TL;DR

Quit every coding agent and editor that launches MCP servers, then run uv cache prune. A running session holds the cache lock, so prune prints “Cache is currently in-use, waiting for other uv processes to finish” and, after uv’s lock timeout, gives up. Do not use --force to skip it. Expect much less back than prune reports: on this Mac it reported 111.1 GiB (about 119 GB) removed and the disk gained 27.5 GB, most likely because cloned files share blocks.

$ uv cache size -H
$ df -h /
$ diskutil info / | grep "Container Free Space"
$ lsof "$(uv cache dir)/.lock"
$ uv cache prune

My Mac was down to 38.4 GB free on a 1 TB disk. The largest directory on it was a 132.7 GiB uv cache that I had never thought about. The coding agents I use launch MCP servers with uvx, and that was enough to fill it.

uvx is uv’s command for running a Python tool from a temporary environment, without installing it. If you have never run uv by hand, an agent or editor ran it for you. This page is part of a series on cleaning up a developer Mac’s disk. Part one of the series, finding what’s filling the disk, is how to know the cache is the cause; you don’t need it to follow the steps here.

Check the size and location of the cache

The environments uvx builds go in uv’s cache. Ask uv for the size and the directory:

$ uv cache size -H

warning: `uv cache size` is experimental and may change without warning. Pass `--preview-features cache-size` to disable this warning.
132.7GiB

$ uv cache dir

/Users/<user>/.cache/uv

uv labels uv cache size as experimental, which is the reason for the warning. The number is still the one to start from. The --cache-dir option, the UV_CACHE_DIR and XDG_CACHE_HOME variables and the tool.uv.cache-dir setting move the directory, according to uv’s cache documentation (opens in a new tab). Every command below reads the directory from uv cache dir, so it follows a moved cache.

Find what fills the cache

Environments that uvx builds sit in the cache’s archive-v0 directory. Count its entries, then count the ones that are Python environments, which have a pyvenv.cfg at their root:

$ ls "$(uv cache dir)"/archive-v0 | wc -l
$ find "$(uv cache dir)"/archive-v0 -maxdepth 2 -name pyvenv.cfg | wc -l

On this Mac, archive-v0 held 4,005 entries, and 2,562 of them were environments. To see which MCP servers the environments belong to, count the executables with mcp in their names in the environments’ bin directories (a server named otherwise needs its own pattern):

$ ls -d "$(uv cache dir)"/archive-v0/*/bin/*mcp* | xargs -n1 basename | sort | uniq -c | sort -rn | head

Nearly all of the environments were copies of three MCP servers, with 1,150, 1,143 and 191 copies, plus 50 of a fourth. One server’s environments held only 158 distinct sets of installed packages, and environments built on the same day had the same installed packages.

Why each launch can add an environment

An MCP server configured as uvx <server>@latest asks uv to resolve the latest version on every launch. With uvx -v, the log shows uv fetching the latest version and revalidating the index. Launching one server did not explain more than a thousand copies, so I measured when a launch adds an environment:

When several sessions start together and the resolution isn’t cached yet, each launch builds its own environment. Once the resolution is cached, launches add nothing. That implies pinning a version, instead of @latest, would stop most of the copies. I didn’t test that. I also didn’t check whether a later release of uv reuses an environment that another process built moments earlier. All of this is uv 0.11.12.

Choose between uv cache prune and uv cache clean

uv cache prune removes the cache entries nothing uses, and all centralized project environments, which uv recreates as needed. uv cache clean removes every entry and empties the cache; uv cache clean <package> removes one package’s entries. Both are described in uv’s cache documentation (opens in a new tab). This page uses prune, which here took the cache from 132.7 GiB to 3.9 GiB and left 540 entries in place. I didn’t run clean.

Quit every session that holds the cache lock

Each running uvx process holds the cache lock, the .lock file in the cache directory, for as long as its server runs. Cache-modifying commands wait for the lock, so a prune started now waits too. List the holders:

$ lsof "$(uv cache dir)/.lock"

COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
uv      <pid> <user>   9u   REG  <dev>        0 <inode> /Users/<user>/.cache/uv/.lock
uv      <pid> <user>   9u   REG  <dev>        0 <inode> /Users/<user>/.cache/uv/.lock

lsof prints nothing when the lock is free; empty output from a path that is not your cache directory is not a clear lock. Each row is one uvx process. To find the session that started it, look up the parent of each <pid>:

$ ps -o ppid= -p <pid>
$ ps -o comm= -p <ppid>

On this Mac, one holder was launched by a Claude Code session and another by the VS Code extension host. Quitting a session or an editor ends its uvx children, which release the lock:

1. Run lsof "$(uv cache dir)/.lock".
2. Look up the parent of each <pid>.
3. Quit that session or editor.
4. Run lsof again until it prints nothing.

Record free space before pruning

The comparison needs readings from before the prune, so take them now and save the output:

$ df -h /
$ diskutil info / | grep "Container Free Space"
$ uv cache size -H

Run the prune

This command deletes cached environments. With nothing running, it removed every environment in the cache, not only the ones that no process referenced. The next launch of each MCP server builds a fresh environment. Run it from a plain Terminal window, not from inside one of the sessions you quit:

$ uv cache prune

Pruning cache at: .cache/uv
Removed 7278379 files (111.1GiB)

It took 409 seconds. Do not interrupt it.

Check the space you got back

The free space went up by much less than 111.1 GiB. Run the same three commands again and compare them with the readings you saved:

The container gained 27.5 GB. uv reported 111.1 GiB removed, which is about 119 GB. uv prints binary units (GiB, 2^30 bytes) and diskutil prints decimal ones (GB), so do not compare the two figures as equals. Even in the same unit, the disk got back about a quarter of what uv reported.

The explanation that fits is the link mode; I didn’t test it directly. uv’s default on macOS is clone, per uv’s settings reference (opens in a new tab), which makes APFS copy-on-write clones. Environments share blocks with each other and with the cached wheels. uv 0.11.12 counts every cloned file at its full size, and deleting a clone frees nothing when another file still uses its blocks. uv’s cache documentation (opens in a new tab) describes a cache-physical-space preview feature that accounts for copy-on-write clones; I didn’t test it.

du -sh agreed with uv cache size at 3.9G after the prune. That is a drop of 128.8 GiB from 132.7GiB, while prune printed 111.1GiB removed; I did not find why the two differ.

A local snapshot could also hold space after a delete. On this Mac, tmutil listlocalsnapshots / listed none, and diskutil apfs listSnapshots showed none on the data volume, so no snapshot was holding any.

