@@ -19,6 +19,27 @@ jobs:
       - run: cargo clippy --all-targets --locked -- -D warnings
       - run: cargo test --workspace --locked
 
+  macos:
+    runs-on: macos-latest
+    needs: check
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install toolchain from rust-toolchain.toml
+        run: rustup show active-toolchain || rustup toolchain install
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all-targets --locked -- -D warnings
+      - run: cargo test --locked -p gitagent-sandbox
+      - name: The launcher refuses writes outside the allowed folders
+        run: |
+          cargo build --locked -p gitagent-cli
+          mkdir -p allowed
+          target/debug/gitagent __sandbox --write "$PWD/allowed" --write /dev -- \
+            sh -c 'echo ok > allowed/in.txt && ! (echo x > outside.txt) 2>/dev/null' 2> launcher.err
+          cat launcher.err
+          test -f allowed/in.txt
+          test ! -e outside.txt
+          ! grep -q 'sandbox limited' launcher.err
+
   musl:
     runs-on: ubuntu-latest
     needs: check
 
@@ -79,7 +79,7 @@ Harbor also hosts other benchmarks with the same task shape, SWE-bench Verified
                  │    hooks · approvals · audit                             │
                  ├──────────────────────────────────────────────────────────┤
                  │  record: trajectory + counters every turn, events        │
-                 │  sandbox: Landlock + seccomp around the agent's shell    │
+                 │  sandbox: Landlock + seccomp; macOS: sandbox-exec        │
                  └──────────────────────────────────────────────────────────┘
 ```
 
@@ -125,7 +125,7 @@ Steps 4 to 9 repeat until the stop check accepts, the agent replies in conversat
 | D19 | Parallel work as a `plan` tool over sub-agents, with a reconciling step, opt-in per agent | Large jobs finish faster and more consistently; bounded phases and tasks keep the cost predictable |
 | D20 | Schedules run in-process while `gitagent schedule start` runs | The same behaviour as before; anything that must not be missed calls `gitagent schedule run` from an external scheduler |
 | D21 | The terminal is the interface | One console with tool lines, approvals, a task board and command suggestions; no web server to secure |
-| D22 | Landlock and seccomp around the agent's shell, not around gitagent | The agent cannot write outside its folders, while gitagent can still record |
+| D22 | Landlock and seccomp (on macOS, a `sandbox-exec` profile) around the agent's shell, not around gitagent | The agent cannot write outside its folders, while gitagent can still record |
 | D23 | `--bench` reads only committed files, and a test pins its prompt and tools | Product features cannot change a scored run by accident |
 | D24 | Everyday defaults keep the benchmark's guards, except the snapshot; the console has no time limit unless one is set | The loop detector, stop check and context clearing help in any repository; a person at the console stops a turn with Ctrl-C, while runs nobody watches keep a 30-minute ceiling; the snapshot costs up to 15 seconds per start in a project the user already knows |
 | D25 | Sub-agents are warned as their turns run low, may be given their own turn limit (up to 100), and come back marked partial when they run out | A review cut off mid-step wastes its whole cost; a warned one hands back what it found, and the lead re-runs only what is marked partial |
@@ -180,7 +180,7 @@ gitagent/
 │  ├─ mcp/        the MCP client
 │  ├─ record/     trajectory, counters, events
 │  ├─ repo/       clone, branch, commit, push
-│  ├─ sandbox/    Landlock and seccomp
+│  ├─ sandbox/    Landlock and seccomp; sandbox-exec on macOS
 │  ├─ learn/      offline learning of lessons
 │  └─ sdk/        the in-process Rust library
 ├─ clients/       python/ and typescript/: thin clients over --ipc
@@ -201,7 +201,7 @@ pub trait Provider: Send + Sync {
 }
 ```
 
