Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
mise wrappers made before --quiet pollute stdout, and the regeneration migration can no longer parse them
Reported by jayrascodes · filed Sep 15, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
omarchy-mise-install gained --quiet on its mise use -g line at some point, but nothing regenerates wrappers written before that change. On this machine 11 of them were still stale, and every one corrupted piped stdout:
$ gh auth status 2>/dev/null | head -1
mise ~/.config/mise/config.toml tools: [email protected]That line is written by mise use -g to stdout (it survives 2>/dev/null and disappears under 1>/dev/null), and the wrapper runs that command on every single invocation.
The concrete failure that led me here: ~/.config/git/config sets
credential.https://github.com.helper = !gh auth git-credentialGit resolves gh through PATH to the wrapper, so the banner became the first line of the credential-helper protocol:
$ git push -u origin some-branch
warning: invalid credential line: mise ~/.config/mise/config.toml tools: [email protected]
fatal: could not read Username for 'https://github.com': No such device or addressEvery push, fetch and clone over HTTPS fails while a stale gh wrapper is on PATH. Anything else that pipes one of these tools is silently corrupted too.
Expected
Wrappers generated before --quiet get regenerated, or otherwise stop writing to stdout.
The regeneration migration can no longer parse its own output
This is the part worth a closer look. migrations/1784909971.sh ("Regenerate mise wrappers to stop them recursing through PATH") is the one place that rebuilds wrappers in bulk, and it was written against the older wrapper format:
package=$(sed -n 's/^mise use -g "\(.*\)"$/\1/p' "$wrapper")
bin=$(sed -n 's/^exec "\(.*\)" "\$@"$/\1/p' "$wrapper")Both patterns fail against the format omarchy-mise-install emits today:
| Line in a current wrapper | Pattern | Matches? | ||
|---|---|---|---|---|
| `mise use -g "gh" \ | \ | exit 1` | ^mise use -g "\(.*\)"$ | no — line no longer ends in " |
exec mise x "gh" -- "gh" "$@" | ^exec "\(.*\)" "\$@"$ | no — no longer a bare exec "<path>" |
Simulating that loop over today's wrappers:
gh: package='' bin='' -> SKIPPED
claude: package='' bin='' -> SKIPPED
ghui: package='' bin='' -> SKIPPEDSince package and bin both come back empty, the if [[ -n $package && -n $bin ]] guard skips every wrapper, silently. So a new migration written by copying this loop would appear to run and change nothing.
Steps to reproduce
- Have a wrapper generated before
--quietwas added — e.g.~/.local/bin/ghcontainingmise use -g "gh" || exit 1. gh auth status 2>/dev/null | head -1→ prints the mise banner instead ofgithub.com.- With
credential.https://github.com.helper = !gh auth git-credentialset,git pushto any HTTPS remote →invalid credential linethenfatal: could not read Username.
Affected wrappers on this machine
claude, copilot, crush, gemini, gh, ghui, hunk, omp, opencode, pi, playwright — all dated 2026-08-25. cursor-agent, hermes and muse were already current, presumably regenerated by their own later migrations.
Suggested fix
A migration that regenerates stale wrappers, with patterns matching the format actually on disk. Parsing the package from the mise use -g line and the bin from the exec mise x ... -- <bin> line preserves non-trivial specs (npm:@kitlangton/ghui, aqua:modem-dev/hunk, github:can1357/oh-my-pi), which regenerating from the command name alone would lose. It may be worth making the parser tolerant of both wrapper generations, given this is the second format change it has to survive.
I fixed my own machine by extracting each package/bin pair and re-running omarchy-mise-install per wrapper; the resulting diff was exactly one line each (--quiet), and git push works again.
System
- Omarchy
4.0.3-1 - mise
2026.9.1 linux-x64 - Wrappers written
2026-08-25
No debug log attached: omarchy debug --no-sudo --print isn't a command in 4.0.3 (Unknown Omarchy command). This one is hardware-independent anyway — it reproduces from the wrapper contents plus the git credential-helper config.
