add cline

sandbox/agent

@@ -57,6 +57,19 @@ case "$agent" in
   *) profile="$agent" ;;
 esac
 
+# Cline Desktop is a window, usually opened from the app menu in your home
+# directory, so it always starts in ~/Projects and can change projects there.
+# Its profile hides /run/user, where your session's D-Bus and keyring sockets
+# are, except the Wayland socket it draws through. The sandbox has no GPU, and
+# WebKit can't start its own sandbox (bubblewrap) inside this one.
+gui_socket=""
+case "$profile" in
+  cline-desktop)
+    mkdir -p "$HOME/Projects" && cd "$HOME/Projects" || exit 1
+    gui_socket="$XDG_RUNTIME_DIR/${WAYLAND_DISPLAY:-wayland-0}"
+    export GDK_BACKEND=wayland WEBKIT_DISABLE_DMABUF_RENDERER=1 WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 ;;
+esac
+
 srt="$(command -v srt || echo "$HOME/.local/bin/srt")"
 if [ ! -x "$srt" ]; then
   echo "The sandbox (srt) isn't installed; run update. To run $agent without it: unsandboxed $agent"
@@ -101,8 +114,9 @@ done
 
 # Outside the sandbox's writable paths, so the agent can't change its own rules
 settings="$SETTINGS_DIR/$agent.$$.json"
-if ! jq -s --arg domains "$COREDESKTOP_SANDBOX_DOMAINS" \
-    "$MERGE"' | .network.allowedDomains += ($domains | split(" ") | map(select(. != "")))' \
+if ! jq -s --arg domains "$COREDESKTOP_SANDBOX_DOMAINS" --arg socket "$gui_socket" \
+    "$MERGE"' | .network.allowedDomains += ($domains | split(" ") | map(select(. != "")))
+      | if $socket != "" then .filesystem.allowRead += [$socket] else . end' \
     "${configs[@]}" > "$settings"; then
   echo "Couldn't read the sandbox config: ${configs[*]}"
   exit 1