Skip to content

Enable keychain and launch-services under safe #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
technicalpickles merged 3 commits into from
Oct 16, 2026
Merged

Enable keychain and launch-services under safe #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
da3055d
safe: enable launch-services so open works under safehouse
technicalpickles Oct 16, 2026
fa021bc
safe: enable keychain so gh can read its token
technicalpickles Oct 16, 2026
01a490d
safe: document what each enabled feature unlocks and exposes
technicalpickles Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion bin/safe
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,22 @@ if [ -f "$profiles/role-$role.sb" ]; then
role_profile="--append-profile=$profiles/role-$role.sb"
fi

# Optional safehouse features, each a deliberate hole in the sandbox:
# clipboard pbcopy/pbpaste work. Sandboxed code can also read the
# clipboard.
# keychain Keychain reads. Needed because gh keeps its token there;
# without it `gh auth status` says the token is invalid.
# Sandboxed code can read EVERY Keychain item you own. A
# narrower option is a dedicated token via --env-pass.
# launch-services `open` works (MCP OAuth sign-in, plannotator opening a
# browser). Without it: kLSUnknownErr -10810 from
# RunningBoard. Anything it launches runs OUTSIDE the
# sandbox with your full privileges, so it is an escape
# hatch (`open -a Terminal ...`) the role escape guards don't
# cover.
# Rationale and tradeoffs: doc/adr/0060-agent-safehouse-wrapper.md.
exec safehouse \
--enable=clipboard \
--enable=clipboard,keychain,launch-services \
--env-pass=SSH_AUTH_SOCK,GIT_CONFIG_GLOBAL \
--append-profile="$profiles/common.sb" \
${role_profile:+"$role_profile"} \
Expand Down
4 changes: 3 additions & 1 deletion doc/adr/0060-agent-safehouse-wrapper.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ it (`safe pi`). It:

- appends `config/agent-safehouse/common.sb`, then `role-$DOTPICKLES_ROLE.sb`
when one exists. Role rules come last so their denies win.
- enables `clipboard`.
- enables `clipboard`, `keychain`, and `launch-services`.
- starts a **dedicated ssh-agent** at `~/.ssh/agent/safehouse.sock`, fills it
with `bin/load-agent-ssh-keys` (Keychain passphrase per
[ADR 0030](0030-ssh-keychain-loading-at-login.md), skipping keys Automic Vault
Expand Down Expand Up @@ -77,4 +77,6 @@ The split between files follows role, not convenience:
dedicated agent has nothing to sign with. Signing inside the sandbox on an AV
machine would need `av-gpg` reachable from the sandbox. Not done.
- `--enable=clipboard` lets sandboxed code read the clipboard.
- `--enable=keychain` lets `gh` read its token from the Keychain (`gh auth status` reports it invalid without this), but sandboxed code can read every Keychain item the user owns. Accepted tradeoff; a narrower option is a dedicated token passed via `--env-pass`.
- `--enable=launch-services` lets `open` work (MCP OAuth sign-in, plannotator), but anything it launches runs outside the sandbox with full privileges. Accepted tradeoff: this is a sandbox escape hatch (e.g. `open -a Terminal`), and the escape guard in `role-work.sb` does not cover it.
- No Linux story; safehouse is Seatbelt-only.
Loading