Can someone explain why Codexbar is trying to connect via ssh, atuin, and curl?

[NeckBeardPrince]

I just tried to clone a repo, and I got a popup from Little Snitch saying that it was trying to connect to GitHub via SSH. I have other examples of it attempting to use atuin and curl. Why?

[ngutman]

Thanks for reporting this. I dug through the startup and CLI-detection paths, and the short version is: CodexBar does not intentionally exec ssh or curl itself for normal app behavior, but it currently does launch your shell as an interactive login shell to discover CLI binaries and PATH entries.

That matters because launching zsh -l -i / bash -l -i runs your shell startup files (.zshrc, .zprofile, .bashrc, etc). If those files initialize tools like atuin, prompt helpers, version managers, or wrappers that make network calls, Little Snitch will attribute those child processes to CodexBar.

So the likely explanation is:

• atuin comes from shell init being executed during CodexBar’s CLI/path discovery
• ssh / curl are probably side effects of shell startup or shell-integrated tooling on your machine, not CodexBar directly calling those binaries
• CodexBar is not supposed to be cloning repos or talking to GitHub over SSH on its own

I’m looking at reducing how aggressive that shell-based detection is so CodexBar relies more on inherited PATH and known install locations before falling back to shell probing.

[steipete]

Fixed on main in 8413329.

CodexBar now resolves explicit overrides, captured login PATH, inherited PATH, and well-known install locations before falling back to an interactive login-shell probe. That means common installs like /opt/homebrew/bin/claude, ~/.local/bin/claude, ~/.claude/local/claude, and cmux.app are found without running shell init hooks that can trigger tools such as atuin, ssh, or curl.

Verification:

• swift test --filter PathBuilderTests
• swift test
• pnpm check
• ./Scripts/compile_and_run.sh rebuilt, packaged, relaunched CodexBar.app, app stayed running
• GitHub Actions CI 25361817996 green on main after rerunning the hosted macOS xctest-launch flake
• Pages 25361817217 green