Confirm your MCP servers still start

The prune left archive-v0 with 540 entries and no environments, and emptied environments-v2. Start each agent or editor that uses MCP servers and open a session. Each server builds a fresh environment on its next launch; on this Mac, one appeared at the next session start. Check:

$ find "$(uv cache dir)"/archive-v0 -maxdepth 2 -name pyvenv.cfg | wc -l

A count above zero means at least one server built an environment. Check each agent’s MCP server list or status view for errors.

Do this with a coding agent

Paste this prompt into your own local coding agent. It measures and reports, and it proposes before anything is removed:

Investigate my uv cache on this Mac. Measure and report only; change nothing yet.

1. Report the cache directory (uv cache dir) and its size (uv cache size -H).
2. Report how many entries in archive-v0 are Python environments (a pyvenv.cfg
   at the root), and which tools they belong to (the executables in their bin
   directories).
3. Report free space two ways: df -h / and diskutil info / (Container Free
   Space).
4. List every process holding the cache lock (lsof on the .lock file in the
   cache directory), and for each one its parent process, so I can tell which
   agent or editor session to quit.
5. Separate what is safe from what is in use: running uv processes, open agent
   or editor sessions, and any project whose own virtual environment lives
   inside the cache. If this session is itself one of the lock holders, say so
   and stop; I will run the prune from a plain Terminal.

Then propose each removal as a separate item, with the command and the current
cache size as an upper bound. uv has no dry run, so do not state an expected
figure, and note that APFS clones make the real gain smaller. Remove nothing until I approve that item. Remove only
through uv's own command (uv cache prune). Never delete files under the cache
directory by hand and never use --force. Afterwards, report free space again
with the same two readings and say how far the figure uv printed is from the
space actually gained.

Common failures

Cache is currently in-use, waiting for other uv processes to finish

Cache is currently in-use, waiting for other uv processes to finish (use `--force` to override)

Another uv process holds the cache lock, and uv cache prune and uv cache clean wait for it. Run lsof "$(uv cache dir)/.lock", quit the session that owns each holder as described earlier, and run the command again. Nothing was changed while it waited: I stopped a prune that had waited eight seconds, and the cache was unchanged.

These uv cache commands give up after a timeout; uv’s cache documentation (opens in a new tab) gives its value and the UV_LOCK_TIMEOUT environment variable that changes it. Waiting longer does not help while a session still runs its server.

Do not use --force. The documentation reserves it for cases where no other uv process is reading or writing the cache, and a running uvx server is exactly such a process.

TL;DR

Record the free space, then narrow down one level at a time with du until a directory belongs to one tool. That tells you which cleanup you need. Clean it with that tool’s own command where it has one, never with rm on a cache a tool manages, and record the free space again; the cleanup’s own report is not what the Mac got back.

$ diskutil info / | grep "Container Free Space"
$ du -hd 1 ~ 2>/dev/null | sort -hr | head -15

My Mac had 37.7 GB free on a 1 TB disk. I expected Xcode to be the reason, since I keep a full set of iOS simulators, and Xcode did hold 79 GiB. The largest directory was a 132 GiB uv cache, which I had never thought about: most of the entries in it were environments uvx had built for MCP servers, covered in part 2. Which directory is largest on your Mac depends on what you build and which tools you run. The method for finding it is below, and the series covers each cause.

Record the free space before you start

On a modern Mac, df -h / reports the sealed system volume, so its Used column is misleading:

$ df -h /

Filesystem        Size    Used   Avail Capacity iused ifree %iused  Mounted on
/dev/disk3s1s1   926Gi    13Gi    40Gi    24%    484k  423M    0%   /

/ is the sealed system snapshot. Your files live on the Data volume in the same APFS container. Every volume in a container draws on one pool of free space, so Used for / counts the system alone, and Avail is the pool. The container’s own figure comes from the startup disk’s container only, so an external APFS drive cannot be mistaken for it:

$ diskutil info / | grep "Container Free Space"

   Container Free Space:      65.8 GB (65847853056 Bytes) (exactly 128609088 512-Byte-Units)

This reading was taken after the cleanup, so it does not match the df output above, which was taken partway through, or the 37.7 GB before any cleanup. df -h prints GiB and diskutil prints GB, so the same moment looks different in the two units. Use one of them for every reading, or the difference between the units looks like progress. A Mac keeps writing while you work, so treat a change of a gigabyte or two as noise.

Find what’s taking up space with du

du reads sizes and changes nothing. 2>/dev/null hides the permission errors that protected directories print.

1. List the largest directories in your home directory:

   Command

   $ du -hd 1 ~ 2>/dev/null | sort -hr | head -15

2. Skip the first line, which is the total for the directory you ran it on. Run the same command on the largest directory below it, and repeat until the directory belongs to one tool. On this Mac, that took three levels: ~/.cache, then ~/.cache/uv, then ~/.cache/uv/archive-v0.

3. Check the two places that hide the most, even if they didn’t top the first list:

   Command

   $ du -hd 1 ~/Library/Caches 2>/dev/null | sort -hr | head -15
   $ du -hd 1 ~/Library/Developer 2>/dev/null | sort -hr

4. For a package manager, ask the tool where its cache is rather than assuming a path. pip on macOS uses ~/Library/Caches/pip, not ~/.cache/pip:

   Command

   $ uv cache dir

   Output

   /Users/<user>/.cache/uv

   Command

   $ python3 -m pip cache dir

   Output

   /Users/<user>/Library/Caches/pip

A du total is an upper bound on what deleting frees. APFS clones share their blocks with the original until one of them changes, and du counts a cloned file at full size wherever it appears.

Match the directory to its cause

These are the directories that were large on this Mac, and the part of this series that covers each one:

For the uv cache, read part 2 before you prune: a running coding session holds a lock that makes the prune wait, and the prune reports far more than the disk gets back. The other parts are listed on the series page.

Some directories stay whatever their size. A Docker volume holds an app’s data, not cache. An app’s Application Support directory holds its state.

Clear Homebrew downloads and Ollama logs

Two directories on the list need no part of their own.

brew cleanup -s removes old versions and the cached downloads of anything no longer installed. It keeps the downloads of what is installed now, so on this Mac it freed about 270 MB of the 1.1 GiB:

$ brew cleanup -s

An app can keep its data somewhere else and still write its logs to the internal disk. My Ollama models live on an external SSD, linked into place:

$ ls -ld ~/.ollama/models

lrwxr-xr-x  1 <user>  staff  ... /Users/<user>/.ollama/models -> /Volumes/<drive>/ollama/models

The logs aren’t linked. List them first:

$ ls -lh ~/.ollama/logs

Here they had reached 947 MB in two files, server-1.log and app-1.log. Yours may have other names. Ollama has no cleanup command for them, so quit Ollama and delete the files that list showed, by name:

$ rm ~/.ollama/logs/server-1.log ~/.ollama/logs/app-1.log

Deleting a log leaves the models and the settings as they are.

