Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Agents follow the omarchy skill into sudo and never reach pkexec
Reported by shawnyeager · filed Oct 8, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
The end-user omarchy skill tells an agent to use sudo when a terminal is available and pkexec only when one is not. An agent's shell is a terminal from the process's point of view, including when it has a pty, and the user cannot type a password into it.
Agents follow the first sentence. sudo then waits on a prompt the user never sees, or fails with a password is required, and the agent stops. The later sentence that mentions pkexec for agents loses, because it says to use pkexec only in that case and not to replace sudo with pkexec just because a command needs root.
#11804 adds a sudo -n fallback and leaves that first sentence in place. Agents never reach the fallback if they obey the lead rule.
omarchy pkg add has the same shape. It calls sudo unless it is already root, so an agent that runs it directly hangs the same way. pkexec on /usr/bin/omarchy-pkg-add takes the root branch. omarchy pkg aur add cannot, because yay will not build as root (#7875).
View raw text
The end-user omarchy skill tells an agent to use `sudo` when a terminal is available and `pkexec` only when one is not. An agent's shell is a terminal from the process's point of view, including when it has a pty, and the user cannot type a password into it. Agents follow the first sentence. `sudo` then waits on a prompt the user never sees, or fails with `a password is required`, and the agent stops. The later sentence that mentions `pkexec` for agents loses, because it says to use `pkexec` only in that case and not to replace `sudo` with `pkexec` just because a command needs root. #11804 adds a `sudo -n` fallback and leaves that first sentence in place. Agents never reach the fallback if they obey the lead rule. `omarchy pkg add` has the same shape. It calls `sudo` unless it is already root, so an agent that runs it directly hangs the same way. `pkexec` on `/usr/bin/omarchy-pkg-add` takes the root branch. `omarchy pkg aur add` cannot, because `yay` will not build as root (#7875).
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 22:31 UTC