Skip to content

snap: strict confinement with read-only personal-files plug - #978

Merged
iamtoruk merged 1 commit into
mainfrom
snap/strict-personal-files
Aug 12, 2026
Merged

snap: strict confinement with read-only personal-files plug#978
iamtoruk merged 1 commit into
mainfrom
snap/strict-personal-files

Conversation

@iamtoruk

Copy link
Copy Markdown
Member

Follow-up to #970 after Snapcraft forum feedback: no supported classic category fits, and strict is the well-trodden electron-builder path anyway.

  • confinement strict, single personal-files plug (ai-agent-session-logs), read-only, enumerating the 25 home dot-directories plus .config/.local subpaths the providers read
  • the app's own config and cache live in the snap's private area under strict, so no write access is requested
  • store side still needs an auto-connection request on the forum after first upload; until granted, users can connect manually with snap connect

Note: under strict confinement the snap cannot share ~/.cache/codeburn with a natively installed CLI; the snap is self-contained. That is the accepted trade for store distribution.

Classic has no fitting store category (per forum feedback) and strict is
electron-builder's well-supported path. One personal-files plug grants
read-only access to the dot-directories the supported tools write session
logs into; the app's own config and cache stay in the snap's private area.
@iamtoruk
iamtoruk merged commit 1d1ffae into main Aug 12, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant