Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-529GitHub issuePublicFixed

mise wrappers made before --quiet pollute stdout, and the regeneration migration can no longer parse them

Reported by jayrascodes · filed Sep 15, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

mise wrappers made before --quiet pollute stdout, and the regeneration migration can no longer parse themrevision 1 · captured 2026-09-28 21:23 UTC via poll

What happened

omarchy-mise-install gained --quiet on its mise use -g line at some point, but nothing regenerates wrappers written before that change. On this machine 11 of them were still stale, and every one corrupted piped stdout:

$ gh auth status 2>/dev/null | head -1
mise ~/.config/mise/config.toml tools: [email protected]

That line is written by mise use -g to stdout (it survives 2>/dev/null and disappears under 1>/dev/null), and the wrapper runs that command on every single invocation.

The concrete failure that led me here: ~/.config/git/config sets

credential.https://github.com.helper = !gh auth git-credential

Git resolves gh through PATH to the wrapper, so the banner became the first line of the credential-helper protocol:

$ git push -u origin some-branch
warning: invalid credential line: mise ~/.config/mise/config.toml tools: [email protected]
fatal: could not read Username for 'https://github.com': No such device or address

Every push, fetch and clone over HTTPS fails while a stale gh wrapper is on PATH. Anything else that pipes one of these tools is silently corrupted too.

Expected

Wrappers generated before --quiet get regenerated, or otherwise stop writing to stdout.

The regeneration migration can no longer parse its own output

This is the part worth a closer look. migrations/1784909971.sh ("Regenerate mise wrappers to stop them recursing through PATH") is the one place that rebuilds wrappers in bulk, and it was written against the older wrapper format:

package=$(sed -n 's/^mise use -g "\(.*\)"$/\1/p' "$wrapper")
bin=$(sed -n 's/^exec "\(.*\)" "\$@"$/\1/p' "$wrapper")

Both patterns fail against the format omarchy-mise-install emits today:

Line in a current wrapperPatternMatches?
`mise use -g "gh" \\exit 1`^mise use -g "\(.*\)"$no — line no longer ends in "
exec mise x "gh" -- "gh" "$@"^exec "\(.*\)" "\$@"$no — no longer a bare exec "<path>"

Simulating that loop over today's wrappers:

gh:     package='' bin='' -> SKIPPED
claude: package='' bin='' -> SKIPPED
ghui:   package='' bin='' -> SKIPPED

Since package and bin both come back empty, the if [[ -n $package && -n $bin ]] guard skips every wrapper, silently. So a new migration written by copying this loop would appear to run and change nothing.

Steps to reproduce

  1. Have a wrapper generated before --quiet was added — e.g. ~/.local/bin/gh containing mise use -g "gh" || exit 1.
  2. gh auth status 2>/dev/null | head -1 → prints the mise banner instead of github.com.
  3. With credential.https://github.com.helper = !gh auth git-credential set, git push to any HTTPS remote → invalid credential line then fatal: could not read Username.

Affected wrappers on this machine

claude, copilot, crush, gemini, gh, ghui, hunk, omp, opencode, pi, playwright — all dated 2026-08-25. cursor-agent, hermes and muse were already current, presumably regenerated by their own later migrations.

Suggested fix

A migration that regenerates stale wrappers, with patterns matching the format actually on disk. Parsing the package from the mise use -g line and the bin from the exec mise x ... -- <bin> line preserves non-trivial specs (npm:@kitlangton/ghui, aqua:modem-dev/hunk, github:can1357/oh-my-pi), which regenerating from the command name alone would lose. It may be worth making the parser tolerant of both wrapper generations, given this is the second format change it has to survive.

I fixed my own machine by extracting each package/bin pair and re-running omarchy-mise-install per wrapper; the resulting diff was exactly one line each (--quiet), and git push works again.

System

  • Omarchy 4.0.3-1
  • mise 2026.9.1 linux-x64
  • Wrappers written 2026-08-25

No debug log attached: omarchy debug --no-sudo --print isn't a command in 4.0.3 (Unknown Omarchy command). This one is hardware-independent anyway — it reproduces from the wrapper contents plus the git credential-helper config.

