Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-616GitHub issuePublicDecided· Out of scope

Install/remove helpers hardcode --noconfirm, silently skipping confirmation

Reported by maffur-hub · filed Sep 13, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Install/remove helpers hardcode --noconfirm, silently skipping confirmationrevision 1 · captured 2026-09-28 21:23 UTC via poll

Bug report: install/remove helpers hardcode --noconfirm, silently skipping confirmation

What happened

Since the 4.0.2/4.0.3 upgrade, Omarchy's user-facing package install and
remove commands pass --noconfirm to pacman/yay, so no [Y/n] confirmation
is ever shown.

Repro: open the Omarchy menu → Install → Services → Spotify (or run
omarchy-pkg-add spotify / omarchy-pkg-remove). A floating terminal opens
and the package is installed/removed immediately without waiting for a
confirmation. Same behavior for the install/remove Package and AUR TUIs.

What was expected

An interactive confirmation prompt ([Y/n]) before any package is installed
or removed, as it behaved before 4.0.2.

Where it comes from

--noconfirm is hardcoded in the packaged user-facing helpers:

  • /usr/bin/omarchy-pkg-add — pacman -S --noconfirm --needed
  • /usr/bin/omarchy-pkg-install — sudo pacman -S --noconfirm
  • /usr/bin/omarchy-pkg-aur-add — yay -S --noconfirm --needed
  • /usr/bin/omarchy-pkg-aur-install — yay -S --noconfirm
  • /usr/bin/omarchy-pkg-remove — sudo pacman -Rns --noconfirm
  • /usr/bin/omarchy-pkg-drop — sudo pacman -Rns --noconfirm
  • /usr/bin/omarchy-remove-dev-env — sudo pacman -Rns --noconfirm (PHP/Symfony)

Maintenance/update flows (keyring, system upgrade, migrations, channel) also
use --noconfirm, which is correct there — the regression is only that the
interactive install/remove paths gained the flag.

Regression

  • omarchy-settings/omarchy 4.0.1-1 -> 4.0.2-1 on 2026-09-06
  • 4.0.2-1 -> 4.0.3-1 on 2026-09-10
  • Login binaries dated 2026-09-09 04:30 (build time)

System

  • Omarchy 4.0.3-1, channel stable
  • Arch Linux
  • Ryzen 7 2700, Radeon RX 540/550

Suggested fix

Drop --noconfirm from the seven helper commands listed above (keep it in the
automated update/migration paths). An local-workaround mirroring this fix is in
place on this machine via a pacman hook that strips the flag after each
omarchy upgrade.

View raw text
## Bug report: install/remove helpers hardcode `--noconfirm`, silently skipping confirmation

### What happened

Since the 4.0.2/**4.0.3** upgrade, Omarchy's user-facing package install and
remove commands pass `--noconfirm` to pacman/yay, so no `[Y/n]` confirmation
is ever shown.

Repro: open the Omarchy menu → **Install → Services → Spotify** (or run
`omarchy-pkg-add spotify` / `omarchy-pkg-remove`). A floating terminal opens
and the package is installed/removed immediately without waiting for a
confirmation. Same behavior for the install/remove Package and AUR TUIs.

### What was expected

An interactive confirmation prompt (`[Y/n]`) before any package is installed
or removed, as it behaved before 4.0.2.

### Where it comes from

`--noconfirm` is hardcoded in the packaged user-facing helpers:

- `/usr/bin/omarchy-pkg-add` — `pacman -S --noconfirm --needed`
- `/usr/bin/omarchy-pkg-install` — `sudo pacman -S --noconfirm`
- `/usr/bin/omarchy-pkg-aur-add` — `yay -S --noconfirm --needed`
- `/usr/bin/omarchy-pkg-aur-install` — `yay -S --noconfirm`
- `/usr/bin/omarchy-pkg-remove` — `sudo pacman -Rns --noconfirm`
- `/usr/bin/omarchy-pkg-drop` — `sudo pacman -Rns --noconfirm`
- `/usr/bin/omarchy-remove-dev-env` — `sudo pacman -Rns --noconfirm` (PHP/Symfony)

Maintenance/update flows (keyring, system upgrade, migrations, channel) also
use `--noconfirm`, which is correct there — the regression is only that the
interactive install/remove paths gained the flag.

### Regression

- `omarchy-settings`/`omarchy` `4.0.1-1 -> 4.0.2-1` on 2026-09-06
- `4.0.2-1 -> 4.0.3-1` on 2026-09-10
- Login binaries dated 2026-09-09 04:30 (build time)

### System

- Omarchy `4.0.3-1`, channel `stable`
- Arch Linux
- Ryzen 7 2700, Radeon RX 540/550

### Suggested fix

Drop `--noconfirm` from the seven helper commands listed above (keep it in the
automated update/migration paths). An local-workaround mirroring this fix is in
place on this machine via a pacman hook that strips the flag after each
`omarchy` upgrade.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 12:28 UTC