Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-304GitHub issuePublicDecided· Out of scope

omarchy-launch-browser crashes Chrome when man-db is absent: --help probe execs man and dies with SIGTRAP

Reported by Johnprempeh2 · filed Sep 19, 2026Closed upstream on 2026-10-12 by the bot omarchybot, as a duplicate (target not recorded).

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

omarchy-launch-browser crashes Chrome when man-db is absent: --help probe execs man and dies with SIGTRAPrevision 1 · captured 2026-09-28 21:23 UTC via poll

System details

Omarchy 4.0.3-1 · aarch64 (Try Omarchy guest VM, CPU implementer 0x61) · kernel 7.2.6-1-aarch64-ARCH · virtio-gpu-gl-pci (virgl, no native GPU) · Chrome as default browser

What's wrong?

omarchy-launch-browser decides which private-mode flag a browser takes by running it with --help and grepping for MOZ_LOG:

# /usr/share/omarchy/bin/omarchy-launch-browser, line 12
if $browser_exec --help 2>/dev/null | grep -q MOZ_LOG; then
  private_flag="--private-window"
elif [[ $browser_exec =~ edge ]]; then
  private_flag="--inprivate"
else
  private_flag="--incognito"
fi

Chrome's --help does not print to stdout — it execlp("man", ...) to show its manual page. On an image where `man-db` is not installed, that `execlp` fails with ENOENT and Chrome dies with SIGTRAP. So every call to omarchy-launch-browser produces a Chrome core dump before the browser it was asked to launch even starts.

The 2>/dev/null hides it, so the symptom looks like unexplained Chrome crashes with nothing pointing at the launcher.

Steps to reproduce

  1. On an image without man-db, set Chrome as the default browser.
  2. Run omarchy-launch-browser https://example.com, or use any binding that calls it.
  3. coredumpctl list shows a new Chrome core, signal SIGTRAP.

Evidence the mechanism is what's claimed

  • pacman -Q man-db returned package 'man-db' was not found, with no install record in pacman.log — despite man-db being listed in the base package manifest.
  • The mechanism was proven by putting a stub `man` binary on `PATH`, after which the probe completed and Chrome stopped crashing.
  • 11 Chrome cores accumulated, all SIGTRAP. Installing man-db 2.13.1-2 resolved it.

One secondary effect worth noting: a diagnostic session investigating the crashes re-triggered the probe while investigating, taking the core count from 7 to 10. The bug amplifies itself when anything automated looks into it.

Suggested fix

Detect by executable name instead of probing --help — the same function already does this for Edge on the next line:

if [[ $browser_exec =~ firefox|librewolf|zen|floorp ]]; then
  private_flag="--private-window"
elif [[ $browser_exec =~ edge ]]; then
  private_flag="--inprivate"
else
  private_flag="--incognito"
fi

That removes the subprocess entirely, is faster, and cannot crash the browser it is about to launch. If probing is preferred for extensibility, man-db should be a hard dependency, and the probe shouldn't run a browser binary whose --help may exec a pager.

Why it's worth fixing even though `man-db` is usually present

The failure is silent, is attributed to the wrong component, and amplifies under automated investigation. A minimal or container-derived image is exactly where man-db goes missing — and exactly where someone is least likely to connect a crashing browser to a private-mode detection heuristic.

View raw text
### System details

Omarchy 4.0.3-1 · aarch64 (Try Omarchy guest VM, CPU implementer 0x61) · kernel 7.2.6-1-aarch64-ARCH · virtio-gpu-gl-pci (virgl, no native GPU) · Chrome as default browser

### What's wrong?

`omarchy-launch-browser` decides which private-mode flag a browser takes by running it with `--help` and grepping for `MOZ_LOG`:

```bash
# /usr/share/omarchy/bin/omarchy-launch-browser, line 12
if $browser_exec --help 2>/dev/null | grep -q MOZ_LOG; then
  private_flag="--private-window"
elif [[ $browser_exec =~ edge ]]; then
  private_flag="--inprivate"
else
  private_flag="--incognito"
fi
```

Chrome's `--help` does not print to stdout — it `execlp("man", ...)` to show its manual page. **On an image where `man-db` is not installed, that `execlp` fails with ENOENT and Chrome dies with SIGTRAP.** So every call to `omarchy-launch-browser` produces a Chrome core dump before the browser it was asked to launch even starts.

The `2>/dev/null` hides it, so the symptom looks like unexplained Chrome crashes with nothing pointing at the launcher.

**Steps to reproduce**

1. On an image without `man-db`, set Chrome as the default browser.
2. Run `omarchy-launch-browser https://example.com`, or use any binding that calls it.
3. `coredumpctl list` shows a new Chrome core, signal SIGTRAP.

**Evidence the mechanism is what's claimed**

- `pacman -Q man-db` returned `package 'man-db' was not found`, with no install record in `pacman.log` — despite `man-db` being listed in the base package manifest.
- The mechanism was proven by putting a **stub `man` binary on `PATH`**, after which the probe completed and Chrome stopped crashing.
- 11 Chrome cores accumulated, all SIGTRAP. Installing `man-db` 2.13.1-2 resolved it.

One secondary effect worth noting: a diagnostic session investigating the crashes **re-triggered the probe while investigating**, taking the core count from 7 to 10. The bug amplifies itself when anything automated looks into it.

**Suggested fix**

Detect by executable name instead of probing `--help` — the same function already does this for Edge on the next line:

```bash
if [[ $browser_exec =~ firefox|librewolf|zen|floorp ]]; then
  private_flag="--private-window"
elif [[ $browser_exec =~ edge ]]; then
  private_flag="--inprivate"
else
  private_flag="--incognito"
fi
```

That removes the subprocess entirely, is faster, and cannot crash the browser it is about to launch. If probing is preferred for extensibility, `man-db` should be a hard dependency, and the probe shouldn't run a browser binary whose `--help` may exec a pager.

**Why it's worth fixing even though `man-db` is usually present**

The failure is silent, is attributed to the wrong component, and amplifies under automated investigation. A minimal or container-derived image is exactly where `man-db` goes missing — and exactly where someone is least likely to connect a crashing browser to a private-mode detection heuristic.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 16:07 UTC