Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
omarchy-network-speedtest can run unbounded and burn huge amounts of data if the panel UI dies
Reported by doitn0w · filed Sep 4, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
AMD Ryzen 7 PRO 6850U
What's wrong?
omarchy-network-speedtest (invoked by the speedtest panel, Panel.qml) has no self-imposed timeout — it relies entirely on the caller sending SIGTERM after the intended ~5s window per direction. The traffic workers run while true loops with 8 parallel curl/dd streams and only stop via the trap cleanup EXIT handler, which only fires if the process actually receives a signal.
If the Quickshell panel process dies, gets orphaned, or otherwise loses track of the child process (e.g. after a shell crash/restart) without sending that SIGTERM, the 8 parallel download/upload streams keep running indefinitely in the background — with no indicator anywhere in the UI that it's still active, since the overlay that would show it is already gone.
Impact: On a metered connection (mobile hotspot), this silently consumed ~5GB of data before I noticed via ss -tup / ps that curl processes hitting nflxvideo.net were still running with no associated UI.
Suggested fix: add a hard self-timeout inside the script (e.g. break out of the any_alive monitoring loop after N seconds regardless of external signals), so the existing trap cleanup EXIT always fires within a bounded time even if the parent process disappears.
Environment: omarchy 4.0.2-1, Arch Linux, kernel 7.1.9-arch1-2
View raw text
### System details AMD Ryzen 7 PRO 6850U ### What's wrong? omarchy-network-speedtest (invoked by the speedtest panel, Panel.qml) has no self-imposed timeout — it relies entirely on the caller sending SIGTERM after the intended ~5s window per direction. The traffic workers run while true loops with 8 parallel curl/dd streams and only stop via the trap cleanup EXIT handler, which only fires if the process actually receives a signal. If the Quickshell panel process dies, gets orphaned, or otherwise loses track of the child process (e.g. after a shell crash/restart) without sending that SIGTERM, the 8 parallel download/upload streams keep running indefinitely in the background — with no indicator anywhere in the UI that it's still active, since the overlay that would show it is already gone. Impact: On a metered connection (mobile hotspot), this silently consumed ~5GB of data before I noticed via ss -tup / ps that curl processes hitting nflxvideo.net were still running with no associated UI. Suggested fix: add a hard self-timeout inside the script (e.g. break out of the any_alive monitoring loop after N seconds regardless of external signals), so the existing trap cleanup EXIT always fires within a bounded time even if the parent process disappears. Environment: omarchy 4.0.2-1, Arch Linux, kernel 7.1.9-arch1-2
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 10:47 UTC