The macOS app now asks before editing your shell startup files.…#455
Merged
Conversation
…) (#2405) OK Desktop silently appended a managed block to ~/.zshrc / ~/.bash_profile / fish conf.d on first packaged launch. The rc-file append is now gated on explicit consent, folded into the existing first-launch "Add OpenKnowledge to your AI tools" dialog as a distinct pre-checked toggle — making that dialog's PATH disclosure truthful. - path-install.json gains an additive consent field (version stays 1); startup appends only on a recorded grant or grandfather evidence (healthy managed block on disk => stamped consented, no re-nag). - OK-owned steps (~/.ok/bin symlinks, ~/.ok/env.sh) stay eager; delete-the-block opt-outs and self-heal are preserved. - Confirm handler finalizes the PATH decision after editor writes and before the MCP marker, so a failed rc write defers the marker (same-boot retry, next-boot re-fire). - Built-in terminal prepends ~/.ok/bin in buildShellEnv, so declining only affects ok in external terminals; dialog warning is scoped to exactly that. - File-menu re-trigger renamed to "Set up OpenKnowledge integrations…". - Consent decisions emit path-install-consent-granted/-declined events. - Docs: what-open-knowledge-writes reflects the consent gate. Spec: specs/2026-07-02-shell-path-install-consent/SPEC.md GitOrigin-RevId: 0902459b1dd53bf87ea906b930c1a2e6bc03bd59
![inkeep-internal-ci[bot]](https://avatars.githubusercontent.com/u/123133689?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Automated approval from agents-private public-mirror-sync (run: https://github.com/inkeep/agents-private/actions/runs/28634201975). Source of truth is the monorepo; direct edits on inkeep/open-knowledge are overwritten on next sync.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The macOS app now asks before editing your shell startup files. Putting
okon yourPATHused to happen silently on first launch — a managed block appended to~/.zshrc/~/.bash_profile/ fish'sconf.d. That write is now a pre-checked "Add theokcommand to your terminal" toggle in the first-launch dialog, and nothing touches your shell config if you uncheck it. Declining only affectsoktyped in an external terminal: the app's built-in terminal now hasokavailable regardless, and MCP wiring and "Open with AI" launches never depended on it. Decisions are recorded inpath-install.json; machines that already have the managed block are treated as consented (no re-prompt, block left in place), deleting the block still opts out permanently, and a declined install can be re-run any time from File → Set up OpenKnowledge integrations… (the renamed "Configure AI tool integrations…" item).