Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-566GitHub issuePublicDecided· Out of scope

1password 8.12.36-2 omits MCP group/setgid setup, causing peer authentication rejection

Reported by larok00 · filed Sep 14, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

1password 8.12.36-2 omits MCP group/setgid setup, causing peer authentication rejectionrevision 1 · captured 2026-09-28 21:23 UTC via poll

The Omarchy repository's 1password 8.12.36-2 package omits the MCP group/setgid setup supplied by 1Password's bundled installer. The running desktop app consequently rejects MCP authentication with Linux peer effective GID check failed.

Evidence

  • pacman -Si 1password: repository omarchy, version 8.12.36-2; upgraded from 8.12.34-36 on 2026-09-14.
  • getent group onepassword-mcp: no entry.
  • Host-side stat of /opt/1Password/1password-mcp: owner root, group root, mode 0755.
  • The installed package script at /var/lib/pacman/local/1password-8.12.36-2/install creates onepassword and configures 1Password-BrowserSupport, but has no MCP setup.
  • /opt/1Password/after-install.sh lines 145–156 explicitly create onepassword-mcp, assign that group to 1password-mcp, and apply chmod g+s, explaining that this allows peer verification via SO_PEERCRED.

Observed failure

On 2026-09-14 at 18:44:28 BST, a Codex-launched 1password-mcp requested authentication. The existing desktop instance logged no application groups existed on the system and Rejecting MCP connection: Linux peer effective GID check failed. The MCP log then recorded IPC unavailable, attempting to launch 1Password and spawned a new desktop process.

The new process immediately crashed with SIGSEGV; the kernel recorded a general-protection fault inside the 1password executable. The original desktop instance survived. The new startup log also warned that XDG_RUNTIME_DIR was unset. No core was saved because the process's core-size limit disabled dumping, so the exact segfault cause is unproven. This report concerns the verified packaging omission; the crash is an associated symptom, not a proven consequence of the missing group.

Expected / proposed correction

Mirror the bundled installer's dedicated MCP group and executable setgid setup in the package's install and upgrade hooks. The bundled installer also provides /usr/bin/1password-mcp and the legacy /opt/1Password/onepassword-mcp alias, which should be reviewed for packaging parity. Users should not be added to the dedicated group.

The local repair has not been applied and end-to-end authentication after repair has not been tested.

System

  • Omarchy 4.0.3-1
  • Linux 7.2.3-arch1-3, x86_64
  • glibc 2.44+r24+g16be1518495f-1
  • omarchy debug --no-sudo --print is unavailable on this installation (unknown command), so no generated debug bundle is attached.

Filed by GPT-6 via Codex.

View raw text
The Omarchy repository's `1password 8.12.36-2` package omits the MCP group/setgid setup supplied by 1Password's bundled installer. The running desktop app consequently rejects MCP authentication with `Linux peer effective GID check failed`.

## Evidence

- `pacman -Si 1password`: repository `omarchy`, version `8.12.36-2`; upgraded from `8.12.34-36` on 2026-09-14.
- `getent group onepassword-mcp`: no entry.
- Host-side stat of `/opt/1Password/1password-mcp`: owner root, group root, mode `0755`.
- The installed package script at `/var/lib/pacman/local/1password-8.12.36-2/install` creates `onepassword` and configures `1Password-BrowserSupport`, but has no MCP setup.
- `/opt/1Password/after-install.sh` lines 145–156 explicitly create `onepassword-mcp`, assign that group to `1password-mcp`, and apply `chmod g+s`, explaining that this allows peer verification via SO_PEERCRED.

## Observed failure

On 2026-09-14 at 18:44:28 BST, a Codex-launched `1password-mcp` requested authentication. The existing desktop instance logged `no application groups existed on the system` and `Rejecting MCP connection: Linux peer effective GID check failed`. The MCP log then recorded `IPC unavailable, attempting to launch 1Password` and spawned a new desktop process.

The new process immediately crashed with SIGSEGV; the kernel recorded a general-protection fault inside the 1password executable. The original desktop instance survived. The new startup log also warned that XDG_RUNTIME_DIR was unset. No core was saved because the process's core-size limit disabled dumping, so the exact segfault cause is unproven. This report concerns the verified packaging omission; the crash is an associated symptom, not a proven consequence of the missing group.

## Expected / proposed correction

Mirror the bundled installer's dedicated MCP group and executable setgid setup in the package's install and upgrade hooks. The bundled installer also provides `/usr/bin/1password-mcp` and the legacy `/opt/1Password/onepassword-mcp` alias, which should be reviewed for packaging parity. Users should not be added to the dedicated group.

The local repair has not been applied and end-to-end authentication after repair has not been tested.

## System

- Omarchy `4.0.3-1`
- Linux `7.2.3-arch1-3`, x86_64
- glibc `2.44+r24+g16be1518495f-1`
- `omarchy debug --no-sudo --print` is unavailable on this installation (unknown command), so no generated debug bundle is attached.

Filed by GPT-6 via Codex.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 13:24 UTC