# Changelog ## [Unreleased] ### Upgrade Notes - No special notes. ### Changed Sandboxing Profiles - No profiles changed. ## [0.12.0] - 2026-09-07 ### Upgrade Notes - Breaking: `open` is now blocked by default unless you pass `--enable=launch-services`. Launch Services starts the handler application *outside* the sandbox with your full user permissions, so any sandboxed process that could call `open` could escape. - Claude Code's Ctrl+G handoff to an already-running VS Code calls `open -b`, so it now needs `--enable=launch-services`. Full command: `safehouse --enable=launch-services -- claude` - The `--enable=vscode` cold-start path execs the app binary directly and is unaffected. - Breaking: Reading an out-of-sandbox process's argv and environment is now denied by default. Thus `ps -ww`, `ps eww`, and similar commands no longer expose host command lines or environment variables (which often carry secrets). Processes inside the sandbox are still fully inspectable. - Restore the old behavior with `--enable=process-control` or `--enable=lldb`. - Breaking: `--enable=1password` no longer grants file access to `~/.1password` or `/Users/Shared/.1password`. - 1Password itself never creates either directory on macOS so this change only affects users who have manually created those directories themselves. ### Features - Nix-installed programs now run by default. - Running `nix` itself to install packages within Safehouse remains unsupported. - `~/.config/nix` (which may contain `access-tokens`) remains unreadable. - New `--enable=gpg`: GPG git commit signing through a `gpg-agent` running outside the sandbox. - Start the agent outside the sandbox first with `gpgconf --launch gpg-agent && gpgconf --launch keyboxd`. - Secret keys under `~/.gnupg/private-keys-v1.d` and the legacy `~/.gnupg/secring.gpg` stay denied within the sandbox. - New `--enable=gpu`: Metal shader compilation and GPU IOKit access without the rest of the `electron` or `macos-gui` stack. - New `--enable=herdr`: status and bell reporting to [herdr](https://herdr.dev). Auto-enabled when `HERDR_ENV` is set in the host environment. - The Cursor desktop app is now recognized and gets its own app profile. - `--append-profile` profiles can use workdir-relative rules. - Safehouse defines `WORK_DIR` and exposes `workdir-literal`, `workdir-subpath`, and `workdir-prefix` helpers to profiles. Example: ```scheme (deny file-read* file-write* (workdir-literal "/.env")) ``` - If workdir is disabled with `--workdir=` (empty string), a policy using these helpers fails to compile rather than silently matching a path built from an empty string. ### Bug Fixes - The Codex CLI installed by the ChatGPT app no longer errors on startup. - Its bundled `node_repl` MCP server needs the adjacent Node runtime under `ChatGPT.app/Contents/Resources/cua_node`, which was unreadable. - Copilot CLI now works inside a VS Code integrated terminal. - VS Code's Copilot Chat extension prepends its own `copilot` launcher shim to `PATH`, shadowing Copilot CLI's `copilot` binary, and that shim needs certain grants to trampoline to the real CLI. - `--enable=docker` now allows anonymous image pulls to succeed without additional configuration. - Authenticated image pulls still additionally require `--enable=keychain` permissions. - Python `multiprocessing` no longer fails at `sem_open(3)`. - POSIX named semaphores were denied by default, which broke `multiprocessing.Queue`, `Pool`, and anything else backed by them. ### Chores - E2E agent TUI test improvements: - `cline` and `copilot` tests run in CI. - `copilot` test now submits a real prompt, rather than just launching the binary. - TUI tests run weekly in CI with recent agent versions, catching regressions proactively. - Flakiness reduced: Startup-gate handling is centralized and judged against a single frozen frame. - Improved diagnostics: Failure dumps include a settled frame. - Low-cost model names updated. - CI security improvements: - CI now runs `zizmor` against the GitHub Actions workflows and fails on new findings. Existing diagnostics are fixed: - No unsafe cache usage in the docs deploy. - No docs builds from non-main branches. - Secret-exfiltration paths have documented mitigations. - CI refuses a `dist/safehouse.sh` that does not match a fresh regeneration, via a new `./scripts/generate-dist.sh --check`. Hand-edited dist artifacts no longer reach a release. - Unpinned tool versions in CI now skip anything published in the last 4 days, limiting the blast radius of a compromised upstream release. - `CONTRIBUTING` now states the Bash 3.2 compatibility target, which is what ships with macOS. ### Thanks - @Rhys-T contributing Nix package manager support in [#97](https://github.com/eugene1g/agent-safehouse/pull/97). - @yairchu fixing Python `multiprocessing` semaphores in [#171](https://github.com/eugene1g/agent-safehouse/pull/171). - @black-snow adding the `--enable=gpu` option in [#183](https://github.com/eugene1g/agent-safehouse/pull/183). - @danra reaping the `nc` listeners left behind by failing network tests in [#166](https://github.com/eugene1g/agent-safehouse/pull/166). - @mnadel asking for workdir-relative rules in appended policies in [#172](https://github.com/eugene1g/agent-safehouse/issues/172). ### Changed Sandboxing Profiles - [`00-base.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-02c38ee50d8f4793102a508750ddd9d62254a5bef2a70f857fdfdb4f9677acb9): Added the `WORK_DIR` replacement token and the `workdir-literal`/`workdir-subpath`/`workdir-prefix` helpers so profiles can express workdir-relative rules. - [`10-system-runtime.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-c27b7abd9dcf3cd976d593264e5d14dcfc2e10422b3dcdebb8bb9dbee4d611c8): Added read-only grants for `/nix/store`, `/nix/var/nix/profiles`, and the Nix per-user profile symlinks. Denied `kern.procargs*` and `process-info-pidinfo` for out-of-sandbox processes, re-allowing pidinfo for `same-sandbox` targets. - [`ipc-posix-sem.