Repository navigation
[flutter_tools] Detect macOS TCC permission crashes and provide diagnostic guidance - #192432
Merged
auto-submit[bot] merged 9 commits intoNov 5, 2026
Merged
Conversation
…ostic guidance When developing macOS applications that access privacy-sensitive resources (e.g., Camera, Microphone, Speech Recognition, Photos), launching the application binary directly from an IDE (such as VS Code or Android Studio) or terminal via `flutter run` causes macOS Transparency, Consent, and Control (TCC) to attribute permission requests to the parent IDE/terminal process rather than the application bundle itself. If the parent process does not declare the corresponding usage description key in its own `Info.plist`, macOS immediately crashes the application process on the first access attempt, even if the key is properly declared in the Flutter app bundle's `macos/Runner/Info.plist`. To help developers quickly identify and resolve this issue: 1. Updated `DesktopLogReader` to transform stderr into lines using `utf8AllowMalformedLineDecoder` and provide a `handleStderrLine` hook. 2. Introduced `MacOSLogReader` on `MacOSDevice` to inspect stderr for the macOS privacy crash signature, extract the missing usage description key name when present, and print a clear diagnostic banner with the exact terminal workaround command (`open "<bundlePath>"`) and a reference to issue flutter#70374. 3. Added a warning comment to the macOS application template's `macos/Runner/Info.plist` explaining parent process attribution during IDE launches and documenting the workaround. 4. Added comprehensive unit test coverage for crash detection, key extraction, fallback messaging, multi-byte UTF-8 chunk handling, and log reader state management across app launches. Fixes flutter#70374
github-actions
Bot
added
tool
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces macOS privacy permission crash detection by inspecting stderr output during application execution. It refactors DesktopDevice and DesktopLogReader to support platform-specific log readers, implements MacOSLogReader to detect privacy-related crashes and print diagnostic workarounds, and adds corresponding tests and documentation. Feedback on the changes highlights a potential issue where forwarding errors to stderrController without an onError handler on its stream subscription could cause unhandled asynchronous errors, and suggests omitting this forwarding.
…esktopLogReader In `DesktopLogReader.listenToProcessOutput`, `stderrController` transforms bytes into lines using `utf8AllowMalformedLineDecoder` for `handleStderrLine`. Because `stderrController.stream.listen` does not provide an `onError` handler, forwarding errors to `stderrController` caused unhandled asynchronous errors in the listener zone. Since `_inputController` already forwards errors to subscribers of `logLines`, pass `onError: _inputController.addError` directly and do not forward errors to `stderrController`. Added a unit test verifying error propagation to `logLines` without unhandled exceptions.
`MacOSApp.applicationBundle` is a required method on the `MacOSApp` interface that returns a nullable `String?`. Test fakes and implementations already implement this method, making defensive handling of `UnimplementedError` unnecessary.
…LogReader Prefer using multiline string literals over repeated StringBuffer.writeln calls when printing multi-line diagnostic messages.
vashworth
reviewed
Sep 30, 2026
|
|
||
| @override | ||
| @visibleForTesting | ||
| void handleStderrLine(String line) { |
Contributor
There was a problem hiding this comment.
@bkonyi I checked out this PR locally and it doesn't work. It looks like you're checking the process's stderr for the error log, however, it does not get printed there. The error can be found in the macOS system logs or in the crash report, but not the app process.
Contributor
Author
There was a problem hiding this comment.
Ugh, yup, stderr is definitely not right 🤦 I've updated the change to look in the system logs instead.
…shes When macOS terminates a child process for attempting to access privacy-sensitive data without a required `NS*UsageDescription` key in the responsible process's `Info.plist`, `TCC.framework` writes the crash reason to the unified logging system (`com.apple.TCC`) and aborts the process with `SIGABRT` (`exitCode == -6`) rather than writing to the process's `stderr`. Replace the `MacOSLogReader` `stderr` inspection with an `onProcessExited` lifecycle hook on `DesktopDevice`. When a macOS desktop process exits with `SIGABRT` (`-6`), `MacOSDevice` queries `/usr/bin/log show` for a matching TCC crash entry for the exited process ID and prints the privacy crash diagnostic banner. Fixes flutter#70374
Contributor
|
@bkonyi Is this ready for review again? |
Contributor
Author
Sorry, yes! I was just waiting for dashboard checks to run and forgot to rerequest your review. |
vashworth
reviewed
Oct 29, 2026
| ════════════════════════════════════════════════════════════════════════════════ | ||
| macOS Privacy Permission Crash Detected | ||
| ════════════════════════════════════════════════════════════════════════════════ | ||
| The application crashed while requesting access to privacy-sensitive data$keyNotice. |
Contributor
There was a problem hiding this comment.
