allow_browser grants unscoped lsopen; scope it to http(s) URLs #251

--allow-browser emits an unscoped (allow lsopen) (src/sandbox_profile.rs:574-576), which hands any file or application to Launch Services. open -a Terminal /tmp/x.sh launches through launchd, outside the Seatbelt profile — so with this flag on, the sandbox is escapable by design rather than by defect.

The immediate correction is in flight: the flag is labelled Dangerous like allow_docker, its description says what it actually permits, and detect_cypress no longer proposes it automatically. That makes the danger visible but does not reduce it.

The flag's stated purpose is narrower than what it grants — opening a URL in the user's browser, typically for an OAuth flow. A shim would close the gap: intercept open and accept only http:// and https:// URLs, rejecting file paths and -a/-b application arguments. Roughly 50-100 lines, macOS only, and it would let the flag mean what its name says.

Worth checking before building it: whether any supported agent's OAuth flow needs to open something other than an http(s) URL, and whether lsopen is reachable through paths other than /usr/bin/open that the shim would not cover — a program calling LSOpenCFURLRef directly would bypass a PATH shim entirely, in which case the shim is a usability guard rather than a security boundary and should be described as such.