[Bug]: macOS: a project folder T3 Code can't read is added successfully, and the permission failure only shows up mid-turn #36423

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

On macOS, desktop app:

1. Have a folder under ~/Documents, ~/Desktop, or ~/Downloads.
2. Make sure T3 Code has no Files and Folders grant for it (deny the prompt, revoke it in System Settings → Privacy & Security → Files and Folders, or reinstall the app, which can drop the grant without a new prompt, as described in [Bug]: "turn/setPermissionMode failed" masks provider CLI startup death — macOS TCC EPERM kills both Claude and Codex when project is in a protected folder #5943).
3. Add that folder as a project (built-in folder browser or the native picker).
4. Start a thread in it.

Expected behavior

Adding the project fails, or warns, with a clear message that T3 Code can't read the folder and how to grant access. Nothing should look connected while it isn't.

Actual behavior

The project is added successfully. The failure only shows up later, when the agent or the file tree reads the folder and gets Operation not permitted (EPERM). With Claude and Codex this surfaces as the misleading startup errors described in #5943.

WorkspacePaths.normalizeWorkspaceRoot (apps/server/src/workspace/WorkspacePaths.ts) only stats the root and checks that it is a directory. stat succeeds on a TCC-blocked folder, so nothing on the add path tests whether the directory can actually be listed.

Impact

Major degradation or frequent failure

Version or commit

main @ 36f011d

Environment

macOS, desktop app

Logs or stack traces

Operation not permitted

Workaround

Grant T3 Code access under System Settings → Privacy & Security → Files and Folders (or Full Disk Access), then restart the app.

Notes

Related, but not the same problem:

• [Bug]: "turn/setPermissionMode failed" masks provider CLI startup death — macOS TCC EPERM kills both Claude and Codex when project is in a protected folder #5943 / fix(server): surface provider CLI startup diagnostics #22763: making the failure at turn start legible. This issue is about catching it when the project is added.
• [Bug]: Claude skill discovery and favicon reads of project files can exhaust the libuv pool and wedge the host for hours (TCC-blocked open on a removable volume) #26417 / fix(server): blocked project files no longer exhaust the libuv pool and wedge the host #26462: TCC-blocked reads can hang the libuv pool. So any check here should run once, when the project is added (ProjectService), not inside normalizeWorkspaceRoot, which assets and favicons call on every request.

Doing the check on the server means it is correct for remote and tunnel environments too, and on desktop it moves the macOS prompt to the moment the user picks the folder.