Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy-launch-webapp fails silently when the browser .desktop Exec= is a wrapper (env VAR=val brave …)
Reported by bakuro117 · filed Sep 9, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
Every Omarchy web app (Discord, WhatsApp, YouTube, X, Tailscale, the Google apps, …) silently fails to launch — no window, no notification, nothing in any log.
Root cause is in bin/omarchy-launch-webapp:
exec setsid uwsm-app -- $(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1) --app="$1" "${@:2}"sed -n 's/^Exec=\([^ ]*\).*/\1/p' takes only the first whitespace‑delimited token of the Exec= line and assumes it is the browser binary. That assumption breaks whenever the browser .desktop file uses a wrapper form.
On this machine ~/.local/share/applications/brave-browser.desktop (user override, takes precedence over the packaged one) is:
Exec=/usr/bin/env LIBVA_DRIVER_NAME=iHD brave %Uso the extracted token is /usr/bin/env, and the command that actually runs is:
setsid uwsm-app -- /usr/bin/env --app="https://discord.com/channels/@me"$ /usr/bin/env --app="https://discord.com/channels/@me"; echo $?
/usr/bin/env: unrecognized option '--app=https://discord.com/channels/@me'
Try '/usr/bin/env --help' for more information.
125env rejects --app= as an unknown option and exits 125. Because the whole thing is behind setsid uwsm-app, stderr is discarded and the failure is completely silent.
This is not an exotic config: forcing LIBVA_DRIVER_NAME via an env wrapper in the browser .desktop file is a common fix on NVIDIA / hybrid‑GPU laptops (Omarchy itself ships LIBVA_DRIVER_NAME=nvidia in default/hypr/nvidia.lua). Flatpak browsers (Exec=/app/bin/brave %U style, or Exec=flatpak run …) would hit the same parser problem from the other direction.
What I expected
omarchy-launch-webapp opens the URL as an app window in the default Chromium‑family browser regardless of whether that browser's Exec= line is a bare binary or a wrapped invocation.
Steps to reproduce
- Make the default browser's
.desktopfile use a wrappedExec=, e.g. put in~/.local/share/applications/brave-browser.desktop:
Exec=/usr/bin/env LIBVA_DRIVER_NAME=iHD brave %U (xdg-settings get default-web-browser → brave-browser.desktop)
2. Run omarchy-launch-webapp https://discord.com/channels/@me (or launch any bundled web app).
3. Nothing launches. echo $? from the extracted command shows env exiting 125.
Suggested fixes
Any of:
- Resolve the browser through its binary instead of parsing
Exec=— e.g.gio launch <desktop-file>/xdg-opensemantics, or readTryExec=first and fall back to the last non‑%-token ofExec=. - Strip a leading
env//usr/bin/envplus itsVAR=VALarguments before taking the first real token. - Pass the whole resolved
Exec(minus field codes) through and append--app=rather than assuming token 1 is the executable. - At minimum, don't swallow stderr — let the failure surface.
Workaround
Point the .desktop Exec= at a one‑line wrapper script (export LIBVA_DRIVER_NAME=iHD; exec /usr/bin/brave "$@") so Exec= is a single token again. Web apps then launch normally.
System details
- Omarchy:
4.0.2-1 - Hardware: Lenovo Legion Pro 5 16IRX8 — Intel Core i7‑13700HX, Intel Raptor Lake UHD (i915) + NVIDIA RTX 4070 Mobile (nvidia 610.57.04)
- Hyprland 0.56.2, SDDM
- Browser: Brave
1:1.94.119-1(brave-bin),xdg-settings get default-web-browser→brave-browser.desktop bin/omarchy-launch-webapponmasteris identical to the shipped 4.0.2 version — bug is current.- Debug log:
/tmp/omarchy-debug.log(attach on submit)
View raw text
### What happened
Every Omarchy web app (Discord, WhatsApp, YouTube, X, Tailscale, the Google apps, …) silently fails to launch — no window, no notification, nothing in any log.
