What App Sandbox actually takes away from a Mac disk cleaner
A disk cleaner is a badly-shaped citizen of the App Sandbox: its whole job is to look at files the user did not explicitly pick. DiskWise ships twice — one build inside the sandbox (Mac App Store), one outside it (direct download) — and the two builds are not the same program. Same binary logic, different capabilities. This post is the list of differences, each one pinned to a line in the public…
A disk cleaner is an App Sandbox app that faces multiple limitations. The sandboxed version cannot scan the entire disk, only the user's home directory and certain application folders. The direct download version, however, can scan additional system roots. Reading the user's Library folder requires one explicit user gesture, and this is enforced every time the app launches.
A sandboxed app cannot access ~/Library directly, instead relying on a bookmark stored in UserDefaults. The sandbox also restricts certain entitlements, such as com.apple.security.temporary-exception.files.home-relative-path.read-write, which would typically allow a cleaner to read files outside its defined scope. The sandboxed build also lies about the home directory returned by NSHomeDirectory(), making it unusable for scanning purposes.
Another limitation is the inability to empty the Trash, as the sandboxed version does not have the necessary entitlement for Finder automation. Lastly, the sandboxed build cannot spawn subprocesses, so it relies on the direct build to report Docker's reclaimable space.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