-Dependencies are kept few: `tokio`, `reqwest` with rustls, `serde`, `serde_json`, a YAML parser, `clap`, `regex`, `portable-pty`, `anyhow`, `thiserror`, `async-trait`, and `landlock` with a seccomp filter for the sandbox. Token counts are estimated at four bytes per token instead of linking a tokenizer. Release builds are static musl binaries for x86_64 and aarch64 Linux, plus macOS.
+Dependencies are kept few: `tokio`, `reqwest` with rustls, `serde`, `serde_json`, a YAML parser, `clap`, `regex`, `portable-pty`, `anyhow`, `thiserror`, `async-trait`, and `landlock` with a seccomp filter for the sandbox (on macOS it uses the system's `sandbox-exec`, so no dependency). Token counts are estimated at four bytes per token instead of linking a tokenizer. Release builds are static musl binaries for x86_64 and aarch64 Linux, plus macOS.
 
 ---
 
 
@@ -56,7 +56,7 @@ The workspace is split into crates under `crates/`:
 | `mcp` | The Model Context Protocol client |
 | `record` | Trajectories, counters and events |
 | `repo` | Repo mode: clones, branches, commits, pushes |
-| `sandbox` | Landlock and seccomp for the agent's shell |
+| `sandbox` | Landlock and seccomp for the agent's shell; `sandbox-exec` on macOS |
 | `learn` | Offline learning of lessons from finished runs |
 | `sdk` | The Rust library interface |
 
 
@@ -545,7 +545,6 @@ gitagent 3 replaces the TypeScript packages (1.x and 2.x) with one binary. What
 - **Not carried over.** `--voice`; the remote `--sandbox` (the binary prints a one-line note); a plugin's `entry` JavaScript (plugins contribute tools, skills, hooks and prompt text through files); the 1.x telemetry adapter (OTLP export replaces it).
 - **Task list.** 1.x's `task_tracker` kept a searchable list of tasks. gitagent 3's `todo` is a plain checklist the agent rewrites whole; the name `task_tracker` still maps to it in tool lists and hooks.
 - **Learning.** 1.x's online skill learning, which adjusted a skill's confidence after each use, is gone. Lessons are learned from finished runs instead (`learning: online` or `gitagent learn`, below) and go into the system prompt; skills are not changed.
-- **Sandbox on macOS.** The sandbox is Linux-only (Landlock and seccomp). On macOS the agent's shell runs without one, where 1.x's remote sandbox worked on every system.
 - **Scripts without a runtime.** 1.x ran every declared tool with `sh` unless `runtime` was set. gitagent 3 picks the interpreter by extension (`.py` with `python3`, `.js` with `node`, `.rb` with `ruby`, …), so such tools now run instead of failing.
 
 ## Configuration
@@ -582,7 +581,7 @@ With `learning: online`, gitagent learns from each task it completes. The model
 
 ### Sandbox
 
-On Linux, outside benchmark runs, the agent's shell runs under Landlock: it may write only to the working folder, the output folder, the temp folders and `~/.cache`. A seccomp filter blocks system calls such as `mount`, loading kernel modules and `reboot`. Set `sandbox: off` in `gitagent.yaml` to disable it, or `sandbox: on` to require it. In benchmark runs, writing under `/tests` is refused; elsewhere `/tests` is an ordinary path.
+Outside benchmark runs, the agent's shell runs in a sandbox: it may write only to the working folder, the output folder, the temp folders and `~/.cache` (on macOS also `~/Library/Caches`). Reading is not restricted. On Linux this is Landlock, plus a seccomp filter that blocks system calls such as `mount`, loading kernel modules and `reboot`. On macOS it is the system's `sandbox-exec` with a profile that refuses other writes. Other systems run the shell without a sandbox. Set `sandbox: off` in `gitagent.yaml` to disable it, or `sandbox: on` to require it. In benchmark runs, writing under `/tests` is refused; elsewhere `/tests` is an ordinary path.
 
 ## Terminal-Bench with Harbor
 
@@ -624,7 +623,7 @@ It learns only from tasks listed under `dev` in a split file (`--split`, default
 
 **My files are not being used.** Run `gitagent validate <dir>`: it lists every problem with a file and line number. Warnings at startup (`gitagent: warning: …`) name files that were skipped.
 
