Repository navigation
fix(app): say desktop tools off still leaves shell with Ace's macOS permissions - #380
Merged
Merged
Conversation
…ermissions The Channel desktop tools description and the sharing prompt read like a capability boundary, but shell commands inherit Ace's TCC grants (e.g. Screen Recording), so `screencapture` works with the toggle off. Docs say the same. Refs #379 Why: apps/app/src/channel-access.tsx#function ChannelAccess | access copy must not imply the desktop toggle bounds what shell commands can see while they run with Ace's macOS grants
This was referenced Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #379
Wording only. The Channel desktop tools tooltip and the sharing prompt now say plainly that turning desktop tools off refuses new desktop calls only: shell commands keep Ace's macOS permissions, such as Screen Recording, so the toggle isn't a security boundary.
docs/architecture.mdanddocs/desktop-tools.mdsay the same.The other option in #379 — running shell tools in a process without Ace's TCC grants — awaits a product decision, so the issue stays open.
Verified with
bun types,bun run ci, and by rendering the tooltip and sharing dialog in headless Chromium against a source host on a separate port and data dir.Built in Ace
No — built with Claude Code outside Ace by an overnight issue watcher, because this Mac's Ace Canary is a participant in the running two-person study (#218); dogfooding gap tracked in #5.