feat: gate Record on mic & speech permissions with onboarding - #25
Merged
Conversation
Previously the only way to discover missing TCC permissions was to press Record and read the failure in the status bar — and on hardened-runtime builds the OS prompt never appeared at all because the ad-hoc signature lacked com.apple.security.device.audio-input, so even granting after the fact required digging through System Settings. Add a permission-aware onboarding screen that shows up whenever Microphone or Speech Recognition is not yet Granted, with Allow / Open Settings buttons that branch on the underlying TCC state. Wire the entitlement through both the local repro path (the new wisp-desktop.entitlements file) and the release codesign step so the distributed .dmg behaves the same way. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Microphone and Speech Recognition permissions are both Granted. Per-row
Allow buttons fire the OS prompt directly; if a permission is already
Denied the button switches to Open Settings and deep-links to the
right Privacy & Security pane.
WispAudioKit(wisp_permission_status/
wisp_permission_request, mic viaAVCaptureDeviceand speech viaSFSpeechRecognizer) with a safe Rust wrapper inwisp-audiokit.wisp-desktop.entitlementsfile declaringcom.apple.security.device.audio-input,cs.allow-jit, and anexplicit
app-sandbox = false. This is required because the releaseworkflow signs with
--options runtime(hardened runtime); withoutthe audio-input entitlement
AVCaptureDevice.requestAccess(for: .audio)silently returns
falseand no TCC entry is created. Wire the samefile into the release codesign step.
Why
Before this change, the only signal that the user was missing a permission
was the small
Failed: WispAudioKit session start failed: Permission denied: Microphoneline in the status bar after pressing Record, and onreleased builds the OS prompt never appeared in the first place — so even
clicking around in System Settings couldn't recover the user, because no
TCC entry for the app ever got created. Onboarding plus the missing
entitlement together produce the expected "Allow" → OS prompt → Granted
flow on a fresh install of the distributed
.dmg.Test plan
cargo build -p wisp-desktop --releasecleancargo test -p wisp-desktop -p wisp-audiokit(14 passed)cargo clippy -p wisp-desktop -p wisp-audiokit -p wisp-audiokit-sysclean~/Applications/Wisp-test.app, sign with--entitlements apps/wisp-desktop/wisp-desktop.entitlements,tccutil reset Microphone dev.mokmok.wisp+ same forSpeechRecognition, launch. Both Allow buttons fire the OS promptand after Granted the UI transitions to the Record screen.
.dmgwhoseembedded app has the entitlements set (verifiable via
codesign --display --entitlements - Wisp.app).🤖 Generated with Claude Code