Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-917GitHub issuePublicDecided· Out of scope

Add explicit plugin ID migration support for manifest renames

Reported by iamcheyan · filed Sep 6, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Add explicit plugin ID migration support for manifest renamesrevision 1 · captured 2026-09-28 21:23 UTC via poll

Support plugin ID migrations when a manifest ID changes

The plugin manager currently treats the manifest id as the plugin identity, but omarchy plugin update updates the checkout by its existing directory:

~/.config/omarchy/plugins/<old-id>/

It does not detect or migrate a changed manifest.json ID.

Reproduction

  1. Install and enable a plugin with { "id": "author.old-name" }.
  2. The user has author.old-name in shell.json and the checkout at ~/.config/omarchy/plugins/author.old-name/.
  3. Publish an update from the same repository with { "id": "author.new-name" }.
  4. Run omarchy plugin update author.old-name.

The update fast-forwards the old checkout, but the catalog now indexes the manifest as author.new-name. The directory, shell.json, enable/disable state, and commands using the old ID are not migrated together.

Impact

Existing users can end up with an old checkout directory, a new registry ID, a stale shell.json entry, and a plugin that appears installed but is not enabled or loaded. Updating with the new ID can fail because the new directory does not exist. Bar placement and plugin configuration may require manual repair.

New users installing the same repository get the new ID, so old and new installations behave differently.

Suggested direction

Add an explicit migration field to the manifest, for example:

{ "id": "author.new-name", "renamedFrom": ["author.old-name"] }

During update/rescan, the manager could verify the declared migration, migrate the checkout directory, update matching IDs in shell.json while preserving placement and settings, migrate enabled/disabled state, refresh the registry, and keep a temporary compatibility alias for old CLI calls.

The migration should be explicit and opt-in so an arbitrary manifest ID change cannot silently take over another installed plugin's configuration.

View raw text
## Support plugin ID migrations when a manifest ID changes

The plugin manager currently treats the manifest `id` as the plugin identity, but `omarchy plugin update` updates the checkout by its existing directory:

    ~/.config/omarchy/plugins/<old-id>/

It does not detect or migrate a changed `manifest.json` ID.

### Reproduction

1. Install and enable a plugin with `{ "id": "author.old-name" }`.
2. The user has `author.old-name` in `shell.json` and the checkout at `~/.config/omarchy/plugins/author.old-name/`.
3. Publish an update from the same repository with `{ "id": "author.new-name" }`.
4. Run `omarchy plugin update author.old-name`.

The update fast-forwards the old checkout, but the catalog now indexes the manifest as `author.new-name`. The directory, `shell.json`, enable/disable state, and commands using the old ID are not migrated together.

### Impact

Existing users can end up with an old checkout directory, a new registry ID, a stale `shell.json` entry, and a plugin that appears installed but is not enabled or loaded. Updating with the new ID can fail because the new directory does not exist. Bar placement and plugin configuration may require manual repair.

New users installing the same repository get the new ID, so old and new installations behave differently.

### Suggested direction

Add an explicit migration field to the manifest, for example:

    { "id": "author.new-name", "renamedFrom": ["author.old-name"] }

During update/rescan, the manager could verify the declared migration, migrate the checkout directory, update matching IDs in `shell.json` while preserving placement and settings, migrate enabled/disabled state, refresh the registry, and keep a temporary compatibility alias for old CLI calls.

The migration should be explicit and opt-in so an arbitrary manifest ID change cannot silently take over another installed plugin's configuration.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 10:55 UTC