🤖 Generated with Claude Code

View raw text
## What happened

`omarchy-mise-install` gained `--quiet` on its `mise use -g` line at some point, but nothing regenerates wrappers written before that change. On this machine 11 of them were still stale, and every one corrupted piped stdout:

```
$ gh auth status 2>/dev/null | head -1
mise ~/.config/mise/config.toml tools: [email protected]
```

That line is written by `mise use -g` **to stdout** (it survives `2>/dev/null` and disappears under `1>/dev/null`), and the wrapper runs that command on every single invocation.

The concrete failure that led me here: `~/.config/git/config` sets

```
credential.https://github.com.helper = !gh auth git-credential
```

Git resolves `gh` through PATH to the wrapper, so the banner became the first line of the credential-helper protocol:

```
$ git push -u origin some-branch
warning: invalid credential line: mise ~/.config/mise/config.toml tools: [email protected]
fatal: could not read Username for 'https://github.com': No such device or address
```

**Every push, fetch and clone over HTTPS fails** while a stale `gh` wrapper is on PATH. Anything else that pipes one of these tools is silently corrupted too.

## Expected

Wrappers generated before `--quiet` get regenerated, or otherwise stop writing to stdout.

## The regeneration migration can no longer parse its own output

This is the part worth a closer look. `migrations/1784909971.sh` ("Regenerate mise wrappers to stop them recursing through PATH") is the one place that rebuilds wrappers in bulk, and it was written against the *older* wrapper format:

```bash
package=$(sed -n 's/^mise use -g "\(.*\)"$/\1/p' "$wrapper")
bin=$(sed -n 's/^exec "\(.*\)" "\$@"$/\1/p' "$wrapper")
```

Both patterns fail against the format `omarchy-mise-install` emits today:

| Line in a current wrapper | Pattern | Matches? |
|---|---|---|
| `mise use -g "gh" \|\| exit 1` | `^mise use -g "\(.*\)"$` | no — line no longer ends in `"` |
| `exec mise x "gh" -- "gh" "$@"` | `^exec "\(.*\)" "\$@"$` | no — no longer a bare `exec "<path>"` |

Simulating that loop over today's wrappers:

```
gh:     package='' bin='' -> SKIPPED
claude: package='' bin='' -> SKIPPED
ghui:   package='' bin='' -> SKIPPED
```

Since `package` and `bin` both come back empty, the `if [[ -n $package && -n $bin ]]` guard skips every wrapper, silently. So a new migration written by copying this loop would appear to run and change nothing.

## Steps to reproduce

1. Have a wrapper generated before `--quiet` was added — e.g. `~/.local/bin/gh` containing `mise use -g "gh" || exit 1`.
2. `gh auth status 2>/dev/null | head -1` → prints the mise banner instead of `github.com`.
3. With `credential.https://github.com.helper = !gh auth git-credential` set, `git push` to any HTTPS remote → `invalid credential line` then `fatal: could not read Username`.

## Affected wrappers on this machine

`claude`, `copilot`, `crush`, `gemini`, `gh`, `ghui`, `hunk`, `omp`, `opencode`, `pi`, `playwright` — all dated 2026-08-25. `cursor-agent`, `hermes` and `muse` were already current, presumably regenerated by their own later migrations.

## Suggested fix

A migration that regenerates stale wrappers, with patterns matching the format actually on disk. Parsing the package from the `mise use -g` line and the bin from the `exec mise x ... -- <bin>` line preserves non-trivial specs (`npm:@kitlangton/ghui`, `aqua:modem-dev/hunk`, `github:can1357/oh-my-pi`), which regenerating from the command name alone would lose. It may be worth making the parser tolerant of both wrapper generations, given this is the second format change it has to survive.

I fixed my own machine by extracting each package/bin pair and re-running `omarchy-mise-install` per wrapper; the resulting diff was exactly one line each (`--quiet`), and `git push` works again.

## System

- Omarchy `4.0.3-1`
- mise `2026.9.1 linux-x64`
- Wrappers written `2026-08-25`

No debug log attached: `omarchy debug --no-sudo --print` isn't a command in 4.0.3 (`Unknown Omarchy command`). This one is hardware-independent anyway — it reproduces from the wrapper contents plus the git credential-helper config.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

  • Fixed bypr/11514· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 13:45 UTC