fix: allow native SSH-signed commits in sandbox

[jonathanKingston]

Summary

• add an explicit, off-by-default macOS permission for Copse's native git_commit subprocess to reach the single Unix socket named by SSH_AUTH_SOCK
• preserve the existing filesystem and internet-deny sandbox, and replace path-configured SSH signing keys with an inline public identity so the private key and .ssh directory remain unreadable
• pin a one-line sandbox-runtime patch so the documented per-spawn allowUnixSockets override reaches the macOS seatbelt profile
• explain the Git-hook/agent capability boundary in Settings and the shell-permissions documentation

Closes copse-dev/agent-pane#2320.

The dependency patch can be removed after anthropics/sandbox-runtime#420 ships in a release.

Security boundary

The grant is macOS-only, requires explicit user consent, validates that SSH_AUTH_SOCK is an absolute normalized socket, and applies only to the native commit spawn. Network domains remain denied. Git hooks inherit the commit process and can ask ssh-agent to use any loaded key, so the UI recommends ssh-add -c.

Validation

• pnpm test -- git-commit-signing — 12 passed
• pnpm test — 8,555 passed
• pnpm run typecheck
• pnpm run lint
• pnpm run format:check
• pnpm run check:dead-code
• pnpm run check:oracle
• pnpm run check:e2e-syntax
• pnpm run demo:site:check
• pnpm run build
• pnpm install --frozen-lockfile --ignore-scripts
• focused Electron e2e: 2 passed
• git diff --check

Visual evidence

Co-Authored-By: Copse noreply@copse.dev
Copse-Models: acp:codex-acp#gpt-5.6-sol, acp:claude-acp#opus[1m]

[github-actions]

🖥️ PR preview

• Marketing site
• Browser demo
  Interactive, with a mocked backend — jump to a scenario:
• Builds a cupcake site
• Agent-proposed edits open the Changes panel
• Markdown list indentation
• Responsive composer footer
• Subagent display visual reference
• Subagent stays ungrouped beside reading tools
• Semantic search subagent markdown
• Light-theme approval with a bright accent
• Grouped outside-sandbox command approval
• Remote desktop discovered-port list with one selected
• Settings scroll + sticky footer geometry
• Per-model reasoning / temperature / top-p
• Thread switch hydration notice
• Thread switch hydration failure
• Chat layout styling
  _{Static demo of the renderer against a mock API — the browser pane, terminal, and all main-process IPC are stubbed, so it never proves main-process behaviour. Rebuilt whenever a push changes the demo bundle; these links go live once the queued deploy lands, shortly after this comment. Removed when the PR closes.}

[jonathanKingston]

I fixed the sole CI blocker in the branch history: gitleaks matched the intentionally fake private-key marker in the test fixture. Because the scan covers full history, I amended the single PR commit rather than adding a follow-up, then rebased onto current main and force-pushed 0263e6676.

Validation after the rebase: both focused signing test files pass, 12/12, under the pinned Node 24.20.0 runtime; git diff --check is clean; the literal secret signature is absent; and the focused Settings screenshot is readable with the default-off state and risk copy visible. CI is rerunning now.

[copse-release-bot]

Reference screenshots

CI run 34123700910 published no changed screenshot candidates for fbab1598081a.
Any review PR for an older source SHA has been closed.

[jonathanKingston]

Final rerun result on 0263e6676: the aggregate CI gate is green. Precheck (including gitleaks, typecheck, lint, formatting, dead code, API compatibility, and oracle), full check, build, sidecar/bridge, and all eight Electron E2E shards passed. The generated screenshot-candidate PR #2390 contains only unrelated baseline churn and should not be merged; the focused signing screenshot already on this source branch is the relevant visual evidence.