fix(desktop): use the mock keychain in the development sandbox - #39
Merged
Conversation
The sandbox redirects HOME, and macOS resolves the default keychain from HOME, so safeStorage could not store its key. securityd raised a modal on every launch and the app then ran with no credential store and no projection cache. Start the sandboxed app with Chromium's mock keychain on macOS so those paths stay exercised.
5 tasks
wolfiesch
marked this pull request as draft
July 25, 2026 08:12
wolfiesch
marked this pull request as ready for review
July 25, 2026 08:12
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2cb13c7967
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
pnpm dogfood:mac launches the packaged app with sandboxEnvironment, so it runs with the same redirected HOME and inherits the mock keychain. The previous note implied a packaged build verifies real keychain behavior, which only holds for a launch outside any sandbox.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
main.tsnow routes sandbox startup through one helper,applyDevelopmentSandbox, which keeps the existinguserDataredirect and additionally appends Chromium's--use-mock-keychainon macOS.Why
The development sandbox redirects
HOME, and macOS resolves the default keychain from$HOME. The sandbox home has no keychain, so ElectronsafeStoragecannot store its<product> Keyitem and securityd raises a modal on every launch:The modal is the visible half. After dismissing it,
safeStorage.isEncryptionAvailable()is false, solifecycle.tsskipsDeviceCredentialStoreentirely andstores.tsreports the projection cache as unavailable. Every sandbox session was therefore dogfooding the degraded path, with pairing credentials and projection cache persistence silently absent.Evidence for the cause:
HOME=$(mktemp -d) security default-keychainfails withSecKeychainCopyDefault: A default keychain could not be found., so keychain resolution follows the redirectedHOME.Electronfor an unpackaged run, andsecurity find-generic-password -l "Electron Key"finds no such item in the login keychain: the key was never stored.Testing
HOME: with the switch appended at module scope,isEncryptionAvailable()is true andencryptString/decryptStringround trips; without it, false.dist-electron/main.cjslaunched with realT4_DEV_SANDBOXandT4_DEV_SANDBOX_ROOT: the app reaches window creation and writesdevice-credentials.jsonandprojection-cache.jsonunder the sandbox user data, which is only reachable when encryption is available.@t4-code/desktop: 195 pass, including three new cases covering macOS, non-macOS, and no sandbox.tsgo --noEmitandvp lint --deny-warningsclean.Scope
Development sandbox only, gated on
developmentSandboxServiceConfig(). Plainpnpm dev, packaged builds, and non-macOS platforms are unchanged; the switch is a macOS-only Chromium switch. Sandbox ciphertext is mock-key material and is not portable to a real login keychain, whichdocs/DEVELOPMENT.mdnow states alongside the instruction to verify real keychain behavior with a packaged build.