Haruno Knowledge base

Sandbox

Haruno works in an isolated space, so a task cannot reach beyond the folders it was given. It is always on, and the first launch downloads it.

  • Mac appAvailableAlways on. There is no setting to turn it off.
  • Windows appAvailableAlways on, in both views. There is no setting to turn it off.

Haruno works in an isolated space, so a task cannot reach beyond the folders it was given.

On the Mac this is always on, in both the normal and the advanced view. There is no setting that turns it off. Chats and scheduled tasks all run in it.

What a chat can reach

  • The folder the chat works in. That is its project's folder, or its own folder if it is not in a project. Haruno can read and write there.
  • Files and folders you attach to a message, and what you linked to the project as sources.
  • For a chat that is not in a project, your books. Haruno can read them, but not change them. It may change a company's mapping when you ask it to.
  • A short list of websites. By default that is the Haruno service and a few common sites for software packages. For any other site Haruno stops and asks you first. You can add sites for good in Settings ▸ Advanced.

Nothing else on the Mac is reachable.

The first launch: a download

The isolated space is not part of the app download. After you install Haruno it downloads in the background. It is a large file, more than a gigabyte, and it is unpacked on your Mac, so it needs several gigabytes of free space. The app shows the exact figures.

While it downloads, a block called Secure sandbox sits at the bottom of the sidebar, above your account. It shows a progress bar and a percentage. Under it you read one short line:

LineWhat is happening
Checking…Haruno is looking at what is already on the Mac
Waiting for the networkThere is no connection. It starts again by itself when you are back online
How much has arrived, and the totalThe download is under way
Unpacking…The download is being unpacked
Verifying…Haruno is checking the files are the right ones

When it is done the block disappears. If you hide the sidebar, the same notice shows above the message box in Chat.

Until it is ready, chats cannot send

You can type a message while the isolated space is being prepared. You cannot send it yet. Point at the Send button and it says: Please wait, the secure sandbox is still being prepared. Keep typing if you like; you can send as soon as it is ready. A chat is never started without the isolated space.

A new version of the app can bring a newer isolated space. It downloads the same way after the update.

If it stops

The block shows a warning and a sentence that says what to do:

  • Not enough disk space: it says how much is needed and how much the Mac has. Free some space and it tries again by itself.
  • Not published yet: The secure sandbox image for this version isn't available yet. Haruno will keep checking.
  • The download did not match what the app expects, so it was not installed. Try again with Retry.
  • This build can't install its secure sandbox. Install the latest Haruno app.

When trying again could help, a Retry button is in the block. In the advanced view the same status and Retry are in Settings ▸ Advanced ▸ Security.

If a chat cannot start the isolated space, it is blocked with a message. It never runs without it.

Good to know

Older versions had a switch

Earlier versions let the advanced view turn the isolated space off. That switch is gone. A person who had turned it off sees one notice in Settings ▸ Advanced ▸ Security, once.

What to tell a customer: Haruno does its work in an isolated space on their Mac. It can only see the folders it was given, and it asks before it reaches out to a new website. The first time, a large download has to finish before the first message can be sent. The Mac needs a network connection and enough free space for that.

Last updated · PR #2944 · View this version on GitHub

History (1 version)
  1. Internal knowledge base for staff: site, reader keys, assistant, 197 pages and the PR rule (#2944)
    PR #2944Commit a2a7836The page at this version
    What changed
    @@ -0,0 +1,67 @@
+---
+title: Sandbox
+summary: Haruno works in an isolated space, so a task cannot reach beyond the folders it was given. It is always on, and the first launch downloads it.
+feature: sandbox
+covers:
+  - apple/Sources/EngineSupport/GuestImagePhase.swift
+  - apple/Sources/ChatUI/GuestImageSidebarStatus.swift
+  - apple/Sources/ChatUI/GuestImagePreparingBanner.swift
+  - apple/Sources/VMHost/**
+  - apple/docs/release.md
+---
+
+Haruno works in an isolated space, so a task cannot reach beyond the folders it was given.
+
+On the Mac this is always on, in both the normal and the advanced view. There is no setting that turns it off. Chats and scheduled tasks all run in it.
+
+## What a chat can reach
+
+- The folder the chat works in. That is its project's folder, or its own folder if it is not in a project. Haruno can read and write there.
+- Files and folders you attach to a message, and what you linked to the project as sources.
+- For a chat that is not in a project, your books. Haruno can read them, but not change them. It may change a company's mapping when you ask it to.
+- A short list of websites. By default that is the Haruno service and a few common sites for software packages. For any other site Haruno stops and asks you first. You can add sites for good in [Settings ▸ Advanced](/macos/app/settings-advanced/).
+
+Nothing else on the Mac is reachable.
+
+## The first launch: a download
+
+The isolated space is not part of the app download. After you install Haruno it downloads in the background. It is a large file, more than a gigabyte, and it is unpacked on your Mac, so it needs several gigabytes of free space. The app shows the exact figures.
+
+While it downloads, a block called <Ui>Secure sandbox</Ui> sits at the bottom of the sidebar, above your account. It shows a progress bar and a percentage. Under it you read one short line:
+
+| Line | What is happening |
+|---|---|
+| Checking… | Haruno is looking at what is already on the Mac |
+| Waiting for the network | There is no connection. It starts again by itself when you are back online |
+| How much has arrived, and the total | The download is under way |
+| Unpacking… | The download is being unpacked |
+| Verifying… | Haruno is checking the files are the right ones |
+
+When it is done the block disappears. If you hide the sidebar, the same notice shows above the message box in Chat.
+
+<Callout variant="warning" title="Until it is ready, chats cannot send">
+You can type a message while the isolated space is being prepared. You cannot send it yet. Point at the Send button and it says: <Ui>Please wait, the secure sandbox is still being prepared. Keep typing if you like; you can send as soon as it is ready.</Ui> A chat is never started without the isolated space.
+</Callout>
+
+A new version of the app can bring a newer isolated space. It downloads the same way after the update.
+
+## If it stops
+
+The block shows a warning and a sentence that says what to do:
+
+- Not enough disk space: it says how much is needed and how much the Mac has. Free some space and it tries again by itself.
+- Not published yet: <Ui>The secure sandbox image for this version isn't available yet. Haruno will keep checking.</Ui>
+- The download did not match what the app expects, so it was not installed. Try again with <Ui>Retry</Ui>.
+- <Ui>This build can't install its secure sandbox. Install the latest Haruno app.</Ui>
+
+When trying again could help, a <Ui>Retry</Ui> button is in the block. In the advanced view the same status and <Ui>Retry</Ui> are in <Ui>Settings ▸ Advanced ▸ Security</Ui>.
+
+If a chat cannot start the isolated space, it is blocked with a message. It never runs without it.
+
+## Good to know
+
+<Callout variant="info" title="Older versions had a switch">
+Earlier versions let the advanced view turn the isolated space off. That switch is gone. A person who had turned it off sees one notice in <Ui>Settings ▸ Advanced ▸ Security</Ui>, once.
+</Callout>
+
+What to tell a customer: Haruno does its work in an isolated space on their Mac. It can only see the folders it was given, and it asks before it reaches out to a new website. The first time, a large download has to finish before the first message can be sent. The Mac needs a network connection and enough free space for that.