Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Web app installer writes an unquoted URL to Exec=, producing an invalid .desktop for URLs with a query string
Reported by Yannick-Pinta · filed Aug 31, 2026Closed upstream on 2026-08-31 by its own reporter Yannick-Pinta. GitHub close reason: completed. Closed by its own reporter — not by itself evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
What happened
omarchy-webapp-install does not quote the URL when writing the Exec= key, so any web app whose URL contains a query string produces a .desktop file that violates the freedesktop Desktop Entry spec. ? is a reserved character and must appear quoted.
The launcher still works under most launchers, so the breakage is silent — it only surfaces when the file is validated or read by a stricter implementation.
What I expected
A .desktop file that passes desktop-file-validate, regardless of the URL's query string.
Steps to reproduce
omarchy-webapp-install "ZZ Repro Test" "https://example.com/page?a=b" "firefox"
grep '^Exec=' ~/.local/share/applications/"ZZ Repro Test.desktop"
desktop-file-validate ~/.local/share/applications/"ZZ Repro Test.desktop"Result:
Exec=omarchy-launch-webapp https://example.com/page?a=b
/home/user/.local/share/applications/ZZ Repro Test.desktop: error: value
"omarchy-launch-webapp https://example.com/page?a=b" for key "Exec" in group
"Desktop Entry" contains a reserved character '?' outside of a quoteExit code 1. Quoting the URL by hand makes it pass with exit 0:
Exec=omarchy-launch-webapp "https://example.com/page?a=b"Suggested fix
In omarchy-webapp-install, the default exec string interpolates the URL bare:
EXEC_COMMAND="${CUSTOM_EXEC:-omarchy-launch-webapp $APP_URL}"Quoting the URL is enough — omarchy-launch-webapp already handles its argument as "$1":
EXEC_COMMAND="${CUSTOM_EXEC:-omarchy-launch-webapp \"$APP_URL\"}"Side note
The same generated file also trips a desktop-file-validate warning because Comment= is set to the same value as Name=. Cosmetic, and separate from the error above — happy to open a second issue if you'd prefer it tracked separately.
System
- Omarchy: 4.0.1-1
- Kernel: 7.1.9-arch1-2
- CPU: Intel Core i9-10900K
- GPU: NVIDIA GA102 [GeForce RTX 3080]
- desktop-file-utils: 0.28-1
- bash: 5.3.15(1)
View raw text
### What happened
`omarchy-webapp-install` does not quote the URL when writing the `Exec=` key, so any web app whose URL contains a query string produces a `.desktop` file that violates the freedesktop Desktop Entry spec. `?` is a reserved character and must appear quoted.
The launcher still works under most launchers, so the breakage is silent — it only surfaces when the file is validated or read by a stricter implementation.
### What I expected
A `.desktop` file that passes `desktop-file-validate`, regardless of the URL's query string.
### Steps to reproduce
```bash
omarchy-webapp-install "ZZ Repro Test" "https://example.com/page?a=b" "firefox"
grep '^Exec=' ~/.local/share/applications/"ZZ Repro Test.desktop"
desktop-file-validate ~/.local/share/applications/"ZZ Repro Test.desktop"
```
Result:
```
Exec=omarchy-launch-webapp https://example.com/page?a=b
/home/user/.local/share/applications/ZZ Repro Test.desktop: error: value
"omarchy-launch-webapp https://example.com/page?a=b" for key "Exec" in group
"Desktop Entry" contains a reserved character '?' outside of a quote
```
Exit code 1. Quoting the URL by hand makes it pass with exit 0:
```
Exec=omarchy-launch-webapp "https://example.com/page?a=b"
```
### Suggested fix
In `omarchy-webapp-install`, the default exec string interpolates the URL bare:
```bash
EXEC_COMMAND="${CUSTOM_EXEC:-omarchy-launch-webapp $APP_URL}"
```
Quoting the URL is enough — `omarchy-launch-webapp` already handles its argument as `"$1"`:
```bash
EXEC_COMMAND="${CUSTOM_EXEC:-omarchy-launch-webapp \"$APP_URL\"}"
```
### Side note
The same generated file also trips a `desktop-file-validate` warning because `Comment=` is set to the same value as `Name=`. Cosmetic, and separate from the error above — happy to open a second issue if you'd prefer it tracked separately.
### System
- Omarchy: 4.0.1-1
- Kernel: 7.1.9-arch1-2
- CPU: Intel Core i9-10900K
- GPU: NVIDIA GA102 [GeForce RTX 3080]
- desktop-file-utils: 0.28-1
- bash: 5.3.15(1)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.