Skip to main content

Install on macOS

SigmaShake works out of the box on macOS 10.15 (Catalina) and newer, on both Apple Silicon (M-series) and Intel Macs.

Pro subscription required. Sign up at sigmashake.com/pricing, then run ssg auth login to activate your license.

Quick install​

Subscribe at sigmashake.com/pricing first, then install the CLI. Pick one method — they all install the same ssg binary.

curl -fsSL https://install.sigmashake.com | sh

# Same script (alias we ship):
curl -fsSL https://install.sigmashake.com/install.sh | sh

# Non-interactive — records ToS consent (fail-closed without it):
curl -fsSL https://install.sigmashake.com | sh -s -- -y

Verify the install​

ssg --version           # should print: 0.29.19 (or newer)
ssg --help

First-run setup​

cd ~/your-project
ssg init

This does three things:

  1. Writes .sigmashake/ (governance rules) into your project
  2. Auto-detects every AI agent on your machine (Claude Code, Cursor, Copilot, Codex, Antigravity, etc.) and wires ssg hook eval into each
  3. Enables the macOS LaunchAgent so ssg daemon runs automatically at login and restarts on crash — installed at ~/Library/LaunchAgents/com.sigmashake.daemon.plist

You do not need to start a daemon manually, log in, or set any API keys. Tool calls are evaluated locally. The latency design target is under 2 ms (measured p50 0.39 ms, p99 1.91 ms in the 2026-06-10 sigmashake-bench daemon-socket run, ssg 0.29.156, n=500).

Daemon control​

ssg autostart status    # is the LaunchAgent installed and running?
ssg autostart disable   # stop + remove the LaunchAgent
ssg autostart enable    # install + start the LaunchAgent (idempotent)

To opt out of auto-start during ssg init:

ssg init --no-autostart
# or set SSG_NO_AUTOSTART=1 in your environment before running init

Activate your Pro subscription​

ssg requires an active Pro or Enterprise subscription. After installing, run:

ssg auth login            # opens browser → accounts.sigmashake.com

The license JWT is issued automatically after payment and written to disk. No license key to copy or paste.

Subscribe at sigmashake.com/pricing. Pro is $5/month. Enterprise pricing on request.

Once activated, ssg provides:

  • Unlimited evaluations
  • All adapters (Claude Code, Cursor, Copilot, Codex, etc.)
  • All built-in rules (security, destructive-ops, secrets, etc.)
  • Local audit log (the audit_log table in ~/.sigmashake/rules.db, best effort, queried with ssg audit search)
  • Cloud audit sync across machines

Check your status anytime:

ssg status
ssg usage                 # eval usage, storage and plan limits

SigmaShake Desktop — the desktop app (optional)​

SigmaShake Desktop is a menu-bar app that wraps ssg for non-CLI users. It runs the governance daemon, surfaces approvals as native macOS notifications, and opens the dashboard in a webview.

Download​

Live channel metadata (canonical): desktop/swift/latest.json — currently 1.0.13 .dmg. Legacy alias desktop/macos/latest.json serves the same swift pointer.

Not sure which arch to pick? Click Apple → About This Mac → look at the "Chip" / "Processor" line.

  • Anything starting with "Apple M" (M1/M2/M3/M4) → use arm64 below
  • Anything starting with "Intel Core" → use Intel below
  • Unsure / on a shared Mac / installing for someone else → use Intel — it works on every Mac (native on Intel, Rosetta 2 on Apple Silicon). The arm64 build runs only on Apple Silicon.
MacDownload
Always-latest (from swift/latest.json)SigmaShake Desktop .dmg
Mac App Store (sandboxed, auto-updates — macOS 14+, Apple Silicon)SigmaShake Desktop on the Mac App Store
Intel (or any Mac, runs everywhere)SigmaShakeDesktop.dmg (Intel)
Apple Silicon (native, faster — M1/M2/M3/M4)SigmaShakeDesktop.dmg (Apple Silicon)

Mac App Store. Free to download; SigmaShake Pro is a $5/month in-app purchase through Apple. Per Apple's App Review policy, an existing sigmashake.com subscription does not carry over to this build. First-run license/ToS is a GUI gate and stays fail-closed — never skip it.

Install​

  1. Open the .dmg.
  2. Drag SigmaShake Desktop to Applications.
  3. First launch: the release script (sign-notarize.ts) code-signs the .dmg, submits it to Apple notarization and staples the ticket. If macOS still shows "SigmaShake Desktop cannot be opened because Apple cannot check it for malicious software." on first launch, this is a Gatekeeper warning for an app that was downloaded from the web. To bypass:
    • Right-click SigmaShake Desktop in /Applications/ → Open → click Open in the dialog. macOS remembers your decision; subsequent launches are silent.
    • Or from Terminal: xattr -dr com.apple.quarantine "/Applications/SigmaShake Desktop.app"

What it does​

  • Sits in your menu bar (no Dock icon)
  • Click → Settings, Open Dashboard, Diagnostics, Quit
  • Health probe every 5 s — turns red if the governance daemon stops
  • Native macOS notifications when an agent's tool call hits an ask-mode rule
  • Auto-launches ssg daemon + ssg serve on startup; manages port hunting in the 5599-5603 range

First-run wizard​

SigmaShake Desktop opens a one-time wizard asking which profile to apply:

  • Personal
  • Professional
  • Enterprise

The profile records a label in wizard.json and sets the default dashboard view. Professional and Enterprise start in the pro view. Other profiles start in the newcomer view. The profile does not change enforcement: fail-closed is the default for all profiles. For one person on one machine, pick Personal. You can change the dashboard view later.

