You'll notice
Useful3 Signal2
Changing sandbox binary paths now re-prompts for approval, like status line and hook commands already did.
What's wrong with this entry?
Anonymous. No account, no email.
bwrapPathsocatPath
What
The three sandbox binary paths in settings, bwrapPath, ripgrep and socatPath, are now treated as dangerous settings. Changing any of them invalidates your earlier approval and prompts again, the same as statusLine, processWrapper and hook commands already did.
Details
- The values are read out of the
sandboxsettings object and folded into the payload whose hash the consent check compares against, recorded assandbox.bwrapPathand so on. - Effect: a settings file edited by something other than you cannot silently repoint the sandbox helper binaries.
Evidence
bwrapPath
Strings lifted out of the shipped bundle, so the claim above can be checked against them.