AYVI

Security model

Careful handling. No false guarantees.

Safeguards reduce risk but guarantee neither correct AI output nor identical behavior in every target app.

Safeguards in the code

  • Public Accessibility APIs only; no private macOS APIs.
  • Selected text is marked as untrusted content in prompts. That reduces risk; it is no reliable prompt-injection defense.
  • API keys live in the macOS keychain instead of preferences.
  • No silent provider switches: “Only local models” blocks cloud providers; cloud providers are disclosed before the first request.
  • Screen OCR, lens markers, voice input, the Java learning path and the compile check are off by default.
  • The Services menu entry is send-only (no return types) and produces a read-only selection; it can never modify the other app.
  • AYVI executes neither AI-generated nor selected code. Optional compile check instead of execution: with “Check compilation” enabled in the settings (default: off), AYVI runs javac -proc:none, swiftc -typecheck or python3 -I -S -m py_compile only after your click, without a shell, with a cleaned environment, a time limit, an output cap and its own temporary folder that is deleted afterwards. Only syntax and types are checked; the code itself is never run. Compiles does not mean correct. Real execution stays blocked until a supported isolation exists.
  • Selection and full prompts are not written to diagnostic logs. The conversation archive is encrypted with ChaCha20-Poly1305; that does not protect against malware running as the same user on an unlocked Mac.
  • No telemetry or analytics in the app or the website.

Every replacement needs a fresh target check

Before writing, AYVI checks that the original app and Accessibility element still match and that selected text, fingerprint and range are unchanged. An app switch or stale selection aborts. The result stays copyable and a fresh capture can be offered. Normal actions show a visible diff and wait for explicit confirmation; Direct Improve is the single exception you trigger deliberately, and revalidation stays mandatory there too. The clipboard is used only after a separate visible consent.

AI output is a suggestion

A diff shows differences; it does not prove that code is correct, secure or suitable for your project. Check effects, tests and assumptions yourself, especially for shell commands, database changes, authentication, encryption and production systems. AYVI does not run suggested commands.

Known limits

  • Apps expose different Accessibility data. Ranges or editability can be missing; models have finite context windows.
  • Token estimates are approximations. Chunked processing can lose relationships between parts.
  • Clipboard paste behaves differently per app; real app testing matters.
  • Undo is a session-based LIFO history in memory, not a permanent restore.
  • The local secret scanner is heuristic; there has been no external security review.
  • Mock and fake-editor tests and compiled code do not prove the behavior of a real editor or provider.
  • The development build is ad-hoc or locally signed and not notarized. scripts/release.sh (Developer ID, hardened runtime, notarization) is prepared but has not been run.

Detailed source context: SECURITY_MODEL.md (in the repository).