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-f9ed91b3c105be5acbd4822a558e157c1398a19010078b0d0e68ac060980ab34): New shared profile allowing `ipc-posix-sem`, which Python's `multiprocessing` needs for `sem_open(3)`. - [`gpu.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-bd3aff3be81e06c958826180359c72d9f652b5f342f5456e70d014ed988ca5eb): New opt-in profile holding the Metal compiler service, `IOSurfaceRootUserClient`, and `AGXDeviceUserClient` grants. - [`gpg.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-af2da8d3897b37ae3458bcd1d9f88d6ee42dacbbe67f4c1a790291dd3781a052): New opt-in profile granting `~/.gnupg` reads, dotlock/trustdb writes, and connects to the `gpg-agent` and `keyboxd` sockets. Explicitly denies the secret-key directory and legacy `secring.gpg`. - [`herdr.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-94391f56d9d7a6e43b653b4c430177730490ca4422778c2a7cab02594f6040a7): New opt-in profile granting `~/.config/herdr` reads and a connect to `herdr.sock`. - [`launch-services.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-5a55e1897c5f20073224394721909e1469f7a8933c11d3dd3ce4f06a1cd8523d): Moved from `50-integrations-core/` to `55-integrations-optional/`, so `lsopen` and the Launch Services mach lookups are now opt-in rather than always on. - [`electron.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-4741198d5dabb58afd28c97f7c5c5826fce4e80ed446c120542152160b86bb24): Moved its GPU and Metal rules into `gpu.sb` and now requires it. Same effective grants. - [`chromium-headless.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-9f6dc8d781704105880e2f6841f5783b98bf8e483bc6454f3ca1b9560c3fcdc8): Moved its GPU IOKit user clients into `gpu.sb` and now requires it. Same effective grants. - [`docker.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-2a99b527bf61c193bd84db192fc7c84224ff91cb9ecacede2c2672c45d2e5124): Anonymous image pulls now work. Authenticated pulls and `docker login` still need `--enable=keychain`. - [`process-control.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-adc820aead86730d3ff676f3244df95427dc167098218035b09c33a45c8944c5): Added `(allow process-info-pidinfo)` to restore host argv/env visibility now that it is denied by default. - [`lldb.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-9b1a1aee4fcd6c90b56db204faf4c05fcb1bec258503143aeb2c87d53b6dfdbd): Marked its existing `process-info-pidinfo` allow with a test id, pinning it as the debugger-side restore path for the new default deny. - [`1password.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-dae0a12c26e11eedc851247d601cccdd0445d3918b0ade4cdc869d3ffb23b585): Removed the `~/.1password` and `/Users/Shared/.1password` file grants. - [`codex.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-375ef639cf4426f1855e046b144d28f63094bc22f4a8348f176000792c973c25): Added narrow reads for the ChatGPT app's bundled `cua_node` runtime and `codex` CLI, which the bundled `node_repl` MCP server needs. Narrower than granting the whole app bundle. - [`copilot-cli.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-4c4b4a874f02531e9888d2fd68d6a7134dd67d9f41db0a08535679e7bd6f8de6): Added reads for the Copilot Chat extension's `copilotCli` launcher shim and the VS Code `Frameworks` directory, plus the metadata traversal needed to reach them. - [`cursor-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-db51792c4048de7b08e2f3c864744350dce0758b81703cb30f9473441c24670e): New app profile for Cursor Desktop, requiring `keychain.sb` and `electron.sb`. - [`claude-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-e3ba6b6dab397c0aa1f952d3488cffaa0119bb213d3e73fc3ca2ec39ec5f1ea7), [`codex-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-dfd037f71c747a82d9532750cd5ccfd3e79ffbcb83881c0acc599d6ef2072697), [`vscode-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.1...v0.12.0#diff-e36692fe5535f876b390e4776cf042e90b6c47a6fe5370200f4013d0ead65cfb): Comment-only updates noting that `electron.sb` now pulls in `gpu.sb`. ## [0.11.1] - 2026-07-16 ### Upgrade Notes - No special notes. ### Bug Fixes - `--enable=1password` now unblocks the UNIX socket required for SSH-signing commits via `op-ssh-sign`. - `--enable=agent-browser` now unblocks UNIX sockets needed to run Agent Browser. - `--enable=chromium-full` now unblocks UNIX sockets needed to run Chromium. Chrome and Chrome for Testing were already unblocked. - `--enable=chromium-full` now unblocks the `-headless` user-data-dir container that Chrome 151+ creates for `--headless=new`, which previously aborted with "Failed to create headless user data directory container." This also fixes `--enable=agent-browser`, which launches Chrome for Testing headless by default. - `--enable=chromium-headless` now unblocks UNIX sockets, plists, and Crashpad needed to run Chrome, Chrome for Testing, and Chromium. - `--enable=docker` now re-opens the Podman UNIX sockets (the system socket and the per-machine sockets) it previously left blocked, so `docker`/`podman` clients pointed at a Podman unix socket can `connect()` instead of failing with `EPERM`. Previously only the Docker sockets were re-opened even though the core deny profile blocked both Docker and Podman. - `--enable=ssh` now unblocks the SSH_AUTH_SOCK socket on macOS Tahoe 26.4+. The pre-Tahoe location remains supported. - `--enable=vscode` now unblocks certain UNIX sockets needed to avoid opening multiple copies of the VS Code process. - The Claude desktop app's new Mach names are now granted by Safehouse. - The Codex desktop app is now recognized when installed as `ChatGPT.app`, which is how current builds ship. `Codex.app` remains supported. Safehouse also now grants additional filesystem paths, Mach names, and UNIX sockets so that Codex launches successfully. ### Chores - macOS CI now runs a `macos-26` + `macos-15` matrix instead of `macos-latest`, so Tahoe- and Sequoia-specific policy differences such as the relocated SSH agent socket are caught before release rather than after. ### Thanks - @d0ugal re-opening the Podman sockets under `--enable=docker`, including the test coverage that pins them against the identical strings in the deny block, in [#145](https://github.com/eugene1g/agent-safehouse/pull/145). - @jburnham reporting that `--enable=1password` could no longer reach the SSH agent socket after UNIX-socket connects became deny-by-default in [#139](https://github.com/eugene1g/agent-safehouse/issues/139). - @yngvark reporting that macOS Tahoe relocated `SSH_AUTH_SOCK` under `/var/run`, which `--enable=ssh` did not yet grant, in [#138](https://github.com/eugene1g/agent-safehouse/issues/138). ### Changed Sandboxing Profiles - [`10-system-runtime.