macos-host-security

license	MIT
name	macos-host-security
description	Durable research for building a macOS host-safety layer that protects a dev box from any AI agent or downloaded executable running on it — the primitives, prior art, the read-only-vs-privileged trust map, and the no-keyword-NLP secret-detection method behind Port Daddy's `pd safe` ("the AI little sniffer", ADR-0088). Covers Endpoint Security Framework (ESF) + eslogger, Network Extension (NEFilterDataProvider/DNS/transparent proxy), pf forced egress, code-trust CLIs (codesign/spctl/xattr), libproc/nettop/lsof read-only inventory, TCC + Full Disk Access, structured-format + Shannon-entropy secret scanning, and Santa-fronted binary lockdown. Activate on: "macOS host security", "endpoint security framework", "eslogger", "ESF AUTH_EXEC", "NEFilterDataProvider", "network extension", "system extension entitlement", "pf forced egress", "codesign trust", "quarantine xattr", "Full Disk Access", "TCC", "secret scanner", "gitleaks rules", "Shannon entropy detection", "Santa binary lockdown", "pd safe", "AI sniffer", "confine agent on macOS", "block rogue executable". NOT for: the TypeScript daemon's coordination logic, generic Rust/borrow-checker help (use rust-with-claude-code), web/UI security (use agentic-zero-trust-security for crypto/ocap), or prompt-injection defense.
allowed-tools	Read,Write,Edit,Bash,Glob,Grep,WebSearch,WebFetch
metadata	{"category":"Security & Trust","tags":["macos-security","endpoint-security","eslogger","network-extension","system-extension","pf-firewall","codesign","tcc","secret-detection","shannon-entropy","santa","host-safety","pd-safe"],"pairs-with":[{"skill":"agentic-zero-trust-security","reason":"The cryptographic/ocap layer; this skill is the OS-primitive layer beneath it."},{"skill":"daemon-development","reason":"pd safe's read-only sensors run in the Port Daddy daemon."}]}

macOS Host Security — the pd safe research base

Durable record of the macOS host-safety research so future sessions don't re-research it. This is the OS-primitive foundation under pd safe (the AI little sniffer, ADR-0088). The product widens the Coast Guard (lib/coast-guard.ts, ADR-0050) from protect git push to protect the whole machine from any agent/executable.

The cardinal rule (read this first, every time)

Any tool you run as the operator's own UID, a same-UID agent can disable, unset, kill, or read around. Read-only sensors are genuine DETECTION and EVIDENCE — they catch runaway loops, accidental exfil, confused-deputy reads, a freshly-downloaded unsigned binary phoning home. They are NOT containment. Real containment needs an authority outside the agent's UID: a SIP-protected system extension (ESF or NE) or a separate UID/VM + pf. Never market a same-UID watcher as a wall. lib/coast-guard.ts HONEST_LIMITS states this verbatim; echo it.

TCC trap: ~/.env/~/.aws/~/.ssh/~/.config/~/.npmrc are plain POSIX-readable by the same UID — TCC does not guard them. Full Disk Access guards ~/Library/Mail| Messages|Safari and other apps' containers, not the dotfiles that hold the crown jewels.

Read-only vs privileged map

Tier	Mechanism	Authority	What you get
READ-ONLY (today)	codesign/spctl/xattr/csrutil, libproc/ps/lsof/nettop/vm_stat, dotfile secret scan, persistence diff, log stream	none	DETECTION + EVIDENCE; defeatable by the watched process
READ-ONLY but elevated	eslogger/any ESF NOTIFY read	sudo + operator-granted Full Disk Access (NO Apple entitlement)