2026-10-13 note: an earlier version of this page described the profiles as "relaxed", "strict" and "fail-closed" postures, with audit sync and MDM differences. The code does not tie those behaviors to the profile.

Update​

By default the CLI does not update itself. It prints an update notice, and you run ssg update to install the new version. Auto-update is opt-in. To pull the latest:

ssg update

For the desktop app, SigmaShake Desktop checks for updates on launch and prompts when a new version is available.

Uninstall​

ssg uninstall --yes                                              # remove ssg + ~/.sigmashake/
# Then drag /Applications/SigmaShake Desktop.app to Trash if you installed the desktop app

ssg uninstall cleans up:

  • ~/.sigmashake/ (audit log, license, daemon socket)
  • All .claude/settings.json files in your home tree (strips ssg hook entries)
  • Any ~/.codex/ adapter configs

It does not touch ~/.cargo/, node_modules/, vendored crates, or other third-party stuff.

Permissions you'll be asked for​

PermissionWhyWhen asked
Allow Terminal to control "Finder"None — ssg does not request thisNever
NetworkUsed by ssg auth login (browser sign-in), the background license heartbeat (about every 6 hours with a license), the update check (at startup, at most once a day), and the fleet heartbeat (only if the device is enrolled). Rule evaluation makes no network call per tool call. See Offline mode.Never (macOS shows no permission prompt for outgoing connections)
NotificationsSigmaShake Desktop — native macOS approval promptsFirst time you open SigmaShake Desktop

ssg (CLI) does NOT request:

  • Microphone, camera, accessibility, contacts, calendar, photos, location
  • Network access for rule evaluation (evaluation makes no network call per tool call; the background calls above are listed in Offline mode)
  • Full disk access

Troubleshooting​

"ssg-hook-fast binary unusable" warning in Claude Code logs​

This message may appear if you have an older install that still has a ssg-hook-fast binary on disk. ssg-hook-fast is a deprecated legacy dispatcher that is no longer needed — ssg init now writes "<ssg>" hook eval directly, which invokes the Go binary. The Go binary does not have a startup-cost problem (it is a native compiled binary, not a Bun runtime). Run ssg init to migrate to the canonical hook command.

License not active after install​

Run ssg auth login to link the CLI to your Pro subscription. If you have already subscribed and this still shows, run ssg auth refresh to force a license re-check.

SigmaShake Desktop won't launch​

  1. xattr -dr com.apple.quarantine "/Applications/SigmaShake Desktop.app"
  2. If still failing, run from Terminal to see the actual error: 
    "/Applications/SigmaShake Desktop.app/Contents/MacOS/sigmashake-desktop"
  3. Check ~/.sigmashake/desktop.$(date +%F).log
  4. File a bug at support.sigmashake.com

Other SigmaShake products on macOS​

The full SigmaShake product family — by macOS readiness:

ProductStatus on macOSWhat it does
ssg CLI✅ ProductionThe governance engine. Pro subscription required. Install via the one-line installer above.
SigmaShake Desktop✅ ProductionMenu-bar app for non-CLI users. Download from sigmashake.com/desktop or the .dmg links earlier on this page.
SigmaShake Voice⚠️ macOS install docs pendingWhisper-powered voice-to-text with global hotkey. By default, all processing is local with the Whisper model and needs no API key. An optional NVIDIA NIM backend, if you enable it with your own key, sends audio to NVIDIA. The daemon is a pure-Go headless service; macOS packaging (launchd/Homebrew) is not yet documented. See voice.sigmashake.com.
ssg debug capture✅ WorksBuilt-in. Captures the SigmaShake Desktop UI to PNG for debugging. Usage: ssg debug capture --window <wizard|ade|diagnostics> (the desktop app must be running with that window open).
SigmaShake Gaze❌ Linux-only (v0)Webcam eye-tracking. macOS support is on the v1 roadmap.

SigmaShake Voice on macOS​

Whisper-powered voice-to-text. Press a hotkey, speak, text appears wherever you're typing. By default, transcription runs locally with Whisper and needs no API key. If you enable the optional NVIDIA NIM backend with your own key, your audio goes to NVIDIA.

REWORK — macOS install docs pending. SigmaShake Voice is a pure-Go headless daemon (systemd --user unit on Linux; the retired Tauri/Rust .dmg builds are no longer shipped). A macOS install path (launchd plist or Homebrew formula) is not yet documented. Visit voice.sigmashake.com for the current download, or see the SigmaShake Voice install guide for the daemon install pattern (it covers Linux).

What's next​