Ollama wasn’t in Open at Login, but App Background Activity, under System Settings > General > Login Items, allowed it to run in the background. I turned that off. I didn’t check whether background runs are what filled the logs.

Record the free space again

Run the same command you started with:

$ diskutil info / | grep "Container Free Space"

Here it went from 37.7 GB before any cleanup to 65.8 GB after the uv prune. The cleanup commands had reported more than 140 GB between them. A cleanup command reports what it removed from its own storage; only the container’s figure says what the Mac got back.

Do this with a coding agent

Paste this prompt into your own local coding agent. It finds and reports, and it deletes nothing:

Find what is taking up space on this Mac's internal disk. Measure and report
only; delete, prune or clean nothing. Stay in my home directory, and don't
follow links to external drives.

1. Report free space with diskutil info / (Container Free Space) and
   df -h /, and say which units each prints.
2. Run du -hd 1 on my home directory, then on the largest subdirectory it
   lists (not the total line for the directory itself), and keep going down
   until each large directory belongs to one tool. Also check
   ~/Library/Caches and ~/Library/Developer. Ask package managers for their
   cache paths (for example uv cache dir, python3 -m pip cache dir) instead of
   assuming them.
3. For each directory over 1 GB, report its size, which tool owns it, what
   fills it, and the tool's own cleanup command if it has one.
4. Mark anything that is in use or holds work: running processes using the
   directory (lsof), open coding-agent or editor sessions, uncommitted or
   unpushed changes in any git checkout, Docker volumes, app data under
   Application Support. Say what would be lost if each were removed.
5. Note that du counts APFS clones at full size, so a total is an upper bound
   on what deleting frees.

Then stop and wait. I will choose what to clean.

Common failures

Free space barely moved after a cleanup

Docker reports space inside its VM disk, and du and uv cache size count cloned files at full size. Measure the container with diskutil info / before and after; that is the only figure that says what the Mac got back.

With Time Machine on, a local snapshot can keep a deleted file’s space in use. Time Machine keeps hourly snapshots for 24 hours and deletes them as they age or as space is needed, per Apple’s Time Machine guide (opens in a new tab). List them; on this Mac the list was empty:

$ tmutil listlocalsnapshots /

uv cache prune waits, then times out

uv cache prune waits while any other uv process is running, and every uvx server counts. After five minutes by default (UV_LOCK_TIMEOUT) it gives up; the uv cache documentation (opens in a new tab) covers the lock. Quit the coding sessions that started the servers, then run it again. To see what holds the lock:

$ lsof "$(uv cache dir)/.lock"

Part 2 shows how to find which session holds it.

npm cache clean left ~/.npm large

npm cache clean --force empties npm’s package cache, _cacache. The space is in _npx, where npx keeps the packages it runs; part 4 covers it.

TL;DR

When a video has one keyframe per second, decode only the keyframes and give each one a frame at 30 fps. The result plays 30 times faster than the drive:

$ ffmpeg -skip_frame nokey -i <clip>.mp4 -vf "setpts=N/(30*TB)" -r 30 \
    -map_metadata -1 -c:v hevc_videotoolbox -q:v 65 -tag:v hvc1 \
    -color_range pc -an <clip>_30x.mp4

-skip_frame nokey goes before -i, because it tells the decoder to discard every frame that isn’t a keyframe. setpts=N/(30*TB) gives frame N the timestamp N/30 seconds, so one second of driving becomes one frame of output.

To keep several cameras in sync, render each recording segment separately, pad every camera’s segment with black to the front camera’s length, and join the segments with a stream copy. The script later in this article does that.

A Rivian R1T films five directions for as long as it’s driven. I wanted a hyperlapse of every drive from a summer of footage, one file per camera, so a drive could be cut as a multi-camera edit at 30× speed. An ordinary hyperlapse decodes 30 frames to keep one, and this footage didn’t need that: the truck writes one keyframe every second. Reading only those, a 36-minute drive became 72 seconds of video and took 4.4 minutes to render, with one drive rendering at a time. The hyperlapses for 218 drives, five cameras each, came to 107 GB.

This is part of a series about reading dashcam video without watching it. How to sort months of dashcam footage with Claude Code is the hub, with the prompts and the checks that drove the whole job.

Why keyframes are enough

The Rivian’s clips are H.264 at 30 fps with I- and P-frames only, and one keyframe (an I-frame) every second. A keyframe decodes on its own. A P-frame needs the frames before it, so taking every 30th frame of an ordinary decode still means decoding the other 29.

With -skip_frame nokey the decoder drops the P-frames before decoding them. What reaches the filter is one picture per second of driving, already spaced evenly in time. The setpts=N/(30*TB) filter discards their timestamps and numbers them off at 30 per second. N is the frame’s index and TB is the stream’s time base. Without setpts, the output has the same frames, each still held for a second, and plays at the speed of the drive.

The speed this produces is fixed by the footage: one keyframe per second, shown at 30 fps, is 30×. Footage with a keyframe every two seconds would come out at 60× from the same command.

Check the keyframe rhythm

Before relying on it, count the keyframes in one clip. In a terminal, run:

$ ffprobe -v error -skip_frame nokey -select_streams v \
    -show_entries frame=pts_time -of csv=p=0 <clip>.mp4 | head -3

0.000000
1.000000
2.000000

Pipe the same command to wc -l instead of head for the count. On a 351-second clip it printed 351, and a full 15-minute segment from the truck has 900. On some drives one camera’s keyframes fall at 0.967 s past each second rather than on it, and which camera varies by drive. The spacing is still one second, which is what the speed depends on.

If the times are not one second apart, the hyperlapse still renders, but its speed is the keyframe interval times 30 rather than 30×.

Render one clip

In the folder that holds the clip, run:

$ ffmpeg -nostdin -v error -skip_frame nokey -i <clip>.mp4 \
    -vf "setpts=N/(30*TB)" -r 30 -map_metadata -1 \
    -c:v hevc_videotoolbox -q:v 65 -tag:v hvc1 \
    -color_range pc -an <clip>_30x.mp4

It writes <clip>_30x.mp4 beside the source and changes nothing else. On a 351-second clip of a bridge crossing, the output was 351 frames and 11.7 seconds long, 11.2 MB from a 438.8 MB source.

