u/outcoldman

https://loshadki.app/openin4/#example-how-the-author-of-openin-uses-openin

Yes. Rules are important, and their order. Create two rules. One default, no conditions, just one app. Second all apps, condition when Cmd is pressed. OpenIn executes rules in order. So if Cmd is before default, and Cmd is not pressed - it goes to the next rule. Next rule does not have any conditions, so it just sends the link to one selected app.

It bothers me as well. Obviously things look different on normal screens/monitors. But we froze the release 2 weeks ago. And noticed that only when started to make screenshots. It is on the roadmap for the next patch release.

I just got it, and I’m restoring it from the backup. My spouse is an Android user, and she used a Flip since probably Gen 1 and now a Samsung Fold of a similar size as a Duo. So I used to want one for a while now.

A few things I dislike, very Apple-like.

First. Redesign to the right of the status bar, just because they decided to make the phone with very rounded corners, probably came from the same design team who invented macOS 26. Samsung just kept everything rectangular, and it is much easier to use, and way more familiar. I am not sure if it is going to annoy me that status icons are on the right, but really annoying is that the screen of the app is not centered.

Second is... It is so Magic Mouse-like. The USB-C is on the side that you are going to fold. Samsung again - figured it out. I don't use cables that much, only because I restore the phone right now I have noticed how annoying this is. Mostly I charge the phones over MagSafe stands, so don't think I will ever notice that again. But if you have a cable connected and try to fold the phone, it is so weird and uncomfortable.

But anyway, I love it. Cannot wait to play with it. Again, I have been seeing how my wife loves her Samsung one.

And also. I still remember a time, when having the best possible phone used to be a few hundred bucks. And just a little below a grand. And for the past few years, just a little below a few grands. Now it is 3 grand. Yes, I got the 2TB version.

Thanks! That helps, I think I have some ideas for the OpenIn 4.6 to address those

No worries, but thank you for reminding me about Slack workspaces, I think I zoomed out this request. Added to my backlog to research.

No, the commands do not need list_storage_passwords, and the roles we ship (aws_search_user and aws_search_admin) do not have it. Giving it to every searcher would mean they can read every secret in the store in clear text, so we built it differently.

The search commands never read storage/passwords themselves. They call two REST endpoints of the app, which check run_aws_search and then read the secret with the system token. The handler decides what the caller can get, based on the authenticated Splunk user:

• assume_role account: the search head assumes the role, the search gets only a temporary STS session. Base key and external id never leave the search head. Session name is os_aws_search@<splunk user>, so CloudTrail shows who ran it, and every issued session is logged in _internal (index=_internal "aws_search audit:" event=session). A user can still take that temporary session out of their running search, but it expires.
• instance_role: nothing leaves the search process.
• per-user credentials: the secret name is bound to the user, and the handler checks it against the session user, so you can resolve only your own.
• static keys: here I want to be honest. The key is returned only to a running search job owned by the caller, so a simple | rest does not get it. But a custom command runs with the user's session key, so whatever the command can get, a determined user can get too. Treat a shared static key as readable by everybody who can query that account, and scope its IAM policy to read-only. For anything sensitive use assume_role or per-user credentials.

The app's entries in storage/passwords are admin-only and not exported to other apps.

Details: https://www.outcoldsolutions.com/docs/aws-search/access-control/

No, you are talking about the domain of the link, not the domain of the slack profile. Those are different things.

Thanks, that’s a great request. OpenIn remembers each app by its exact location, so when Photoshop 2025 becomes Photoshop 2026 the old entries point at an app that’s gone. The only fix right now is removing and re-adding it, which loses its place in your lists and rules.

I’m going to look into two things:

• when an app you’ve added disappears but a newer version of the same app is installed, OpenIn finds it and keeps using it, in the same place in your lists and rules
• a place in Settings that shows every app OpenIn uses and where, with a way to replace one app with another (or remove it) everywhere at once

One question that would help: when Photoshop (or GraphicConverter, ON1) updates to the new year, do you keep the old version installed for a while, or does the installer remove it?

Thank you for the warm comment!

Lol, yep, that is how I invented it to be used https://loshadki.app/blog/2023-08-23-openin-4-1/#browser-launcher-helper :D

And that is exactly how I use it as well.

In the Shortcuts app, create a shortcut with the “Open App” action and pick Browser Launcher (it is just an app under OpenIn /Applications/OpenIn.app/Contents/Helpers/Browser Launcher.app). Then in the shortcut’s details (ⓘ), choose “Add Keyboard Shortcut”.

Hey, we are working on exactly this. Last week we published our OS AI Agent app for Splunk on Splunkbase, it runs on Splunk Cloud and Splunk Enterprise. It has unattended runs: you attach the "Ask OS AI Agent" action to any alert, and the agent investigates it read-only, it cannot change anything in Splunk.

For the control part we built decisions. Per alert you write a closed list, like escalate: yes/no or severity: high/medium/low. The agent must pick from your list, and when the run finishes it writes one event to an index. Then your own alert acts on that event, with its own permissions and throttling, so you decide what goes to automation and what still goes to an analyst. Every run stays as a conversation with every search it ran, so the analyst can see why it decided that.

