Fix macOS TCC permissions for apps launched from integrated terminal

[mikaelweiss]

Re-sign the patched Electron dev bundle with an ad-hoc signature so macOS TCC can bind the Info.plist and show privacy permission prompts (microphone, camera, etc.) for child processes.

For production builds, ad-hoc sign unsigned Mac builds (identity: "-", hardenedRuntime: false) and inject NSMicrophoneUsageDescription and NSCameraUsageDescription via extendInfo. Signed/notarized builds use entitlements with hardened runtime instead.

Note: I wasn't able to test with production build signing. I don't have that all set up yet, so I'm just trusting that Claude did the prod build signing correctly. I did test the dev build bun run dist:desktop:dmg:arm64 and it worked.

Note

Add macOS TCC permissions for terminal-launched apps by introducing hardened runtime entitlements and ad‑hoc re‑signing in electron-launcher.mjs

Add an entitlements plist with JIT, unsigned executable memory, and microphone access; ad‑hoc re‑sign the mac app bundle during launcher build; include mac privacy usage descriptions and adjust mac signing config for signed vs. unsigned builds.

📍Where to Start

Start with buildMacLauncher and resignAppBundle in electron-launcher.mjs.

📊 Macroscope summarized dc66007. 3 files reviewed, 2 issues evaluated, 1 issue filtered, 1 comment posted

🗂️ Filtered Issues

apps/desktop/scripts/electron-launcher.mjs — 0 comments posted, 1 evaluated, 1 filtered

• line 140: The cache invalidation logic at lines 128-134 will incorrectly reuse existing cached app bundles that were built before the resignAppBundle step was added. The metadata check compares launcherVersion, but LAUNCHER_VERSION at line 22 was not incremented as part of this change. Users with existing cached bundles will have invalid code signatures since the previous builds modified plist files without re-signing, and this change won't fix their cached copies. [ Out of scope ]

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 27ee2096-1f91-43d7-9dda-f597a71fbe6e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mikaelweiss]

Oh, I guess I should explain the issue.

I have a TTS and STT electron app that uses the microphone and other permissions

When I run pnpm run dev inside of T3 Code, then it never asks for permissions and just fails for anything permissions related.

I open the dir for that worktree and run it in Ghostty and it works just fine.

This is a fix for that.

[macroscopeapp]

🔴 Critical resources/entitlements.mac.plist:9

The entitlements file includes com.apple.security.device.audio-input for microphone access but is missing com.apple.security.device.camera, so camera access will be silently denied on signed builds with hardened runtime enabled despite the NSCameraUsageDescription being present in Info.plist. Consider adding the camera entitlement to match the intended TCC permissions fix.

 	<key>com.apple.security.device.audio-input</key>
 	<true/>
+	<key>com.apple.security.device.camera</key>
+	<true/>
 </dict>

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/desktop/resources/entitlements.mac.plist around lines 9-11:

The entitlements file includes `com.apple.security.device.audio-input` for microphone access but is missing `com.apple.security.device.camera`, so camera access will be silently denied on signed builds with hardened runtime enabled despite the `NSCameraUsageDescription` being present in Info.plist. Consider adding the camera entitlement to match the intended TCC permissions fix.

[mikaelweiss]

Was this fixed?

[mikaelweiss]

I just saw that "Contributing" documentation was added. My assumption is that this issue was auto closed without being looked at.

Since this makes the app really difficult for me to use for my specific projects, I'll be opening an issue so that hopefully it's looked at.