Repository navigation
fix: isolated panes cannot ask macOS to start programs, and Ctrl+click opens files only in an app chosen at the click - #181
Merged
Merged
Conversation
…solated panes - An agent plugin's data paths are part of what it can do: the install and update question names them, and an update that adds one asks again, also under --yes. - The plugins let in are kept in plugins-admitted.json; a server start loads the lock's, those and the built-ins, never a folder put in since. The first start with the file keeps every folder already there; a missing file says so in daemon.log, and one that does not parse lets in the lock's only and stays as it is until the owner's Reload. - The pane wrapper is told the server's plugins with --plugins; without it (an older server) it reads the file, so a folder never let in adds nothing to a pane's profile. - Reload from a window inside a pane loads again only what was let in, and says so when a folder waits. - Remote shells, database and language prompts, debuggers, multiplexers, sudo and su, and every program in /bin, /sbin, /usr/bin and /usr/sbin are refused as agent names. - The Isolation window prefixes a plugin's sandbox note with "plugin <name>: " and indents it, so no wrapped line of it reads as a built-in's note. - Tests: the not-JSON config test names its agent vimlike (vim, in /usr/bin, is now refused); the restart test stops the server through stop_and_wait. Part of GHSA-jr8q-vrww-r6hm Co-Authored-By: Claude <noreply@anthropic.com>
…k opens files only in an app chosen at the click - every pane profile refuses lsopen, job-creation, appleevent-send and user-preference-write, and looking up the services that run Automator workflows, shortcuts and user scripts; Isolation::profiled names where a profile applies - the Isolation window shows what that costs only for picks with a profile, a tab's or space's inherited one included - Ctrl+click and Open in its app refuse program types, Finder aliases, sockets and program folders; scripts, extensionless files and files without a trusted app open in the plain-text app; other files and packages open in the app LaunchServices names at the click, trusted only under the sealed system, /Applications, /Library or ~/Applications, with no part of the app or its executable in a folder another account may write, and outside the clicked path and the pane's folder - file:// links open only on this Mac; open -t is gone; links run /usr/bin/open - tmux, Zellij and screen in a This-folder-only pane get a 0700 folder of the pane's own that other panes can neither write nor connect into; the profile names that folder without following a link at its path, and allows nothing there when the folder could not be made; every This-folder-only pane may neither write where tmux, Zellij, screen and kitty outside it keep their sockets nor, with Network Open, connect there, the tmux nerd runs inside included - ~/Applications stays read-only in a This-folder-only pane - docs/isolation.md, SECURITY.md and docs/privacy-and-security.md say what the profile and the click now do and what they do not cover - the plugin-note test picks This folder only, no network, since notes show only for a pick with a profile Part of GHSA-649j-c4px-mfjq fix: the Isolation window says what an isolated pane's launch refusals cover and that osascript still runs The line read as if osascript were refused outright; it still runs scripts and reads the clipboard, only its events to other apps are refused. The docs now record that user scripts and launchctl setenv were checked by hand; Automator, Shortcuts and launchctl kickstart are still unchecked. Co-Authored-By: Claude <noreply@anthropic.com>
nyxene
pushed a commit
that referenced
this pull request
Nov 7, 2026
Release pull request, maintained by release-please. Merging it creates the tag and a draft GitHub release; then run `scripts/publish-binary.sh vX.Y.Z` from a terminal to attach the macOS binary and publish the release. --- ## [0.19.1](v0.19.0...v0.19.1) (2026-11-07) ### Fixed * a preview picture goes while the notice card is drawn over it ([#169](#169)) ([6ca3a7f](6ca3a7f)) * caches whose contents run later stay read-only in a pane isolated to its folder ([#176](#176)) ([dda6fdb](dda6fdb)) * Check for a new release leaves a release already installed to Update ([#175](#175)) ([7552294](7552294)) * isolated panes cannot ask macOS to start programs, and Ctrl+click opens files only in an app chosen at the click ([#181](#181)) ([02d8db3](02d8db3)) * only the release commit is signed, and an installer refuses a nerd of another version ([#178](#178)) ([a74be79](a74be79)) * Servers says why a machine cannot be listed, and offers a terminal only when ssh wanted a prompt ([#171](#171)) ([5519b1e](5519b1e)) * the server's sockets, files, ssh and typed messages hold their limits when a pane pushes on them ([#180](#180)) ([6bcc4cf](6bcc4cf)) * what a pane prints is bounded in the server's memory and time ([#182](#182)) ([126df17](126df17)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fixes, merged in order with the other ghsa/ steps.
Part of #177
🤖 Generated with Claude Code