EXTENSIONS

macOS Keychain vault using the security CLI. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and keychain service only — never secret values, argv, or error messages.

Headless Apple Podcasts transcript fetcher. Reads the local Apple Podcasts library (MTLibrary.sqlite) to find episodes, and downloads their TTML transcripts via the FetchTranscript binary (Apple's private frameworks) with a Podcasting 2.0 `<podcast:transcript>` RSS fallback. Pure subprocess + HTTP; no GUI. Two methods: `search` — MTLibrary substring lookup returning matching episodes; `fetch` — by store_id, tries FetchTranscript then RSS, writes TTML + plaintext to the output directory and records episode metadata as data.

Read and administer an Apple Business Manager organization over the Apple Business API. OAuth 2 client-credentials auth with an ES256 JWT client assertion signed in WebCrypto — no JWT library, no native dependencies — with in-process token caching, 429 and 5xx retry honouring Retry-After, and automatic re-mint on a mid-flight 401. Accepts the private key whether it is PKCS#8 or SEC1, detected from the DER rather than the PEM label, because Apple issues a PKCS#8 key under EC PRIVATE KEY armour. Roll the whole organization up in one call — devices tallied by product family, status, and purchase source alongside the device management service inventory. Sweep devices, device management services, blueprints, configurations, users, user groups, organizational units, apps, and packages, each fully paged through links.next and filterable client-side with a CEL selector since the API offers no server-side filtering. Drill into a single device, its AppleCare coverage, its assigned management service, or an enrolled device's OS, storage, FileVault, firewall, lock, and erase state. Assign and unassign devices to a device management service as one batched activity and poll it to completion, read the organization audit log over a time window, and reach any unwrapped endpoint through an authenticated passthrough. Works against Apple School Manager by pointing apiBaseUrl at api-school.apple.com and setting the scope to school.api.

Lifecycle management for a Colima VM (macOS container runtime, https://github.com/abiosoft/colima) via the local colima CLI: start and provision, stop, restart, delete, sync VM status, and exec commands inside the VM. One model instance targets one Colima profile.

Thin swamp wrapper around Apple's `container` CLI (a macOS container platform — Linux containers in lightweight VMs on Apple Silicon, no Docker daemon). Image-lifecycle subset: `build`, `run`, `image push`, `registry login` — each method mirrors a `container` subcommand so workflows can drive the build/run/publish lifecycle without bespoke shell steps. Verified against container CLI 1.0.0: no `manifest` subcommand, so a single multi-arch image is built with repeated `--arch` and pushed whole with `image push`.

Read-only local macOS security, sanity, and performance posture checks with a severity-rated report.

Full-lifecycle handling of macOS installer packages (.pkg) by wrapping the native Apple toolchain.

Manage macOS launchd daemons: lifecycle, observability, plist management, discovery, and reporting

ZFS pool management for swamp — import/export pools, sync health status, snapshot datasets, prune retention, scrub, and TRIM

SSH-based configuration management for Linux and macOS.