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-c27b7abd9dcf3cd976d593264e5d14dcfc2e10422b3dcdebb8bb9dbee4d611c8): Extended the default deny for launchd per-user listener sockets to the Tahoe 26.4+ `/private/var/run` location, naming `file-read-metadata` explicitly so the deny outranks the general `/private/var/run` metadata allow in the same profile. - [`container-runtime-default-deny.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-b26c73e82fe28da645a8216c4e2f81fc42121217d7c03fa2cf669f7686e290f2): Comment-only change clarifying that the `network-outbound` deny is defense-in-depth, since `20-network.sb` never allows UNIX sockets in the first place. - [`ssh-agent-default-deny.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-d5ee2399dc6de3abc866607371d90c0e6a0748d68ab1f31f1b327dc32dd6ea72): Added the Tahoe 26.4+ `/private/var/run` listener socket patterns so SSH agent access stays opt-in on that OS version. - [`1password.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-dae0a12c26e11eedc851247d601cccdd0445d3918b0ade4cdc869d3ffb23b585): Allowed `network-outbound` connect to the 1Password SSH agent socket, which was readable but not connectable. - [`agent-browser.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-51e021c04a1aa945867c71f383a570f1212b5011f7c23a4166781df6b58a0fe3): Allowed bind/listen/connect on the per-session daemon socket at `~/.agent-browser/.sock`, which previously failed with "Failed to bind socket: Operation not permitted". - [`chromium-full.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-d542719401c3da098b9f40fa32c7f156af327e4ac8e980ef85b48d73fe7c2e82): Moved the ProcessSingleton and Crashpad grants down to `chromium-headless.sb` so all Chromium builds share them, and added the Chromium preferences plist. - [`chromium-headless.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-9f6dc8d781704105880e2f6841f5783b98bf8e483bc6454f3ca1b9560c3fcdc8): Added ProcessSingleton socket and Crashpad grants for Chrome, Chrome for Testing, and Chromium, plus the `-headless` user-data-dir container Chrome 151+ requires for `--headless=new`. - [`docker.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-2a99b527bf61c193bd84db192fc7c84224ff91cb9ecacede2c2672c45d2e5124): Re-opened the Podman sockets (system, and `~/.local/share/containers` / `~/.config/containers` machine sockets) for both file access and `network-outbound` connect, symmetric with the deny rules in `container-runtime-default-deny.sb`. - [`ssh.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-27e3f65a24bff6925a3e1e6fca94111fa57ca9cd73e662b4a78b1480804f097d): Allowed the Tahoe 26.4+ SSH_AUTH_SOCK location for both file access and connect, matching the specificity of the default deny so the allow wins. - [`claude-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-e3ba6b6dab397c0aa1f952d3488cffaa0119bb213d3e73fc3ca2ec39ec5f1ea7): Accepted the optional team-ID prefix on the app's MachPortRendezvousServer names. - [`codex-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-dfd037f71c747a82d9532750cd5ccfd3e79ffbcb83881c0acc599d6ef2072697): Covered the `ChatGPT.app` bundle alongside `Codex.app`, added `~/.codex` and `~/Library/Caches/Codex`, the `com.openai.codex.apps.*` Mach names, and the ProcessSingleton socket needed at launch. - [`vscode-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.11.0...v0.11.1#diff-e36692fe5535f876b390e4776cf042e90b6c47a6fe5370200f4013d0ead65cfb): Allowed the sandboxed instance to receive CLI IPC and to hand off args between Safehouse-managed instances, while explicitly denying outbound connects to an unsandboxed VS Code's IPC socket and to the `vscode-git` credential socket, which cross a trust boundary. ## [0.11.0] - 2026-07-07 ### Upgrade Notes - Breaking: UNIX-socket access is now denied by default. Custom setups which rely on communicating with a UNIX socket may now need an `--append-profile` with an `(allow network-outbound (remote unix-socket (path-literal "/path/to/my.sock"))` grant. - Breaking: Sandboxed agents can no longer write to the workdir `.safehouse` config or to any `--append-profile` file by default. If your workflow requires an agent to edit its own policy files use `--allow-workdir-config-writes` or `--allow-profile-writes`. ### Features - The `.safehouse` workdir config now supports `enable=` and `append-profile=` keys, in addition to the existing `add-dirs-ro` and `add-dirs` keys, so a trusted workdir can enable integrations and add a custom profile without extra CLI flags. - Workdirs can be trusted via `--always-trust-workdir-config`, enabling the use of its `/.safehouse` config without needing to always provide the `--trust-workdir-config` option. - `--enable=1password` now supports configuring `op-ssh-sign` for Git commit signing using `gpg.ssh.program`. - `fnm use` now works to change the node version. Previously only the initial node version could be used. ### Bug Fixes - `--enable=docker` now grants read access to the `Docker.app` bundle, so the `docker` command no longer fails at startup. - `--enable=shell-init` now supports the `bash` shell. - Node global packages under `~/.local/lib/node_modules` are now readable, fixing fnm/XDG prefix setups where globally installed CLIs could not be run. ### Chores - Fixed Rust toolchain