Should I vibe code
Mac launcher with extensions, snippets, clipboard history, and AI
Clipboard history is a keylogger you asked for. macOS marks password copies concealed; your version has to notice.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
A hotkey that opens a window and calls a model is an evening, and it will feel great for about a week. Two things then happen. The first is that a launcher lives or dies on latency and muscle memory — 40ms to first paint, ranking that puts the right result first because it remembers you chose it last time, and a keystroke you never have to think about — and none of that is a feature you add later. The second is quieter and is the actual reason this entry exists: clipboard history. An always-on pasteboard recorder is a small, cheerful piece of software that will faithfully archive every password you copy out of your password manager, every API key, every one-time code. macOS has a convention for marking those copies concealed, and a homemade recorder does not honour it unless somebody thought to. Build the launcher for fun. Think hard before you build the clipboard.
What actually breaks
not "if". the specific failures.
- Clipboard history: every password, API key, recovery code and one-time code you copy, retained indefinitely in a local store, unless you filter org.nspasteboard.ConcealedType, org.nspasteboard.TransientType and org.nspasteboard.AutoGeneratedType
- That store, unencrypted on disk, readable by every process running as you — including whatever you installed last month
- Cloud sync, which turns the above into a copy of your secrets on a server, and the server is you
- Latency, which is the only feature. A launcher that takes 200ms to appear is a launcher you stop using without ever deciding to
- Ranking, which is the second only feature — frecency, prefix matching and remembering what you actually picked last time
- The Accessibility and Input Monitoring permissions you granted to code generated on a Sunday, which cover a lot more than opening apps
- macOS releases, which will break something about window management or focus handling roughly annually, on Apple's schedule rather than yours
- The extension ecosystem, which is not a weekend and is the reason you will keep Raycast installed anyway
Is that you?
the verdict is a default, not a law
- It is a launcher and a snippet expander with no clipboard capture at all
- You want a few workflows nobody has written an extension for, and you are building those rather than a platform
- Everything stays on the machine, with no sync and no account
- You treat it as a toy that you personally maintain, because that is exactly what it is
- You are recording clipboard contents without filtering the concealed and transient pasteboard types
- The clipboard database is unencrypted and unexpiring on disk
- You are planning to sync any of this to a server you also wrote
- You are distributing it to colleagues, at which point their secrets are in your storage format and your update mechanism
If you build it anyway
the checklist, then the prompt that enforces it
- Before storing a single clipboard item, implement the exclusion list: org.nspasteboard.ConcealedType, org.nspasteboard.TransientType, org.nspasteboard.AutoGeneratedType. Maccy has done this for years and its handling is worth reading before you write yours.
- Add a heuristic layer on top of the pasteboard types — high-entropy strings, anything from a known password manager, anything shaped like a token — and default to not storing rather than storing.
- Give clipboard entries a default expiry measured in hours, plus an obvious purge command. Unbounded retention is what turns convenience into exposure.
- Encrypt the clipboard store at rest with a key from the Keychain, and keep it out of Time Machine and any cloud-synced folder.
- Build the exclusion and expiry behaviour before the search UI. The fun part is the search UI, which is exactly why it must come second.
- Do not sync clipboard history anywhere. If you want sync for snippets and notes, sync those and leave the clipboard local.
- Measure first-paint latency from keypress and treat anything over 50ms as a bug, because a slow launcher is not a launcher.
- Be deliberate about Accessibility and Input Monitoring: request them late, explain each one, and revoke them the day you stop using the tool.
I am building a macOS launcher for myself: global hotkey, app and file search,
snippets, clipboard history, and an AI chat panel. The dangerous component is the
clipboard recorder. Order the work accordingly and refuse if I ask you to reorder.
1. Build clipboard exclusion before clipboard capture. Filter
org.nspasteboard.ConcealedType, TransientType and AutoGeneratedType, and show me
a test proving a password copied from a password manager never hits disk.
