9x

9x makes the red close button quit selected macOS applications.

macOS normally closes a window without quitting its application. 9x changes that behavior only for applications that the user adds to an allowlist.

Safety properties

• Runs as the current user.
• Does not use sudo, root access, a kernel extension, or a system daemon.
• Does not request Accessibility, Input Monitoring, or Screen Recording.
• Does not read keyboard events.
• Does not use the network or collect telemetry.
• Sends a normal macOS Quit request. It never force-quits an application.
• Refuses to operate on protected macOS components.
• Keeps the allowlist private with mode 600.

9x monitors left mouse button events and public window metadata. After a click in a supported close-button location, it waits for that exact window to close. It sends Quit only when the clicked window is no longer on-screen and the application is explicitly allowlisted.

Requirements

• macOS 13 or later
• Apple Silicon or Intel Mac
• zsh for the command-line interface

End users do not need Xcode or the Command Line Tools.

Install with Homebrew

Homebrew is the recommended installation method:

brew tap syncroot/9x
brew trust --formula syncroot/9x/nine-x
brew install syncroot/9x/9x
9x add "Microsoft PowerPoint"
9x on

The trust command applies only to the nine-x formula, not the entire tap. Homebrew downloads the release and verifies its SHA-256 checksum. Before an upgrade or removal, stop the helper:

9x off
brew uninstall syncroot/9x/9x

Homebrew leaves the private allowlist in place. It is stored at:

$HOME/Library/Application Support/9x/apps.txt

Install a GitHub archive

GitHub releases are intentionally labeled unsigned. They are not signed with an Apple Developer ID and are not notarized by Apple.

Download the archive and its .sha256 file from the same GitHub Release. Verify the checksum before extracting:

shasum -a 256 -c 9x-0.1.0-unsigned.zip.sha256

If GitHub CLI is installed, also verify that GitHub built the archive from this repository:

gh attestation verify 9x-0.1.0-unsigned.zip \
  --repo syncroot/9x \
  --signer-workflow syncroot/9x/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0 \
  --deny-self-hosted-runners

GitHub provenance confirms the source workflow and artifact digest. It is not an Apple security review and does not prove the software has no vulnerabilities.

Extract the verified archive, open Terminal in its directory, and run:

./install.sh

The default prefix is $HOME/.local. To use another user-writable prefix:

./install.sh --prefix "$HOME/tools"

The installer does not edit shell configuration. If $HOME/.local/bin is not already in PATH, add it yourself.

macOS may block the helper because its developer cannot be verified. First try to start it with 9x on. If macOS blocks it and you trust the verified download, open System Settings, choose Privacy & Security, and use Open Anyway for the blocked helper. Then run 9x on again. Do not disable Gatekeeper globally.

For zsh completion, add the following to .zshrc:

fpath=("$HOME/.local/share/zsh/site-functions" $fpath)
autoload -Uz compinit
compinit

Use

9x add "Microsoft PowerPoint"
9x add Safari
9x add /Applications/Firefox.app
9x list
9x on

Application names are matched without regard to capitalization. After typing 9x add , press Tab to complete an installed application name. You can also drag an application from Finder into Terminal after 9x add .

To restore normal macOS behavior:

9x off

Other useful commands:

9x status
9x doctor
9x logs
9x version
9x remove Safari

To remove the program but keep the allowlist:

9x uninstall

For a Homebrew installation, use 9x off followed by brew uninstall syncroot/9x/9x instead.

To remove the program and its settings:

9x uninstall --purge

Build from source

An Xcode toolchain with Swift 6 is required:

make verify

This creates a universal helper for arm64 and x86_64 with a macOS 13 deployment target. Development builds use an ad-hoc signature.

To create the same unsigned package used by the GitHub release workflow:

make github-release

This requires a clean Git tree and complete attribution. The release check requires an ad-hoc signature with hardened runtime and refuses misleading Apple Developer ID claims, incomplete attribution, non-ASCII readable files, and hard-coded developer home paths.

Apple Developer ID signing and notarization remain available as an optional future release path. They are not required for the GitHub release.

Each archive has an external SHA-256 checksum. It also contains MANIFEST.sha256 with a checksum for every packaged file.

Limitations

9x supports standard macOS traffic-light controls and inset layouts used by applications such as Microsoft PowerPoint. Applications with other unusual custom window layouts may not be compatible. The frontmost-app check, bounded hit regions, exact-window tracking, and explicit allowlist reduce the risk of an unrelated click causing Quit.

Applications still control their normal Quit flow. Save prompts and cancellation remain available.

License

9x is licensed under the Apache License 2.0. Redistributors must preserve the license and attribution notices as required by that license. See LICENSE and NOTICE.