-**A command or file write is refused.** On Linux the agent's shell runs in a sandbox that allows writes only under the working folder, the output folder, the temp folders and `~/.cache`. Set `sandbox: off` in `gitagent.yaml` if the agent must write elsewhere. A hook may also have blocked the action; the `$` line says so in its result.
+**A command or file write is refused.** On Linux and macOS the agent's shell runs in a sandbox that allows writes only under the working folder, the output folder, the temp folders and `~/.cache`. Set `sandbox: off` in `gitagent.yaml` if the agent must write elsewhere. A hook may also have blocked the action; the `$` line says so in its result.
 
 **The session pauses with `! approval needed`.** The agent's compliance settings ask a person for that action. Answer `y` or `n`. Without a terminal, for example in a pipe, such requests are denied.
 
 
@@ -755,7 +755,7 @@ fn sandbox_dirs(
         "auto" => !bench && gitagent_sandbox::available(),
         "on" => {
             if !gitagent_sandbox::available() {
-                bail!("sandbox: on needs Linux (Landlock and seccomp)");
+                bail!("sandbox: on needs Linux (Landlock and seccomp) or macOS (sandbox-exec)");
             }
             true
         }
@@ -773,8 +773,19 @@ fn sandbox_dirs(
         PathBuf::from("/var/tmp"),
         PathBuf::from("/dev"),
     ];
-    if let Some(home) = std::env::var_os("HOME") {
-        dirs.push(PathBuf::from(home).join(".cache"));
+    if let Some(home) = std::env::var_os("HOME").map(PathBuf::from) {
+        dirs.push(home.join(".cache"));
+        if cfg!(target_os = "macos") {
+            dirs.push(home.join("Library/Caches"));
+        }
+    }
+    // macOS keeps the per-user cache folder (compilers' module caches) next
+    // to the per-user temp folder `.../T`.
+    if cfg!(target_os = "macos") {
+        let tmp = std::env::temp_dir();
+        if tmp.file_name().is_some_and(|n| n == "T") {
+            dirs.extend(tmp.parent().map(|p| p.to_path_buf()));
+        }
     }
     std::fs::create_dir_all(out_dir)?;
     Ok(Some(dirs))
 
@@ -1,11 +1,12 @@
-//! `gitagent __sandbox --write <dir>... -- <program> [args...]`: applies the
-//! sandbox to this process, then replaces it with the program (the agent's
-//! shell). Used only internally, when the sandbox is on.
+//! `gitagent __sandbox --write <dir>... -- <program> [args...]`: prepares the
+//! sandbox (on Linux by restricting this process), then replaces this process
+//! with the program (the agent's shell), started inside it. Used only
+//! internally, when the sandbox is on.
 
 use std::ffi::OsString;
 use std::os::unix::process::CommandExt;
 use std::path::PathBuf;
-use std::process::{Command, ExitCode};
+use std::process::ExitCode;
 
 use gitagent_sandbox::{Policy, Status};
 
@@ -34,17 +35,17 @@ pub(crate) fn run(args: &[OsString]) -> ExitCode {
         eprintln!("gitagent __sandbox: missing `-- <program>`");
         return ExitCode::from(2);
     };
-    match gitagent_sandbox::apply(&Policy { writable }) {
-        Ok(Status::Enforced) => {}
-        Ok(Status::Partial(note) | Status::Unsupported(note)) => {
-            eprintln!("gitagent: sandbox limited: {note}");
-        }
+    let sandbox = match gitagent_sandbox::prepare(&Policy { writable }) {
+        Ok(s) => s,
         Err(e) => {
             eprintln!("gitagent: sandbox failed: {e:#}");
             return ExitCode::from(2);
         }
+    };
+    if let Status::Partial(note) | Status::Unsupported(note) = &sandbox.status {
+        eprintln!("gitagent: sandbox limited: {note}");
     }
-    let err = Command::new(&program).args(rest).exec();
+    let err = sandbox.command(&program).args(rest).exec();
     eprintln!("gitagent __sandbox: cannot start {program:?}: {err}");
     ExitCode::from(127)
 }