Native Is the Launch Plane

"It can open anything in the family and change nothing. That's not a limitation — it's the whole design."

A Production App That Only Launches

The Native Launcher is a real, signed macOS app — a global hotkey brings up a compact panel, you search, you open. It owns exactly the launch-plane surface: hotkey activation; a default icon-forward Card Deck plus a persistent Detailed List; search across launchable product surfaces; favorites and recents; opening a locally installed app by its registered bundle identifier; opening a registered web surface in the default browser; showing whether an app is installed or running; best-effort reachability of services; opening the full Web Hub; and receiving a cwkfirelink:// deep link from the WebUI.

Read that list and notice what's not there. No Git. No repository folders or IDE launch or source editing. No roster or network edits. No deploy, restart, process kill, or launchd management. No arbitrary path, URL, bundle, label, or command input. No writer credentials. The launcher can reach the whole family and mutate none of it.

Everything Relative to This Mac

The launcher's other defining trait: every action is relative to this Mac. When it opens a native app, it opens the copy installed here. When it opens a web surface, it resolves the URL for this machine's current network context. When it reports 'installed' or 'running', it's reporting about this laptop, not the office. The office engine never remote-launches a GUI app onto a travel browser; launch is always local, because launching something 'somewhere else' is a category error.

The Cache That Can't Grant Power

Because daily launching has to work even when the office is asleep, the launcher keeps a read-only catalog cache. This is the subtle safety property: cached data never grants management authority. The cache lets you open Ember's UI offline; it does not let you deploy Ember. Lose the laptop and the attacker gets a list of what the family runs and where — a read-only catalog — not a key that mutates anything. The launcher's powerlessness is exactly what makes it safe to put on every Mac and carry through an airport.

Make the ubiquitous surface powerless on purpose. A launcher that is everywhere and can only read + open is safe to lose; a launcher that can also deploy is a set of family keys in every bag. Powerlessness is the feature that lets ubiquity exist.

Code

The launcher opens registered targets — never arbitrary strings·swift

// Every launch resolves a REGISTERED target from the signed catalog.
// There is no text field that becomes a path, a command, or a bundle.
func open(_ target: LaunchTarget) {
    switch target.kind {
    case .nativeApp(let bundleID):          // bundleID is from the catalog, not typed
        guard let appURL = installedAppURL(for: bundleID) else {
            return report(.notInstalledOnThisMac)   // honest, never a guess
        }
        NSWorkspace.shared.openApplication(at: appURL, configuration: .init())
    case .web(let urlSet):
        let url = resolveForThisMac(urlSet)  // client-aware: localhost / LAN / tailnet
        NSWorkspace.shared.open(url)
    }
}

// What this type CANNOT express, by construction:
//   an arbitrary path, a shell command, a git op, a deploy, a restart.
// The catalog is read-only. Losing it leaks a list, not a capability.

Exercise

Think about a companion or launcher app you use (a menu-bar tool, a mobile app that pairs with a service). List what it can do offline versus what it must go online to do. Is its offline capability scoped so that stealing the device leaks data but not power? If offline mode can mutate real state, the cache has quietly become a second writer — describe how you'd re-scope it to read-and-open only.

Hint

The safe pattern is: offline = read + open + local preferences; online-and-authenticated = everything that changes shared truth. If a stolen laptop in offline mode can still deploy or delete, the boundary is in the wrong place.

A Production App That Only Launches

Everything Relative to This Mac

The Cache That Can't Grant Power

Code

External links

Exercise

Progress

Comments 0