A minimal macOS browser for focus: a few tabs, no tab bar, a blocklist. Swift/AppKit shell over WKWebView; policy and omnibox logic in a small Rust core.
script/bundle # -> build/Mako.app (Rust core + Swift shell, ad-hoc signed)
open build/Mako.app
cargo test --manifest-path core/Cargo.toml
| Key | Action |
|---|---|
| ⌘L | Omnibox (also lists open tabs) |
| ⌘T / ⌘W | New tab (refused at the cap) / close tab |
| ⌘1–9 / Tabs menu | Switch tab (the menu lists open tabs by name) |
| ⌘[ / ⌘] | Back / forward |
| ⌘R, ⌘= ⌘- ⌘0 | Reload, zoom |
| ⌥⌘C | Developer console (Web Inspector) |
| ⌘, | Edit config |
Links that try to open a new window load in the current tab. Mako's own shortcuts (⌘T ⌘W ⌘L ⌘, ⌘1–9 ⌥⌘C) win over pages; every other shortcut goes to the page first, so web editors keep ⌘Z.
script/icon design/icon-variants/<variant>.png regenerates app/Resources/AppIcon.icns. Six variants were generated with gpt-image-2.5-sunburst.
CI (.github/workflows/ci.yml) runs the Rust tests, the core performance budget, the app build, DMG packaging, and doc-check on every pull request and push. When CI passes on main, .github/workflows/release.yml builds Mako-0.1.<run>.dmg and publishes it as a GitHub Release. Release builds are ad hoc signed and not notarized: on first launch, right-click Mako.app and choose Open. The UI checks (verify-mako smoke, perf) need a Mac with Accessibility and Screen Recording permission, so they run locally, not in CI.
script/bundle && script/dmg # local DMG: build/Mako-<version>.dmg
WebKit only runs passkey (WebAuthn) requests in apps that hold Apple's restricted com.apple.developer.web-browser.public-key-credential entitlement; without it every site's passkey prompt fails with NotAllowedError, and signing with the entitlement but no profile makes macOS kill the app at launch. To enable passkeys:
-
Wego's Account Holder (team H38F4QZT8M) registers the App ID
com.wego.makoand requests the entitlement at https://developer.apple.com/contact/request/macos-browsers-passkeys/. Apple reviews it against its web-browser criteria. -
Once granted, create a macOS development (or Developer ID) provisioning profile for
com.wego.makothat includes the entitlement, and download it. -
Build with it:
SIGN_IDENTITY="<cert from the same team>" PROVISIONING_PROFILE=path/to/Mako.provisionprofile script/bundlescript/bundlerefuses a profile that is not for macOS, not forcom.wego.mako, or lacks the entitlement.
Verification copies (control-mako) never get passkeys: they are re-signed ad hoc under their own bundle IDs.
docs/control.md documents how to drive Mako from scripts or agents: launching an isolated instance, reading tabs and page text, pressing menus and buttons, and the AX identifiers Mako exposes.
The verify-mako skill (.claude/skills/verify-mako/) launches an isolated instance (MAKO_CONFIG points at a throwaway config) and drives it through the accessibility API. Needs Accessibility and Screen Recording permission for the terminal.
~/.config/mako/config, re-read on every navigation:
max_tabs = 3
restore_session = true # reopen last session's tabs at launch (default)
search = https://duckduckgo.com/?q=%s
block x.com # always, includes subdomains and embeds (iframes)
block youtube.com 09:00-18:00 weekdays # days: mon-fri, sat,sun, weekends, daily