Security Model
bohay is a single-user, local-trust tool — like your shell. The boundary that matters is your OS user account.
The control socket
Section titled “The control socket”The sockets in ~/.bohay/ can spawn commands as you, so they’re protected the
way tmux protects its socket: the state directory is forced to mode 0700
and each socket to 0600 at every start — never left to the umask.
What runs commands, and when
Section titled “What runs commands, and when”- Panes run what you type — bohay adds nothing.
- Modules: installing shows every declared command and requires your confirmation before anything executes; builds run with a scrubbed environment; manifests can’t change silently post-install; uninstall only deletes bohay-managed paths.
- Integration hooks write a single small script and one settings entry in the agent’s config; uninstall removes exactly those and nothing else.
- Git-tab actions validate refs before anything reaches your shell — a hostile branch name from a cloned repo can’t smuggle shell metacharacters.
- Orchestration workers start only on your explicit action, and merges happen in an isolated worktree — never your checkout.
Remote
Section titled “Remote”--remote rides plain ssh — your keys, your config, no bohay network
listener of any kind. The website and binary phone nothing home; there is no
telemetry.
Found something? Please use
private reporting
— see SECURITY.md.