The encoder options are the part to change on another machine:

• hevc_videotoolbox is the Mac’s hardware HEVC encoder. The Homebrew build of ffmpeg used here includes it; ffmpeg -encoders | grep videotoolbox lists it if yours does.
• -q:v 65 asks it for constant quality rather than a bitrate.
• -tag:v hvc1 labels the HEVC stream the way QuickTime and Apple’s players expect.
• -color_range pc labels the output full range like the footage, which the black filler and the join depend on. Apple’s encoder ignores -pix_fmt yuvj420p with a warning, so it isn’t set here.
• -map_metadata -1 drops the source’s tags, including its GPS fix.
• -an writes no audio track. The truck records none.

Pad each segment to the front camera’s length

The truck splits a drive into 15-minute segments, one file per camera per segment. All five cameras’ files for a segment have the same length, unless a camera stopped recording. If one did, that camera’s segment has fewer keyframes, its hyperlapse has fewer frames, and every later frame of that angle plays early. A camera that is missing a whole segment is worse.

When I first rendered every camera of one drive, two came out at 1,303 frames against the front camera’s 2,170. The rear camera had stopped 33 seconds into a segment and recorded the rest of the drive in a sibling folder.

Pad every camera’s segment to the front camera’s frame count with black, so each segment ends at the same frame on every camera. The numbers in these steps are an example, a 351-keyframe front segment and a camera that stopped 33 seconds in:

1. Count the front camera’s keyframes for the segment, as in the first step. On a 351-second segment, that’s 351.

2. Count the other camera’s keyframes for the same segment. A clip that stopped 33 seconds in has 33.

3. Render that camera’s segment with tpad adding the difference as black frames, and -frames:v capping it at the front camera’s count:

   Command

   $ ffmpeg -nostdin -v error -skip_frame nokey -i <rear-segment>.mp4 \
       -vf "setpts=N/(30*TB),tpad=stop=318:color=black" -r 30 -frames:v 351 \
       -map_metadata -1 -c:v hevc_videotoolbox -q:v 65 -tag:v hvc1 \
       -color_range pc -an <rear-segment>_30x.mp4

The -frames:v cap also trims a camera that recorded slightly longer than the front one.

Fill a missing segment with full-range black

When a camera has no file at all for a segment, render a black part of the same size and frame count. The front, rear and side cameras are 1920 × 1536; the Gear Guard bed camera is 1280 × 720.

$ ffmpeg -nostdin -v error -f lavfi -i "color=black:s=1920x1536:r=30" \
    -frames:v 351 -map_metadata -1 -c:v hevc_videotoolbox -q:v 65 -tag:v hvc1 \
    -color_range pc -an <missing-segment>_30x.mp4

The filler must be full range, the same as the footage. -color_range pc is what makes it so: without it, generated black came out labeled limited range (tv), and -pix_fmt yuvj420p doesn’t help, because Apple’s encoder ignores it. The decoded footage is already full range, so the same options are safe on every part.

A mismatch doesn’t make the next step fail. The join is a stream copy, which converts nothing, and the joined file takes its range label from the first part. A camera whose file opens on limited-range filler is labeled limited range throughout, real footage included. That happened to 11 of the more than a thousand hyperlapse files in my batch, all in folders that held only a fragment of a drive, and they had to be rendered again. The script checks each part’s range before joining, because the joined file shows only the first part’s.

Join the segments without re-encoding

List the parts in order in a text file, one file line each, then join them with the concat demuxer and a stream copy:

$ printf "file '%s'\n" <part-001>.mp4 <part-002>.mp4 > list.txt
$ ffmpeg -nostdin -v error -f concat -safe 0 -i list.txt -c copy <camera>_30x.mp4

Every part was encoded with the same options, so the copy only rewrites the container. It takes seconds.

Script the whole drive

The steps combine into one script per camera. It reads the segment list from the front camera’s files, so a camera missing a segment gets black filler for it. The macOS ._ files beside the clips on the truck’s exFAT drive don’t match its pattern, so they’re skipped. The front camera sets every segment’s length, so all five files come out the same length.

#!/usr/bin/env bash
set -euo pipefail

folder=$1
camera=$2
size=${3:-1920x1536}
name=$(basename "$folder")
encode=(-map_metadata -1 -c:v hevc_videotoolbox -q:v 65 -tag:v hvc1
        -color_range pc -an)

keyframes() {
  ffprobe -v error -skip_frame nokey -select_streams v \
    -show_entries frame=pts_time -of csv=p=0 "$1" | wc -l | tr -d ' '
}

work=$(mktemp -d)
: > "$work/list.txt"

for front in "$folder/${name}_frontCenter_"*.mp4; do
  segment=${front##*_}
  frames=$(keyframes "$front")
  source="$folder/${name}_${camera}_${segment}"
  part="$work/$segment"

  if [[ -f $source ]]; then
    shortfall=$(( frames - $(keyframes "$source") ))
    if (( shortfall < 0 )); then shortfall=0; fi
    ffmpeg -nostdin -v error -skip_frame nokey -i "$source" \
      -vf "setpts=N/(30*TB),tpad=stop=${shortfall}:color=black" -r 30 \
      -frames:v "$frames" "${encode[@]}" "$part"
  else
    ffmpeg -nostdin -v error -f lavfi -i "color=black:s=${size}:r=30" \
      -frames:v "$frames" "${encode[@]}" "$part"
  fi
  range=$(ffprobe -v error -select_streams v -show_entries stream=color_range \
    -of csv=p=0 "$part")
  if [[ $range != pc ]]; then
    echo "$part: color_range=$range, expected pc" >&2
    exit 1
  fi
  echo "file '$part'" >> "$work/list.txt"
done

ffmpeg -nostdin -v error -f concat -safe 0 -i "$work/list.txt" \
  -c copy "${name}_${camera}_30x.mp4"
rm -r "$work"

It writes <drive>_<camera>_30x.mp4 in the current folder. Run it once per camera, from the folder where the hyperlapses belong, and pass 1280x720 as the third argument for the Gear Guard camera:

$ for camera in frontCenter rearCenter sideLeft sideRight; do \
    bash hyperlapse.sh <drive-folder> "$camera"; done
$ bash hyperlapse.sh <drive-folder> gearGuard 1280x720

The script assumes the front camera recorded every segment. If it didn’t, the segment is missing from every camera’s hyperlapse.

