From 808f6e49845cccd69620db87ba8fe5a269d51e5a Mon Sep 17 00:00:00 2001
From: Matt Alldian <mattalldian@gmail.com>
Date: Fri, 24 Jul 2026 19:13:33 -0400
Subject: [PATCH] fix(desktop): inherit app TCC identity in sidecar
 entitlements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sidecars ship as loose executables in `Contents/MacOS/` and are signed
with their own code-signing identifiers rather than the app's:

    buzz-desktop           Identifier=xyz.block.buzz.app
    buzz-acp               Identifier=buzz-acp
    buzz-agent             Identifier=buzz-agent
    buzz-dev-mcp           Identifier=buzz-dev-mcp
    buzz                   Identifier=buzz
    git-credential-nostr   Identifier=git-credential-nostr

When a sidecar spawns a subprocess that triggers a TCC-gated access, the
consent prompt is raised under the sidecar's identity. The user's "Allow"
is recorded against `xyz.block.buzz.app`, so the next request — arriving
under a different identity — prompts again. `tccd` logs `DB Action:None`
on every request: no decision is ever persisted.

The result is an unkillable consent loop, and Buzz never appears in
System Settings > Privacy & Security > Files and Folders, so there is no
way to grant the permission manually.

Add `com.apple.security.inherit` so child processes adopt the app's
sandbox/TCC identity and a single grant covers the sidecars.

Refs #2783
---
 desktop/src-tauri/Entitlements.plist | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/desktop/src-tauri/Entitlements.plist b/desktop/src-tauri/Entitlements.plist
index 294ba52362..27a594af75 100644
--- a/desktop/src-tauri/Entitlements.plist
+++ b/desktop/src-tauri/Entitlements.plist
@@ -9,5 +9,22 @@
     <!-- MeshLLM installs versioned native runtimes outside the app bundle. -->
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
+    <!--
+      Sidecars (buzz-acp, buzz-agent, buzz-dev-mcp, buzz, git-credential-nostr)
+      ship as loose executables in Contents/MacOS/ and are signed with their own
+      code-signing identifiers (e.g. `Identifier=buzz-acp`), not the app's
+      `xyz.block.buzz.app`. Without inheritance, a TCC request raised by a
+      sidecar — e.g. buzz-acp spawning `op`, which reads 1Password's group
+      container — is attributed to a subject that does not match the app the
+      user is granting permission to. The user's "Allow" is recorded against
+      xyz.block.buzz.app, the next request arrives under a different identity,
+      and macOS prompts again: an unkillable consent loop, with Buzz never
+      appearing in Privacy & Security › Files and Folders.
+
+      `inherit` makes child processes adopt the parent app's sandbox/TCC
+      identity so one grant covers the sidecars too.
+    -->
+    <key>com.apple.security.inherit</key>
+    <true/>
 </dict>
 </plist>