Haruno Knowledge base

Sending things outside

A command that sends data off the PC always shows a card first, with only Allow once and Deny. A scheduled task or hook with nobody present is refused instead.

  • Mac appAvailablesince 1.3.61
  • Windows appAvailable

When a command would send data off your PC, Haruno stops and asks first. This is the one kind of action that even Auto mode does not decide on its own.

What counts as a send

Haruno recognizes these from the command itself:

  • uploading a file or posting data to a website;
  • copying files to another computer;
  • opening a remote connection to another computer;
  • pushing code with git;
  • changing something on GitHub from the command line.

A plain download is not a send. Fetching from a repository, for example, does not stop for this card.

What you see

The card for a send. There is no Allow for this session button.
An approval card for a command. It says This command sends data off your computer, has a Details line, and offers two buttons: Allow once and Deny.An approval card for a command. It says This command sends data off your computer, has a Details line, and offers two buttons: Allow once and Deny.

The card says This command sends data off your computer. Open Details to read the command. You can choose:

  • Allow once, which lets this one command go ahead;
  • Deny, which refuses it.

There is no Allow for this session on this card. One approval for an upload must not quietly cover every later upload.

In Auto mode the card can also show a short reason. In the other modes that ask, you see only the line above.

Connector messages

A connector that sends something for you, such as an email, asks in the same way, and a remembered approval is narrow. Allow for this session covers the same recipients again, not the whole account. A message to someone else asks again.

A card for a connector message can carry a warning. This message seems to contain a password, key or other secret. Check it before you allow the send. When the message has attachments, a line says The attachments are not checked for secrets yet.

Bypass

In Bypass, Haruno asks nothing, so a send goes ahead with no card. That is a choice the customer makes for a chat they are watching. See Approvals and permission modes.

When nobody is there

A scheduled task, a hook or another run without a person cannot answer a card, so a send is refused.

  • The run ends as Failed, and says: This run tried to send data off this machine, and an unattended run can't do that without someone approving it, so the send was blocked. To let it send, run the same request in a chat and approve the send there.
  • A hook gets the same sentence as its error.
  • These runs never use Bypass. The scheduled task editor says so in the advanced view: Scheduled runs never use Bypass. They ask before sending data off this computer, and refuse when nobody is there.
What to tell a customer

If a scheduled task fails because it tried to send something, there is no setting to allow it. Run the same request once in a chat and approve the send there.

If a chat will not start

Haruno checks that a chat will ask before it sends data. If it cannot confirm that, the chat does not start. You may see This chat could not start because Haruno could not confirm it would ask before running commands. Try again. Or you may see that a settings file, in the chat's folder or in your own Haruno settings, puts it in Bypass, which you did not choose. Remove that setting, or choose Bypass yourself.

Last updated · PR #2944 · View this version on GitHub

History (1 version)
  1. Internal knowledge base for staff: site, reader keys, assistant, 197 pages and the PR rule (#2944)
    What changed
    @@ -0,0 +1,63 @@
    +---
    +title: Sending things outside
    +summary: A command that sends data off the PC always shows a card first, with only Allow once and Deny. A scheduled task or hook with nobody present is refused instead.
    +feature: outward-send
    +covers:
    +  - windows-client/docs/outward-send-permissions.md
    +  - windows-client/haruno-webview/web/e2e/chat-outward-send.spec.ts
    +  - windows-client/Haruno.Desktop.Services/UnattendedPermission.cs
    +  - windows-client/Haruno.Desktop.Services/UnattendedPermissionMode.cs
    +---
    +
    +When a command would send data off your PC, Haruno stops and asks first. This is the one kind of action that even Auto mode does not decide on its own.
    +
    +## What counts as a send
    +
    +Haruno recognizes these from the command itself:
    +
    +- uploading a file or posting data to a website;
    +- copying files to another computer;
    +- opening a remote connection to another computer;
    +- pushing code with git;
    +- changing something on GitHub from the command line.
    +
    +A plain download is not a send. Fetching from a repository, for example, does not stop for this card.
    +
    +## What you see
    +
    +<Shot src="/m/2c0de1a46b56-windows-safety-send-card-light.png" dark="/m/6712621535b4-windows-safety-send-card-dark.png" alt="An approval card for a command. It says This command sends data off your computer, has a Details line, and offers two buttons: Allow once and Deny." caption="The card for a send. There is no Allow for this session button." />
    +
    +The card says **This command sends data off your computer**. Open **Details** to read the command. You can choose:
    +
    +- <Ui>Allow once</Ui>, which lets this one command go ahead;
    +- <Ui>Deny</Ui>, which refuses it.
    +
    +There is no **Allow for this session** on this card. One approval for an upload must not quietly cover every later upload.
    +
    +In Auto mode the card can also show a short reason. In the other modes that ask, you see only the line above.
    +
    +## Connector messages
    +
    +A connector that sends something for you, such as an email, asks in the same way, and a remembered approval is narrow. **Allow for this session** covers the same recipients again, not the whole account. A message to someone else asks again.
    +
    +A card for a connector message can carry a warning. **This message seems to contain a password, key or other secret. Check it before you allow the send.** When the message has attachments, a line says **The attachments are not checked for secrets yet.**
    +
    +## Bypass
    +
    +In Bypass, Haruno asks nothing, so a send goes ahead with no card. That is a choice the customer makes for a chat they are watching. See [Approvals and permission modes](/windows/safety/approvals-and-permission-modes/).
    +
    +## When nobody is there
    +
    +A scheduled task, a hook or another run without a person cannot answer a card, so a send is refused.
    +
    +- The run ends as **Failed**, and says: **This run tried to send data off this machine, and an unattended run can't do that without someone approving it, so the send was blocked. To let it send, run the same request in a chat and approve the send there.**
    +- A hook gets the same sentence as its error.
    +- These runs never use Bypass. The scheduled task editor says so in the advanced view: **Scheduled runs never use Bypass. They ask before sending data off this computer, and refuse when nobody is there.**
    +
    +<Callout variant="tip" title="What to tell a customer">
    +If a scheduled task fails because it tried to send something, there is no setting to allow it. Run the same request once in a chat and approve the send there.
    +</Callout>
    +
    +<Callout variant="info" title="If a chat will not start">
    +Haruno checks that a chat will ask before it sends data. If it cannot confirm that, the chat does not start. You may see **This chat could not start because Haruno could not confirm it would ask before running commands. Try again.** Or you may see that a settings file, in the chat's folder or in your own Haruno settings, puts it in Bypass, which you did not choose. Remove that setting, or choose Bypass yourself.
    +</Callout>