Saelyx works in your Mac's terminal when you say so out loud. You say "show me the pods that are crashing in production", and a moment later the command is running.
Everyone who has spent years in a terminal asks the same question when they hear that, and they ask it with a wince: what if it gets it wrong? This article is that answer.
01First: it doesn't run it to find out what it is
Before touching anything, a classifier reads the text of the command and decides which zone it falls into. It doesn't execute it to find out, and it doesn't consult the terminal's state or the directory you're in: it reasons over the text.
That sounds obvious and isn't. The comfortable alternative —run it and see—
is exactly what you cannot do with an rm.
02The four zones
- Read only. Looking at logs, listing, searching, comparing. Goes straight through, no asking. It is most of a working day.
- Mutates something. Anything that changes state. Asks for confirmation.
-
Destructive but legitimate. Things you do on purpose that really do
delete —the example written in the code itself is
terraform destroy. Wanting to do it isn't the mistake; doing it by accident is. -
Denied. Never by voice.
sudo,dd, a fork bomb.
03The three modes, and who picks them
You pick the mode on the Mac —not from the phone, which is where it would be easiest to change it without noticing:
- Always ask. The one that ships. Everything that mutates asks first.
- Planning. Reads go straight through; to mutate, it shows you the plan and waits for a physical OK before typing anything.
- Hands free. Switched on deliberately, and while it is on there is a persistent amber indicator. You won't forget you left it running.
04The two things that never happen
These two are the ones that matter, because they are written as design guarantees rather than as accidental behaviour:
- Denied never runs, in any mode. Not hands free. Not with Touch ID. There is no combination of settings that lifts it.
- Destructive never auto-runs, hands free included. The permissive mode does not lift the destructive confirmation: that was the central point of the design, not a side effect.
Put another way: the most relaxed mode saves you the confirmations for what mutates, not the ones for what destroys.
05The rule we like most, and it is a stance
Written into the classifier, literally: when in doubt between "destructive" and "denied", choose denied.
That isn't a feature, it is a decision about which way to fall when you don't know. A system that leans towards running when in doubt is comfortable right up until the day it isn't.
06What we cannot tell you
This is where this article parts company with most. Everything above is read from the design and the declared guarantees. What we have not measured is how well the classifier does with real commands: its coverage.
So we can tell you it blocks sudo and dd, because that
is written down. We cannot tell you it blocks everything dangerous,
because we don't know what gets past it. When we measure it we will publish the number
here, however it comes out —the same way we did with
the audio marking, which came out
against us.
In the meantime, the honest recommendation: the mode that ships is the one that asks. Leave it there until you have its measure.
07Why this lives outside the store
An agent that runs things in your terminal needs permissions that are natural outside the system's sandbox and a negotiation inside it. It is one of the reasons the Mac app isn't in the Mac App Store, with what that gains and what it costs.
08Frequently asked questions
Can it run sudo?
No. sudo is in the denied zone, and denied never runs in any mode, Touch ID
included.
What if I say something destructive in hands-free mode?
Destructive never auto-runs, in any mode. Hands free saves you the confirmations for what mutates, not the ones for what destroys.
How do I know which mode I'm in?
The mode is chosen on the Mac. Hands free also leaves a persistent amber indicator while it is active.
Does it run the command to find out whether it is dangerous?
No. The classification is done by reading the text of the command, without executing it and without consulting the terminal's state.
Does it block everything dangerous?
We don't know and we are not going to claim it. It is written that it blocks
sudo and dd, and that when in doubt it chooses to deny. What we
have not measured is its real coverage with day-to-day commands. When we measure it, it
gets published.
Is it Mac only?
Yes, macOS 13 or later. And access is by invitation.