Siri, Spotlight & Shortcuts
Ask your Mac out loud or from Spotlight whether it is behaving, and wire Anomalous into Shortcuts and automations with App Intents.
Available intents
Anomalous publishes a small set of actions — Apple calls them App Intents — that macOS wires into Siri, Spotlight, the Shortcuts app, Control Center, and the widget. The same action behaves identically whether you speak it, type it, or tap it, because a single file is the one front door for every surface.
Six intents ship today:
- Show Status — answers "is my Mac behaving normally?" in one honest sentence, and returns that sentence as a value other Shortcuts steps can use.
- Run Scan — triggers one immediate check of every process right now instead of waiting for the next periodic tick, then reports the result.
- Snooze Alerts — silences anomaly notifications globally for one hour or the rest of the day, while detection keeps running underneath.
- Mark Normal for Me — accepts one specific anomaly's current behavior as normal for you. It never mutes permanently: you are re-alerted only if that behavior gets materially worse, changes, or the process restarts.
- Snooze Anomaly — time-boxes a snooze on a single finding, which re-surfaces when the snooze expires or sooner if it worsens.
- Set Monitoring — turns monitoring on or off; this is the intent behind the Control Center toggle.
Three of these — Show Status, Run Scan, and Snooze Alerts — are registered as ready-to-use Siri and Spotlight shortcuts with natural phrases, so no setup is required. The other three power buttons and toggles: the ambient widget shows "Snooze 1h" and "Normal for me" on each flagged anomaly, and Control Center offers a "Monitoring" on/off toggle plus a "Run Scan" button.
Under the hood
Every intent lives in App/Sources/SharedIntents.swift and is compiled into both the main app and the widget/Control Center extension. When an intent runs inside the app, an IntentBridge is wired to live state (App/Sources/AppState.swift:463-473) and it acts directly. When the same intent runs inside the sandboxed widget process — which cannot touch the app's memory — it reads a shared App Group status file and enqueues a signed command for the app to drain. Commands are signed with a shared Keychain key so the app rejects any forged by another same-user process (SharedIntents.swift:45-54); unsigned commands are enqueued but rejected as the safe default.
Live anomalies and their diagnoses are also exposed as queryable App Intent entities — AnomalyEventEntity and DiagnosisEntity (SharedIntents.swift:66-133) — carrying a process name, kind, short summary, and safety tier. That is local system telemetry, not personal content, and it is what lets the snooze and acknowledge intents target one specific finding.
Asking Siri
Because three shortcuts register with natural phrases, you can just ask Siri without training a fixed command. Try any of these:
- "Is my Mac behaving normally with Anomalous"
- "Show Anomalous status"
- "Run a scan with Anomalous" / "Scan my Mac with Anomalous"
- "Snooze Anomalous alerts" / "Quiet Anomalous for a while"
Show Status replies in one plain sentence — for example "Yes — all systems nominal. Watching 400 processes," or "1 anomaly needs attention. Top: dasd — Stuck retry loop," or "Monitoring is paused." Run Scan does an immediate pass and reports what it found. Snooze Alerts asks how long (defaulting to one hour) and then goes quiet.
Under the hood
The phrases are declared in App/Sources/AppShortcuts.swift:6-39. The status sentence is built by SensorStatus.summaryLine in AnomalousCore/Sources/AnomalousCore/Detection/AcknowledgmentStore.swift:392-407. Every reply is generated on-device from local sensor state — the intent code makes no network calls. Apple forbids an app extension from declaring its own shortcuts provider, so the shortcuts are registered app-side only (AppShortcuts.swift:3-5).
From Spotlight & Shortcuts
The same three actions — Status, Run Scan, Snooze Alerts — appear as tiles in Spotlight and in the Shortcuts app, each with an icon and short title. Press ⌘Space, start typing "Anomalous," and pick an action to run it without opening the app. In the Shortcuts app, the same tiles can be dragged into a custom shortcut.
You can also reach the button-style actions where they live: open Control Center for the "Monitoring" toggle and "Run Scan," and use the widget's per-anomaly "Snooze 1h" and "Normal for me" buttons. See notifications for how "Normal for me" teaches your baseline, and the difference between snoozing and acknowledging.
Building automations
Because Show Status returns its sentence as a value, you can chain Anomalous into your own Shortcuts. A few practical patterns:
- Morning check. A shortcut that runs Show Status and speaks or displays the result, so you get a one-line health read at login.
- Focus mode. Trigger Snooze Alerts (rest of today) when a Focus turns on, so detection keeps running but stays quiet during meetings.
- On-demand scan. Bind Run Scan to a keyboard shortcut or Stream Deck key for an instant check before a big export or render.
Anomalous never asks you to configure what it watches — automations only decide when you ask it a question or quiet it. Everything runs locally; see privacy for what stays on your Mac.
The sensor is open source on GitHub, and the process-identity corpus that grounds every diagnosis is a PR-able data set — corrections and new entries are welcome at the corpus repo (it may still be private today).