terminal-mac gives coding agents a second, separate Mac to work on

A coding agent that controls your own Mac will eventually click the wrong thing. A shortcut pops up, focus jumps, the pointer lands in your chat app. A new GitHub project called terminal-mac gives a different answer. Do not act on the host at all. Give the agent its own separate Mac.

govijr published the first public release this week. The repository has drawn 711 GitHub stars in about a day. The author reports rank 7 on trendshift.io's daily list. Three builds of version 0.2.0 went out the same day. Licence is MIT.

What it is

terminal-mac uses Apple Virtualization on Apple silicon to boot a separate macOS guest. A helper app inside that guest captures its screen and posts input events. The host streams those frames to Kitty, Ghostty or iTerm2 using the terminal's graphics protocol. The agent only sees the guest. The host's pointer never moves. The host's clipboard never changes.

The guest is treated as a different computer. It has its own apps and its own files. It has its own user accounts and its own permissions. Nothing is inherited from the host that runs it.

What the agent can do

terminal-mac carries an MCP server with the tools screenshot, click, drag, scroll, type, key and status. It also carries a skill that walks the agent through an observe, act, verify loop. A single plugin installs both for Claude Code. Cursor, VS Code, Codex and Windsurf take the same MCP server through their own settings. A line in an AGENTS.md file lets any agent with a skills folder pick up the matching instructions.

A command returns JSON. Screenshots arrive as local PNGs sized to the guest's display points. An input coordinate matches the pixel the agent just saw. The helper refuses to run unless hw.model starts with VirtualMac, so a misconfigured call cannot reach the host by mistake.

The streaming path is small. The guest sends a frame only when the screen changes, up to 30 frames per second, as lz4-compressed pixels. Kitty and Ghostty read those frames through shared memory rather than the pty. An idle desktop costs nothing. The stream stops 15 seconds after the viewer closes.

What is still rough

govijr labels this an early release candidate. The README says live guest acceptance on a clean Mac is still pending. Releases are self-signed with a "Govijr Code Signing" identity. They are not Apple-notarized. A first install needs trust granted by hand.

The guest setup is guided, not unattended. The user still runs Apple's Setup Assistant once inside the VM. The user grants the helper Screen Recording and Accessibility.

snapshot is currently an alias for screenshot, not an accessibility-tree readout. Apple's macOS 27 APIs include automatic account provisioning. This build targets the macOS 26 SDK and does not use it. Build 3 helpers poll full screenshots instead of streaming them, and have to be updated once by hand.

The isolation claim carries its own limit. The guest check prevents accidental host execution. It is not hardware attestation. It is not a defence against a compromised host. A compromised host still owns everything.

For a team deciding how to let agents touch desktop apps, a disposable second Mac is a cleaner story. It beats a skill that drives the real desktop. The cost is one macOS install, one guided permissions dance, and a terminal that can render graphics.

Source

govijr/terminal-mac on GitHub