Ghost Process Sniper 2.1.0

Download

GhostProcessSniper-2.1.0.dmg · universal (Apple silicon and Intel) · macOS 26 Tahoe or later

1. Open the disk image and drag Ghost Process Sniper into Applications.
2. Open it from Applications. It lives in the menu bar; choose Open Dashboard for the full console.
3. The app is signed but not notarized, so the first launch shows "Apple could not verify…". Click Done, then open System Settings › Privacy & Security and click Open Anyway. macOS remembers the choice.

Updating from an earlier version: quit Ghost from its menu, replace the app in Applications, and open it again. Settings and history are kept.

What's new

Sentinel, a security watch that explains what it sees; a console that does about half the layout work; numbers that read the same in every language; and releases built in the open, with provenance you can verify.

Sentinel security watch

• A new Security section (⌘3) looks at every process for the shapes attacks take on macOS and explains each finding with the chain that launched it (Google Chrome › zsh › curl), the exact text that matched, and one next step.
• Catches browsers, mail, chat and document apps starting shells or scripts; pasted commands that download and run code (with advice about fake CAPTCHA and "fix" instructions); base64 and other encoded payloads; homemade password dialogs and dscl -authonly; keychain, browser-cookie and wallet theft; quarantine stripping and Gatekeeper disabling; launch-agent persistence; reverse shells and shells or relays waiting for connections; tunnels; crypto miners; silent screen and camera capture.
• Flags programs running from temporary, shared or hidden folders, the Trash, mounted disk images or Downloads, deleted executables, system names from the wrong folder or spelled with look-alike letters, and apps disguised as documents (Invoice.pdf.app).
• Checks each third-party program's code signature once, offline (Apple, App Store, Developer ID, ad hoc, unsigned, invalid), and shows the page it was downloaded from.
• Watches browsers and terminals with kernel process events, so commands that run for under a second are caught with their arguments, at no cost while nothing starts.
• Lists launch agents and daemons and catches new ones the moment they are written, with a notification.
• Shows which apps are recording from the microphone and whether a camera is on, from system listeners that open no device and need no permission.
• A live launch feed of every new process, a banner above the Overview, a raised menu-bar icon and one notification per new suspicious or dangerous program and reason; a program that restarts for the same reason stays silent for a day. Findings never act on their own: Stop… uses the usual preview, and programs can be trusted or findings dismissed.
• Stays quiet on everyday work that resembles an attack: simulator daemons, browser-extension helpers, compiler output, port checks, cookie-jar files, downloads named after wallets, signed programs in /Users/Shared and dev servers built into /tmp. The attack shapes they resemble are still caught.

Power

• The console's detail column no longer measures the whole page for its minimum size on every update; that was about half of the console's main-thread time while it was on screen.
• An open console refreshes at half, then a quarter, of its usual rate when nobody has touched the Mac for 30 seconds or 2 minutes, and returns to the full rate on the next tick after any input.
• Incident recurrence counts are cached between flushes instead of being queried on every scan.
• The two-column layout measures each child once per layout pass.
• Measured with the console frontmost: about 42% of a core before, 23–28% after, including Sentinel (Performance).

Interface

• Sections are ⌘1 Overview, ⌘2 All Processes, ⌘3 Security, ⌘4 Duplicates, ⌘5 Incidents, ⌘6 Rules, following the sidebar order.
• --section security (or any section name) opens the console on that page at launch.

Fixed

• Temperatures and PIDs are formatted the same way in every locale: a Danish Mac no longer shows 91,0°C next to 91.0°C, or PID 12.273 in the stop preview.
• The Overview's recommendation says what a stop does once; it read "Asks ChatGPT to quit like ⌘Q, then stops anything it leaves behind. ChatGPT is asked to quit like ⌘Q…".
• Ghost no longer lists itself under Warming Up or in the Risk Queue while its console is open. It still appears in All Processes, and Settings › Diagnostics shows what it costs.

Distribution

• Releases are built from the tagged source by GitHub Actions. Each disk image carries a signed build-provenance attestation, so gh attestation verify GhostProcessSniper-2.1.0.dmg --repo mikkel32/ghost-process-sniper proves the file came from that build.
• A website, mikkel32.github.io/ghost-process-sniper, with the download, install steps and checksum. It loads nothing from other sites.
• Release notes are generated from this changelog and include the checksum and first-launch steps.

Verify the download

SHA-256: ce4f92f5ff09f9564f898d41688bc47a40ffb6d5d6c20f4e39cd9938a97d4bf5

shasum -a 256 -c GhostProcessSniper-2.1.0.dmg.sha256

This disk image was built from the tagged source by the Release workflow, which publishes a signed build-provenance attestation. With the GitHub CLI you can confirm the file came from that build:

gh attestation verify GhostProcessSniper-2.1.0.dmg --repo mikkel32/ghost-process-sniper

Prefer to build it yourself? git clone https://github.com/mikkel32/ghost-process-sniper && cd ghost-process-sniper && Scripts/dev.sh run (details).