Docs: https://www.outcoldsolutions.com/docs/ai-agent/unattended/#decisions

e already have a list of improvements, including better handling of what you ask about. Happy to chat, have a call or give a demo. The app has a free tier, so you can try it yourself, or we can provide an evaluation license.

SplunkBase: https://splunkbase.splunk.com/app/9973

Fair concerns, and you're right: no model is immune to prompt injection, and we don't claim our app is. What we do is limit what an injected model can do:

• Every search uses your own Splunk session and roles, never a service account. It can't read an index you can't.
• Before it runs any SPL, the app has Splunk's own parser expand it (macros, saved searches, subsearches) and checks every command against Splunk's read-only commands. Anything that writes or sends data (collect, outputlookup, sendemail, sendalert, rest, script, add-on commands nobody allowed) needs you to approve the exact SPL first. Alert-triggered runs can't do it at all. Creating a dashboard or saved search waits for your approval too.
• The agent has no web or HTTP tool. Chat doesn't render images or forms (the usual markdown-image exfil), and a link does nothing until you click it. Your data does go to the model provider you configure, which is why you can point it at a local model (Ollama, vLLM) or your own Bedrock or Azure tenant.
• Search results reach the model wrapped as untrusted data. The app flags text that looks like an injection (ignore-your-instructions, fake transcript markers) on the tool card and in the audit log, and strips hidden Unicode before the model sees it.
• As we mentioned in docs - every turn, tool call, approval, refusal and config change is an event in _internal, with an Activity Trail dashboard: who asked, which model, what SPL ran, who approved it.

An injection can still steer what the model says, so treat its answers like a junior analyst's. It can't act beyond your permissions, write for you, or send your data anywhere except the model you chose.

We're also looking at adding a dedicated injection classifier, a model like Jev, to screen what the agent reads before the main model sees it. It would be optional, since it's one more service your data passes through, and it would be another layer, not a guarantee: classifiers can be fooled too.

even read only on some indexes opens doors to data exfiltration

True if you point it at a public cloud provider. With an in-house or local model, or something like AWS Bedrock in your own account, the data never leaves your environment, and the agent itself has no route out: no web or HTTP tool, no images rendered in chat, and anything that sends data needs your approval. On top of that, an admin can set default_approval_mode = approve_all, so every new conversation starts by pausing on every tool call, every search included, until you've reviewed it.

So it's more limited than it could be, on purpose: the last thing anyone needs is a Trojan horse inside their Splunk.

Fair question. Two things mainly.

It runs on your search head, Enterprise or Cloud, with any model you point it to, including local ones like Ollama or vLLM. Nothing goes to a Splunk-hosted service. Agent Launchpad is a Splunk Cloud service, on-prem gets it through Cloud Connect, and it does not support Ollama or custom endpoints today.

And it comes already knowing Splunk. It profiles data it has not seen, writes SPL and checks it against the reference, builds Dashboard Studio dashboards and alerts, and reads your macros, lookups and data models as you. Every write stops for your approval. Launchpad gives you a blank agent and MCP connections to Jira, Slack, PagerDuty etc, and you build the behavior. If that external part is what you need, Launchpad is the right tool, we don't do it.

The main reason we built it is that in Splunk Enterprise - there is no easy solution to use Splunk AI without a Splunk Cloud subscription, and using local models was not an easy task.

There were several OpenIn updates in 2 months, are there specific use cases you are referencing? Would be helpful to include a bit more detail on what the issues, or suggestions are.

Hide his license from the post, re-read it, and you may get what I am talking about.

Most A-licensed skydivers don’t even jump with audibles. The OP is already far ahead of the rest. Their feedback is as important as anybody else’s. My 2 cents.
Aria is a brand-new device, which is trying to compete in a new and already crowded space, so if there are any known issues, people should know about them.
I would not say that other companies will reply to your email right away, other than Vog - I feel like they are pretty active on Telegram or whatsapp, don’t remember for sure.
I owned Vog, DeepAndSteep and FDS one (not the latest, but one before I believe). I love speaking altimeters and do want every skydiver to have one. Also GPS one

Would grab the Vog for you, and pay for shipping. $200 + shipping

Oh man. I really hope they will bring that to desktop apps

That is exactly my setup. I looked in my emails - I have ordered Vog in January 2020, so I used it for close to 6 years. Probably 2200 jumps on it. Failed once, because I forgot to charge it, and at the altitude it told me that the battery was low.

I have tried a LOT of altimeters, used all of the GPS ones. Used Dekunu and AON X2 for a while, sold both of them. It was annoying to have another thing to charge. Deep And Steep Insight is a completely different beast. I used it since March 2025. So at this point ~500 jumps on it.

From the speaking ones, I have tried SonoAlti (I believe version 3 or similar), and was not impressed. I am sure v4 is way better now.

I bought DeepAndSteep Soundlink, because I really wanted to support DeepAndSteep as I love Insight, and I am so paranoid that my Vog is going to fail at some point (6 years is a good lifetime), so I use Soundlink as a sitter right now.

I would suggest ordering something local to you, as most of the manufacturers will help you to fix or resolve the issues.

Missing DeepAndSteep Soundlink.