installation in the macOS CI workflow. - Hardened the e2e tmux harness by preserving the respawn working directory and isolating tmux servers between runs. - Documented that `--enable=shell-init` can expose credentials stored in shell env files. - Documented that Chromium-based browsers need `--no-sandbox` when run inside the sandbox. - Agent Safehouse contributors using Claude Code will now load agent instructions correctly, by adding a symlink from `CLAUDE.md` to the existing `AGENTS.md`. ### Thanks - @davidfstr for joining the maintainer team and shepherding several PRs to merge for this release. - @tomc-goodrx for designing and prototyping the trusted `.safehouse` workdir config feature set — `enable=`/`append-profile=` keys, persistent trust, and write protection for config and appended profiles — landed in [#77](https://github.com/eugene1g/agent-safehouse/pull/77), [#78](https://github.com/eugene1g/agent-safehouse/pull/78), [#79](https://github.com/eugene1g/agent-safehouse/pull/79), and [#80](https://github.com/eugene1g/agent-safehouse/pull/80). - @black-snow fixing Docker Desktop app-bundle access in [#129](https://github.com/eugene1g/agent-safehouse/pull/129), fnm multishell read/write in [#130](https://github.com/eugene1g/agent-safehouse/pull/130), and Node global package reads in [#132](https://github.com/eugene1g/agent-safehouse/pull/132). - @d0ugal for adding support for 1Password `op-ssh-sign` commit signing in [#108](https://github.com/eugene1g/agent-safehouse/pull/108). - @leemeo3 documenting the shell-init credential exposure warning in [#122](https://github.com/eugene1g/agent-safehouse/pull/122) and the Chromium `--no-sandbox` requirement in [#128](https://github.com/eugene1g/agent-safehouse/pull/128). ### Changed Sandboxing Profiles - [`20-network.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.10.1...v0.11.0#diff-2204b16cdfcda231f4cb64889b5cf29b528d4ecdab3bad9b81e8793ecd5aba64): Replaced the blanket `(allow network*)` with explicit TCP/UDP + DNS grants so UNIX-socket access is no longer permitted by default. - [`30-toolchains/node.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.10.1...v0.11.0#diff-94a5c97eafdc81daa5ae1e467d55943959ac559f14c59d8c3af198e716ad311f): Added the fnm per-shell multishell directory and read access to `~/.local/lib/node_modules` for XDG-prefix global packages. - [`1password.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.10.1...v0.11.0#diff-dae0a12c26e11eedc851247d601cccdd0445d3918b0ade4cdc869d3ffb23b585): Added read access to the `1Password.app` bundle so `op-ssh-sign` can run for Git commit signing. - [`chromium-full.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.10.1...v0.11.0#diff-d542719401c3da098b9f40fa32c7f156af327e4ac8e980ef85b48d73fe7c2e82): Added `ProcessSingleton` `SingletonSocket` bind/inbound/outbound grants so Chrome for Testing can launch under the socket-restricted network policy. - [`docker.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.10.1...v0.11.0#diff-2a99b527bf61c193bd84db192fc7c84224ff91cb9ecacede2c2672c45d2e5124): Added `Docker.app` bundle read access so the `docker` CLI symlink resolves. - [`shell-init.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.10.1...v0.11.0#diff-b4e8dd0043aab271dfa6bf04dec2110baca715ff9a4d6032d22f32ea88a3dd08): Added the user-level bash startup files so interactive bash sessions can source their own init. ## [0.10.1] - 2026-05-20 ### Bug Fixes - Allowed SysV semaphores by default so LMDB-backed tools, including Parcel's cache during pnpm/npm install and build hooks, can open their environment instead of aborting or failing with EPERM. ### Chores - Added regression coverage that the default shared profile includes the SysV semaphore grant and regenerated the packaged dist artifact. ### Thanks - @ptoussai surfacing and fixing LMDB/Parcel SysV semaphore failures in [#101](https://github.com/eugene1g/agent-safehouse/pull/101). ### Changed Sandboxing Profiles - [`ipc-sysv-sem.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.10.0...v0.10.1#diff-a163899ef876526b94e8be2964964a1de0a11cb12b5e7bb1dc81bd9be97f6250): Added default SysV semaphore access for LMDB cross-process locking on macOS. ## [0.10.0] - 2026-05-19 ### Features - Added Elixir runtime support, including Mix archives, escripts, task cache, and Hex package cache access. - Expanded the Xcode integration to support simulator-targeted builds, `simctl`, `actool`, SwiftUI previews, and CoreSimulator-managed runtime enumeration. ### Bug Fixes - Xcode now reads the system-level license acceptance plist and Swift Package Manager cache, avoiding unnecessary license prompts and SPM cache denials inside the sandbox. - `chromium-full` now covers Chrome for Testing Crashpad xattrs and child-port handshakes so Chrome for Testing can complete startup. - GUI app integrations now allow Finder drag-and-drop coordination through `com.apple.coredrag`. - Interactive terminal agents can now perform tty/pty ioctls such as `tcsetattr`, preventing raw-mode failures that leak escape sequences into agent input. ### Chores - Added regression coverage for Elixir profile inclusion, Xcode simulator allowances, Chrome for Testing Crashpad startup, Electron GUI drag-and-drop lookup, tty/pty ioctl handling, and Git workdir denial diagnostics. ### Thanks - @greg0x fixing Xcode license and SPM cache access in [#81](https://github.com/eugene1g/agent-safehouse/pull/81). - @nathanmsmith adding Elixir runtime support in [#82](https://github.com/eugene1g/agent-safehouse/pull/82). - @rularner adding Xcode simulator support in [#92](https://github.com/eugene1g/agent-safehouse/pull/92). - @thegalexc fixing Chrome for Testing Crashpad startup in [#90](https://github.com/eugene1g/agent-safehouse/pull/90). - @saynomoo surfacing the Finder drag-and-drop GUI app denial fixed in this release in [#95](https://github.com/eugene1g/agent-safehouse/issues/95). - @lucagentile fixing tty/pty ioctl handling for terminal raw mode in [#98](https://github.com/eugene1g/agent-safehouse/pull/98). ### Changed Sandboxing Profiles - [`10-system-runtime.