Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Browser tabs can hijack omarchy-launch-or-focus
Reported by milan-panta · filed Mar 8, 2026Closed upstream on 2026-09-21 by bjarneo via an automated message, as a duplicate of #3669 (R-2043). GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
Any Omarchy install using Hyprland, Omarchy 3.4.1
What's wrong?
omarchy-launch-or-focus currently matches windows by .class or .title.
That means a browser tab titled something like Neovide configuration tips or Spotify Wrapped can get focused instead of the actual app when you press the default shortcut for Neovide or Spotify.
The problem is the title fallback here:
'.[]|select((.class|test("\\b" + $p + "\\b";"i")) or (.title|test("\\b" + $p + "\\b";"i")))|.address'Window titles are user content, so they are easy to spoof. Matching on .class alone fixes it.
This looks like the same underlying problem as #3669, but with an easy repro using the default app shortcuts.
View raw text
### System details
Any Omarchy install using Hyprland, Omarchy 3.4.1
### What's wrong?
`omarchy-launch-or-focus` currently matches windows by `.class` or `.title`.
That means a browser tab titled something like `Neovide configuration tips` or `Spotify Wrapped` can get focused instead of the actual app when you press the default shortcut for Neovide or Spotify.
The problem is the title fallback here:
```bash
'.[]|select((.class|test("\\b" + $p + "\\b";"i")) or (.title|test("\\b" + $p + "\\b";"i")))|.address'
```
Window titles are user content, so they are easy to spoof. Matching on `.class` alone fixes it.
This looks like the same underlying problem as #3669, but with an easy repro using the default app shortcuts.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.