Full changelog: v2.0.0…v2.1.0

Ghost Process Sniper 2.0.0

Ghost Process Sniper 2.0 is a verdict-first redesign: every screen now leads with one clear answer, stopping understands what it is about to interrupt, search reaches every running process, and the radar measures everything while doing less work.

Highlights

Smarter, safer stopping

• Every stop knows what it is interrupting — apps, editors, databases, containers, git, package installs, builds, dev servers, and model runners — and judges the risk on everything it would really hit.
• Apps are asked to quit like ⌘Q first, so they can save your work. Databases and prefork servers shut down through their main process (Postgres gets its fast shutdown).
• A protection floor that can never be crossed: Ghost itself, the terminal it runs in, loginwindow, WindowServer, launchd, and system processes.
• One-page stop sheet with better alternatives (stop the supervisor that keeps restarting it, or only the leaking helper), live progress, and a plain result. Confirming needs ⌘↩, so Return alone can never stop anything.
• Quick Stop wherever a culprit appears — named for what it does, like Quit TextEdit… or Shut Down postgres….

Search every running process

• Finds apps, helpers, commands, paths, PIDs, and listening ports — including processes outside the watch scope. Filters like port:3000, cpu>50, kind:, and is:, with typo-tolerant fallback.

Sharper detection

• Slow leaks (5 MB/min over twenty minutes) are caught and pinned to the responsible helper; language servers, dev servers, and databases an editor starts are their own families.
• CPU is judged from twenty minutes of exact CPU time: builds are expected bursts, a process pinned at one core is a busy loop.
• Forgotten processes are recognized by how they were launched, idleness, age, deleted working directories, and idle ports.

Faster and lighter

• Every process is measured on every scan, and scans adapt to what's on screen, battery, Low Power Mode, and heat.
• Learning is written behind in memory: in a 300-family test, 30 scans went from 9,684 database row writes to 318.

Temperatures

• M3 and M4 support, sensor discovery on newer Apple chips, and heat attributed to whole jobs (a make -j10 build is one job; Spotlight, Time Machine, and the Docker VM are labelled as system work).

Interface

• Verdict-first popover, Overview, and family pages; All Processes is a native sortable table; Back/Forward (⌘[ ⌘]); the Engine screen moved into Settings › Diagnostics.

Full details: CHANGELOG.

Upgrading from 1.0

Replace the app in Applications. Your history and settings are migrated on first launch, and a backup of the database (Radar.sqlite.bak-v…) is kept before any upgrade that drops tables.

Install

Download GhostProcessSniper-2.0.0.dmg below (universal: Apple silicon + Intel, macOS 26 or later), open it, and drag Ghost Process Sniper into Applications. It lives in the menu bar; choose Open Dashboard for the full console.

First launch

This build is signed ad hoc but not notarized by Apple, so macOS asks you to confirm it once:

1. Open the app and click Done on the warning.
2. Open System Settings → Privacy & Security, scroll to Security, and click Open Anyway.

Or, in Terminal: xattr -dr com.apple.quarantine "/Applications/Ghost Process Sniper.app"

Verify the download

SHA-256  50ee32a71fdf9786cbe33433465ccc93e8faac301e08645468ddf6c0ad0c833c  GhostProcessSniper-2.0.0.dmg

shasum -a 256 GhostProcessSniper-2.0.0.dmg should print the same value.

Ghost Process Sniper 1.0.0

The first public release of Ghost Process Sniper — a native macOS menu-bar radar for runaway, leaking, duplicated, and forgotten processes, with real CPU and GPU temperatures. Everything stays on your Mac: no network access, no admin rights, no helper tools.

Install

Download GhostProcessSniper-1.0.0.dmg below (universal: Apple silicon + Intel, macOS 26 or later), open it, and drag Ghost Process Sniper into Applications. It lives in the menu bar; choose Open Dashboard for the full console.

First launch

This build is signed ad hoc but not notarized by Apple, so macOS asks you to confirm it once:

1. Open the app and click Done on the warning.
2. Open System Settings → Privacy & Security, scroll to Security, and click Open Anyway.

Or, in Terminal: xattr -dr com.apple.quarantine "/Applications/Ghost Process Sniper.app"

What's in 1.0.0

• Menu-bar radar that turns orange or red when something needs attention, with a one-click summary.
• Leak, CPU-runaway, and GPU-load detection using trend baselines and forecasts, explained in plain language.
• Process families that group apps, helpers, dev servers, and the workers they spawn.
• Duplicate finder for identical dev servers and watchers left running by old sessions.
• Real temperatures from hardware sensors, plus What's heating your Mac?, which ties heat to the apps doing the work.
• Incident history, rules, and an Engine view showing what the radar itself costs.
• Careful stops: previews pin exact PID + start-time identities, re-check protected processes, expire after 60 seconds, and always need your confirmation.

See the user guide and the changelog.

Verify the download

SHA-256  04a96c54c8c3edb9c398e0f80cc40ff6e447826942fc79919161a10e3d186e51  GhostProcessSniper-1.0.0.dmg

shasum -a 256 GhostProcessSniper-1.0.0.dmg should print the same value.