macOS: add Apple Events entitlement for native browser URL capture

[hawai-i]

Summary

ActivityWatch's native macOS watcher already retrieves Chrome and Safari URLs through Apple Events/ScriptingBridge. Distributed macOS builds use Hardened Runtime, but the responsible outer application is not signed with com.apple.security.automation.apple-events, so TCC refuses to present the Automation permission prompt.

The decisive TCC diagnostic is:

Prompting policy for hardened runtime; service: kTCCServiceAppleEvents requires
entitlement com.apple.security.automation.apple-events but it is missing

Controlled before/after testing showed the existing watcher working once the entitlement was added to the responsible application:

Before: Chrome event url = ""
After:  Chrome event url = "https://example.com/..."

Change

• Add an app-level entitlement plist containing the existing PyInstaller runtime entitlements plus Apple Events Automation.
• Apply it to the responsible outer application in both Qt and Tauri packaging paths.
• Keep nested watchers/helpers on the narrower shared entitlement set.
• Re-sign the completed Qt bundle at the application layer because PyInstaller's final BUNDLE signing pass otherwise replaces the earlier aw-qt signature settings.

Artifact validation

• Built the Qt artifact through pyinstaller --clean --noconfirm aw.spec.
• Built the Tauri artifact through the repository's TAURI_BUILD=true build/package flow.
• Verified the Automation entitlement on aw-qt and aw-tauri, and its absence from nested aw-watcher-window and Swift helper executables.
• Scanned both bundle layouts for unintended entitlement propagation.
• codesign --verify --deep --strict passed for both artifacts.
• Built and verified a DMG locally.

Developer ID notarization was not reproduced without production Apple credentials; upstream release CI remains the authoritative validation for that layer.

[greptile-apps]

Greptile Summary

Adds a dedicated macOS application entitlement set containing Apple Events Automation while retaining narrower entitlements for nested binaries.

• Applies the application entitlements to the Qt executable and restores them after PyInstaller assembles the outer bundle.
• Signs the top-level Tauri application with the application-only entitlements after completing inside-out signing of nested code.
• Keeps the shared PyInstaller runtime entitlements unchanged for watchers and helpers.

Confidence Score: 5/5

The pull request appears safe to merge, with application-only Apple Events access correctly separated from nested helper entitlements.

The changed Qt and Tauri signing paths preserve their existing signing options and ordering while applying the expanded entitlement set only at the outer application layer.

Important Files Changed

Filename	Overview
aw.spec	Adds selectable entitlements to PyInstaller executables and re-signs the completed Qt application with the application-specific entitlement set.
scripts/package/app-entitlements.plist	Defines the existing PyInstaller runtime capabilities plus the Apple Events Automation entitlement for outer applications.
scripts/package/build_app_tauri.sh	Preserves inside-out signing while applying application-specific entitlements to the top-level Tauri bundle.
scripts/package/entitlements.plist	Clarifies that the existing entitlement set remains scoped to nested binaries.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Shared[Shared runtime entitlements] --> QtHelpers[Qt nested watchers and helpers]
  Shared --> TauriHelpers[Tauri nested watchers and helpers]
  App[Application entitlements including Apple Events] --> QtApp[Qt outer application]
  App --> TauriApp[Tauri outer application]
  QtHelpers --> QtApp
  TauriHelpers --> TauriApp
  QtApp --> QtArtifact[Signed Qt bundle]
  TauriApp --> TauriArtifact[Signed Tauri bundle]

Loading

_{Reviews (1): Last reviewed commit: "fix(macos): add Apple Events entitlement..." | Re-trigger Greptile}