Root cause is in `bin/omarchy-launch-webapp`:
```bash
exec setsid uwsm-app -- $(sed -n 's/^Exec=\([^ ]*\).*/\1/p' {~/.local,~/.nix-profile,/usr}/share/applications/$browser 2>/dev/null | head -1) --app="$1" "${@:2}"
```
`sed -n 's/^Exec=\([^ ]*\).*/\1/p'` takes only the **first whitespace‑delimited token** of the `Exec=` line and assumes it is the browser binary. That assumption breaks whenever the browser `.desktop` file uses a wrapper form.
On this machine `~/.local/share/applications/brave-browser.desktop` (user override, takes precedence over the packaged one) is:
```
Exec=/usr/bin/env LIBVA_DRIVER_NAME=iHD brave %U
```
so the extracted token is `/usr/bin/env`, and the command that actually runs is:
```
setsid uwsm-app -- /usr/bin/env --app="https://discord.com/channels/@me"
```
```
$ /usr/bin/env --app="https://discord.com/channels/@me"; echo $?
/usr/bin/env: unrecognized option '--app=https://discord.com/channels/@me'
Try '/usr/bin/env --help' for more information.
125
```
`env` rejects `--app=` as an unknown option and exits 125. Because the whole thing is behind `setsid uwsm-app`, stderr is discarded and the failure is completely silent.
This is not an exotic config: forcing `LIBVA_DRIVER_NAME` via an `env` wrapper in the browser `.desktop` file is a common fix on NVIDIA / hybrid‑GPU laptops (Omarchy itself ships `LIBVA_DRIVER_NAME=nvidia` in `default/hypr/nvidia.lua`). Flatpak browsers (`Exec=/app/bin/brave %U` style, or `Exec=flatpak run …`) would hit the same parser problem from the other direction.
### What I expected
`omarchy-launch-webapp` opens the URL as an app window in the default Chromium‑family browser regardless of whether that browser's `Exec=` line is a bare binary or a wrapped invocation.
### Steps to reproduce
1. Make the default browser's `.desktop` file use a wrapped `Exec=`, e.g. put in `~/.local/share/applications/brave-browser.desktop`:
```
Exec=/usr/bin/env LIBVA_DRIVER_NAME=iHD brave %U
```
(`xdg-settings get default-web-browser` → `brave-browser.desktop`)
2. Run `omarchy-launch-webapp https://discord.com/channels/@me` (or launch any bundled web app).
3. Nothing launches. `echo $?` from the extracted command shows `env` exiting 125.
### Suggested fixes
Any of:
- Resolve the browser through its binary instead of parsing `Exec=` — e.g. `gio launch <desktop-file>` / `xdg-open` semantics, or read `TryExec=` first and fall back to the last non‑`%`-token of `Exec=`.
- Strip a leading `env`/`/usr/bin/env` plus its `VAR=VAL` arguments before taking the first real token.
- Pass the whole resolved `Exec` (minus field codes) through and append `--app=` rather than assuming token 1 is the executable.
- At minimum, don't swallow stderr — let the failure surface.
### Workaround
Point the `.desktop` `Exec=` at a one‑line wrapper script (`export LIBVA_DRIVER_NAME=iHD; exec /usr/bin/brave "$@"`) so `Exec=` is a single token again. Web apps then launch normally.
### System details
- Omarchy: `4.0.2-1`
- Hardware: Lenovo Legion Pro 5 16IRX8 — Intel Core i7‑13700HX, Intel Raptor Lake UHD (i915) + NVIDIA RTX 4070 Mobile (nvidia 610.57.04)
- Hyprland 0.56.2, SDDM
- Browser: Brave `1:1.94.119-1` (`brave-bin`), `xdg-settings get default-web-browser` → `brave-browser.desktop`
- `bin/omarchy-launch-webapp` on `master` is identical to the shipped 4.0.2 version — bug is current.
- Debug log: `/tmp/omarchy-debug.log` (attach on submit)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 11:18 UTC