Peter Steinberger
c881bbefa0
Audit findings behind the recurring 'CodexBar wants to use your confidential information stored in CodexBar Cache' dialogs: - The cache item is a legacy file-keychain item whose trusted-application ACL freezes at creation. A 'swift build' binary with no .app ancestor could create it trusting only its own ephemeral unsigned path, after which the packaged app prompts on every background cookie refresh. Unbundled processes now use a process-local in-memory cache and the ACL builder refuses bare dev binaries outright. - Test-process self-detection is name/env based and cannot cover spawned CLI child binaries. When a process decides keychain access is blocked it now exports CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS for children and disables legacy keychain interaction process-wide (SecKeychainSetUserInteractionAllowed(false)), the documented switch for the ACL dialog the per-query no-UI attributes cannot always prevent. - make test-tty ran swift test without the suppression flag; make test-live now opts into keychain access explicitly. - Test spawn sites for CLI binaries pass the suppression flag explicitly, and the prompt-safety audit test now also flags dlsym-resolved Security symbols so runtime-resolved calls cannot bypass the grep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
44 lines
890 B
Makefile
44 lines
890 B
Makefile
SHELL := /bin/bash
|
|
|
|
.PHONY: build check docs-list format lint release restart start start-debug start-release stop test test-live test-tty
|
|
|
|
start:
|
|
./Scripts/compile_and_run.sh
|
|
|
|
start-debug:
|
|
./Scripts/compile_and_run.sh
|
|
|
|
start-release:
|
|
./Scripts/package_app.sh release
|
|
pkill -x CodexBar || pkill -f CodexBar.app || true
|
|
cd /Users/steipete/Projects/codexbar && open -n /Users/steipete/Projects/codexbar/CodexBar.app
|
|
|
|
restart: start
|
|
|
|
stop:
|
|
pkill -x CodexBar || pkill -f CodexBar.app || true
|
|
|
|
check lint:
|
|
./Scripts/lint.sh lint
|
|
|
|
format:
|
|
./Scripts/lint.sh format
|
|
|
|
docs-list:
|
|
node Scripts/docs-list.mjs
|
|
|
|
build:
|
|
swift build
|
|
|
|
test:
|
|
./Scripts/test.sh
|
|
|
|
test-tty:
|
|
CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 swift test --filter TTYIntegrationTests
|
|
|
|
test-live:
|
|
LIVE_TEST=1 CODEXBAR_ALLOW_TEST_KEYCHAIN_ACCESS=1 swift test --filter LiveAccountTests
|
|
|
|
release:
|
|
./Scripts/package_app.sh release
|