macOS service updates require new privacy approvals for each versioned t3 executable #17225

What happened

I run T3 Code as a background service on my Mac so I can access my threads from other computers and mobile devices.

After server updates, macOS asks me to approve folder access again. I also get notifications saying t3 was blocked from App Management.

System Settings now contains multiple entries named t3 under both App Management and Full Disk Access. Approving one version does not cover subsequent versions.

Expected behavior: permissions granted to the service should persist across updates without requiring another local approval for every new executable path. Repeated prompts are particularly disruptive when updating an unattended remote host.

Diagnosis

The service runs executables from version-specific directories:

<T3_HOME>/runtime/versions/<version>/t3

Read-only inspection of macOS’s system TCC database confirmed that the service’s Full Disk Access entries are keyed to these executable paths (client_type = 1). Multiple releases have separate permission records.

The compared binaries are already Developer ID signed and have identical designated requirements:

Identifier: t3
TeamIdentifier: ARK85ZXQ4Z

The changing executable path is therefore the confirmed identity difference associated with the separate Full Disk Access records.

The source matches the observed installation:

• bootService.ts configures the service to run the pinned runtime executable with __service-launcher.
• serviceLauncher.ts constructs the version-specific executable path and launches it with serve.

A stable command symlink alone would not change the version-specific server executable selected by this launcher.

The App Management notifications were reported by the user, and duplicate entries are visible in the supplied screenshot. The specific operation triggering that notification was not captured during triage.

Steps to reproduce

Reported reproduction; no additional update or permission reset was performed during triage:

1. Install and run T3 Code as a macOS background service.
2. Approve folder access and grant the current t3 executable Full Disk Access.
3. Update the server to another nightly release and allow the service to switch to the new runtime.
4. Perform agent work that accesses protected folders.
5. Observe renewed permission prompts and another t3 entry in System Settings.
6. Repeat server updates; separate permission entries accumulate.

Version

Active server: 0.0.46-nightly.20261008.2819
Source commit: 5e2225671f705fcd33f1ea5591b79ba612fb6974

The npx t3 triage CLI reported version 0.0.45; the running service version was verified separately.

Environment

macOS 27.0.1, build 26A434; Apple Silicon arm64; launchd user service. Remote access from other computers and mobile devices. Node v26.8.2 reported by triage.

Evidence

<T3_HOME> replaces the user’s installation root.

launchd ProgramArguments:
<T3_HOME>/runtime/versions/0.0.46-nightly.20261007.2787/t3
__service-launcher

Service state activeVersion:
0.0.46-nightly.20261008.2819

Selected system TCC records:
service: kTCCServiceSystemPolicyAllFiles
client_type: 1

Version                              auth_value
0.0.43-nightly.20260928.2375           2
0.0.44-nightly.20260929.2456           2
0.0.46-nightly.20261003.2632           0
0.0.46-nightly.20261007.2787           0

Each client path:
<T3_HOME>/runtime/versions/<version>/t3

Screenshots show multiple t3 entries under App Management and Full Disk Access:

Related issues

#5285 concerns permissions attributed to the desktop app during agent CLI probes at startup. This report concerns previously granted permissions failing to carry across CLI service updates that change the executable path. No exact duplicate was found.

Fix applied or workaround

No service configuration, binaries, or permission databases were modified. Reapproving individual executable versions provides temporary access but does not address subsequent updates.

Please provide a supported service installation/update mechanism that preserves macOS permission identity across releases.

Filed by

Codex, GPT-6 family, via t3 triage.