2. Add a second layer of refusal: high-entropy strings, common API key prefixes, and
anything copied from an app on a denylist. When in doubt, do not store it.
3. Clipboard entries expire by default — hours, not months — and there is a purge
command I can bind to a key. Make retention a visible setting, not a constant.
4. Encrypt the clipboard store at rest with a Keychain key. Keep the file out of Time
Machine and out of any cloud-synced directory, and tell me where you put it.
5. Nothing syncs. No account, no server, no telemetry. If I later ask for sync,
sync snippets and notes only, and refuse for clipboard history.
6. Request Accessibility and Input Monitoring as late as possible, one at a time,
each with a plain-language explanation of what it grants. Never ask for what a
feature does not need.
7. Measure and print time from keypress to first paint. Treat anything above 50ms
as a defect and tell me what is costing the milliseconds. This is the product.
8. Build ranking as frecency plus prefix match plus explicit user selection history,
and make it explainable — I want to know why a result is first.
9. AI calls are explicit and on demand, keyed from my own Keychain credentials, and
never include clipboard contents or window titles unless I paste them myself.
10. No plugin system. Do not invent an extension API for an audience of one; write
the four commands I actually need.
11. Out of scope unless I ask: window management beyond simple halves, calendar
integration, and any daemon with more privilege than the launcher itself.
12. If I ask you to store clipboard history without exclusions 'just for now', stop
and tell me that 'just for now' is how a keylogger ends up in my home directory.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
For most people, immediately, and note that the free tier already covers the launcher, snippets, window management and three months of clipboard history. Ten dollars a month buys unlimited history, cloud sync, and — the real value — an extension store other people maintain, which is a thing you cannot build and cannot replace. The strong case for building is narrow and legitimate: a handful of workflows specific to your job that nobody will ever write an extension for. Build those as small commands, and keep Raycast for everything else.
$10/mo is cheaper than your weekend.
Trivial, and worth doing properly anyway. Snippets and quicklinks export to JSON or plain text, so keep them there rather than in an opaque store. On the way out, purge the clipboard database rather than merely deleting the app, and revoke the Accessibility and Input Monitoring grants in System Settings — those outlive uninstallation and nothing reminds you. Raycast, Alfred and LaunchBar all import snippet lists, so the switching cost is an afternoon.
Open-source app launcher prior art; strongest on Linux, not a full Raycast-for-Mac replacement.
Open-source macOS launcher with search, window management and clipboard features — the closest thing to a readable reference implementation.
Lightweight macOS clipboard manager that already ignores the concealed, transient and auto-generated pasteboard types. Read this before writing your own.
Questions
Is clipboard history really worth a dataSensitivity of 8?
Think about what passes through your pasteboard in a normal week: a database password, an API key you were rotating, a 2FA code, a recovery phrase, a private URL with a token in the query string. A clipboard recorder is a complete, timestamped log of that, and unlike a keylogger it is one you installed on purpose. The blast radius stays at 1 because it is all yours — but the sensitivity of what is in that file is as high as anything on this site.
Why DEMO ONLY rather than SHIP IT? It is a local tool.
Because the gap between the demo and the product is unusually wide and unusually boring. Hotkey, window, fuzzy search: one evening. Sub-50ms first paint, ranking that feels psychic, snippets that expand in every app, window management that survives a macOS update, and an extension for every service you use: that is the product, and no amount of weekend gets you there. The clipboard risk sharpens it, but the verdict is really about the ecosystem you would be walking away from.
What if I only build the AI panel?
Then it is a good build and an easy one — a hotkey, a text field and your own API key, with no clipboard capture anywhere near it. That version is closer to SHIP IT and it is the one worth doing, because it is the piece Raycast charges extra for and the piece with the least surface area.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
A launcher is a fuzzy search over things you already have. Nothing here can hurt you.
The clipboard manager is a day's work. Making the same secrets appear on three devices is the actual product.
Desktop macros are scripts with a trigger. You have been building these accidentally for years.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice