[fix] reset stale macOS permissions during install

[fix] improve macOS permission request flow
2026-07-14 18:40:19 +08:00 · 2026-05-28 01:34:02 +08:00 · 2026-05-28 01:33:50 +08:00
6 changed files with 377 additions and 124 deletions
@@ -15,6 +15,7 @@ APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
 INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"
 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +74,82 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF
 xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
 find "${APP_BUNDLE}" -name '._*' -delete
 echo ".app created successfully."
 mkdir -p build_pkg_scripts
 cp scripts/macosx/tcc_postinstall.sh build_pkg_scripts/postinstall
 chmod +x build_pkg_scripts/postinstall
 mkdir -p build_pkg_resources
 cat > build_pkg_resources/welcome.html <<EOF
 <!doctype html>
 <html>
 <head>
    <meta charset="utf-8">
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
            font-size: 13px;
            line-height: 1.5;
            color: #222;
            margin: 0;
            padding: 0;
        }
        h1 {
            font-size: 20px;
            font-weight: 600;
            margin: 0 0 12px;
        }
        p {
            margin: 0 0 10px;
        }
    </style>
 </head>
 <body>
    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
 </body>
 </html>
 EOF
 echo "building pkg..."
 pkgbuild \
  --identifier "${IDENTIFIER}" \
  --version "${APP_VERSION}" \
  --install-location "/Applications" \
  --component "${APP_BUNDLE}" \
  --scripts build_pkg_scripts \
  build_pkg_temp/${APP_NAME}-component.pkg
-mkdir -p build_pkg_scripts
+cat > build_pkg_temp/Distribution <<EOF
-
+<?xml version="1.0" encoding="utf-8"?>
-cat > build_pkg_scripts/postinstall <<'EOF'
+<installer-gui-script minSpecVersion="1">
-#!/bin/bash
+    <title>${INSTALLER_TITLE}</title>
-set -e
+    <welcome file="welcome.html" mime-type="text/html"/>
-
+    <options customize="never" require-scripts="false" hostArchitectures="arm64"/>
-IDENTIFIER="cn.crossdesk.app"
+    <choices-outline>
-
+        <line choice="default">
-# 获取当前登录用户
+            <line choice="${IDENTIFIER}"/>
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
+        </line>
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
+    </choices-outline>
-
+    <choice id="default" title="${INSTALLER_TITLE}"/>
-# 清除应用的权限授权，以便重新授权
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
-# 使用 tccutil 重置录屏权限和辅助功能权限
+        <pkg-ref id="${IDENTIFIER}"/>
-if command -v tccutil >/dev/null 2>&1; then
+    </choice>
-    # 重置录屏权限
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
+</installer-gui-script>
    # 重置辅助功能权限
    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
    # 重置摄像头权限（如果需要）
    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
    # 重置麦克风权限（如果需要）
    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
 fi
 # 为所有用户清除权限（可选，如果需要）
 # 遍历所有用户目录并清除权限
 for USER_DIR in /Users/*; do
    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
        USER_NAME=$(basename "$USER_DIR")
        # 跳过系统用户
        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
            # 删除 TCC 数据库中的相关条目（需要管理员权限）
            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
            if [ -f "$TCC_DB" ]; then
                # 使用 sqlite3 删除相关权限记录（如果可用）
                if command -v sqlite3 >/dev/null 2>&1; then
                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
                fi
            fi
        fi
    fi
 done
 exit 0
 EOF
 chmod +x build_pkg_scripts/postinstall
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
  --package-path build_pkg_temp \
  --resources build_pkg_resources \
  "${PKG_NAME}"
 echo "PKG package created: ${PKG_NAME}"
@@ -171,7 +187,7 @@ APPLESCRIPT
 fi
 echo "Set icon finished"
-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}
 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
@@ -15,6 +15,7 @@ APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
 INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"
 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +74,82 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF
 xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
 find "${APP_BUNDLE}" -name '._*' -delete
 echo ".app created successfully."
 mkdir -p build_pkg_scripts
 cp scripts/macosx/tcc_postinstall.sh build_pkg_scripts/postinstall
 chmod +x build_pkg_scripts/postinstall
 mkdir -p build_pkg_resources
 cat > build_pkg_resources/welcome.html <<EOF
 <!doctype html>
 <html>
 <head>
    <meta charset="utf-8">
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
            font-size: 13px;
            line-height: 1.5;
            color: #222;
            margin: 0;
            padding: 0;
        }
        h1 {
            font-size: 20px;
            font-weight: 600;
            margin: 0 0 12px;
        }
        p {
            margin: 0 0 10px;
        }
    </style>
 </head>
 <body>
    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
 </body>
 </html>
 EOF
 echo "building pkg..."
