v0.11.1

Upgrade Notes

• No special notes.

Bug Fixes

• --enable=1password now unblocks the UNIX socket required for SSH-signing commits via op-ssh-sign.
• --enable=agent-browser now unblocks UNIX sockets needed to run Agent Browser.
• --enable=chromium-full now unblocks UNIX sockets needed to run Chromium. Chrome and Chrome for Testing were already unblocked.
• --enable=chromium-full now unblocks the -headless user-data-dir container that Chrome 151+ creates for --headless=new, which previously aborted with "Failed to create headless user data directory container." This also fixes --enable=agent-browser, which launches Chrome for Testing headless by default.
• --enable=chromium-headless now unblocks UNIX sockets, plists, and Crashpad needed to run Chrome,
  Chrome for Testing, and Chromium.
• --enable=docker now re-opens the Podman UNIX sockets (the system socket and the per-machine sockets) it previously left blocked, so docker/podman clients pointed at a Podman unix socket can connect() instead of failing with EPERM. Previously only the Docker sockets were re-opened even though the core deny profile blocked both Docker and Podman.
• --enable=ssh now unblocks the SSH_AUTH_SOCK socket on macOS Tahoe 26.4+. The pre-Tahoe location remains supported.
• --enable=vscode now unblocks certain UNIX sockets needed to avoid opening multiple copies of the VS Code process.
• The Claude desktop app's new Mach names are now granted by Safehouse.
• The Codex desktop app is now recognized when installed as ChatGPT.app, which is how current builds ship. Codex.app remains supported. Safehouse also now grants additional filesystem paths, Mach names, and UNIX sockets so that Codex launches successfully.

Chores

• macOS CI now runs a macos-26 + macos-15 matrix instead of macos-latest, so Tahoe- and Sequoia-specific policy differences such as the relocated SSH agent socket are caught before release rather than after.

Thanks

• @d0ugal re-opening the Podman sockets under --enable=docker, including the test coverage that pins them against the identical strings in the deny block, in #145.
• @jburnham reporting that --enable=1password could no longer reach the SSH agent socket after UNIX-socket connects became deny-by-default in #139.
• @yngvark reporting that macOS Tahoe relocated SSH_AUTH_SOCK under /var/run, which --enable=ssh did not yet grant, in #138.

Changed Sandboxing Profiles

• 10-system-runtime.sb: Extended the default deny for launchd per-user listener sockets to the Tahoe 26.4+ /private/var/run location, naming file-read-metadata explicitly so the deny outranks the general /private/var/run metadata allow in the same profile.
• container-runtime-default-deny.sb: Comment-only change clarifying that the network-outbound deny is defense-in-depth, since 20-network.sb never allows UNIX sockets in the first place.
• ssh-agent-default-deny.sb: Added the Tahoe 26.4+ /private/var/run listener socket patterns so SSH agent access stays opt-in on that OS version.
• 1password.sb: Allowed network-outbound connect to the 1Password SSH agent socket, which was readable but not connectable.
• agent-browser.sb: Allowed bind/listen/connect on the per-session daemon socket at ~/.agent-browser/<session>.sock, which previously failed with "Failed to bind socket: Operation not permitted".
• chromium-full.sb: Moved the ProcessSingleton and Crashpad grants down to chromium-headless.sb so all Chromium builds share them, and added the Chromium preferences plist.
• chromium-headless.sb: Added ProcessSingleton socket and Crashpad grants for Chrome, Chrome for Testing, and Chromium, plus the -headless user-data-dir container Chrome 151+ requires for --headless=new.
• docker.sb: Re-opened the Podman sockets (system, and ~/.local/share/containers / ~/.config/containers machine sockets) for both file access and network-outbound connect, symmetric with the deny rules in container-runtime-default-deny.sb.
• ssh.sb: Allowed the Tahoe 26.4+ SSH_AUTH_SOCK location for both file access and connect, matching the specificity of the default deny so the allow wins.
• claude-app.sb: Accepted the optional team-ID prefix on the app's MachPortRendezvousServer names.
• codex-app.sb: Covered the ChatGPT.app bundle alongside Codex.app, added ~/.codex and ~/Library/Caches/Codex, the com.openai.codex.apps.* Mach names, and the ProcessSingleton socket needed at launch.
• vscode-app.sb: Allowed the sandboxed instance to receive CLI IPC and to hand off args between Safehouse-managed instances, while explicitly denying outbound connects to an unsandboxed VS Code's IPC socket and to the vscode-git credential socket, which cross a trust boundary.