I think proper name is protected resources: https://developer.apple.com/documentation/bundleresources/protected-resources?language=objc
Suggested change
| The application crashed while requesting access to privacy-sensitive data$keyNotice. | |
| The application crashed while requesting access to protected resources$keyNotice. |
| When launched from an IDE (such as VS Code or Android Studio) or terminal via | ||
| "flutter run", macOS Transparency, Consent, and Control (TCC) attributes | ||
| permission requests to the parent IDE or terminal process rather than the | ||
| application bundle. |
Contributor
There was a problem hiding this comment.
Suggested change
| application bundle. | |
| When launched from an IDE (such as VS Code or Android Studio) or custom terminal via | |
| "flutter run", protected resource requests are made to the parent IDE or terminal process rather than the | |
| application bundle. |
Comment on lines
+220
to
+222
| 2. Run the project directly from Xcode, or launch the application bundle | ||
| directly from Finder or Terminal: | ||
| $runCommand |
Contributor
There was a problem hiding this comment.
If you use the default terminal app, everything works fine. I think that's better than launching it directly without any flutter tooling. You can't hot reload if you launch it directly.
Suggested change
| 2. Run the project directly from Xcode, or launch the application bundle | |
| directly from Finder or Terminal: | |
| $runCommand | |
| 2. Run the project directly from Xcode, or 'flutter run' using the default macOS Terminal app. |
Contributor
There was a problem hiding this comment.
Or is there a way to attach to it from the IDE after it's been launched?
Contributor
Author
There was a problem hiding this comment.
Launching the app bundle directly with open doesn't pass the FLUTTER_ENGINE_SWITCH_* environment variables needed to start the VM service (and macOS desktop doesn't advertise over mDNS for flutter attach), so running from the default Terminal app or Xcode is definitely the way to go.
Update the macOS TCC crash diagnostic message and template `Info.plist` comment to refer to protected resources and recommend running from Xcode or running `flutter run` from the default macOS Terminal app. Remove the unused `package` and `buildInfo` parameters from `DesktopDevice.onProcessExited` now that `bundlePath` is no longer needed by the diagnostic message.
…acos-tcc-crash-diagnostic
vashworth
approved these changes
Nov 5, 2026
flutter-dashboard
Bot
removed
the
autosubmit
This was referenced Nov 5, 2026
auto-submit Bot
pushed a commit
to flutter/packages
that referenced
this pull request
Nov 6, 2026
Roll Flutter from 3623d2d34543 to 09175cdeac89 (61 revisions) flutter/flutter@3623d2d...09175cd 2026-11-06 [email protected] Roll Skia from ae35b7b2221f to 793b8ac73d4b (3 revisions) (flutter/flutter#196091) 2026-11-06 [email protected] [web] Rasterize scenes at the size passed to `FlutterView.render` (flutter/flutter#196052) 2026-11-06 [email protected] Roll Skia from 4aa043a81e0c to ae35b7b2221f (1 revision) (flutter/flutter#196086) 2026-11-06 [email protected] Roll Fuchsia Linux SDK from Fqe3UlLwAohsPbsCS... to KIc0XZbhLmvDpTluZ... (flutter/flutter#196085) 2026-11-06 [email protected] Allow a zero scale change in InteractiveViewer (flutter/flutter#194949) 2026-11-06 [email protected] Roll Skia from dd5c2553a856 to 4aa043a81e0c (2 revisions) (flutter/flutter#196079) 2026-11-06 [email protected] [web] Keep ImageFilter.blur bounds in equality and description (flutter/flutter#196013) 2026-11-06 [email protected] iOS: Remove unused PlatformViewIOS setup from FlutterPlatformViewsTest (flutter/flutter#196033) 2026-11-06 [email protected] Serialize LoggerTests that mutate the shared Logger (flutter/flutter#196028) 2026-11-06 [email protected] Use reverseDuration for the AnimatedCrossFade size animation (flutter/flutter#194860) 2026-11-05 [email protected] Roll Skia from a5aacd103e68 to dd5c2553a856 (8 revisions) (flutter/flutter#196073) 2026-11-05 [email protected] Fix ListWheelScrollView null check error when it reads itemIndex before content dimensions are set (flutter/flutter#194859) 2026-11-05 [email protected] Allow zero cross axis extent in SliverGridDelegateWithMaxCrossAxisExtent (flutter/flutter#194858) 2026-11-05 [email protected] Revert: Allow color delta tolerance in in-memory fuzzy image comparator (flutter/flutter#196067) 2026-11-05 [email protected] Revert: Mitigate snapshot race in 3D transform test by reducing loop density (flutter/flutter#196066) 2026-11-05 [email protected] Delegate createStream in ResizeImage and ScrollAwareImageProvider (flutter/flutter#194756) 