Confirm every camera has the same frame count

Same length is the whole point of the padding, so count the frames in each output, and read the pixel format while you’re there:

$ for f in *_30x.mp4; do echo "$f $(ffprobe -v error -select_streams v \
    -count_packets -of compact=p=0 \
    -show_entries stream=nb_read_packets,pix_fmt,color_range "$f")"; done

<drive>_frontCenter_30x.mp4 pix_fmt=yuvj420p|color_range=pc|nb_read_packets=351
<drive>_gearGuard_30x.mp4 pix_fmt=yuvj420p|color_range=pc|nb_read_packets=351
<drive>_rearCenter_30x.mp4 pix_fmt=yuvj420p|color_range=pc|nb_read_packets=351
<drive>_sideLeft_30x.mp4 pix_fmt=yuvj420p|color_range=pc|nb_read_packets=351
<drive>_sideRight_30x.mp4 pix_fmt=yuvj420p|color_range=pc|nb_read_packets=351

Every camera of a drive prints the same count, and every file prints yuvj420p and pc. A camera with fewer frames was not padded. The range here is only the first part’s, because a stream-copy join takes its label from the first part, so the script checks every part’s range before it joins them and stops on one that isn’t pc.

Remove the location before publishing

A hyperlapse runs from the start of a drive to its end. Trim both ends before you publish one, too.

Keyframes vs a setpts timelapse of every frame

Reading only keyframes is what makes this fast, and it fixes what the hyperlapse can be.

On the same 351-second clip, I rendered the 30× hyperlapse twice: once from keyframes, and once by decoding every frame and keeping every 30th with select='not(mod(n,30))'. Both came out at 351 frames. The keyframe render took 4.4 seconds and used about one CPU core. The full decode finished in 7.0 seconds only because it spread across the cores: it used 57 seconds of CPU time, roughly 13 times the work. On one clip that’s a few seconds of waiting. Across a batch of drives, the CPU time is what adds up.

What the full decode buys you is choice:

For dashcam footage with a steady one-second keyframe, 30× was the speed I wanted, so keyframes were the right choice. If the speed has to be something else, decode everything and accept the cost.

The same -skip_frame nokey read is the cheap way to analyze footage, not only to watch it. When you extract keyframes as raw frames rather than encoding a video, add -fps_mode passthrough. Without it, ffmpeg duplicates each keyframe back up to 30 fps, and every frame-to-frame difference you compute reads zero.

TL;DR

Give Claude Code one prompt per stage: survey, move, find, cut, publish. Each prompt states what the agent can’t touch and carries three demands: run on one drive first, break your own check on purpose and confirm that it fails, and list what you couldn’t verify. The agent reads the GPS tag and the keyframes instead of the pixels and proposes candidates. You confirm every pick on a contact sheet before anything is cut, moved, or deleted.

Driving from July to September filled the truck’s 2 TB dashcam drive, a SanDisk Extreme Portable SSD (opens in a new tab) (affiliate link): 240 drive folders, 1,958 GB, five cameras recording on every trip. I wanted to keep only what might make a video, and the backup drive couldn’t hold all of it. Watching it wasn’t an option. I directed Claude Code in plain language instead. It sorted the drives by where they went using GPS, found the I-90 floating bridge by the color of the tunnel lights, cut synced clips, and rendered a hyperlapse of every drive.

Almost every failure in that work was caught by a check: a size comparison, a frame count, a positive control, a contact sheet, or me. One failure was caught by nothing for hours. The prompts in this guide are general versions of the ones I typed, rewritten for your own footage, and each one carries the guardrail that the failure taught.

Signals already in the files

A Rivian writes one folder per drive and one MP4 per camera per 15-minute segment. Two things in those files do most of the work, and neither needs anyone to watch the video:

• GPS. The container’s location tag holds one fix per segment, taken at its start. That’s the only GPS in the file; there’s no per-second track.
• Keyframes. Every camera writes one keyframe per second. Decoding only the keyframes, downscaled to 64 × 48, gives a per-second record of motion and color without decoding the frames between them.

Read the tag from any clip:

$ ffprobe -v error -show_entries format_tags=location -of default=nw=1:nk=1 <clip>.mp4

It prints a signed latitude immediately followed by a signed longitude, such as 47.589462-122.2655. Some tags end in / and most don’t, and 0,0 means the truck had no fix. Read the GPS location from Rivian dashcam video with ffprobe covers every spelling. Other dashcams store GPS differently, which is why the first prompt asks the agent to find out rather than assume.

Tools and rules for every stage

You need:

• Claude Code, run in a terminal on the machine that has the footage mounted
• The ffmpeg and ffprobe commands on the PATH
• The exiftool command, for the privacy stage
• A second drive with room for whatever you keep

Every prompt carries three rules, worded for its stage. They’re repeated on purpose, so that a prompt pasted on its own still carries them:

• One drive first. A bug found on the first drive costs one drive’s time. The same bug found late in a batch costs every drive before it.
• Break the check on purpose. A check that has never failed proves nothing. The agent damages its own input or output, confirms the check catches it, and then restores it.
• Say what couldn’t be verified. Matching file sizes aren’t matching content, and a report that doesn’t say so reads as if they were.

Survey every drive without changing anything

In Claude Code, from the folder that holds the drive folders, paste:

The folder <footage-folder> holds video from my truck's dashcam: one subfolder per drive, and one MP4 per camera per segment. Survey it without changing anything.

For every drive folder, use ffprobe to read each segment's duration and GPS location tag. Report each drive's start time, length, GPS points, the distance between its two farthest points, and its size on disk. Ignore any ._ files macOS has left beside the clips on a FAT32 or exFAT drive.

Rules:
- Read only. Do not move, rename, re-encode, or delete anything.
- Run on one drive first and show me the result before you run the rest.
- The location tag is written in more than one format. Parse it permissively, and treat 0,0 as no fix, not as a place.
- Before you run the whole batch, feed your parser a malformed tag on purpose and confirm that it reports the drive instead of skipping it silently.
- Cache everything you read in one file, so that later steps don't read the drives again.
- Then propose a way to sort the drives into routine and unusual, and wait. I'll tell you my regular routes.
- Finish with a list of the drives you couldn't read and anything you couldn't verify.

What went wrong here. I asked for road trips, and the agent ranked drives by distance. The ranking itself showed there were none: no drive in the batch went far. Distance was the wrong question, and only I could supply the right one: the corridor across the I-90 bridges that most of the drives used. With that, the classification became a corridor test. A drive whose every GPS point falls inside a box around that corridor is a corridor drive; anything else is worth a look. The test found 168 corridor drives, 1,594 GB, and 14 off the corridor worth keeping, 171 GB. That’s why the prompt ends by waiting for you. Your routes are context the agent can’t get from the files.

The parser also failed on its first real run, on a tag that ended in /. The fix was a pattern that finds two signed numbers wherever they sit. Expect the same from your own camera’s metadata, and test both spellings.

Move the drives you keep

Decide which drives to keep from the survey, then paste:

Move these drives from <footage-folder> to <backup-drive>/<kept-folder>: <list of drive folders>.

