FSEvents

If you want to watch for all file changes, use the FSEvents interface. It's part of "Core Carbon", which is 95% deprecated, but FSEvents is not -- there's no newer API that does this.

There's two inconsistent and weird cases to be aware of, with sandboxed apps:

• If you ask to observe a path which is not part of the sandbox, it'll return a non-nil streamRef, but it won't do anything. It will never call your callback.
• If you ask to use the flag kFSEventStreamCreateFlagWatchRoot, it'll return nil for the streamRef.

Of course, the proper solution is to get permissions to observe the path you care about, but the inconsistency here will drive you crazy when debugging.