ScopeShelf 1.1.0 release notes

September 11, 2026 · Auf Deutsch lesen

1.1.0 is about the terminal. A terminal app cannot run inside the sandbox (macOS refuses the setuid program /usr/bin/login it starts its shell with), so ScopeShelf now sandboxes the shell inside your running terminal instead. Claude Code, Codex and everything else you start there inherits the launcher's rules.

What's new

• Start shell: a terminal launcher (iTerm, Terminal.app) gets a "Start shell" button instead of "Start". One click opens a new terminal window with a shell that runs in the launcher's sandbox profile. The first click asks which project folder the shell should work in; the answer is stored in the launcher.
• The working folder is the workspace: the shell starts there and may write there, even if the folder is not in the grants. Your home directory and blocked folders are refused.
• Your setup travels along: tick the startup files (.zshenv, .zshrc …), the files they load themselves, and the program folders from your PATH (~/.local/bin, ~/.bun/bin, ~/.cargo/bin …) that the sandbox should see. Everything is measured on your Mac, nothing is guessed.
• Own configuration and history: the sandboxed shell keeps its configuration directory and history under ~/Library/Application Support/ScopeShelf/shells/. Your real ~/.zsh_history stays untouched.
• scopeshelf shell <launcher> on the command line, with --cd, --shell, --env and --no-network; scopeshelf scope inside the shell shows what applies. .scopeshelf project files can set the shell's working folder for the whole team.
• Presets for iTerm and Terminal.app, and a quick-pick row of installed apps in the new-launcher dialog. Apple's Terminal lives in /System/Applications/Utilities; you no longer have to find it.
• Command line tool with one click: Settings → Command line tool links scopeshelf into ~/.local/bin, no admin rights.
• Help pages: Terminal, iTerm and the sandboxed shell explains every setting, every command and every error message.
• Terminal launchers no longer count as "running unprotected", the sidebar shows the real app icon, and scopeshelf doctor points at scopeshelf shell for terminal launchers.

1.1.1 (September 12): hardening against escape and shutdown

A process inside the sandbox must not be able to leave it or switch it off. 1.1.1 adds rules to every profile that a test script in the repository checks by actually trying each escape from inside a sandboxed shell:

• No writes outside your home directory except temp folders and explicit grants. Before, an agent could replace /opt/homebrew/bin/git and wait for your next unsandboxed git.
• No launching other apps via LaunchServices (open -a Terminal …): an app started that way would run unsandboxed. Links clicked inside a sandboxed app therefore no longer open your browser.
• Signals only within the sandbox: the ScopeShelf process holding the domain filter and your other apps cannot be killed from inside.
• The ssh-agent socket is blocked; loaded keys cannot be used from inside.
• ScopeShelf's own app bundle and launcher store are write-protected even inside a granted folder.

What the profile cannot block, and why, is on the help page: Apple events to other apps are gated by macOS's Automation permission, not by the sandbox.

1.1.2 (September 12): after the review

Two independent reviews (Codex gpt-6-astra, Kimi k3) plus our own escape attempts found what 1.1.1 still left open. A correction first: 1.1.1 claimed that ScopeShelf's own bundle and launcher store are write-protected. The rule existed, but no launch path passed it to the profile, so it was not active. 1.1.2 fixes that and adds:

• Protected folders can neither be renamed away from their rules nor edited through a hardlink placed in a writable folder; a grant inside the bundle or store no longer reopens it.
• Unsandboxed helpers of the same user cannot run commands for the sandbox: a screen server (reached through a FIFO in the shared temp folder, a real escape we reproduced), tmux, Neovim and Emacs servers, Docker and Shortcuts are blocked. Sandboxed shells get their own temp folder; tmux and screen started inside keep working.
• With the network off, the process cannot listen on a port either.
• A .scopeshelf file may only grant folders inside its project, so an agent editing it cannot widen its next sandbox.

The test script now runs 21 attempts, including killing the ScopeShelf process from outside; every claim and its evidence is listed in docs/sandbox-enforcement-map.md.

Download

ScopeShelf 1.1.2 runs on macOS 14 (Sonoma) or later; the DMG is notarized.

Download ScopeShelf-1.1.2.dmg

All 1.x updates are free. Pricing and trial: website.