When Codex runs Computer Use inside the signed macOS desktop app, its native turn-ended helper cannot request Apple Events access because T3's signing entitlements omit Automation. The reported result is failed cleanup and a cursor that remains visible after the turn; the app also lacks the Automation usage description.
Add com.apple.security.automation.apple-events to the existing generated macOS entitlement plist and NSAppleEventsUsageDescription to the macOS Info.plist configuration. Cover both declarations in the existing desktop packaging tests.
Fixes #21282 GitCafe: https://git.cafe/pingdotgg/t3code/issues/21282 Triaged bug via the automated issue flow: #21282.
PATH="$PWD/node_modules/.bin:$PATH" vp test run scripts/build-desktop-artifact.test.ts: 43 passed again after merging current main, at 6ea8952975. Integrated-head test log.| Evidence | Before | After |
|---|---|---|
| Focused packaging tests | 2c467424bb: 2 failed / 41 passed | c2405f2124: 43 passed |
| Generated configuration | Missing declarations asserted by the red tests | Configuration transcript |
Fixture matrix and proof boundaries · Scoped verification log
No render paths changed, so UI screenshots and pixel diffs do not apply. cannot-verify macos-desktop: this Linux VM cannot inspect the final signed app, exercise macOS Automation consent/denial/recovery, or record Codex helper completion and cursor cleanup (matrix A1 and N1–N3). No end-to-end native success is claimed.
Models: Claude Opus 5.5 through Claude Agent; GPT-6.1-Sol through Codex in T3 Code.
Fixes pingdotgg/t3code#21282
Added 3 commits
Verdict: Needs Human Approval
Macroscope's review found this PR requires human approval — This changes the default macOS artifact permissions by adding Apple Events automation entitlement and its user-facing usage description, allowing agent helpers to request control of other apps. The scope is small and tested, but the security-sensitive permission and product-default change warrant human review.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
The macOS build configuration now includes an Apple Events usage description and automation entitlement. Tests assert that both declarations are present.
Changes: macOS Apple Events declarations
| Layer / File(s) | Summary |
|---|---|
Add and verify Apple Events declarations scripts/build-desktop-artifact.ts, scripts/build-desktop-artifact.test.ts | The rendered macOS entitlements enable Apple Events automation, and the build configuration sets an Apple Events usage description. Tests assert both declarations. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Possibly related issues
pingdotgg/t3code issue 21283 concerns analogous macOS privacy declarations for Calendar. This change adds Apple Events declarations but does not add Calendar declarations.Suggested reviewers: t3dotgg
6ea89The macOS permission declarations are in place, with no identified issue blocking merge. Automation consent in a signed app has not yet been exercised.
| Check name | Status | Explanation |
|---|---|---|
| Title check | Passed | The title is concise, specific, and accurately describes the primary change: allowing macOS agent helpers to request Automation access. |
| Linked Issues check | Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | Passed | Check skipped because no linked issues were found for this pull request. |
| Description check | Passed | The description covers the problem, change, linked triaged issue, and focused verification results. It also states the limits of Linux-based testing and identifies the models and harnesses used. |
c083ac62-2f60-43c3-9939-0b4c0dc45be2Reviewing files that changed from the base of the PR and between 6318bfc597e544679848c4ed816606bacd32a175 and 6ea89529757fe203b637b49208cf324f599eba21.
scripts/build-desktop-artifact.test.tsscripts/build-desktop-artifact.tsLimit details: You’ve used all 10 included reviews currently available.
This is a welcome fix!
Thanks for this. #33869 makes the same change and is the one being kept.
#33869 adds the same Automation entitlement and usage description with a smaller change. It also checks the description across signed and unsigned stable and nightly configurations, making it the stronger version to keep.
Your diagnosis and the two missing declarations remain the basis of the fix. The remaining validation is to exercise Automation consent and Computer Use cleanup in a signed macOS build.
Closing as a duplicate.
