Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-753GitHub issuePublicDecided· Out of scope

KDE Connect notifications display literal " entities

Reported by jeancarlosg93 · filed Sep 9, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

KDE Connect notifications display literal " entitiesrevision 1 · captured 2026-09-28 21:23 UTC via poll

System details

  • Omarchy: 4.0.2-1
  • Quickshell: 0.3.1-1
  • KDE Connect: 26.08.0-1
  • Kernel: 7.1.9-arch1-2
  • CPU/GPU: AMD Ryzen 7 7840U / Radeon 780M (Phoenix1)

What's wrong?

Notification bodies forwarded from Android by KDE Connect can display literal HTML entities in Omarchy Shell. This is especially visible in WhatsApp reaction notifications, where quotation marks around the reacted-to message appear as " instead of ".

For an affected notification, Omarchy's persisted notification JSON contains a body equivalent to:

{"app":"KDE Connect","summary":"WhatsApp","body":"Someone: Reacted 🤓 to "🤗""}

NotificationCard.qml renders the body as Text.StyledText, which decodes one entity layer. The user therefore sees:

Someone: Reacted 🤓 to "🤗"

Steps to reproduce

This synthetic notification reproduces the rendering independently of a phone:

notify-send "WhatsApp" 'Someone: Reacted 🤓 to "🤗"'

Expected behavior

The notification should be displayed as:

Someone: Reacted 🤓 to "🤗"

Additional context

KDE Connect deliberately HTML-escapes incoming notification title and body text before passing it to KNotification:

https://github.com/KDE/kdeconnect-kde/blob/master/plugins/notifications/notification.cpp#L87-L108

This may be an interoperability issue between KDE Connect/KNotifications and Omarchy's freedesktop notification renderer rather than an Omarchy-only defect. However, the malformed presentation occurs in Omarchy Shell, and the exact body received by its notification model is retained in its history, so it should be possible to cover with a renderer test using the synthetic payload above.

The real notification included personal contact information, so it has been anonymized rather than attached publicly.

View raw text
### System details

- Omarchy: 4.0.2-1
- Quickshell: 0.3.1-1
- KDE Connect: 26.08.0-1
- Kernel: 7.1.9-arch1-2
- CPU/GPU: AMD Ryzen 7 7840U / Radeon 780M (Phoenix1)

### What's wrong?

Notification bodies forwarded from Android by KDE Connect can display literal HTML entities in Omarchy Shell. This is especially visible in WhatsApp reaction notifications, where quotation marks around the reacted-to message appear as `"` instead of `"`.

For an affected notification, Omarchy's persisted notification JSON contains a body equivalent to:

```json
{"app":"KDE Connect","summary":"WhatsApp","body":"Someone: Reacted 🤓 to "🤗""}
```

`NotificationCard.qml` renders the body as `Text.StyledText`, which decodes one entity layer. The user therefore sees:

```text
Someone: Reacted 🤓 to "🤗"
```

### Steps to reproduce

This synthetic notification reproduces the rendering independently of a phone:

```bash
notify-send "WhatsApp" 'Someone: Reacted 🤓 to "🤗"'
```

### Expected behavior

The notification should be displayed as:

```text
Someone: Reacted 🤓 to "🤗"
```

### Additional context

KDE Connect deliberately HTML-escapes incoming notification title and body text before passing it to KNotification:

https://github.com/KDE/kdeconnect-kde/blob/master/plugins/notifications/notification.cpp#L87-L108

This may be an interoperability issue between KDE Connect/KNotifications and Omarchy's freedesktop notification renderer rather than an Omarchy-only defect. However, the malformed presentation occurs in Omarchy Shell, and the exact body received by its notification model is retained in its history, so it should be possible to cover with a renderer test using the synthetic payload above.

The real notification included personal contact information, so it has been anonymized rather than attached publicly.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 11:22 UTC