You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Three upcoming workstreams make architectural choices that either survive App Sandbox adoption or don't, and they land before any sandboxing discussion is scheduled:
WKWebView resource loading (Migrate from WebView to WKWebView #111): the preview must load local images/CSS referenced by documents (including out-of-tree paths like ../../images/foo.png). The two candidate designs — loadFileURL:allowingReadAccessToURL: scoping vs a custom WKURLSchemeHandler — have very different sandbox stories (security-scoped bookmarks vs handler-mediated reads).
Sparkle 2 re-enable (survey §4.5): Sparkle 2's XPC installer model is the sandbox-compatible path; choosing it (or not) changes the integration.
MPHomebrewSubprocessController (MacDown/Code/Utility/) spawns subprocesses — incompatible with the sandbox as-is.
The Quick Look extension is already sandboxed (see #367: entitlements, sandbox baseURL fixes), so the project has partial experience with the constraints.
The decision to make
Pick one, write it into docs/ (or CLAUDE.md), and treat it as an input to #111's design:
A. Never sandboxing (distribution stays direct-download + notarized). Simplest; forecloses Mac App Store distribution permanently. The scheme-handler design in Migrate from WebView to WKWebView #111 can then read the filesystem freely.
B. Sandbox eventually (keep MAS open as an option). Migrate from WebView to WKWebView #111's resource loading must then be designed around security-scoped access from day one, and the Homebrew/CLI-install feature needs a sandbox-compatible replacement or removal plan.
C. Sandbox now — almost certainly wrong mid-overhaul, listed for completeness.
No implementation work in this issue — the deliverable is a written, dated decision with rationale.
Why this is a v3000.0.9 decision
Three upcoming workstreams make architectural choices that either survive App Sandbox adoption or don't, and they land before any sandboxing discussion is scheduled:
../../images/foo.png). The two candidate designs —loadFileURL:allowingReadAccessToURL:scoping vs a customWKURLSchemeHandler— have very different sandbox stories (security-scoped bookmarks vs handler-mediated reads).MPHomebrewSubprocessController(MacDown/Code/Utility/) spawns subprocesses — incompatible with the sandbox as-is.The Quick Look extension is already sandboxed (see #367: entitlements, sandbox baseURL fixes), so the project has partial experience with the constraints.
The decision to make
Pick one, write it into
docs/(or CLAUDE.md), and treat it as an input to #111's design:No implementation work in this issue — the deliverable is a written, dated decision with rationale.
References
plans/dependency-overhaul-decisions.mdD-19 (branchclaude/dependencies-overhaul-planning-hw3lms)