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.9.0...v0.10.0#diff-c27b7abd9dcf3cd976d593264e5d14dcfc2e10422b3dcdebb8bb9dbee4d611c8): Added tty/pty `file-ioctl` allowances so interactive agents can switch terminals into raw mode reliably. - [`elixir.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.9.0...v0.10.0#diff-80a71899199b2a47ed95946d28f5525f6ac308a04dd451a8ce8b6ebf35e360c8): Added Mix and Hex cache/state access for Elixir workflows. - [`chromium-full.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.9.0...v0.10.0#diff-d542719401c3da098b9f40fa32c7f156af327e4ac8e980ef85b48d73fe7c2e82): Added Chrome for Testing Crashpad xattr and child-port handshake access required during startup. - [`macos-gui.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.9.0...v0.10.0#diff-3ddea98ee8aa3646b2cb0d688dac05b16fdc45a52697fcf2e38bd0ab26c3600c): Added the CoreDrag lookup used by Finder drag-and-drop into GUI apps. - [`xcode.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.9.0...v0.10.0#diff-d037b532f9b9bff74bf91c2037f0c0340ebd8cd1bf90fb1d36e4641cb11d8396): Added system license plist, SwiftPM cache, and CoreSimulator namespace access needed by Xcode build and simulator workflows. ## [0.9.0] - 2026-03-27 ### Features - Added an opt-in `--enable=cloud-storage` integration that grants the FileProvider and FileCoordination Mach lookups needed for macOS cloud storage mounts under `~/Library/CloudStorage`, so explicit grants into Google Drive, Dropbox, iCloud Drive, OneDrive, and other FileProvider-backed paths work as expected. ### Chores - Added regression coverage for the new `cloud-storage` integration and documented when to enable it for FileProvider-backed macOS cloud storage paths. ### Thanks - @thegalexc adding the `cloud-storage` integration for FileProvider XPC in [#73](https://github.com/eugene1g/agent-safehouse/pull/73). ### Changed Sandboxing Profiles - [`cloud-storage.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.8.0...v0.9.0#diff-af9e3f2e414fe4097cda7de9bd3a1f3868c42c7dd70ae3cbe0b77eea1e42c5c8): Added opt-in FileProvider and FileCoordination Mach lookups so `--add-dirs` and `--add-dirs-ro` grants into macOS cloud storage mounts work without broadening access beyond the paths the user already grants. ## [0.8.0] - 2026-03-27 ### Features - Added explicit `--enable=keychain` support so plugin-backed helper flows, including `opencode-claude-auth`, can opt into macOS Keychain access even when no built-in Safehouse profile auto-detects the requirement. ### Chores - Added regression coverage and `--explain`/packaging assertions for explicit keychain enablement, and documented when to use `--enable=keychain` for plugin-driven credential flows. ### Thanks - @ChristianKniep surfacing the plugin-backed OpenCode keychain access gap fixed in this release in [#71](https://github.com/eugene1g/agent-safehouse/issues/71). ### Changed Sandboxing Profiles - [`keychain.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.7.0...v0.8.0#diff-a2a140b0b9d2a0c8819f343d379ecafb454d0f47b8b565b18a93a0b7d7bddaae): Made the Keychain integration explicitly user-enableable while keeping auto-injection for profiles that declare it as a dependency. ## [0.7.0] - 2026-03-27 ### Upgrade Notes - No special notes. ### Features - `chromium-headless` now supports branded Google Chrome on macOS by allowing the `com.google.Chrome.*` Mach services and scoped Crashpad state needed for headless launches. ### Bug Fixes - `shell-init` can now follow Homebrew-installed completion symlinks that resolve into GUI app bundle `Contents/Resources` paths, eliminating noisy `operation not permitted` output from zsh `compinit` without granting full app-bundle reads. ### Chores - Added regression coverage for Homebrew GUI-app completion symlinks and refreshed the Claude Code end-to-end startup matcher so the macOS TUI suite stays aligned with the current Claude welcome screen. ### Thanks - @thegalexc adding branded Google Chrome headless support in [#70](https://github.com/eugene1g/agent-safehouse/pull/70). - @pingvinen surfacing the Homebrew GUI completion noise fixed in this release in [#67](https://github.com/eugene1g/agent-safehouse/issues/67). ### Changed Sandboxing Profiles - [`chromium-headless.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.6.0...v0.7.0#diff-9f6dc8d781704105880e2f6841f5783b98bf8e483bc6454f3ca1b9560c3fcdc8): Added branded Google Chrome Mach port and Crashpad access so headless Chrome can launch under `chromium-headless` instead of crashing during rendezvous or crashpad initialization. - [`shell-init.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.6.0...v0.7.0#diff-b4e8dd0043aab271dfa6bf04dec2110baca715ff9a4d6032d22f32ea88a3dd08): Allowed shell startup flows to follow Homebrew GUI-app completion symlinks into `Contents/Resources` while keeping access scoped to completion-like files. ## [0.6.0] - 2026-03-23 ### Upgrade Notes - Claude's VS Code external-editor handoff now defaults to reuse-only mode. If you rely on `Ctrl+G` to cold-start VS Code from a plain `safehouse -- claude ...