Proof Portal

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox

ReportR-4658GitHub issuePublicFixed

webapp install: slashes in app name create a nested .desktop path that webapp remove can't delete

Reported by curatingbits · filed Aug 23, 2026Closed upstream on 2026-08-27 by the merge of PR #7984 (closed by omarchybot, a bot). GitHub close reason: completed.

Open at source

Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?: Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?: Not yet mapped to any requirement or component.
3 · Is it reproducible?: No validation has been run yet.
4 · What remains unclear?: Not validated yet: no claims, no reproducer.
5 · What happens next?: Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

webapp install: slashes in app name create a nested .desktop path that webapp remove can't deleterevision 1 · captured 2026-10-04 12:03 UTC via poll

What happened

I accidentally entered the URL into the Name field when installing a web app (Name> http://127.0.0.1:4000). The install "succeeded", but because the name contains slashes, the launcher was written to a nested path instead of a single file:

~/.local/share/applications/http:/127.0.0.1:4000/.desktop

omarchy-webapp-install builds DESKTOP_FILE="$HOME/.local/share/applications/$APP_NAME.desktop" and then runs mkdir -p "$(dirname "$DESKTOP_FILE")", so every / in the name becomes a directory level.

The broken entry then cannot be removed with omarchy webapp remove:

The picker finds the file via find "$DESKTOP_DIR" -name '*.desktop' and displays basename "${file%.desktop}" → it shows up as 127.0.0.1:4000.
Removal then runs rm -f "$DESKTOP_DIR/$APP_NAME.desktop" → ~/.local/share/applications/127.0.0.1:4000.desktop, which doesn't exist. The real file is in the nested directory, so the rm silently deletes nothing and the app stays in the launcher.

Passing the original name doesn't work either: omarchy webapp remove "http://127.0.0.1:4000" targets .../http:/127.0.0.1:4000.desktop, but the actual file is .../http:/127.0.0.1:4000/.desktop.

Manual cleanup: rm -rf ~/.local/share/applications/http:

Steps to reproduce

omarchy webapp install "http://example.test/oops" "https://example.com" hey

ls ~/.local/share/applications/
# → a directory "http:" containing "example.test/oops.desktop"

omarchy webapp remove "http://example.test/oops"   # notification says removed, file remains
omarchy webapp remove                               # picker entry can't resolve back to the real path

Expected

Either the name is sanitized/rejected (no / in $APP_NAME, similar to what safe_icon_name already does for icons), or at minimum removal works on whatever install created.

Suggested fix

In omarchy-webapp-install: validate APP_NAME (reject or strip /) before composing DESKTOP_FILE. The mkdir -p "$(dirname ...)" then becomes a plain mkdir -p of the applications dir.
In omarchy-webapp-remove: remember the full path found by find and delete that, instead of reconstructing $DESKTOP_DIR/$APP_NAME.desktop from the displayed basename. That would also make removal robust to any other odd names that slip through.

Related: #1092 covered spaces in names breaking removal; this is the slash variant, with the extra twist that install itself writes an invalid layout.

System

Omarchy version: 4.0.0.r1772.gf32ebbd-1
Hardware-independent — pure script-logic bug in bin/omarchy-webapp-install / bin/omarchy-webapp-remove, reproduced from the packaged scripts.

View raw text

### What happened

I accidentally entered the URL into the **Name** field when installing a web app (`Name> http://127.0.0.1:4000`). The install "succeeded", but because the name contains slashes, the launcher was written to a **nested path** instead of a single file:

```
~/.local/share/applications/http:/127.0.0.1:4000/.desktop
```

`omarchy-webapp-install` builds `DESKTOP_FILE="$HOME/.local/share/applications/$APP_NAME.desktop"` and then runs `mkdir -p "$(dirname "$DESKTOP_FILE")"`, so every `/` in the name becomes a directory level.

The broken entry then **cannot be removed** with `omarchy webapp remove`:

- The picker finds the file via `find "$DESKTOP_DIR" -name '*.desktop'` and displays `basename "${file%.desktop}"` → it shows up as `127.0.0.1:4000`.
- Removal then runs `rm -f "$DESKTOP_DIR/$APP_NAME.desktop"` → `~/.local/share/applications/127.0.0.1:4000.desktop`, which doesn't exist. The real file is in the nested directory, so the rm silently deletes nothing and the app stays in the launcher.

Passing the original name doesn't work either: `omarchy webapp remove "http://127.0.0.1:4000"` targets `.../http:/127.0.0.1:4000.desktop`, but the actual file is `.../http:/127.0.0.1:4000/.desktop`.

Manual cleanup: `rm -rf ~/.local/share/applications/http:`

### Steps to reproduce

```bash
omarchy webapp install "http://example.test/oops" "https://example.com" hey

ls ~/.local/share/applications/
# → a directory "http:" containing "example.test/oops.desktop"

omarchy webapp remove "http://example.test/oops" # notification says removed, file remains
omarchy webapp remove # picker entry can't resolve back to the real path
```

### Expected

Either the name is sanitized/rejected (no `/` in `$APP_NAME`, similar to what `safe_icon_name` already does for icons), or at minimum removal works on whatever install created.

### Suggested fix

1. In `omarchy-webapp-install`: validate `APP_NAME` (reject or strip `/`) before composing `DESKTOP_FILE`. The `mkdir -p "$(dirname ...)"` then becomes a plain `mkdir -p` of the applications dir.
2. In `omarchy-webapp-remove`: remember the full path found by `find` and delete that, instead of reconstructing `$DESKTOP_DIR/$APP_NAME.desktop` from the displayed basename. That would also make removal robust to any other odd names that slip through.

Related: #1092 covered spaces in names breaking removal; this is the slash variant, with the extra twist that install itself writes an invalid layout.

### System

- Omarchy version: `4.0.0.r1772.gf32ebbd-1`
- Hardware-independent — pure script-logic bug in `bin/omarchy-webapp-install` / `bin/omarchy-webapp-remove`, reproduced from the packaged scripts.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Related PRpr/8644· confirmed
Fixed bypr/8472· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.

Proof

History & reports

Reference