Repository navigation
feat(runtime)!: confine every desktop-app launch under seatbelt - #58
Merged
Merged
Conversation
Each launch runs under macOS Seatbelt: it writes only into its own sandbox, never reads the user's folders, runs nothing it drops there, and reaches neither preferences, the keychain, the clipboard nor other agents' sockets. A canary checks the confinement before every launch (one read refused, one allowed); without it, no launch. A project's files/ is copied into each launch's sandbox (links, devices and oversized trees refused); the app's arguments name paths in it. Sandboxes live in ~/.kiframe/sandboxes, each named after the Kiframe that made it, so a crash sweep removes only what no running Kiframe owns. BREAKING CHANGE: a desktop app's args must be paths in the project's files/ (files/<name>); any other argument no longer parses.
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
- each launch writes its own canary, and a canary that went missing proves nothing (refused): launches at once never spoil each other's - the app's time to start begins once its files are copied - a stop during the copy ends the launch before the app starts - a folder in files/ swapped for a link while copied is refused - the app's own temp folder holds its own pages again
- a folder in files/ is checked again once its entries are copied: one swapped for a link at any point of the copy is refused - each canary lies beside its sandbox, named after it: a crash's is swept - a stop ends the canary check and the copy at once, said as the stop - a canary that was read reads as a confinement that didn't hold - the slow-copy tests are sized to the app's measured start, built once and removed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR 3a of the Electron targets epic (#55). Every desktop-app launch runs confined; the project's
files/is what an app opens;~/.kiframe/is Kiframe's deletable work area (decisions of 2026-10-09).Confinement (
electron-confine.ts)macOS Seatbelt (
sandbox-exec) around every launch, measured with a probe app (each escapeEPERM, the app driven as usual):open/osascript/launchctl, no Apple Events;Stated limits (OBJECT-MODEL §0.9, BACKLOG): an app can still ask LaunchServices to open a file or URL (no app starts without it, measured), and it reaches localhost. The confinement guards against an app reaching the user's data by accident, not one built to escape. An app's own copy and paste does nothing in a run.
files/
Copied into each launch's sandbox (own walker: links, FIFOs, devices refused, the root too; 500 MB / 20,000 entries / depth 32; APFS clones). The app's
argsnamefiles/<path>, and its edits are thrown away.Work area
~/.kiframe/sandboxes/(0700, never a link, out of Time Machine and Spotlight). Each sandbox is named after its owner (kiframe-app-<pid>-<start>-…), so it's owned from the moment it exists: no shared state file to race on. The crash sweep at start:psin the C locale, sweeps nothing whenpscan't be read, and never trusts a reused pid.Tests
DENIED EPERM), the clipboard, the canary's two sides, a home outside the denied roots;files/copy, refusals and limits;ps.Each test fails with its fix put back.
BREAKING CHANGE: a desktop app's
argsmust be paths in the project'sfiles/.