Codex Computer Use inside the packaged T3 Code macOS app cannot clean up its native overlay after a turn. The visible Software Cursor remains because macOS rejects the cleanup helper's Apple Events request. The signed T3 0.1.8 app lacks com.apple.security.automation.apple-events and NSAppleEventsUsageDescription, so the user cannot grant Automation permission.
This is tracked by https://git.cafe/pingdotgg/t3code/issues/21282. PR https://git.cafe/pingdotgg/t3code/pulls/2796 proposed the same declarations, but it was closed as fixed by https://git.cafe/pingdotgg/t3code/pulls/2745. https://git.cafe/pingdotgg/t3code/pulls/2745 changed Tailscale and filesystem TCC prompt behavior and did not add these declarations.
Add the macOS Apple Events entitlement and permission description to the desktop packaging configuration. Add focused assertions for both declarations.
The change is limited to the macOS capability needed by the existing Computer Use helper. It does not change thread lifecycle, notification wiring, runtime behavior, or the gateway.
This is a very small, focused fix for an established capability and an obvious packaging defect. It qualifies for the focused-bug exception in CONTRIBUTING.md. The linked issue contains reproductions on multiple T3 versions, including current stable 0.1.8.
main.git diff --check passed.0.1.8 show Policy disallows prompt for com.t3tools.t3code for kTCCServiceAppleEvents.turn-ended payload. It removed the visible Software Cursor.0 on transport failure, so cleanup was verified from TCC logs, helper errors, service contact, and CGWindowListCopyWindowInfo.I could not build and test the patched T3 app because this machine has no valid Apple signing identity. A signed T3 build and macOS Automation approval are still required for the final end-to-end test.
Model: Sol 6.1. Harness: Codex in T3 Code.
Fixes pingdotgg/t3code#21282
Added 1 commit
Verdict: Needs Human Approval
Macroscope's review found this PR requires human approval — The packaging change enables macOS Automation permission requests for terminal and agent commands, not only Computer Use cleanup. Human review is needed to accept that broader default capability; macOS authorization still gates access.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
The macOS desktop build configuration now includes an Apple Events usage description and enables the Apple Events automation entitlement. Tests check that both declarations are present.
Changes: Apple Events macOS packaging permissions
| Layer / File(s) | Summary |
|---|---|
Declare and test Apple Events access scripts/build-desktop-artifact.ts, scripts/build-desktop-artifact.test.ts | The macOS build configuration adds an Apple Events usage description and enables the Apple Events automation entitlement. Tests check that the description is non-empty and the entitlement is enabled. |
Estimated code review effort: 2 (Simple) | ~8 minutes
Change: Bug fix
Possibly related issues
Possibly related PRs
Suggested labels: bugfix, size:XS
Suggested reviewers: lenoridev, juliusmarminge
e114fThe build declares Apple Events access for cleanup. No merge-blocking defect is established; signed macOS testing is still needed.
| Check name | Status | Explanation |
|---|---|---|
| Title check | Passed | The title clearly and concisely identifies the macOS Apple Events access change for Computer Use cleanup. |
| Linked Issues check | Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | Passed | Check skipped because no linked issues were found for this pull request. |
| Description check | Passed | The description covers the problem, change, scope and approval basis, and verification. It reports focused test results and clearly states that a signed build and macOS Automation approval are still n… |
Explanation
The description covers the problem, change, scope and approval basis, and verification. It reports focused test results and clearly states that a signed build and macOS Automation approval are still needed for end-to-end testing.
d27c0cb5-3a60-428e-8e65-a40ba984699aReviewing files that changed from the base of the PR and between 41443e5706c4605bc3efc17bcf431970488a146d and e114f51212963a8b282e759c559256747ecd0aff.
scripts/build-desktop-artifact.test.tsscripts/build-desktop-artifact.tsIncluded review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.