Apple Safari

Host a copy with our keys and logs.

• APPLE_SAFARI_ALLOW_WRITES — Register the mutating tools. Off by default, and the gate decides whether the write tools exist at all rather than merely refusing — an agent with writes off cannot see them.
• APPLE_SAFARI_ALLOW_CODES — Return one-time codes: a one-time-code field in apple_safari_page_elements, and apple_safari_find_codes for a code a page shows as text. Its own gate rather than allowWrites, because it is a read. Credential fields stay redacted whatever this says.
• APPLE_SAFARI_ALLOW_NETWORK — Register apple_safari_network_record, _list and _get, which record what a page you allowed the extension on fetches and read the responses. Its own gate rather than allowWrites, because it is a read; off means the tools do not exist. Headers named like credentials are masked, bodies are not. Reloading a tab to record and saving a body to a file still need APPLE_SAFARI_ALLOW_WRITES.
• APPLE_SAFARI_ALLOW_COOKIES — Register apple_safari_cookies, which lists the cookies Safari would send to an open page, HttpOnly ones included, through the extension's cookies permission. Its own gate rather than allowWrites, because it is a read; off means the tool does not exist. Not enough on its own: only sites in APPLE_SAFARI_COOKIE_HOSTS are readable. Values never come back inline; saveAs writes named ones to a 0600 file and needs APPLE_SAFARI_ALLOW_WRITES.
• APPLE_SAFARI_COOKIE_HOSTS — Comma-separated registrable domains whose cookies apple_safari_cookies may read, like "yahoo.com"; each covers the domain and its subdomains. Empty, the default, means no site is readable. An entry with no dot is ignored.
• APPLE_SAFARI_DOWNLOAD_DIR — Where saveAs writes a file, for apple_safari_network_get and apple_safari_cookies. Defaults to ~/Downloads. A name is kept to its basename and an existing file is never replaced unless asked.
• APPLE_SAFARI_NETWORK_CHUNK_CHARS — Characters of a body the server asks the page for per command when it reads a large body. Defaults to 262144, which was measured to work; how far above that Safari's native-message channel goes is unmeasured.