Features should knock first

Open an app you’ve used for five years. Count the buttons you’ve never pressed.

There’s a sidebar you don’t remember agreeing to. An AI button that showed up one Tuesday. A share menu full of services you’ve never opened. Each one arrived in an update, moved in, and stayed.

Nobody asked you. Nobody had to. That’s just how apps grow.

Here’s the question that changed how I build: who invited all this?

Fixtures and guests

There are two ways a feature can join a piece of software.

It can be a fixture — wired into the walls. You can’t remove it. If it exists, you’re trusting it, whether you use it or not.

Or it can be a guest. A guest knocks. A guest says what it wants to touch before it touches anything. And a guest can be asked to leave — taking its things with it.

Almost all software is built the fixture way, because fixtures are easier to build. Each one seems harmless on its own. But fixtures only ever pile up, and every new one stretches what “I trust this app” has to cover.

A feature you can’t remove is a decision you can’t take back.

How a guest arrives

In Clabrate, features arrive as extensions — signed packages you install and remove in Settings → Add-ons. And the rule isn’t just for strangers’ code. Our own tools ship the same way. The tool that searches your notes is an extension, built and signed like any stranger’s would be.

Before a guest gets anything, you see a card in plain words. Not a license agreement — a short list of what it may touch. If an extension wants to keep data on your Mac, the card says how much: “up to 32 MB,” not “some storage.” If a tool can reach the internet, its card carries an amber warning: data may leave your Mac.

And when the app meets a permission it doesn’t recognize, the label rounds up, never down: unknown means risky, not “probably fine.”

Leaving means leaving

Turn an extension off, and something stronger than hiding happens.

Take window snapping. Switch it off, and the assistant forgets windows exist. You can’t talk it into moving one — the tools that could are gone, so there’s nothing left to misuse.

A guest’s things stay its things, too. Any extension that keeps storage shows a live count of what it’s using, next to a “Delete data…” button. One click, and it’s gone. You never have to wonder what got left behind in some folder.

Why go to this much trouble

Because trust shouldn’t be a lump sum.

The fixture model makes you re-trust the whole app every time it learns a trick. The new feature can do whatever the app can do, and your only vote is uninstall. That’s a bad deal, and we’ve all stopped noticing how bad.

The guest model keeps the sizes honest. You trust the core with your voice — that trust is earned first, and it stays on your Mac. Then each new ability earns its own, smaller yes. A window mover gets windows. A note reader gets notes. Nobody gets everything.

Here’s the honest cost: guests are slower to build. Every capability needs a boundary, an honest card, a delete button. A fixture is one afternoon; a guest is a week. We think the week is the product.

Check the guest list

Try this tonight. Open the extensions or add-ons page of any app you rely on. Read what each entry says it can do — if it says anything at all. Then turn one off and check: is it gone, or just hidden?

If you want to see the guest version, Clabrate’s list is in Settings → Add-ons, badges and delete buttons included. But the idea doesn’t need our settings page. Software should knock.

In five years, I want you to open this app, count the buttons, and remember saying yes to every one of them.