Repository navigation
Conversation
…d to its folder A pane set to Files: This folder only could write the system Python's bytecode cache, Homebrew's downloads and bootsnap, ccache, sccache, esbuild, Bazelisk and Coursier caches under ~/Library/Caches; what it planted there ran later outside the pane. They join the folders that stay read-only, and the denylist's limit is marked. The plugin sandbox test now tells a refused exec from a program that ran and failed, and its probes start nothing if the profile regresses. Fixes GHSA-ggxm-v286-f48h fix: a folder above a place a pane isolated to its folder may not write cannot be moved away or linked in - Seatbelt checks a rename against the moved path, not its folder: every folder above a denied place now refuses rename, swap and removal, and a link put in its place - the folders above are derived from the denied lists and the regex doors, not listed again, both as written and resolved; a missing fixed one cannot be made either, while agents' data folders stay creatable - a denied place or a folder above one that is a link keeps the link itself - an agent folder that is a link (Stow's ~/.claude, a synced ~/.claude/projects) keeps memory and Qwen's workflow scripts read-only at its target too - hook install and the start of each Folder pane make an agent's missing data folder above a denied place (~/.gemini/tmp), so it cannot be moved in whole - the temp folder's podman folder and the ssh agent's socket join the write denies, so neither can be moved to dodge the socket deny - ceiling: a missing ~/.<agent>/projects or project folder in it can still be moved in whole with memory or Qwen's workflow scripts inside, which docs/isolation.md now says; link chains are followed one link deep - tests: moving or swapping a project folder, moving ~/Library/Caches or $TMPDIR/podman, replacing a linked cache or a linked ~/go, memory under a linked agent folder, a planted link and a folder moved in where one is missing are refused; new project folders, session files and caches still work Part of GHSA-ggxm-v286-f48h fix: a pane isolated to its folder finds its agents' session folders writable and leaves no file in them - the start of a Folder pane asked whether each agent's data folder is writable by making a file there and removing it; the profile now refuses removing a direct child of ~/.<agent>/projects, so the check warned on every start and left .nerd-write-check-<pid> behind - the folder is now asked, not tried: its permissions, then Seatbelt through sandbox_check, so nothing is written - test: a Folder pane prints no warning and leaves nothing in ~/.claude/projects Co-Authored-By: Claude <noreply@anthropic.com>
nyxene
pushed a commit
that referenced
this pull request
Nov 7, 2026
Release pull request, maintained by release-please. Merging it creates the tag and a draft GitHub release; then run `scripts/publish-binary.sh vX.Y.Z` from a terminal to attach the macOS binary and publish the release. --- ## [0.19.1](v0.19.0...v0.19.1) (2026-11-07) ### Fixed * a preview picture goes while the notice card is drawn over it ([#169](#169)) ([6ca3a7f](6ca3a7f)) * caches whose contents run later stay read-only in a pane isolated to its folder ([#176](#176)) ([dda6fdb](dda6fdb)) * Check for a new release leaves a release already installed to Update ([#175](#175)) ([7552294](7552294)) * isolated panes cannot ask macOS to start programs, and Ctrl+click opens files only in an app chosen at the click ([#181](#181)) ([02d8db3](02d8db3)) * only the release commit is signed, and an installer refuses a nerd of another version ([#178](#178)) ([a74be79](a74be79)) * Servers says why a machine cannot be listed, and offers a terminal only when ssh wanted a prompt ([#171](#171)) ([5519b1e](5519b1e)) * the server's sockets, files, ssh and typed messages hold their limits when a pane pushes on them ([#180](#180)) ([6bcc4cf](6bcc4cf)) * what a pane prints is bounded in the server's memory and time ([#182](#182)) ([126df17](126df17)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fixes, merged in order with the other ghsa/ steps.
Part of #177
🤖 Generated with Claude Code