Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Stale hyprlock process after successful unlock silently disables all locking (manual, idle, and before-suspend)
Reported by shawnyeager · filed Jul 27, 2026Closed upstream on 2026-07-27 by its own reporter shawnyeager, as not planned. Closed by its own reporter — not by itself evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
Framework Laptop 13 (AMD Ryzen 5 7640U / Radeon 760M), Omarchy 3.8.4, Hyprland 0.56.0, hyprlock v0.9.6, hypridle from default config
What's wrong?
A hyprlock process that survives a successful unlock silently disables all locking — manual, idle timeout, and lock-before-suspend — with no error and no visible symptom until you notice the display waking straight into your session with no password prompt.
What happened here:
- 17:12 — hypridle idle timeout ran
omarchy-system-lock; hyprlock started normally. - 17:36 — I unlocked. Journal shows
auth: authenticated for hyprlock. hyprlock should have exited here, but the process stayed alive (still running 3.5 hours later; killing it restored normal behavior). That lingering process is arguably an upstream hyprlock v0.9.6 bug, but the omarchy side is what turns it from a leaked process into a security problem: omarchy-system-lockopens with:
if ! pidof hyprlock >/dev/null; then
(
hyprlock
omarchy-system-wake
) &
fi With the stale process alive, every subsequent lock attempt was a silent no-op. Journal shows the hypridle timeouts at 17:55, 19:21, and 20:24 all short-circuited on pidof hyprlock. Pressing the lock keybind did nothing. And since before_sleep_cmd = OMARCHY_LOCK_ONLY=true omarchy-system-lock goes through the same guard, suspending would have resumed straight into the unlocked session too.
Why the guard can't distinguish good from bad: pidof hyprlock succeeding is supposed to mean "already locked, nothing to do." But a hung/stale hyprlock also satisfies it, and in that state the machine is not locked and can never lock again until someone notices and kills the process by hand.
Possible fixes:
- Have
omarchy-system-lockverify the session is actually locked rather than trusting process existence — e.g. checkloginctl show-session -p LockedHint, or route locking throughloginctl lock-sessionas #6359 discussed for the suspend path. - Or treat a pidof hit more skeptically: if hyprlock is running but the session isn't locked, kill it and relaunch instead of returning silently.
Related but distinct: #6359 covered resuming unlocked due to the before_sleep_cmd regression; this is a different mechanism (stale process defeating the guard) that also breaks manual and idle locking, not only suspend.
Recovery: kill <stale hyprlock pid> — locking works again immediately.
View raw text
### System details
Framework Laptop 13 (AMD Ryzen 5 7640U / Radeon 760M), Omarchy 3.8.4, Hyprland 0.56.0, hyprlock v0.9.6, hypridle from default config
### What's wrong?
A hyprlock process that survives a successful unlock silently disables **all** locking — manual, idle timeout, and lock-before-suspend — with no error and no visible symptom until you notice the display waking straight into your session with no password prompt.
**What happened here:**
1. 17:12 — hypridle idle timeout ran `omarchy-system-lock`; hyprlock started normally.
2. 17:36 — I unlocked. Journal shows `auth: authenticated for hyprlock`. hyprlock should have exited here, but the process stayed alive (still running 3.5 hours later; killing it restored normal behavior). That lingering process is arguably an upstream hyprlock v0.9.6 bug, but the omarchy side is what turns it from a leaked process into a security problem:
3. `omarchy-system-lock` opens with:
```bash
if ! pidof hyprlock >/dev/null; then
(
hyprlock
omarchy-system-wake
) &
fi
```
With the stale process alive, every subsequent lock attempt was a silent no-op. Journal shows the hypridle timeouts at 17:55, 19:21, and 20:24 all short-circuited on `pidof hyprlock`. Pressing the lock keybind did nothing. And since `before_sleep_cmd = OMARCHY_LOCK_ONLY=true omarchy-system-lock` goes through the same guard, suspending would have resumed straight into the unlocked session too.
**Why the guard can't distinguish good from bad:** `pidof hyprlock` succeeding is supposed to mean "already locked, nothing to do." But a hung/stale hyprlock also satisfies it, and in that state the machine is *not* locked and can never lock again until someone notices and kills the process by hand.
**Possible fixes:**
- Have `omarchy-system-lock` verify the session is actually locked rather than trusting process existence — e.g. check `loginctl show-session -p LockedHint`, or route locking through `loginctl lock-session` as #6359 discussed for the suspend path.
- Or treat a pidof hit more skeptically: if hyprlock is running but the session isn't locked, kill it and relaunch instead of returning silently.
Related but distinct: #6359 covered resuming unlocked due to the `before_sleep_cmd` regression; this is a different mechanism (stale process defeating the guard) that also breaks manual and idle locking, not only suspend.
**Recovery:** `kill <stale hyprlock pid>` — locking works again immediately.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.