Files
openworker/docs
Devika VermaandClaude Fable 5.1 3046f3d947 Settings > Sandbox: the app installs OpenShell itself where it can; one command where it cannot (OPE-207)
From a fresh-user run on WSL (2026-09-27): "Set up sandbox" handed over two
commands, gave no install instructions, and put a Copy button on notes
("found none") and file paths.

- steps carry `command` (run in a terminal, gets Copy) apart from `hint`
  (a note) and `docs` (a Guide link). `checks()` prints command or hint.
- `admin_prefix()`: `sudo -n` when this user may sudo without a password,
  else `pkexec` (the desktop's own password prompt) when there is a display
  and this is not WSL. The app never sees or holds a password.
- `install_openshell()`: NVIDIA's installer as the user on a Mac; on Linux
  under the admin prefix with `loginctl enable-linger` FIRST in the same
  run, because the installer starts the gateway through the user's systemd
  manager, which on WSL does not run until linger is on (it otherwise
  prints "could not reach the user systemd manager" and exits 0 without
  registering the gateway). The job streams its output as progress and it
  can be cancelled.
- No prefix (WSL): the openshell row hands over ONE command, linger + the
  installer, and the job stops until "Check again".
- `enable_linger()` tries the user, then the admin prefix, then hands over.
- Terminal `setup`: linger (sudo) before the installer; Guide URL printed.
- Page: "Run this in a terminal on this machine:" above a command; notes
  plain, no Copy; Guide links; install progress row; a fixable row shows
  its command only once the app could not do it.
- Wording: switch-off text says what it means ("directly on this machine,
  with the same access as your user account"); "stored in <path>" only
  while the switch is on; the credential editor explains itself with an
  npm example and placeholders; "needs download" hint points at the
  button, not a terminal command.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-27 23:59:06 +05:30
..