Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-5118GitHub issuePublicReceived

Migration 1788163635 fails on dev-linked checkout: hardcodes /usr/bin/omarchy-sudo-passwordless

Reported by ekollof · filed Sep 25, 2026Closed upstream on 2026-09-27 by the merge of PR #13350 (closed by spencerbull). GitHub close reason: completed.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Migration 1788163635 fails on dev-linked checkout: hardcodes /usr/bin/omarchy-sudo-passwordlessrevision 1 · captured 2026-10-04 12:10 UTC via poll

What happened

omarchy update aborts at migration 1788163635 on a dev-linked checkout:

Running migration (1788163635)
Remove legacy temporary passwordless sudo grants
Usage: omarchy-sudo-passwordless [MINUTES]
Usage: omarchy-sudo-passwordless [MINUTES]

Something went wrong during the update!

Full log tail in /tmp/omarchy-update.log matches the above (pacman reports there is nothing to do with warnings that local omarchy-dev 1:dev.c8a27f33-1 is newer than repo).

Root cause (verified)

migrations/1788163635.sh hardcodes the packaged copy:

if ! /usr/bin/omarchy-sudo-passwordless __migration-complete; then
  sudo /usr/bin/omarchy-sudo-passwordless __migrate
fi

On a dev-linked machine OMARCHY_PATH=~/src/omarchy holds the new helper (16227 bytes, supports __migrate/__migration-complete), but /usr/bin/omarchy-sudo-passwordless is still the old release copy (2558 bytes, only [MINUTES] arg). Any __* arg falls through to usage() and exits 1, so both lines print Usage and the migration fails.

This is a dev-checkout ordering issue:
- omarchy-update-dev only does git pull --ff-only, pulling the new migration in.
- omarchy-update-system-pkgs (pacman -Syu) does nothing because the dev packages (epoch 1, 1:dev.c8a27f33-1) sort newer than the repo release, so /usr/bin stays stale.
- omarchy-migrate then runs the new migration from $OMARCHY_PATH/migrations against the old /usr/bin helper.
- sudo secure_path on a dev-linked box already points at ~/src/omarchy/bin (via /etc/sudoers.d/omarchy-dev-path), but the hardcoded /usr/bin/ path bypasses it.

Workaround that unblocked this machine: sudo ~/src/omarchy/bin/omarchy-sudo-passwordless __migrate succeeded (created /var/lib/omarchy/migrations/1788163635, no legacy grants present), then touched the per-user marker and re-ran omarchy-migrate.

Related gap: omarchy-dev-sync skew detection only rebuilds helpers containing privileged_copy_matches; bin/omarchy-sudo-passwordless has no such marker, so --pkg does not auto-rebuild it.

Expected

Migration resolves the helper from the checkout under test (e.g. $OMARCHY_PATH/bin/omarchy-sudo-passwordless or bare omarchy-sudo-passwordless via sudo secure_path), or the dev update path rebuilds dev packages before running migrations that depend on new packaged helpers.

Steps to reproduce

  1. Dev-link a checkout (/etc/omarchy.conf -> ~/src/omarchy) with stale /usr/bin/omarchy-sudo-passwordless (pre-__migrate version).
  2. Pull a tree containing migrations/1788163635.sh + new bin/omarchy-sudo-passwordless without reinstalling dev packages.
  3. Run omarchy update (or omarchy-migrate with marker missing).

System

  • omarchy version: dev (d3e097e7), integration-prs checkout
  • packages: omarchy-dev 1:dev.c8a27f33-1, omarchy-settings-dev 1:dev.c8a27f33-1
  • omarchy debug --no-sudo --print: GPD G1628-04 laptop, AMD Ryzen AI 9 HX 370 w/ Radeon 890M, kernel 7.2.5-3-omarchy, Hyprland 0.56.2, Arch x86_64 (full log in /tmp/omarchy-debug.log)
  • no files under /etc/sudoers.d/99-omarchy-nopasswd-* (nothing to quarantine/clean)
View raw text
## What happened

`omarchy update` aborts at migration 1788163635 on a dev-linked checkout:

```
Running migration (1788163635)
Remove legacy temporary passwordless sudo grants
Usage: omarchy-sudo-passwordless [MINUTES]
Usage: omarchy-sudo-passwordless [MINUTES]

Something went wrong during the update!
```

Full log tail in /tmp/omarchy-update.log matches the above (pacman reports `there is nothing to do` with warnings that local `omarchy-dev 1:dev.c8a27f33-1` is newer than repo).

## Root cause (verified)

`migrations/1788163635.sh` hardcodes the packaged copy:

```bash
if ! /usr/bin/omarchy-sudo-passwordless __migration-complete; then
  sudo /usr/bin/omarchy-sudo-passwordless __migrate
fi
```

On a dev-linked machine `OMARCHY_PATH=~/src/omarchy` holds the new helper (16227 bytes, supports `__migrate`/`__migration-complete`), but `/usr/bin/omarchy-sudo-passwordless` is still the old release copy (2558 bytes, only `[MINUTES]` arg). Any `__*` arg falls through to `usage()` and exits 1, so both lines print Usage and the migration fails.

This is a dev-checkout ordering issue:
- `omarchy-update-dev` only does `git pull --ff-only`, pulling the new migration in.
- `omarchy-update-system-pkgs` (`pacman -Syu`) does nothing because the dev packages (epoch 1, `1:dev.c8a27f33-1`) sort newer than the repo release, so `/usr/bin` stays stale.
- `omarchy-migrate` then runs the new migration from `$OMARCHY_PATH/migrations` against the old `/usr/bin` helper.
- `sudo` secure_path on a dev-linked box already points at `~/src/omarchy/bin` (via /etc/sudoers.d/omarchy-dev-path), but the hardcoded `/usr/bin/` path bypasses it.

Workaround that unblocked this machine: `sudo ~/src/omarchy/bin/omarchy-sudo-passwordless __migrate` succeeded (created `/var/lib/omarchy/migrations/1788163635`, no legacy grants present), then touched the per-user marker and re-ran `omarchy-migrate`.

Related gap: `omarchy-dev-sync` skew detection only rebuilds helpers containing `privileged_copy_matches`; `bin/omarchy-sudo-passwordless` has no such marker, so `--pkg` does not auto-rebuild it.

## Expected

Migration resolves the helper from the checkout under test (e.g. `$OMARCHY_PATH/bin/omarchy-sudo-passwordless` or bare `omarchy-sudo-passwordless` via sudo secure_path), or the dev update path rebuilds dev packages before running migrations that depend on new packaged helpers.

## Steps to reproduce

1. Dev-link a checkout (`/etc/omarchy.conf` -> `~/src/omarchy`) with stale `/usr/bin/omarchy-sudo-passwordless` (pre-__migrate version).
2. Pull a tree containing `migrations/1788163635.sh` + new `bin/omarchy-sudo-passwordless` without reinstalling dev packages.
3. Run `omarchy update` (or `omarchy-migrate` with marker missing).

## System

- `omarchy version`: `dev (d3e097e7)`, integration-prs checkout
- packages: `omarchy-dev 1:dev.c8a27f33-1`, `omarchy-settings-dev 1:dev.c8a27f33-1`
- `omarchy debug --no-sudo --print`: GPD G1628-04 laptop, AMD Ryzen AI 9 HX 370 w/ Radeon 890M, kernel 7.2.5-3-omarchy, Hyprland 0.56.2, Arch x86_64 (full log in /tmp/omarchy-debug.log)
- no files under /etc/sudoers.d/99-omarchy-nopasswd-* (nothing to quarantine/clean)

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.