Security and Trust Boundaries

Forge is local-first, but local software can still execute dangerous commands, inherit credentials, or destroy work. Security here means making the boundaries explicit and hard to bypass accidentally.

Electron

Renderer:

• nodeIntegration: false;
• contextIsolation: true;
• sandbox enabled where supported;
• narrow preload surface;
• no generic “execute shell command” bridge;
• validate navigation/external-link behavior.

Electron main owns OS integration and the core lifecycle, not business rules.

ProcessRunner

All managed process launching goes through one infrastructure boundary using executable + argument array, cwd, controlled environment, cancellation, deadlines, and output handling.

Avoid shell-string concatenation when direct argv execution works.

This boundary is where we centralize:

• environment isolation;
• PATH resolution;
• process groups/signals;
• timeouts;
• output limits;
• logging/redaction;
• secret/environment allow/deny rules.

Project trust

Opening a repository is not the same as trusting repository-defined scripts.

Initial model:

UNTRUSTED → TRUSTED

Before Forge first executes project-defined setup/verification/dev commands, the user should understand that local code will run.

Agent configuration boundary

Forge may configure one invocation using flags, environment variables, registered tools/MCP definitions, or provider-supported runtime controls. It does not secretly write user-global or repository agent configuration files.

When isolation from ambient configuration is required for a guarantee, the adapter should actively isolate/verify rather than simply refraining from adding new config.

Host gating versus involvement

Conversational autonomy is not permission autonomy.

Delegate can mean “do not interrupt me for normal engineering choices” while host gating can still stop destructive or policy-disallowed tool calls.

Classify tools by capability class (read, write, exec) or another stable semantic scheme rather than provider-specific tool names.

Unknown enforcement state fails closed when acting could violate an important safety invariant.

Decisions

Agent safety statements are claims, not enforcement. Destructive-action decisions never auto-resolve by deadline/default.

Data

• Raw logs may contain code, prompts, and provider output. Store them under Forge data directories with normal local-user permissions.
• Avoid duplicating provider credentials into Forge unless a future feature truly requires it.
• Logs and diagnostics should redact known secrets where possible, but redaction is not a substitute for proper access boundaries.