th-a455be: SMOOTH_DEMO mode — host-safe daemon for the App Store reviewer demo - #577
Open
brentrager wants to merge 1 commit into
Open
th-a455be: SMOOTH_DEMO mode — host-safe daemon for the App Store reviewer demo#577brentrager wants to merge 1 commit into
brentrager wants to merge 1 commit into
Conversation
…viewer demo
Big Smooth iOS can't be reviewed without a paired Mac daemon ("Open Big Smooth
on your Mac"), so submitting it needs a safe hosted demo a review account
auto-connects to over the relay. But relay phones authenticate as the daemon
OWNER (full toolset, Bypass) — Plan mode and family RBAC don't gate them — and
the demo creds ship in the review notes, so env-only lockdown isn't airtight.
SMOOTH_DEMO=1 clamps every turn to a deny-by-default read-only allowlist
(DEMO_SAFE_TOOLS), applied LAST and unconditionally in tools_for, so a reviewer
gets chat + safe reads only (read_file/list_files/grep confined to
SMOOTH_WORKSPACE, web_search/crawl/knowledge_search/recall, datetime/weather,
create_artifact, cd/present_plan/todo_write) and never bash / write_file /
edit_file / th / create_skill / send_file / remember / calendar / reminders /
imessage / contacts / MCP / send_sidekick — regardless of auto-mode or principal.
Pair with SMOOTH_WORKSPACE (throwaway) + SMOOTH_EGRESS_ALLOWLIST.
Runbook: docs/Operations/App-Store-Reviewer-Demo.md (stand-up + verify + ASC
review-notes template). Test: demo_mode_clamps_to_the_safe_set_even_for_an_owner
_in_auto proves the clamp holds for an owner in Auto (the relay reviewer's exact
posture). Parent th-73e3bf.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HVAvzYG7unJjCD9c3B9j1f
🦋 Changeset detectedLatest commit: 822486b The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
brentrager
enabled auto-merge (squash)
September 9, 2026 19:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Big Smooth iOS is a client for the user's own daemon on their Mac — its empty state is "Open Big Smooth on your Mac", so an App Store reviewer can't exercise it without a paired daemon, and Apple rejects apps they can't fully test (Guideline 4.2/2.1). Submitting it needs a safe, always-on demo daemon a review account auto-connects to over the relay (zero pairing — a lone online daemon for the account is auto-selected).
The catch: relay phones authenticate as the daemon owner (full toolset, Bypass mode) — Plan mode and family RBAC don't gate them — and the demo creds ship in the review notes. So env-only lockdown (
SMOOTH_AUTO_MODE=deny) isn't airtight; it relies on tool classification.What
SMOOTH_DEMO=1→SandboxedToolProvider::tools_forclamps every turn to a deny-by-default allowlist (DEMO_SAFE_TOOLS), applied last and unconditionally, so nothing outside it reaches the model regardless of auto-mode or principal:read_file/list_files/grep(confined toSMOOTH_WORKSPACE),web_search,crawl,knowledge_search,recall,get_current_datetime,get_weather,create_artifact,cd,present_plan,todo_write.bash,write_file,edit_file,th,create_skill,send_file,remember, calendar / reminders / imessage / contacts, plugins, MCP,send_sidekick,notify.Pair with
SMOOTH_WORKSPACE(throwaway dir) +SMOOTH_EGRESS_ALLOWLIST=llm.smoo.ai,api.smoo.ai,auth.smoo.ai; run on Linux for a fourth layer (macOS personal tools compile out).Plus
docs/Operations/App-Store-Reviewer-Demo.md— stand-up steps, a misbehavior verification checklist, and an ASC review-notes template.Verification
demo_mode_clamps_to_the_safe_set_even_for_an_owner_in_autoproves the clamp holds for an owner in Auto — the relay reviewer's exact posture — dropping every dangerous tool and leaving only the allowlist. Existingplan_mode_filters…still green.cargo fmt/clippy -p smooai-smooth-daemonclean.Not in this PR (ops / your call)
APPLE_AUTHin prod (SIWA is built + Supabase-configured; it's a flag flip + provider verify — a live auth change, your call).Parent: th-73e3bf (Big Smooth iOS App Store submission).
🤖 Generated with Claude Code