` session, add `--enable=vscode`. Existing `EDITOR` or `VISUAL` values still take precedence. ### Features - Added automatic profile selection for the OpenAI Codex Desktop app, including its app bundle, app state paths, Electron runtime dependencies, preference domain, and Keychain-backed sign-in surface. - `safehouse --explain` now reports the invoked command, profile target command, host and execution `PATH` matches, and a ready-to-run sandbox denial log hint to make command-resolution debugging much easier. ### Bug Fixes - Restored Node/npm workflows under `fnm` by allowing the metadata traversal and install roots used by `fnm_multishells` shims and the macOS `~/Library/Application Support/fnm` layout. - Safehouse now skips stale linked-worktree admin entries during startup and `--explain`, avoiding `realpath` failures when old worktree metadata is left behind. - Home-scoped path grants now resolve symlink targets for profile-owned paths, which fixes Opencode bootstrap when `~/.config/opencode` points at a dotfiles-managed directory. - Refined Claude's VS Code editor handoff so the default path reuses an already-running VS Code instance, while the explicit `--enable=vscode` cold-start path launches detached with an isolated Safehouse-managed profile. ### Chores - Added regression coverage for Codex Desktop bundle detection, `fnm` multishell and App Support Node workflows, Opencode symlinked XDG paths, stale worktree handling, `--explain` command-resolution output, and the new Claude/VS Code editor-shim modes. - Updated the docs around `--enable=vscode`, Claude external-editor handoff, and the default preservation of `EDITOR` and `VISUAL` in sanitized mode. ### Thanks - @Kola50011 adding the OpenAI Codex Desktop app profile in [#62](https://github.com/eugene1g/agent-safehouse/pull/62). - @wkirby surfacing the `fnm`-backed Node/npm resolution failures fixed in this release in [#13](https://github.com/eugene1g/agent-safehouse/issues/13). - @benjivm surfacing the Opencode symlinked XDG-path bootstrap failure fixed in this release in [#61](https://github.com/eugene1g/agent-safehouse/issues/61). - @rublev surfacing the Claude-to-VS Code handoff behavior tightened in this release in [#46](https://github.com/eugene1g/agent-safehouse/issues/46). ### Changed Sandboxing Profiles - [`node.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.2...v0.6.0#diff-94a5c97eafdc81daa5ae1e467d55943959ac559f14c59d8c3af198e716ad311f): Added `fnm` install-root and multishell metadata access so Node child-process `PATH` resolution and npm shims work for both XDG and macOS App Support layouts. - [`vscode.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.2...v0.6.0#diff-471f0b2ad5b04157955a47cc887440730950d6b71a0e9ff5181d66a9f95bb515): Made the full VS Code desktop/editor integration explicitly opt-in so cold-start editor handoff only happens behind `--enable=vscode`. - [`claude-code.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.2...v0.6.0#diff-caf651f708e889ca1935c3c382d551ccbed8eb81f611fab631829993fca117b7): Split core Claude CLI access from a narrow metadata-only VS Code reuse surface so `Ctrl+G` can still hand off to an already-running VS Code without granting full app startup by default. - [`opencode.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.2...v0.6.0#diff-cd89eca750d855f552c01fc868cdf1400d4c482fbf93e47c50425e84f470fa5a): Added the parent XDG directory allowances Opencode needs to bootstrap its default state roots, which now also works when the config path is symlinked into a dotfiles tree. - [`codex-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.2...v0.6.0#diff-dfd037f71c747a82d9532750cd5ccfd3e79ffbcb83881c0acc599d6ef2072697): Added a dedicated OpenAI Codex Desktop app profile covering the app bundle, Codex state directories, preference domain, app-specific Mach services, and its Electron/keychain dependencies. - [`vscode-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.2...v0.6.0#diff-e36692fe5535f876b390e4776cf042e90b6c47a6fe5370200f4013d0ead65cfb): Added isolated Safehouse-managed Claude editor cache roots and `/Applications` traversal so the explicit VS Code cold-start path can launch cleanly without reusing the user's normal VS Code profile. ## [0.5.2] - 2026-03-18 ### Upgrade Notes - No special notes. ### Bug Fixes - The default Apple Command Line Tools profile now includes `ranlib` plus common compiler aliases and low-risk archive and inspection helpers, restoring `cargo build` and other static-archive workflows that implicitly invoke `ranlib` inside the sandbox. ### Chores - Added execution coverage for `ar` archive creation and Rust `cargo build` of a `staticlib`, and installed a stable Rust toolchain in the macOS test workflow so this regression is exercised in CI. ### Thanks - @Sixeight surfacing the missing `ranlib` allowance behind the Rust staticlib failure fixed in this release in [#57](https://github.com/eugene1g/agent-safehouse/issues/57). ### Changed Sandboxing Profiles - [`apple-toolchain-core.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.1...v0.5.2#diff-2e94e17a0cc2897fd42614396f336402efeab2c61bf5164883c16af81389fb2b): Added `ranlib`, common compiler aliases, and related low-risk inspection helpers to the curated CLT allowlist so static archive builds work by default without broadening access to debugger tooling. ## [0.5.1] - 2026-03-17 ### Upgrade Notes - No special notes. ### Bug Fixes - Built-in absolute `file-read*` paths now resolve macOS compatibility symlinks such as `/private/etc/resolv.conf` and `/private/etc/localtime`, while keeping `xcode-select` pointer symlinks explicit so the default sandbox does not silently inherit a host-specific full Xcode bundle. - `--enable=lldb` now covers versioned/full Xcode app bundles and Apple private developer frameworks needed on hosts where LLDB loads Xcode-backed developer resources instead of only Command Line Tools. - Bundler can now read the macOS system default gemspec catalog under `/Library/Ruby/Gems`, restoring read-only Bundler commands such as `bundle --version` inside the sandbox. ### Chores - Added regression coverage for built-in symlink-target rendering, `xcode-select` pointer exceptions, LLDB on Xcode-backed hosts, Bundler system gem reads, and file-symlink CLI grants. - Clarified the README and policy/distribution docs around built-in path resolution and its current scope. ### Thanks - @technicalpickles surfacing the built-in symlink-resolution gap fixed in this release in [#54](https://github.com/eugene1g/agent-safehouse/issues/54). ### Changed Sandboxing Profiles - [`ruby.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.0...v0.5.1#diff-e6c5527826f7eeab06d5ebadd9b3a6be91aa1b5c88874d651f9a60f758a1554e): Added read-only `/Library/Ruby/Gems` access so Bundler can enumerate macOS default gems without needing write access to system Ruby state. - [`lldb.