How valentintorassa/blackice works
blackice is a macOS outbound-connection firewall, operated through a CLI and menu-bar app. The main workflow is to configure and start the filter, inspect or answer connections, and apply the selected mode and rules; in ask mode, hooks—including configured coding agents—can answer pending events. The graph includes the filter, daemon, XPC boundary, event logging, and menu interface. Some runtime modules are unsampled, so their connections are shown only where the README or indexed references support them.
Main entry points: NESystemControl.swift System control · Daemon.swift Decision daemon · FilterDataProvider.swift Network extension · HookRunner.swift Hook runner
Components 26
User interfaces
- CLI commands
macos/Sources/BlackiceCLI/CLI.swift - Setup wizard
macos/Sources/BlackiceCLI/Wizard.swift - Menu bar UI
macos/Sources/BlackiceMenu/MenuBarApp.swift - App entry point
macos/Sources/blackice/main.swift
Configuration and control
- System control
macos/Sources/BlackiceSystem/NESystemControl.swift - Provider configuration
macos/Sources/BlackiceCore/ProviderConfiguration.swift - Mode and rules
macos/Sources/BlackiceCore/FilterPolicy.swift - Agent setup
macos/Sources/BlackiceCLI/AgentConnect.swift - Agent instructions
macos/Sources/BlackiceCore/AgentInstructions.swift - Instruction text
macos/Sources/BlackiceCore/AgentInstructionsText.swift
Connection filtering
- Network extension
macos/Sources/BlackiceFilter/FilterDataProvider.swift - Kernel filters
macos/Sources/BlackiceSystem/KernelFilters.swift - XPC event intake
macos/Sources/BlackiceXPC/FilterClient.swift - XPC server
macos/Sources/BlackiceXPC/FilterServer.swift - XPC messages
macos/Sources/BlackiceCore/Messages.swift
Events and decisions
- Decision daemon
macos/Sources/BlackiceCore/Daemon.swift - Connection event
macos/Sources/BlackiceCore/HookEvent.swift - Hook runner
macos/Sources/BlackiceCore/HookRunner.swift - Hook answer parser
macos/Sources/BlackiceCore/HookAnswer.swift - Event log
macos/Sources/BlackiceCore/EventLog.swift - Code identity
macos/Sources/BlackiceCore/CodeIdentity.swift - Agent instructions helper
macos/Sources/BlackiceCore/AgentInstructionsText.swift
Other components
- Mac user
- Outbound connections
- Configured agent
- macOS network extension services
Connections 29
- Mac user → App entry point: runs
- App entry point → CLI commands: dispatches commands
macos/Sources/blackice/main.swift - App entry point → Menu bar UI: launches app
macos/Sources/blackice/main.swift - App entry point → System control: supplies control
macos/Sources/blackice/main.swift - Mac user → Setup wizard: configures firewall
- CLI commands → System control: controls filter
- Setup wizard → Provider configuration: writes configuration
- Menu bar UI → System control: changes mode
- System control → Provider configuration: installs configuration
macos/Sources/BlackiceSystem/NESystemControl.swift - System control → XPC event intake: starts daemon intake
macos/Sources/BlackiceSystem/NESystemControl.swift - Provider configuration → Network extension: configures provider
macos/Sources/BlackiceCore/ProviderConfiguration.swift - Outbound connections → Network extension: opens connection
- Network extension → Mode and rules: checks mode and rules
- Network extension → XPC server: sends events
- XPC event intake → XPC server: registers and receives
- XPC event intake → XPC messages: decodes messages
macos/Sources/BlackiceXPC/FilterClient.swift - XPC event intake → Decision daemon: provides intake
macos/Sources/BlackiceSystem/NESystemControl.swift - Decision daemon → Connection event: handles events
macos/Sources/BlackiceCore/Daemon.swift - Decision daemon → Hook runner: runs hooks
macos/Sources/BlackiceCore/Daemon.swift - Decision daemon → Event log: records decisions
macos/Sources/BlackiceCore/Daemon.swift - Hook runner → Hook answer parser: parses output
macos/Sources/BlackiceCore/HookRunner.swift - Hook runner → Code identity: checks executable
macos/Sources/BlackiceCore/HookRunner.swift - Decision daemon → Network extension: returns verdicts
- Agent setup → Hook runner: tests hook
macos/Sources/BlackiceCLI/AgentConnect.swift - Agent setup → Agent instructions: sets up agent
macos/Sources/BlackiceCLI/AgentConnect.swift - Agent instructions → Instruction text: uses instruction text
macos/Sources/BlackiceCore/AgentInstructions.swift - Configured agent → Hook runner: answers pending event
- System control → macOS network extension services: requests authorization
macos/Sources/BlackiceSystem/NESystemControl.swift - Kernel filters → macOS network extension services: uses kernel filters