🤖 Generated with Claude Code
View raw text
## What happened `omarchy-mise-install` gained `--quiet` on its `mise use -g` line at some point, but nothing regenerates wrappers written before that change. On this machine 11 of them were still stale, and every one corrupted piped stdout: ``` $ gh auth status 2>/dev/null | head -1 mise ~/.config/mise/config.toml tools: [email protected] ``` That line is written by `mise use -g` **to stdout** (it survives `2>/dev/null` and disappears under `1>/dev/null`), and the wrapper runs that command on every single invocation. The concrete failure that led me here: `~/.config/git/config` sets ``` credential.https://github.com.helper = !gh auth git-credential ``` Git resolves `gh` through PATH to the wrapper, so the banner became the first line of the credential-helper protocol: ``` $ git push -u origin some-branch warning: invalid credential line: mise ~/.config/mise/config.toml tools: [email protected] fatal: could not read Username for 'https://github.com': No such device or address ``` **Every push, fetch and clone over HTTPS fails** while a stale `gh` wrapper is on PATH. Anything else that pipes one of these tools is silently corrupted too. ## Expected Wrappers generated before `--quiet` get regenerated, or otherwise stop writing to stdout. ## The regeneration migration can no longer parse its own output This is the part worth a closer look. `migrations/1784909971.sh` ("Regenerate mise wrappers to stop them recursing through PATH") is the one place that rebuilds wrappers in bulk, and it was written against the *older* wrapper format: ```bash package=$(sed -n 's/^mise use -g "\(.*\)"$/\1/p' "$wrapper") bin=$(sed -n 's/^exec "\(.*\)" "\$@"$/\1/p' "$wrapper") ``` Both patterns fail against the format `omarchy-mise-install` emits today: | Line in a current wrapper | Pattern | Matches? | |---|---|---| | `mise use -g "gh" \|\| exit 1` | `^mise use -g "\(.*\)"$` | no — line no longer ends in `"` | | `exec mise x "gh" -- "gh" "$@"` | `^exec "\(.*\)" "\$@"$` | no — no longer a bare `exec "<path>"` | Simulating that loop over today's wrappers: ``` gh: package='' bin='' -> SKIPPED claude: package='' bin='' -> SKIPPED ghui: package='' bin='' -> SKIPPED ``` Since `package` and `bin` both come back empty, the `if [[ -n $package && -n $bin ]]` guard skips every wrapper, silently. So a new migration written by copying this loop would appear to run and change nothing. ## Steps to reproduce 1. Have a wrapper generated before `--quiet` was added — e.g. `~/.local/bin/gh` containing `mise use -g "gh" || exit 1`. 2. `gh auth status 2>/dev/null | head -1` → prints the mise banner instead of `github.com`. 3. With `credential.https://github.com.helper = !gh auth git-credential` set, `git push` to any HTTPS remote → `invalid credential line` then `fatal: could not read Username`. ## Affected wrappers on this machine `claude`, `copilot`, `crush`, `gemini`, `gh`, `ghui`, `hunk`, `omp`, `opencode`, `pi`, `playwright` — all dated 2026-08-25. `cursor-agent`, `hermes` and `muse` were already current, presumably regenerated by their own later migrations. ## Suggested fix A migration that regenerates stale wrappers, with patterns matching the format actually on disk. Parsing the package from the `mise use -g` line and the bin from the `exec mise x ... -- <bin>` line preserves non-trivial specs (`npm:@kitlangton/ghui`, `aqua:modem-dev/hunk`, `github:can1357/oh-my-pi`), which regenerating from the command name alone would lose. It may be worth making the parser tolerant of both wrapper generations, given this is the second format change it has to survive. I fixed my own machine by extracting each package/bin pair and re-running `omarchy-mise-install` per wrapper; the resulting diff was exactly one line each (`--quiet`), and `git push` works again. ## System - Omarchy `4.0.3-1` - mise `2026.9.1 linux-x64` - Wrappers written `2026-08-25` No debug log attached: `omarchy debug --no-sudo --print` isn't a command in 4.0.3 (`Unknown Omarchy command`). This one is hardware-independent anyway — it reproduces from the wrapper contents plus the git credential-helper config. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Fixed bypr/11514· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 13:45 UTC