2026-11-05 [email protected] [iOS] Introduce FlutterShell and move thread host and profiler (flutter/flutter#195388) 2026-11-05 [email protected] [web] Support FragmentShader.getImageSampler on CanvasKit and Skwasm (flutter/flutter#195854) 2026-11-05 [email protected] Deprecates setFloat API (flutter/flutter#195505) 2026-11-05 [email protected] [flutter_tools] Remove public GlobalToolContext and globals from runner (flutter/flutter#195561) 2026-11-05 [email protected] Defer TLHC PlatformViewWrapper frame post and avoid initial 1x1 buffer resize (flutter/flutter#195861) 2026-11-05 [email protected] Roll Skia from b5abed66da86 to a5aacd103e68 (17 revisions) (flutter/flutter#196054) 2026-11-05 [email protected] Made `FlutterWindowControllerSizeTest.SizedToContentNotResizable` more robust (flutter/flutter#195845) 2026-11-05 [email protected] Update docs for contributor ladder (flutter/flutter#196011) 2026-11-05 [email protected] [Impeller] Use the transfer stage for the Vulkan readback barrier (flutter/flutter#194991) 2026-11-05 [email protected] Remove Mac mac_unopt builder (flutter/flutter#196027) 2026-11-05 [email protected] Updated Instructions for Determining Gradle Version for `gradle_dists` in CIPD (flutter/flutter#193310) 2026-11-05 [email protected] Move ios_app_with_extensions_test into the tool integration shard (flutter/flutter#195609) 2026-11-05 [email protected] [web] Respect Uint8List view bounds when detecting animated WebP/GIF (flutter/flutter#196010) 2026-11-05 [email protected] Add platform_views_layout to build_tests so iOS/Android build breaks are caught in presubmit (flutter/flutter#192985) 2026-11-05 [email protected] [flutter_tools] Detect macOS TCC permission crashes and provide diagnostic guidance (flutter/flutter#192432) 2026-11-05 [email protected] Roll Packages from 670b30e to 0478162 (15 revisions) (flutter/flutter#196047) 2026-11-05 [email protected] [web] Support Skwasm rendering without bitmap capture (flutter/flutter#195103) 2026-11-05 [email protected] [flutter_tools] Reland fix for local CanvasKit asset paths on Windows (flutter/flutter#195770) 2026-11-05 [email protected] Roll Skia from f96be51af95d to b5abed66da86 (14 revisions) (flutter/flutter#196017) 2026-11-05 [email protected] Split chrome web engine test drone (flutter/flutter#195873) 2026-11-05 [email protected] Roll Dart SDK from c9153304136a to 6623b84628f3 (1 revision) (flutter/flutter#196026) 2026-11-05 [email protected] Roll ICU from 4fe960221710 to a0ea93436c52 (6 revisions) (flutter/flutter#196025) 2026-11-05 [email protected] Add more guidance in README and AGENTS for contributing to flutter_tools (flutter/flutter#195998) 2026-11-05 [email protected] Roll Fuchsia Linux SDK from p0HDXLISPIElJfSz7... to Fqe3UlLwAohsPbsCS... (flutter/flutter#196019) 2026-11-05 [email protected] Roll Dart SDK from e362a23e9738 to c9153304136a (18 revisions) (flutter/flutter#196014) 2026-11-05 [email protected] [Impeller] Fix dilation input bounds when clipping saveLayers (flutter/flutter#195652) 2026-11-05 [email protected] Add `variantOf` to the M3E migration checklist (flutter/flutter#195099) 2026-11-05 [email protected] [flutter_tools] Eliminate globals from remaining subsystem files (flutter/flutter#195555) 2026-11-05 [email protected] Fix gap flipping when dragging variable height reorderable items (flutter/flutter#194478) 2026-11-05 [email protected] [A11y] Send un-merged SemanticsNodes in the same update that first references them (flutter/flutter#195829) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When developing macOS applications that access protected resources (such as Camera, Microphone, Speech Recognition, or Photos), launching the application binary from an IDE or custom terminal via
flutter runcauses macOS Transparency, Consent, and Control (TCC) to attribute permission requests to the parent IDE or terminal process rather than the application bundle. If the parent process lacks the correspondingNS*UsageDescriptionkey in itsInfo.plist,TCC.frameworklogs the violation to the macOS unified logging system (com.apple.TCC) and aborts the child process withSIGABRT(exitCode == -6), even when the key is declared inmacos/Runner/Info.plist.This change adds an
onProcessExitedlifecycle hook toDesktopDeviceand overrides it inMacOSDeviceto query/usr/bin/log showwhen the launched process terminates withSIGABRT, printing an actionable diagnostic message with the requiredInfo.plistkey and workaround (running from Xcode or runningflutter runfrom the default macOS Terminal app). It also adds a comment to the macOS templateRunner/Info.plistdocumenting this behavior.Fixes #70374
Pre-launch Checklist
///).