Rules:
- Before you copy anything, compare the total size with the free space on <backup-drive>, and stop if it won't fit.
- Copy first. After each drive, compare every file's size on the destination with the source.
- Do not delete anything from the source until I say so. Show me the drives whose sizes all match, and wait.
- When I confirm, remove the source files with a tool that removes only what it has copied, such as rsync --remove-source-files. Do not rely on shell-specific glob features.
- Skip any folder that another process, such as Finder, is still writing to or moving.
- Report the empty folders that a move leaves behind. Do not delete them, and make every later step skip them.
- Move one drive first and show me the result.
- Before the batch, truncate a copy in a scratch folder and confirm your size check reports it.
- Say plainly that a size match isn't a content match, and list anything you couldn't verify.

What went wrong here. A queued move used a zsh glob qualifier that the shell Claude Code runs commands in doesn’t enable. It would have copied every file and deleted none. Inspecting the running process caught it, and the move switched to rsync --remove-source-files, which removes only what it copied. Later, a cleanup command of the form rm -f $B/*.jpg was blocked by Claude Code’s own guard, because an unset $B would expand the path to /*. The cleanup wasn’t needed, and the guard was right to stop it.

The moves also left empty drive folders behind. Nothing failed because of them until the hyperlapse run, in a later stage, which is why this prompt asks for them to be reported now.

Find a landmark from computed signals

GPS places a drive to within a 15-minute segment, which is too coarse to find a bridge crossing. The picture has to do it, and the cheap way to read the picture is to compute a few numbers per second once and reuse them. Paste:

I want the moment in each drive where the truck passes <landmark>. The GPS has one point per segment, which is too coarse, so find it from the picture.

1. From keyframes only, downscaled to 64x48, compute per-second signals for each camera: the mean change in green from the previous keyframe, and the mean red, green, and blue. Cache them per drive and per camera, so that no later step decodes video again.
2. Propose a signal that marks <landmark>, and explain why it should separate the landmark from things that look like it.
3. Propose candidates. Do not pick for me.

Rules:
- Read only on <footage-folder>. Write only under <work-folder>.
- When you extract keyframes as raw frames, make sure ffmpeg doesn't duplicate them back up to the source frame rate.
- Before you scan everything, calibrate the signal on a drive where I know the landmark is present and a drive where I know it isn't. If both read the same, suspect your extraction before the signal.
- Run on one drive first.
- Build a contact sheet with one row per drive, labeled with the drive's name, and one frame per candidate in time order. Write a picks file with your best guess for each drive, which I can edit. Then wait for me.
- Ignore the first and last few minutes of each drive, where the truck is parking or leaving.
- If a result contradicts something already confirmed, check your tool before you report the contradiction: extract the same frame two ways and compare them.
- List the drives with no candidate, and anything you couldn't verify.

For a tunnel, the signal turned out to be color. Auto-exposure keeps a tunnel’s brightness close to daylight’s, but sodium lighting tips the front camera’s red/blue ratio above 1.0. A run of 25–150 s above that ratio, away from the first and last 3 minutes of the drive, found a tunnel on 71 of the 79 bridge drives scanned. Seven of the eight misses were after dark. Finding a bridge in dashcam video by the color of tunnel lights is the full account, including what didn’t work.

What went wrong here. The first calibration read zero change between every pair of keyframes, parked or moving. A signal that’s flat on a known positive and a known negative is a broken instrument, not a finding. The cause was ffmpeg duplicating keyframes back up to 30 fps, so consecutive frames were identical. -fps_mode passthrough fixed it. That bug is why the prompt asks for a known positive and a known negative before the scan.

The automatic pick, one tunnel chosen by its position in the drive, was right about two times in three. The rest landed on other tunnels. The contact sheet is what turned an unreliable detector into a usable one. It showed one frame per candidate, taken from the bridge side of the tunnel. From it, I confirmed 68 crossings, couldn’t confirm two night drives, and found none on one. The first sheet was a flat grid of every candidate frame, and it was easy to match a frame to the wrong drive. One row per drive makes that mistake visible.

The worst wrong claim of the whole session came at this stage. Partway through, the agent reported that the picks for some drives were the wrong tunnel, the Mercer Island lid instead of the Mount Baker tunnel. The contact sheets had been built with an output-side -ss, which ffmpeg applied after tiling, so the sheets showed a different window from the one the picks named. Extracting one frame two ways exposed it. The picks had been right, and the claim was retracted.

Cut synced clips and render hyperlapses

With picks confirmed, paste:

For each confirmed pick in <picks-file>, cut a clip from every camera, from <seconds-before> seconds before the landmark to <seconds-after> seconds after it, without re-encoding. Then render a 30x hyperlapse of every drive for every camera, decoding keyframes only.

Rules:
- Read only on <footage-folder>. Write only under <work-folder>.
- A stream copy can start only on a keyframe. Measure each camera's keyframe timing first; do not assume the cameras share it.
- A camera's first frames in a segment file can depend on frames at the end of the previous file. Cut across segment files in one pass, and check the joins.
- After cutting, compare every camera's frame count, duration, and start_time. Same length isn't the same as in sync.
- Pad a camera that stopped early with black frames, per segment, so that every camera stays the same length as the front camera. Give the black the footage's pixel format and color range, and check the range of every joined file.
- Do not trust folder names or file timestamps for timing. If a camera restarted into another folder, measure its offset from cameras that see the same scene, in more than one window. If that offset doesn't land on one of the camera's keyframes, re-encode only that camera, cut at the exact frame, and tell me which files were re-encoded.
- Test on one drive first, and include a drive where a camera stopped early.
- Before the batch, shift one camera by a second on purpose and confirm that your sync check fails. Then restore it.
- In the batch, one bad drive must be logged and skipped, not stop the run. Write each output to a temporary name and rename it when it's complete, so that a rerun resumes.
- Time the test drive and estimate the batch from that.
- If the run will outlive this session, start a watcher that tells me when the run ends or stops making progress.
- List the drives that were skipped or padded, and anything you couldn't verify.

Each keyframe becomes one frame at 30 fps, so a hyperlapse plays at 30× speed. A 36-minute drive became 72 s and took 4.4 minutes to render. The hyperlapses of 218 drives, five cameras each, came to 107 GB. Cut multi-camera dashcam clips with ffmpeg and make a hyperlapse from keyframes with ffmpeg cover each step in full.

