macOS

אזהרת אבטחה

ClawDaddy זיהה דפוסים חשודים ב-Skill הזה. בדקו בקפידה לפני ההתקנה.

BSD vs GNU Commands

• sed -i requires extension argument: sed -i '' 's/a/b/' file — empty string for no backup, Linux doesn't need it

• find doesn't support -printf — use -exec stat or xargs with stat -f instead

• date uses different format flags: date -j -f '%Y-%m-%d' '2024-01-15' '+%s' — -j prevents setting time

• grep -P (Perl regex) doesn't exist — use grep -E (extended) or install ggrep via Homebrew

• xargs defaults to /usr/bin/echo not the command — always specify the command explicitly

• readlink -f doesn't exist — use realpath or python3 -c "import os; print(os.path.realpath('path'))"

Homebrew Paths

• Apple Silicon: /opt/homebrew/bin, /opt/homebrew/lib

• Intel: /usr/local/bin, /usr/local/lib

• Check architecture: uname -m returns arm64 or x86_64

• Homebrew doesn't add to PATH automatically — check ~/.zprofile for eval line

• Running x86 binaries: arch -x86_64 /bin/bash then install/run Intel-only tools

Keychain (Secrets)

• Store: security add-generic-password -a "$USER" -s "service_name" -w "secret_value" -U

• Retrieve: security find-generic-password -a "$USER" -s "service_name" -w

• -U flag updates if exists — without it, duplicate entries error

• Keychain prompts for access on first use — authorize permanently for automation

• Delete: security delete-generic-password -a "$USER" -s "service_name"

launchd (Services)

• User agents: ~/Library/LaunchAgents/ — runs as user when logged in

• System daemons: /Library/LaunchDaemons/ — runs at boot as root

• Load: launchctl load -w ~/Library/LaunchAgents/com.example.plist

• Unload before editing: launchctl unload — edits to loaded plists are ignored

• Check errors: launchctl list | grep service_name then launchctl error <exit_code>

• Logs: log show --predicate 'subsystem == "com.example"' --last 1h

Privacy Permissions (TCC)

• Automation scripts fail silently without Full Disk Access or Automation permissions

• Grant in System Settings → Privacy & Security → corresponding category

• Terminal and iTerm need separate permissions — granting to one doesn't grant to other

• tccutil reset clears permissions: tccutil reset AppleEvents for Automation

• Check granted permissions: sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT * FROM access"

defaults (Preferences)

• Read: defaults read com.apple.finder AppleShowAllFiles

• Write: defaults write com.apple.finder AppleShowAllFiles -bool true

• Delete: defaults delete com.apple.finder AppleShowAllFiles

• Restart app after changing: killall Finder

• Find app bundle ID: osascript -e 'id of app "App Name"'

• Export all: defaults export com.apple.finder - outputs XML

File Operations

• ditto preserves resource forks and metadata — use instead of cp for app bundles

• Create DMG: hdiutil create -volname "Name" -srcfolder ./folder -format UDZO output.dmg

• Mount DMG: hdiutil attach image.dmg — returns mount point path

• Unmount: hdiutil detach /Volumes/Name

• Extended attributes: xattr -l file to list, xattr -c file to clear all

• Quarantine removal: xattr -d com.apple.quarantine app.app

Clipboard

• Copy to clipboard: echo "text" | pbcopy

• Paste from clipboard: pbpaste

• Copy file contents: pbcopy < file.txt

• Preserve RTF: pbpaste -Prefer rtf

• Clipboard works in SSH sessions to local machine — useful for remote file copying

Screenshots and Screen

• Screenshot region to file: screencapture -i output.png

• Screenshot window: screencapture -w output.png

• Screenshot to clipboard: screencapture -c

• Headless (no UI): screencapture -x — suppresses sound and cursor

• Screen recording requires Screen Recording permission in Privacy settings

Process Management

• Prevent sleep: caffeinate -i command — keeps system awake while command runs

• Prevent sleep with timeout: caffeinate -t 3600 — 1 hour

• Check why not sleeping: pmset -g assertions

• Power settings: pmset -g to view, sudo pmset -a sleep 0 to disable sleep

• Current app in focus: osascript -e 'tell application "System Events" to get name of first process whose frontmost is true'

Network

• List interfaces: networksetup -listallhardwareports

• Get IP: ipconfig getifaddr en0 (Wi-Fi usually en0 on laptops)

• DNS servers: scutil --dns | grep nameserver

• Flush DNS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

• Proxy settings: networksetup -getwebproxy "Wi-Fi"

System Integrity Protection

• Check status: csrutil status

• Disable (Recovery Mode only): csrutil disable — not recommended for production

• Protected paths: /System, /usr (except /usr/local), /sbin, /bin

• Can't modify these even as root — design your automations around this

Logs

• Stream live: log stream --predicate 'process == "processname"'

• Search recent: log show --last 1h --predicate 'eventMessage contains "error"'

• Subsystem filter: log show --predicate 'subsystem == "com.apple.example"'

• Save to file: log collect --output ./logs.logarchive — opens in Console.app

Automation Tips

• Open URL: open "https://example.com" — uses default browser

• Open app: open -a "Safari" — by name, not path

• Open file with specific app: open -a "TextEdit" file.txt

• Run AppleScript: osascript -e 'tell application "Finder" to get name of home'

• Spotlight search: mdfind "kMDItemDisplayName == 'filename.txt'" — faster than find for indexed files