Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Tailscale panel lists Funnel ingress relays as machines when Funnel is on
Reported by rfrost-xyz · filed Oct 2, 2026Closed upstream on 2026-10-02 by its own reporter rfrost-xyz, as a duplicate (target not recorded). Closed by its own reporter — not by itself evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
Razer Blade 15 (Mid 2021), Intel i7-11800H, NVIDIA RTX 3080 Mobile, Omarchy 4.0.4-1, Tailscale 1.102.3
What's wrong?
With Tailscale Funnel enabled on a machine, the Tailscale panel's machine list fills with entries named funnel-ingress-node (23 here), alongside the real devices.
When Funnel is on, Tailscale adds its public ingress relays to the host's netmap. They appear in tailscale status --json under Peer with HostName: "funnel-ingress-node", Tags: ["tag:ingress"], ShareeNode: true, an empty DNSName and Online: true. The peer loop in shell/plugins/panels/tailscale/Model.js skips Mullvad nodes but keeps every other online peer, so the relays are listed as machines. They aren't devices you can copy, Taildrop to or use as an exit node.
Steps to reproduce:
- Allow the
funnelnode attribute for the machine in the tailnet policy. - Run
tailscale funnel --bg 8787(any local port). - Open the Tailscale panel: the machine list is padded with
funnel-ingress-nodeentries.
Expected: only real tailnet devices are listed.
Suggested fix, in the peer loop:
if ((peer.Tags || []).indexOf("tag:ingress") >= 0) continueView raw text
### System details
Razer Blade 15 (Mid 2021), Intel i7-11800H, NVIDIA RTX 3080 Mobile, Omarchy 4.0.4-1, Tailscale 1.102.3
### What's wrong?
With Tailscale Funnel enabled on a machine, the Tailscale panel's machine list fills with entries named `funnel-ingress-node` (23 here), alongside the real devices.
When Funnel is on, Tailscale adds its public ingress relays to the host's netmap. They appear in `tailscale status --json` under `Peer` with `HostName: "funnel-ingress-node"`, `Tags: ["tag:ingress"]`, `ShareeNode: true`, an empty `DNSName` and `Online: true`. The peer loop in `shell/plugins/panels/tailscale/Model.js` skips Mullvad nodes but keeps every other online peer, so the relays are listed as machines. They aren't devices you can copy, Taildrop to or use as an exit node.
Steps to reproduce:
1. Allow the `funnel` node attribute for the machine in the tailnet policy.
2. Run `tailscale funnel --bg 8787` (any local port).
3. Open the Tailscale panel: the machine list is padded with `funnel-ingress-node` entries.
Expected: only real tailnet devices are listed.
Suggested fix, in the peer loop:
```js
if ((peer.Tags || []).indexOf("tag:ingress") >= 0) continue
```
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.