What went wrong here. On the first drive I cut, the side-left camera came out short. On other drives it’s a different camera, or none, so the prompt measures every camera. The frame-count comparison caught it twice:

1. Its GOPs run across segment files. Cutting each segment separately and joining them dropped the frames that reference the previous file: the camera came out 1.9 s short, with a jump at the join. One concat-demuxer pass over the source segments keeps them.
2. It was still 29 frames short, because its keyframes fall at n + 0.967 s, not on whole seconds like the other cameras’. Landing each camera’s in-point exactly on its own keyframe makes every file start at time 0. An offset camera starts a few frames early, and setting that clip’s In point that many frames in lines it up with the others.

A third check, on start_time, caught a version that had the right length but started 0.967 s late, which an editor might ignore.

The hyperlapse test drive caught two more. Two cameras came out at 1,303 frames against the front camera’s 2,170. The first guess was the black filler’s pixel format; the real cause was the rear camera stopping 33 s into a segment. The fix is to pad every segment to the front camera’s length. The filler has a trap of its own: it has to be full range like the footage, which takes -color_range pc; Apple’s hardware encoder ignores -pix_fmt yuvj420p. A mismatched part doesn’t make the stream-copy join fail. The joined file takes the first part’s label, so a camera whose file opens on filler was labeled limited range throughout: 11 of more than a thousand hyperlapse files, found and re-rendered later. Across 233 drive folders, six hyperlapse sets needed black-filled segments.

On that same drive, the rear and side-left cameras had restarted into a sibling folder whose name was 34 s later. The name was wrong by more than a second. Correlating motion between the Gear Guard camera and the restarted rear camera, which both face backward, measured 32.7 s ± 0.1 s across four independent windows. Front against rear disagreed by 0.9 s between windows, because those two cameras don’t see the same scene. Rivian dashcam camera missing from a drive covers the restart.

Then the batch failed, and no check caught it. Background jobs in the session stopped at a time limit, so the run was relaunched detached. A detached process sends no notice when it ends. It crashed at 10:11 on one of the empty folders the moves had left behind, and it sat dead until 16:48, when I asked what was next: more than six and a half hours. Two fixes came out of it, and both are in the prompt: an empty or bad drive is now a logged skip, and a long run gets a watcher.

Keep location out of anything you publish

Paste, for each file you mean to share:

Prepare <export-file> for publishing.

Rules:
- Treat GPS in any clip as private. List every metadata field that holds a location, with: exiftool -G1 -a "-gps*" "-location*" <file>
- First run that command on an original clip from the truck and confirm that it finds the location. Then run it on the export.
- If the export carries a location, write a copy without it, run the same command again, and show me the empty result.
- List the first and last frames of every clip, and flag any frame from either end of a drive, any license plate, and any face. Do not decide for me what to blur or cut.
- Also list creation dates, and any drive date or time in file names. Strip them with -map_metadata -1 and rename the files, unless I say otherwise.
- List what this check can't see, such as a street sign or a house number in the picture.

Run the check on every export rather than reasoning about which files carry a tag. In this work the answer differed by tool. The raw clips carry it. The hyperlapse tool I used copies the first source file’s metadata, GPS included, so the set stays traceable; the published hyperlapse script strips it. Clips cut with the concat demuxer came out without it, but a plain -c copy of a single file keeps it, and -map_metadata -1 removes it. Show only public landmarks on screen, and never frames from either end of a drive.

Detectors that didn’t work

Four ideas failed, and each failure says something about the signal rather than the threshold:

• Parked footage. The hypothesis was that recording while parked padded every drive. The measurement found 23 GB of 1,760 GB: with Gear Guard turned off, the truck stops recording seconds after parking. The scan still paid for itself, because its per-second signals fed every detector after it.
• Hard stops. The detector returned 875 candidates, and all 12 at the top were turns into parking lots or ordinary stops. Turning changes the picture as much as braking does.
• Traffic jams. Crawling traffic still changes the picture, because the neighboring cars move.
• Garage boundaries by color. An overcast sky is as gray as a concrete ceiling. It worked on a clear day and failed on a cloudy one, which is the case to test first.

One detector worked with a person in the loop. Close passes, read as a one-sided spike on a side camera while the front camera shows steady driving, were swamped by overpass shadows until the frame’s overall brightness change was subtracted. Of the top 60, 37 were real passes, and a contact sheet sorted them. A human pass was cheaper than a better detector.

Failures and the checks that caught them

Each stage in depth

Each later part of this series takes one stage and stands on its own:

2. Read the GPS location from Rivian dashcam video with ffprobe: the tag’s spellings, a parser, and how to strip it.
3. Rivian dashcam camera missing from a drive: it restarted in another folder: finding the sibling folder and measuring its real offset.
4. Cut multi-camera dashcam clips with ffmpeg without re-encoding, and keep them in sync: snapping each camera to its own keyframe.
5. Make a hyperlapse from keyframes with ffmpeg without decoding every frame: the 30× render, the padding, and the full-range filler.
6. Finding a bridge in dashcam video by the color of tunnel lights: the detector, the review sheet, and what didn’t work.

TL;DR

Find the USB drive with diskutil list, unmount it, write the ISO to its raw device with dd, and eject it.

dd writes to whatever device you name, with no confirmation and no undo. Replace N in diskN with the number diskutil list shows for your USB drive, and check it before the third command.

$ diskutil list
$ diskutil unmountDisk /dev/diskN
$ sudo dd if="$HOME/Downloads/linuxmint-22.3-cinnamon-64bit.iso" \
    of=/dev/rdiskN bs=1m status=progress
$ diskutil eject /dev/diskN

I wanted to repurpose my old Mac, a 2011 iMac, by putting Linux Mint on it. balenaEtcher stopped at “Starting…” on my Apple Silicon MacBook Pro. I wrote the installer drive with dd instead, and the iMac booted from it. dd ships with macOS, so nothing needs installing. It copies the image onto the device block for block, which is what Etcher’s helper does in code.

1. Identify the USB device

$ diskutil list

Find the external disk in the output. Its number replaces N in the commands that follow:

/dev/diskN (external, physical):

Before going further, confirm both:

• The header reads external, physical. Internal disks read internal, physical, and APFS containers read synthesized. Neither is your USB drive.
• The size matches your USB drive.

2. Unmount the disk

$ diskutil unmountDisk /dev/diskN

Unmount, not eject. An ejected disk is removed from /dev. An unmounted disk stays in /dev with no volume mounted, so dd can open it for writing.

3. Write the ISO

This command erases everything on the drive and replaces it with the image. sudo prompts for your administrator password.

