What problem does it solve? Sandboxed macOS apps fail silently at runtime when file access lacks user consent, security-scoped bookmarks, or matching entitlement keys, and AI-generated SwiftUI code routinely reproduces these iOS-shaped mistakes because the sandbox is invisible in Swift source. ## Core Features & Use Cases - Nine-rule defect index (sf-01 to sf-09): Detects arbitrary-path reads without panel consent, picked URLs persisted by path instead of security-scoped bookmarks, unbalanced startAccessingSecurityScopedResource calls, missing entitlement keys, UIPasteboard on macOS, legacy NSItemProvider drag-drop, and Hardened Runtime gaps. - Hybrid lint engine: Runs tier-1 ripgrep tells plus tier-2 ast-grep structural rules (e.g., start-without-stop inside a function body) with per-file parse probes, emitting unified JSON and SARIF output. - Evidence-grounded fixes: Verifies uncertain findings against a corpus of 1,857 shipping macOS apps via the swiftui-ctx CLI and Apple docs via Sosumi, then applies auto-fixes only for mechanical defects like UIPasteboard to NSPasteboard. - Use Case: Point it at a finished macOS SwiftUI project before App Store submission to catch the sandbox entitlement and bookmark bugs that compile cleanly but fail at runtime. ## Quick Start Audit my macOS SwiftUI project for App Sandbox file-access and entitlement problems and write the findings to swiftui-audits/sandbox-files.
