AI Config Selector（acs）：为 AI 编程 CLI 提供可复用沙箱能力 Profile

Reusable, sandboxed capability Profiles for AI coding CLIs on macOS.

AI Config Selector (acs) is a Go CLI that runs Devin, Codex, a shell, or any command inside the native macOS Seatbelt sandbox. Run directly, a coding agent can usually reach your whole home directory, every installed Skill and any credentials it finds. ACS makes that access explicit and repeatable: save the local Skills, instruction files, filesystem permissions, environment references and local MCP servers a tool may use in a reusable Profile, then launch it from any project.

Get started · Documentation · Security boundaries · Contribute

Important

ACS supports macOS 26 on Apple Silicon (darwin/arm64). Linux and Intel Macs are not supported runtimes. Devin and Codex are installed separately; you can try the sandbox without an AI account.

Why ACS?

• Explicit access. New v3 Profiles default to a read-only workspace; write access and extra paths are opt-in. See Profiles.
• One Profile, many targets. The same selections drive Devin, Codex, a sandbox shell or a literal command, from any project directory.
• Inspect before you launch. acs explain reports requested and effective authority, and --dry-run plans a launch without starting a Session. See Diagnostics.
• Local Skills and MCP servers. Select Skill bundles and local STDIO MCP servers per Profile.
• History and sharing. Compare and restore Profile revisions and export sanitized selections without host paths or credentials.
• Fail closed. A launch runs inside the sandbox or not at all, and retained Sessions are recovered only after cleanup is proven.

How it works

Profile ──► immutable authority plan ──► private Session ──► Seatbelt sandbox ──► target
(saved      (resolved before any         (synthetic home,      (macOS native,       devin | codex |
selections)  Session exists)              selected material)    no fallback)         /bin/zsh -f | your command

The architecture and security model describe each step in detail.

Install

Install the latest stable release:

curl -fsSL https://github.com/alcimerio/ai-config-selector/releases/latest/download/install.sh | sh

The installer checks your OS and architecture, verifies the archive checksum, and installs in ~/.local/bin. It refuses to overwrite an existing acs, needs no sudo, and does not edit shell startup files. Add the installed directory to this terminal's search path and verify which binary will run:

export PATH="$HOME/.local/bin:$PATH"
command -v acs
acs version

Inspect the installer or choose a specific release

Choose a release and copy its tag and installer SHA-256 from the release asset metadata. Use tag_name and the hexadecimal part of the install.sh asset's digest, without the sha256: prefix. Replace the two input values below with those from the same reviewed release. Use a scratch directory without install.sh. Verify the downloaded installer, inspect it (q exits less), then run it locally:

set -eu
release_version='vMAJOR.MINOR.PATCH'
installer_sha256='REVIEWED_INSTALLER_SHA256'
release_url="https://github.com/alcimerio/ai-config-selector/releases/download/$release_version"
curl --fail --location --proto '=https' --tlsv1.2 \
  --output install.sh "$release_url/install.sh"
printf '%s  %s\n' \
  "$installer_sha256" install.sh \
  | shasum -a 256 -c -
less install.sh
sh ./install.sh
"$HOME/.local/bin/acs" version

Verify release provenance

Release archives and SHA256SUMS carry GitHub build attestations. With the GitHub CLI, from a directory holding the downloaded release assets:

gh attestation verify acs_MAJOR.MINOR.PATCH_darwin_arm64.tar.gz --repo alcimerio/ai-config-selector
shasum -a 256 -c SHA256SUMS

Warning

Release archives are unsigned and unnotarized. SHA-256 checks byte identity against a trusted digest; GitHub attestations provide separate origin evidence. Neither is Apple approval or a malware review. Do not disable Gatekeeper, remove quarantine, or weaken sandbox settings to make ACS run. See installation and recovery.

Upgrading

Already have ACS? Follow the upgrade and recovery guide to retain your working binary and verify the replacement before switching. Use the manual path when your binary has no updater.

acs update --check and acs update support direct installer layouts. Read the upgrade guide before replacing a binary: rollback does not downgrade stored data.

Build from source

With the Go toolchain in go.mod on a supported Mac:

git clone https://github.com/alcimerio/ai-config-selector.git
cd ai-config-selector
go build -o ./bin/acs ./cmd/acs
./bin/acs version
export PATH="$PWD/bin:$PATH"

A source build reports acs devel and cannot self-update. See Contributing for checks and release-evidence requirements.

Quickstart

No AI account is needed. Run these from the project you want to inspect:

acs doctor --target sandbox                 # 1. check host prerequisites
acs profile create --name first-review      # 2. save a read-only Profile
acs explain sandbox --profile first-review  # 3. see what the sandbox will allow
acs sandbox --profile first-review          # 4. open a shell inside the sandbox

In the builder (step 2), keep the Review preset, continue without target overlays, and choose Create Profile for a minimal read-only run. Confirm the empty selection. The builder requires no client or account.

The shell runs /bin/zsh -f without user startup files. Your workspace is the current directory and $HOME is a synthetic Session home. Type exit to return.

To use an AI target, install and authenticate it separately and select its target overlay in the Profile builder. Then launch it with the Profile:

acs devin --profile NAME
acs codex --profile NAME

Follow Get started to add a Skill and continue with Devin, interactive Codex for its ACS-owned named login, and target conformance for integration differences.

Common commands

Use acs help for your binary's command grammar and the CLI reference for every command.

Security boundaries

There is no unsandboxed fallback. New v3 Profiles default to read-only workspace access; the private Session is writable. ACS removes it only after proving process-tree cleanup, preserving uncertain state for recovery.

Caution

ACS is not an egress firewall: targets can transmit data they can read. Selected secrets are shared with the attached process tree, including MCP servers.

Choose trusted Skills, instructions and programs. Read the security model before granting access.

Compatibility

Supported Codex versions are listed in target compatibility.

Project status

ACS is pre-1.0. Documentation follows this checkout and main can describe changes that have not shipped; use your release tag for installed behavior and GitHub Releases for published notes and downloads.

Help and support

Start with troubleshooting, then open an issue with a sanitized reproduction, ACS/macOS versions and architecture. Keep credentials, target output, Session contents and private bindings out of reports.

Contributing

Contributing covers setup and PR checks; the documentation index lists user, reference and maintainer pages.

License

ACS is available under the MIT License.