$ sudo dd if="$HOME/Downloads/linuxmint-22.3-cinnamon-64bit.iso" \
    of=/dev/rdiskN bs=1m status=progress

Three details in that command:

• "$HOME/Downloads/...", not ~/Downloads/.... The default macOS shell, zsh, doesn’t expand a tilde after if=, and dd reports the file as missing. $HOME expands in every shell.
• rdiskN, not diskN. The r prefix names the raw device, which bypasses the buffer cache and writes faster on macOS.
• status=progress prints the bytes written as it goes, so a slow write shows progress instead of looking stalled.

On this drive, the sustained rate was about 7.6 MB/s, and the 3 GB image took about seven minutes. That rate is the drive’s own write speed, not a fault.

4. Confirm it finished

dd reports the total when it completes:

3091660800 bytes transferred in 404.24 secs (7648047 bytes/sec)

Compare the byte count with the ISO’s size:

$ stat -f %z "$HOME/Downloads/linuxmint-22.3-cinnamon-64bit.iso"

3091660800

The two numbers match and no I/O error was printed, so the write is complete. dd doesn’t read the drive back to verify it the way Etcher does. Booting from the drive, later in this article, is the verification.

When dd releases the device, macOS might report that the disk isn’t readable and offer to initialize it. Choose Ignore or Eject. Initialize opens Disk Utility, where erasing the drive would undo the write.

5. Eject

$ diskutil eject /dev/diskN

What Finder shows afterward

Finder shows unfamiliar partitions, or a fraction of the drive’s capacity. That’s expected: the ISO was written as a raw disk image, not as a file system that macOS can mount. On a 32 GB drive, the image uses about 3 GB, and the rest is outside any partition in this layout. Don’t change anything on the drive until you’ve booted from it.

To return the drive to ordinary use later, erase it as exFAT. This removes the Linux image:

$ diskutil eraseDisk ExFAT USB GPT /dev/diskN

Boot the USB drive

An Intel Mac, such as the 2011 iMac, can boot from this drive. An Apple Silicon Mac can’t.

On an Intel Mac, hold Option during startup and select the external entry. The entry is usually labeled “EFI Boot”, though the label depends on the firmware and on how the drive is enumerated.

TL;DR

When balenaEtcher stays at “Starting…” with no progress bar and no error, check the USB drive’s format. On a drive formatted as APFS, Etcher’s helper receives the write request and never starts writing. Running Etcher as sudo doesn’t change that. Erase the whole drive as exFAT and flash again.

The erase deletes everything on the drive. Replace N in diskN with the number diskutil list shows for your USB drive, and check it before the last command.

$ diskutil list
$ diskutil unmountDisk force /dev/diskN
$ diskutil eraseDisk ExFAT USB GPT /dev/diskN

If Etcher still stops, write the ISO with dd instead, as described in Create a bootable Linux USB drive on macOS with dd.

I wanted to repurpose my old Mac, a 2011 iMac, by putting Linux Mint on it. I wrote the installer USB drive on my Apple Silicon MacBook Pro with balenaEtcher. Etcher stopped at “Starting…” and gave no reason, so I wrote the drive with dd, and the iMac booted from it. Later I reproduced the hang on a second drive to find the cause.

Symptoms

balenaEtcher (also searched as Balena Etcher) detects the drive and loads the ISO. After you click Flash, the window stays at:

Starting...

No progress bar appears and no error is raised. Launching the app from a terminal with elevated permissions makes no difference:

sudo /Applications/balenaEtcher.app/Contents/MacOS/balenaEtcher

Etcher’s DevTools console shows the flasher starting and then stopping short of the write. This is Etcher 2.1.6 with an APFS-formatted drive:

Starting priviledged flasher sidecar on port 3435
/Applications/balenaEtcher.app/Contents/Resources/etcher-util
... with privileges ...
elevated pending
...
elevated granted
etcher-<id>
Connection to sidecar flasher process attempt 1 / 10 failed; retrying in 1000ms...
etcher-<id>
CHILD READY
start heartbeat
params Object
CHILD LOG: Ready ...
CHILD LOG: write requested
CHILD LOG: Image: /Users/<user>/Downloads/<image>.iso
CHILD LOG: Devices: /dev/diskN
CHILD LOG: Auto blockmapping: true
CHILD LOG: Decompress first: true

The log reaches write requested, echoes the job’s settings, and no bytes follow. In the log, <user> is your account name and <image> is the ISO you selected. N is your drive’s disk number, and <id> is a random name Etcher gives each helper run.

APFS drive that stops the helper before the write

Etcher doesn’t write the disk itself. The Electron app launches a separate privileged helper, the “sidecar flasher”, and hands it the image and the device. The CHILD LOG lines after write requested are the helper echoing that request back. Etcher asks macOS for administrator rights for the helper itself, which is what the elevated pending and elevated granted lines record, so sudo adds nothing. Run as sudo, the log is identical.

The log doesn’t show why the helper stops. The drive’s format does. I reproduced the hang with a second USB drive, a different ISO and Etcher 2.1.6, and changed only the format between two runs:

Erased as exFAT, the same flash continued straight into progress:

CHILD LOG: Decompress first: true
Flashing 1 device, 0% at 1.60 MB/s (total 1.60 MB/s) eta in 235s with 0 failed devices

That matches the reports on balena’s forums. One thread (opens in a new tab) states that Etcher doesn’t work on an APFS drive and surfaces no error. Another (opens in a new tab) with this hang was resolved by erasing the drive as exFAT.

A USB drive isn’t APFS unless someone made it so. Disk Utility offers APFS only when you erase the whole device with a GUID partition map, not when you erase a volume on a drive with the older MBR layout. I don’t know what the first drive was formatted as when it hung. dd wrote the Mint image to it without an error, so the ISO and the drive weren’t at fault.

Erase the USB drive as exFAT

The erase replaces the drive’s partition map and every volume on it. Copy off anything you need from the drive first.

1. Find the USB drive

$ diskutil list

Find the header that reads external, physical and matches your drive’s size. Its number replaces N in the next step. An APFS drive also appears a second time, as a synthesized container. Use the external, physical identifier, not the container’s.

2. Erase it

$ diskutil unmountDisk force /dev/diskN
$ diskutil eraseDisk ExFAT USB GPT /dev/diskN

force matters when Spotlight is indexing the drive. Without it, the erase can fail with Couldn't unmount disk. : (-69888) and name the process mds. USB is the new volume name; any name works, because the flash overwrites it.

3. Flash again

Select the ISO and the drive in Etcher, and click Flash. Within a few seconds, the window shows Flashing... with a percentage, and the DevTools log shows Flashing 1 device lines.

Write the ISO with dd instead

If Etcher still stops after the erase, dd writes the image without Etcher’s helper. That’s how the Mint drive in this article was written. The steps, the checks that keep dd off the wrong disk, and how to confirm the write are in Create a bootable Linux USB drive on macOS with dd.