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.5.0...v0.5.1#diff-9b1a1aee4fcd6c90b56db204faf4c05fcb1bec258503143aeb2c87d53b6dfdbd): Broadened LLDB's read-only Xcode coverage to include versioned app bundles and private developer frameworks needed when hosts select a full Xcode install. ## [0.5.0] - 2026-03-17 ### Upgrade Notes - Safehouse now keeps the default workdir at the exact invocation directory instead of walking up to an enclosing Git root. This avoids accidentally widening access when you launch from a deeply nested folder inside a larger repo or beneath a home-directory Git tree. If you intentionally want broader repo access from a nested launch, grant it explicitly with `--add-dirs=/path/to/repo` or `--add-dirs-ro=/path/to/repo`. ### Features - Added a reusable `microphone` optional integration for microphone capture via TCC, CoreAudio, CMIO, and the Apple HDA input path. - Claude Code now pulls that shared microphone integration automatically for voice mode instead of embedding microphone allowances directly in the agent profile. ### Bug Fixes - Ancestor `.git` directories without real repository metadata no longer widen the default workdir. ### Chores - Added regression coverage for invocation-scoped workdir behavior, nested linked-worktree launches, trusted `.safehouse` discovery, microphone integration, and PATH probing. - Clarified the docs and machine-readable wrapper guidance so the default workdir contract matches the runtime behavior. ### Thanks - @schmijos surfacing the default workdir auto-walk problem fixed in this release in [#52](https://github.com/eugene1g/agent-safehouse/issues/52). ### Changed Sandboxing Profiles - [`10-system-runtime.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.4.0...v0.5.0#diff-c27b7abd9dcf3cd976d593264e5d14dcfc2e10422b3dcdebb8bb9dbee4d611c8): Added narrow `~/.local/bin` traversal and listing access so PATH probing can find user-installed helpers without reading their contents. - [`microphone.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.4.0...v0.5.0#diff-dbfccfaa1929f95619d832f800692ab0400315aa6e601f0f2f2f1a6bd37fbda9): Added a reusable microphone integration covering TCC, CoreAudio, CMIO, and Apple HDA input access for voice-enabled agent workflows. - [`claude-code.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.4.0...v0.5.0#diff-caf651f708e889ca1935c3c382d551ccbed8eb81f611fab631829993fca117b7): Switched Claude Code voice mode to depend on the shared `microphone` integration instead of carrying microphone access inline. ## [0.4.0] - 2026-03-16 ### Upgrade Notes - SSH agent authentication is now opt-in. If you previously relied on `SSH_AUTH_SOCK` inside Safehouse without extra flags, add `--enable=ssh`. - Packaged releases now ship only `dist/safehouse.sh`. If you consumed `dist/profiles/*` or the generated Claude launcher commands, switch to `dist/safehouse.sh` or generate what you need from source. - Linked Git worktrees are now auto-detected at launch and sibling worktrees become readable by default. If you want stricter single-worktree visibility, narrow that with `--append-profile` deny rules or disable automatic workdir grants and use explicit path flags. ### Features - Added linked-worktree support by default: when the effective workdir is a Git worktree root, Safehouse now grants shared Git metadata access for that worktree and read-only visibility into the other existing worktrees for the same repo. - Expanded Chrome-family browser support on macOS: `chromium-full` now covers system Google Chrome launches, `playwright-chrome` injects `PLAYWRIGHT_MCP_SANDBOX=false`, and `agent-browser` now depends on the full Chrome allowances used by Chrome for Testing. - Sandboxed commands now get `APP_SANDBOX_CONTAINER_ID=agent-safehouse` by default unless the caller or environment already set a value. ### Bug Fixes - GitHub Copilot CLI can now bootstrap its startup cache under `~/Library/Caches/copilot`, allowing the packaged launcher to start cleanly on first run. - SSH agent sockets are denied by default unless `--enable=ssh` is set, closing a gap where agent-backed SSH auth could still work through `network-outbound`. ### Chores - Reworked the shell/runtime internals into staged CLI, policy, and execution modules, and rebuilt the release packaging around a single embedded `dist/safehouse.sh`. - Added much broader policy, surface, packaging, and tmux-driven end-to-end coverage to validate behavior and improve release predictability. - Clarified the default HOME sandbox behavior in the docs, including what `HOME_DIR` does and what the base policy still does not grant. ### Thanks - @clkao adding default `APP_SANDBOX_CONTAINER_ID` injection in [#43](https://github.com/eugene1g/agent-safehouse/pull/43). - @prabirshrestha driving the linked Git worktree support in [#37](https://github.com/eugene1g/agent-safehouse/issues/37). - @eikes surfacing the Copilot startup failure fixed in this release in [#47](https://github.com/eugene1g/agent-safehouse/issues/47). - @Bouke prompting the clearer HOME behavior docs in [#11](https://github.com/eugene1g/agent-safehouse/issues/11). - @mtford90 surfacing the Agent Browser and Playwright support gap addressed in this release in [#25](https://github.com/eugene1g/agent-safehouse/issues/25). ### Changed Sandboxing Profiles - [`00-base.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-02c38ee50d8f4793102a508750ddd9d62254a5bef2a70f857fdfdb4f9677acb9): Clarified the `HOME_DIR` base-profile comments so the generated policy docs match the current render pipeline. - [`ssh-agent-default-deny.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-d5ee2399dc6de3abc866607371d90c0e6a0748d68ab1f31f1b327dc32dd6ea72): Added default-deny rules for launchd and `~/.ssh/agent/*` sockets so SSH agent credential use stays opt-in until `--enable=ssh`. - [`worktree-common-dir.