I made a UI for this to run terminal apps, like claude and codex: https://multitui.com
Which terminal do you embed?
SwiftTerm, for not. I may switch to ghostty when their library is ready for embedding.
macOS's Little-Known Command-Line Sandboxing Tool (2025)
91–96 of 96 posts
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#92I made a UI for this to run terminal apps, like claude and codex: https://multitui.com
I’m impressed really neat work! Why did you opt for closed source? edit: I don’t have a problem with closed source, but when software is expected to be accountable for my security I get a little paranoid, so was curious about the safety and guarantees here. The UX and everything else looks great
Yeah, that’s understandable. Many open source macOS-only apps seem to get abandoned, so I’m trying to build something sustainable.
It uses only 3 dependencies that are very well known and widely used, so supply chain risk is minimal. That leaves me, the developer, as the main point of trust.
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#93I went down the sandbox-exec rabbit hole recently trying to get a “safe shell” for poking at random GitHub projects. I eventually realized I was solving the wrong problem. For development you usually don’t need a kernel policy language - you mostly want: 1. builds not trashing your real $HOME 2. no dotfiles/config pollution 3. some basic separation if a project does something dumb A much simpler (and more reliable) a…
> clone repos into ~/projects Cloning them there means leaving access to your SSH keys, right?
No, I don’t think so?
The .git folder will likely contain the URL to the repo, but not any credentials.
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#94Earlier quoted context omitted.
Does this mean you tried to ship an App in the Apple App Store but could not because of some restriction?
Why would it mean that?
I took the "granularity doesn't cut it" comment to mean there aren't enough entitlements to eliminate the need for custom SBPL. Followed by a sentence about apps that have temporary exception SBPL. Combining the two seems to imply that if there were more entitlements the custom SBPL might not be necessary. In the followup you noted; the split in reasoning and evaluation is rough and potentially not needed. I read this as a conclusion of wanting to do something, but could not as there were not enough entitlements to make it work, so custom SBPL would be necessary.
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#95Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#96Earlier quoted context omitted.
SwiftTerm, for not. I may switch to ghostty when their library is ready for embedding.
have you find a way to make claude emit the OSC hyperlink escapes when using SwiftTerm?
No, I run a separate URL detection to make links clickable. However, SwiftTerm just added link detection a few days ago and I haven’t had time to look into theirs yet.