user -f
uwsm_app-daemon[1263]: received: app -- --app=https://maps.google.com
uwsm_app-daemon[1263]: sent: error 'Error: Path "--app=https:/maps.google.com" does not exist!' 1The error names a "Path" that is really a browser command-line flag, so it gives no hint that the real problem is an empty browser command.
Expected
Either the webapp window opens, or the failure names the actual cause — e.g. omarchy-launch-webapp: no Exec found for chromium.desktop; install chromium or set a supported default browser.
Root cause
/usr/share/omarchy/bin/omarchy-launch-webapp:
browser=$(xdg-settings get default-web-browser)
case $browser in
google-chrome* | brave* | microsoft-edge* | opera* | vivaldi* | helium*) ;;
*) browser="chromium.desktop" ;;
esac
exec setsid uwsm-app -- $(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1) --app="$1" "${@:2}"Two problems compound:
- The allowlist is incomplete. Zen, Vivaldi forks, Floorp, LibreWolf, Waterfox, Chromium, and any other Chromium/Firefox derivative are all missing, so they are silently rewritten to
chromium.desktop. - The empty result is not detected. If the
sedlookup finds nothing, the command substitution expands to zero arguments anduwsm-appreceives only--app=<url>.uwsm-appthen treats--app=...as a file to open and fails with the "Path does not exist" message above.
Suggested fix
Prefer the default browser's own Exec unconditionally, and use the chromium.desktop fallback only when the default browser cannot be resolved — then verify it resolved before exec'ing:
browser=$(xdg-settings get default-web-browser)
exec_line=$(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1)
if [[ -z $exec_line ]]; then
browser=chromium.desktop
exec_line=$(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1)
fi
if [[ -z $exec_line ]]; then
echo "omarchy-launch-webapp: could not resolve an Exec line for $browser; install it or set a different default browser" >&2
exit 1
fi
exec setsid uwsm-app -- $exec_line --app="$1" "${@:2}"This removes the need to enumerate browsers at all (any browser whose desktop entry has an Exec line just works), keeps Chromium as a fallback for a missing/unset default, and turns the silent failure into an actionable message.
A second, smaller issue: --app="$1" relies on the caller quoting the URL, but Exec= in a desktop file does not use shell quoting, so authors who write Exec=omarchy-launch-webapp "https://example.com" are relying on undefined behaviour. Worth documenting in the webapp docs.
Workaround
Point the .desktop entry at the browser directly, bypassing the helper:
Exec=/opt/zen-browser-bin/zen-bin --app=https://play.pocketcasts.com/System
- Omarchy: 4.0.4-1
- OS: Omarchy (Arch), kernel 7.2.5-3-omarchy
- Session: Hyprland (Wayland)
- CPU: AMD Ryzen 5 3400G with Radeon Vega Graphics
- GPU: amdgpu
- Default browser:
zen.desktop(zen-browser-bin 1.22.3b-1, AUR) chromium: not installed
View raw text
## Summary
`omarchy-launch-webapp` silently fails for any default browser that is not on its hardcoded allowlist. When the allowlist misses, it falls back to `chromium.desktop`, and if Chromium is not installed the resolved command is **empty** — so `uwsm-app` is invoked with no binary and reports a misleading error about a nonexistent file path.
This breaks every Omarchy webapp shortcut (`omarchy-launch-webapp` .desktop entries) for affected users.
## Steps to reproduce
1. Set a default web browser whose `.desktop` filename is not on the allowlist (Zen is the common case: `xdg-settings get default-web-browser` -> `zen.desktop`).
2. Do **not** have `chromium` installed.
3. Launch any webapp shortcut that uses `omarchy-launch-webapp`, e.g. `~/.local/share/applications/Google Maps.desktop` or the ones Omarchy generates for third-party web apps.
4. No window opens.
## Actual
```
$ gtk-launch "Google Maps.desktop"
$ journalctl --user -f
uwsm_app-daemon[1263]: received: app -- --app=https://maps.google.com
uwsm_app-daemon[1263]: sent: error 'Error: Path "--app=https:/maps.google.com" does not exist!' 1
```
The error names a "Path" that is really a browser command-line flag, so it gives no hint that the real problem is an empty browser command.
## Expected
Either the webapp window opens, or the failure names the actual cause — e.g. `omarchy-launch-webapp: no Exec found for chromium.desktop; install chromium or set a supported default browser`.
## Root cause
`/usr/share/omarchy/bin/omarchy-launch-webapp`:
```bash
browser=$(xdg-settings get default-web-browser)
case $browser in
google-chrome* | brave* | microsoft-edge* | opera* | vivaldi* | helium*) ;;
*) browser="chromium.desktop" ;;
esac
exec setsid uwsm-app -- $(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1) --app="$1" "${@:2}"
```
Two problems compound:
1. **The allowlist is incomplete.** Zen, Vivaldi forks, Floorp, LibreWolf, Waterfox, Chromium, and any other Chromium/Firefox derivative are all missing, so they are silently rewritten to `chromium.desktop`.
2. **The empty result is not detected.** If the `sed` lookup finds nothing, the command substitution expands to zero arguments and `uwsm-app` receives only `--app=<url>`. `uwsm-app` then treats `--app=...` as a file to open and fails with the "Path does not exist" message above.
## Suggested fix
Prefer the default browser's own `Exec` unconditionally, and use the `chromium.desktop` fallback only when the default browser cannot be resolved — then verify it resolved before exec'ing:
```bash
browser=$(xdg-settings get default-web-browser)
exec_line=$(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1)
if [[ -z $exec_line ]]; then
browser=chromium.desktop
exec_line=$(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1)
fi
if [[ -z $exec_line ]]; then
echo "omarchy-launch-webapp: could not resolve an Exec line for $browser; install it or set a different default browser" >&2
exit 1
fi
exec setsid uwsm-app -- $exec_line --app="$1" "${@:2}"
```
This removes the need to enumerate browsers at all (any browser whose desktop entry has an `Exec` line just works), keeps Chromium as a fallback for a missing/unset default, and turns the silent failure into an actionable message.
A second, smaller issue: `--app="$1"` relies on the caller quoting the URL, but `Exec=` in a desktop file does not use shell quoting, so authors who write `Exec=omarchy-launch-webapp "https://example.com"` are relying on undefined behaviour. Worth documenting in the webapp docs.
## Workaround
Point the `.desktop` entry at the browser directly, bypassing the helper:
```ini
Exec=/opt/zen-browser-bin/zen-bin --app=https://play.pocketcasts.com/
```
## System
- Omarchy: 4.0.4-1
- OS: Omarchy (Arch), kernel 7.2.5-3-omarchy
- Session: Hyprland (Wayland)
- CPU: AMD Ryzen 5 3400G with Radeon Vega Graphics
- GPU: amdgpu
- Default browser: `zen.desktop` (zen-browser-bin 1.22.3b-1, AUR)
- `chromium`: not installed
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Fixed bypr/11975· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 21:07 UTC