fix: reduce repeated macOS file-permission prompts#1
Conversation
On macOS, unsigned app updates can cause TCC to lose track of previously granted permissions and re-prompt the user. This adds three mitigations: - CI: set APPLE_SIGNING_IDENTITY="-" in both build and publish workflows so every macOS build gets a consistent ad-hoc code signature, which lets tccutil resolve the bundle identity. - Auto-reset offer: on launch, compare the stored build version against the current one; if this is an update (not a first install), show a native dialog offering to run `tccutil reset SystemPolicyAllFiles org.strawlab.Sunbeam`. The stored version is updated regardless of the user's answer so the prompt only fires once per update. - Manual reset button: a "Reset macOS file permissions" link is shown at the bottom of the Launch card on macOS for on-demand resets. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Thanks for the pull request. When you write "unsigned app updates can cause TCC to lose track of previously granted permissions", do you mean A) in the same process, B) across multiple runs of the same binary, or C) across updates of the binary? This seems like quite some specialized code to maintain unless the answer is A. Is this documented somewhere? |
|
As I understand the problem, it is that MacOS is repeatedly asking for permissions for the same running process. It's hard to believe MacOS is losing track of the app identity within the same process. Even if it did, the code in the PR is about maintaining identity across upgrades of the binary, not about maintaining identity within the same process. Therefore this doesn't seem like it is going to fix the problem. I'm going to close for now, but if you feel that's an error, please reopen. I'd be especially interested if the bug could be reproduced and that this could be shown to solve the problem. I think perhaps setting the working directory in the Sunbeam app to some "non important" (from a security perspective) subdirectory before launching Jupyter might reduce the frequency of permission requests within one process run. |
2 participants
On macOS, unsigned app updates can cause TCC to lose track of previously granted permissions and re-prompt the user. This adds three mitigations:
CI: set APPLE_SIGNING_IDENTITY="-" in both build and publish workflows so every macOS build gets a consistent ad-hoc code signature, which lets tccutil resolve the bundle identity.
Auto-reset offer: on launch, compare the stored build version against the current one; if this is an update (not a first install), show a native dialog offering to run
tccutil reset SystemPolicyAllFiles org.strawlab.Sunbeam. The stored version is updated regardless of the user's answer so the prompt only fires once per update.Manual reset button: a "Reset macOS file permissions" link is shown at the bottom of the Launch card on macOS for on-demand resets.