Manifa

macOS

Installing

curl -fsSL https://manifa.dev/install | sh

The installer detects your chip and pulls the right release: aarch64-apple-darwin (Apple silicon) or x86_64-apple-darwin (Intel). No Xcode or Rust toolchain needed for the CLI itself.

The CLI

Every command works exactly as documented in the CLI reference — login, init, vault create, sync, watch, daemon start, env, device, recovery all behave identically to Linux. Your device's local keypair (generated on mani device enroll / first mani init) is stored in the macOS Keychain; its private half never touches disk in plaintext and never leaves the device. See vaults and devices for what that keypair is for.

One difference: mani mount <vault> <path>, which mounts over FUSE, is Linux-only and errors on macOS. Here the same command takes --finder instead of a path and hands the vault to Finder through Apple's File Provider framework — same idea, different plumbing, and it needs the app below.

Finder integration

Manifa Vault.app presents a vault in Finder the same way iCloud Drive or Dropbox do: the whole tree appears under Locations immediately and takes almost no disk space, and a file's bytes stream in the moment you open it. It shares its core with mani mount — the same Rust placeholder model and chunk-decryption logic — wired to Finder through Swift instead of to the Linux kernel through FUSE:

Finder ──► fileproviderd ──► FileProviderExtension (Swift)
                                   │  enumerate / stat / fetch / decrypt
                                   ▼
                             Rust core (C-FFI): placeholders + crypto
                                   ▲  ciphertext (presigned GET)
                                   │
                             Tigris CAS + Convex control plane

Download the signed, notarized app from the download page. It requires macOS 13 Ventura or newer and is universal (Apple silicon and Intel).

Setting it up

mani ships inside the app bundle, so the CLI and the extension can never be different versions. Put it on your PATH once:

sudo mkdir -p /usr/local/bin
sudo ln -sf "/Applications/Manifa Vault.app/Contents/MacOS/mani" /usr/local/bin/mani

Open Manifa Vault.app once — that is what makes macOS create the App Group container the next two commands need. Then, per vault:

mani daemon start --finder     # vends keys in memory over an app-group socket
mani mount --finder <vault>    # provisions the vault for the extension

Back in Manifa Vault.app, switch the vault on; it appears in Finder's sidebar under Locations. The app is a status window and a switchboard — everything it tells you to do is a mani command, which is why the symlink above is not optional.

Nothing is written to disk in plaintext: mani daemon start --finder holds the Vault Key in memory and vends it to the sandboxed extension over a socket in that App Group container. Run it again after a reboot — the keys are gone with the process, and until it is back the vault shows in Finder but stays empty.

Uninstalling

If you installed the CLI on its own:

rm $(which mani)

If you installed the app, mani is a symlink into it. Switch every vault off in Manifa Vault.app first — that unregisters the Finder domains — then:

sudo rm /usr/local/bin/mani
rm -rf "/Applications/Manifa Vault.app"

Either way this only removes local software — your account, vaults, and recovery code are unaffected (they live server-side and on your other devices). To also forget this device, run mani device revoke <this-device> from another enrolled device first.