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-1e29ea236a9b67bfd5f5ab1c7049e9737e9d978f64d4d4c89be7b6974268b8c1): Added runtime-generated grants for a linked worktree's shared Git common dir so refs and index metadata outside the selected workdir keep working. - [`worktrees.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-17e3dbc495bdbdf1e1e848162114ff08e5a8d92aa06de242f72cde411f3d108a): Added runtime-generated read-only grants for sibling linked worktrees so cross-worktree inspection works by default. - [`agent-browser.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-51e021c04a1aa945867c71f383a570f1212b5011f7c23a4166781df6b58a0fe3): Switched the dependency to `chromium-full` so the default macOS Agent Browser path works with Chrome for Testing. - [`chromium-full.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-d542719401c3da098b9f40fa32c7f156af327e4ac8e980ef85b48d73fe7c2e82): Expanded Chrome allowances to cover the system Google Chrome app bundle, prefs, Crashpad state, and Mach rendezvous used during full-browser launches. - [`keychain.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-a2a140b0b9d2a0c8819f343d379ecafb454d0f47b8b565b18a93a0b7d7bddaae): Clarified that Keychain access is auto-injected transitively from dependent profiles. - [`macos-gui.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-3ddea98ee8aa3646b2cb0d688dac05b16fdc45a52697fcf2e38bd0ab26c3600c): Added an explicit clipboard dependency so GUI apps automatically pick up pasteboard IPC. - [`playwright-chrome.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-71143f8c791e41abf6b58108b3be4fac283ce630871a13708abeee848126e57b): Added a Playwright Chrome-channel profile that pulls `chromium-full` and injects `PLAYWRIGHT_MCP_SANDBOX=false`. - [`ssh.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-27e3f65a24bff6925a3e1e6fca94111fa57ca9cd73e662b4a78b1480804f097d): Extended SSH access to newer `~/.ssh/agent/*` socket layouts and unix-socket connections used by modern macOS ssh-agent setups. - [`amp.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-7aad0697a20f2d7bbd6001edf23e5259590ca1e4088d5f6f98f4d4ee5ca622ac): Added `/home` compatibility-root reads so Amp startup probes do not fail on macOS path-resolution quirks. - [`claude-code.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-caf651f708e889ca1935c3c382d551ccbed8eb81f611fab631829993fca117b7): Added the `claude` launcher alias and browser-native-messaging dependency so Claude Code auto-selects correctly and `claude --chrome` works. - [`copilot-cli.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-4c4b4a874f02531e9888d2fd68d6a7134dd67d9f41db0a08535679e7bd6f8de6): Added the `copilot` launcher alias and writable Copilot cache access so the packaged CLI can bootstrap cleanly. - [`cursor-agent.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-8709a949dfd9b6444711734ba983308c5ba7728d6b102a82831b023275454d6a): Added the `agent` launcher alias used by some Cursor Agent installs so Cursor profile selection auto-matches more reliably. - [`kilo-code.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-5624593fba664d15e46adfb4928f77bc0c91963eebdd8b0a2d2aeb6e80e33faa): Added the `kilo` launcher alias so Kilo Code profile selection works across more install names. - [`claude-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-e3ba6b6dab397c0aa1f952d3488cffaa0119bb213d3e73fc3ca2ec39ec5f1ea7): Made Claude Desktop depend on the shared `claude-code` profile so it inherits Claude Code state, keychain access, and the Chrome bridge through one contract. - [`vscode-app.sb`](https://github.com/eugene1g/agent-safehouse/compare/v0.3.1...v0.4.0#diff-e36692fe5535f876b390e4776cf042e90b6c47a6fe5370200f4013d0ead65cfb): Simplified VS Code's dependency chain so Electron now pulls macOS GUI access transitively while keychain access stays explicit. ## [0.3.1] - 2026-03-12 ### Bug Fixes - Default sanitized execution now preserves common non-secret proxy, TLS, and browser-control environment variables, including `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, lowercase proxy variants, `NODE_EXTRA_CA_CERTS`, and `NO_BROWSER`. - Tightened Java toolchain sandboxing so system `/Library/Java` runtimes stay read-only while per-user `~/Library/Java` installs remain writable, preventing accidental writes to globally installed JDKs. ### Changed Sandboxing Profiles - [`profiles/30-toolchains/java.sb`](https://github.com/eugene1g/agent-safehouse/blob/v0.3.1/profiles/30-toolchains/java.sb): Split system and user Java grants so globally installed runtimes are read-only while per-user Java state stays writable. ## [0.3.0] - 2026-03-12 ### Features - New `--enable=xcode` integration: read-only access to Xcode developer roots, app bundles, and Command Line Tools; read/write access to per-user DerivedData, CoreSimulator, XCTestDevices, and CoreDevice state; CoreSimulator and CoreDevice mach service lookups. Enables `xcodebuild`, `simctl`, and `devicectl` under the sandbox. - `SDKROOT` is now preserved in the default sanitized environment, so Xcode SDK-backed compilation works without `--env`. - Added `safehouse update [--head]` subcommand for standalone installs to self-update from GitHub release assets or the latest `main` build. ### Bug Fixes - Node toolchain profile now includes `~/.cache/puppeteer` alongside Playwright and Cypress cache paths. ### Chores - Bumped NPM docs-site dependencies. - Refactored live-test denial patterns into shared infrastructure. ### Changed Sandboxing Profiles - [`profiles/55-integrations-optional/xcode.sb`](https://github.com/eugene1g/agent-safehouse/blob/v0.3.0/profiles/55-integrations-optional/xcode.sb): New profile granting Xcode developer roots plus scoped per-user build and simulator state. - [`profiles/30-toolchains/node.sb`](https://github.com/eugene1g/agent-safehouse/blob/v0.3.0/profiles/30-toolchains/node.sb): Added Puppeteer cache path (`~/.cache/puppeteer`). ## [0.1.0] - 2026-03-11 ### Upgrade Notes - First tagged release.