mirror of
https://github.com/storytold/effectcraft.git
synced 2026-10-30 13:08:07 -06:00
Anubhav RaiandClaude Opus 5
2d6e790fde
`script.run` and the Scripts menu are refused while file access is confined, but a ScriptUI panel's script was not: `window.scriptPanel` runs it to build the panel, `window.restoreScriptPanels` runs every remembered one, `scriptui.click` / `set` / `mouse` / `close` dispatch events to its handlers, and `script.runTasks` runs its `app.scheduleTask` tasks. A script reads and writes files and reaches the network, so none of that may start while confined. `prefs.set` is refused for the `scripting.*` settings for the same reason: the engine already stops a script from granting itself the access the user withheld (`Scripting::same_permissions`), and a confined agent writing it to the settings file would hand it to every script run afterwards, long after the session. `prefs.get` and the read-only `scriptui.list` / `scriptui.get` are untouched. This is the "Running code" part of the F-11 audit; the other parts of #2131 are separate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>