 pkgbuild \
  --identifier "${IDENTIFIER}" \
  --version "${APP_VERSION}" \
  --install-location "/Applications" \
  --component "${APP_BUNDLE}" \
  --scripts build_pkg_scripts \
  build_pkg_temp/${APP_NAME}-component.pkg
-mkdir -p build_pkg_scripts
+cat > build_pkg_temp/Distribution <<EOF
-
+<?xml version="1.0" encoding="utf-8"?>
-cat > build_pkg_scripts/postinstall <<'EOF'
+<installer-gui-script minSpecVersion="1">
-#!/bin/bash
+    <title>${INSTALLER_TITLE}</title>
-set -e
+    <welcome file="welcome.html" mime-type="text/html"/>
-
+    <options customize="never" require-scripts="false" hostArchitectures="x86_64"/>
-IDENTIFIER="cn.crossdesk.app"
+    <choices-outline>
-
+        <line choice="default">
-# 获取当前登录用户
+            <line choice="${IDENTIFIER}"/>
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
+        </line>
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
+    </choices-outline>
-
+    <choice id="default" title="${INSTALLER_TITLE}"/>
-# 清除应用的权限授权，以便重新授权
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
-# 使用 tccutil 重置录屏权限和辅助功能权限
+        <pkg-ref id="${IDENTIFIER}"/>
-if command -v tccutil >/dev/null 2>&1; then
+    </choice>
-    # 重置录屏权限
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
+</installer-gui-script>
    # 重置辅助功能权限
    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
    # 重置摄像头权限（如果需要）
    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
    # 重置麦克风权限（如果需要）
    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
 fi
 # 为所有用户清除权限（可选，如果需要）
 # 遍历所有用户目录并清除权限
 for USER_DIR in /Users/*; do
    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
        USER_NAME=$(basename "$USER_DIR")
        # 跳过系统用户
        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
            # 删除 TCC 数据库中的相关条目（需要管理员权限）
            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
            if [ -f "$TCC_DB" ]; then
                # 使用 sqlite3 删除相关权限记录（如果可用）
                if command -v sqlite3 >/dev/null 2>&1; then
                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
                fi
            fi
        fi
    fi
 done
 exit 0
 EOF
 chmod +x build_pkg_scripts/postinstall
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
  --package-path build_pkg_temp \
  --resources build_pkg_resources \
  "${PKG_NAME}"
 echo "PKG package created: ${PKG_NAME}"
@@ -171,7 +187,7 @@ APPLESCRIPT
 fi
 echo "Set icon finished"
-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}
 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
@@ -0,0 +1,112 @@
 #!/bin/bash
 set -e
 APP_IDENTIFIER="cn.crossdesk.app"
 # Keep known historical identifiers here. tccutil only resets identifiers that
 # Launch Services can currently resolve, so path/db cleanup below remains a
 # best-effort fallback for stale entries from unsigned or removed builds.
 BUNDLE_IDENTIFIERS=(
    "cn.crossdesk.app"
    "cn.crossdesk.CrossDesk"
    "com.crossdesk.app"
    "com.crossdesk.CrossDesk"
    "com.kunkundi.crossdesk"
    "com.kunkundi.CrossDesk"
 )
 TCC_SERVICES=(
    "ScreenCapture"
    "Accessibility"
    "Microphone"
    "AudioCapture"
 )
 run_tccutil() {
    local user_name="$1"
    local user_id="$2"
    local service="$3"
    local bundle_id="$4"
    if [ -n "$user_name" ] && [ -n "$user_id" ]; then
        /bin/launchctl asuser "$user_id" \
            /usr/bin/sudo -u "$user_name" \
            /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
    else
        /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
    fi
 }
 reset_bundle_tcc() {
    local user_name="$1"
    local user_id="$2"
    local bundle_id
    local service
    for bundle_id in "${BUNDLE_IDENTIFIERS[@]}"; do
        if run_tccutil "$user_name" "$user_id" "All" "$bundle_id"; then
            continue
        fi
        for service in "${TCC_SERVICES[@]}"; do
            run_tccutil "$user_name" "$user_id" "$service" "$bundle_id" || true
        done
    done
 }
 cleanup_tcc_db() {
    local db_path="$1"
    if [ ! -f "$db_path" ] || ! command -v sqlite3 >/dev/null 2>&1; then
        return
    fi
    /usr/bin/sqlite3 "$db_path" <<'SQL' >/dev/null 2>&1 || true
 DELETE FROM access
 WHERE service IN (
  'kTCCServiceScreenCapture',
  'kTCCServiceAccessibility',
  'kTCCServiceMicrophone',
  'kTCCServiceAudioCapture'
 )
 AND (
  client IN (
    'cn.crossdesk.app',
    'cn.crossdesk.CrossDesk',
    'com.crossdesk.app',
    'com.crossdesk.CrossDesk',
    'com.kunkundi.crossdesk',
    'com.kunkundi.CrossDesk'
  )
  OR lower(client) LIKE '%crossdesk%'
 );
 SQL
 }
 cleanup_user_tcc_db() {
    local user_name="$1"
    local home_dir
    home_dir=$(/usr/bin/dscl . -read "/Users/${user_name}" NFSHomeDirectory 2>/dev/null |
        /usr/bin/awk '{print $2}')
    if [ -z "$home_dir" ]; then
        return
    fi
    cleanup_tcc_db "${home_dir}/Library/Application Support/com.apple.TCC/TCC.db"
 }
 CONSOLE_USER=$(/usr/bin/stat -f "%Su" /dev/console 2>/dev/null || true)
 if [ -n "$CONSOLE_USER" ] &&
   [ "$CONSOLE_USER" != "root" ] &&
   [ "$CONSOLE_USER" != "loginwindow" ]; then
    CONSOLE_UID=$(/usr/bin/id -u "$CONSOLE_USER" 2>/dev/null || true)
    reset_bundle_tcc "$CONSOLE_USER" "$CONSOLE_UID"
    cleanup_user_tcc_db "$CONSOLE_USER"
 fi
 # Also clear any system/root-scoped decisions as a harmless fallback.
 reset_bundle_tcc "" ""
 cleanup_tcc_db "/Library/Application Support/com.apple.TCC/TCC.db"
 exit 0
@@ -636,6 +636,12 @@ int Render::LoadSettingsFromCacheFile() {
 }
 int Render::ScreenCapturerInit() {
 #ifdef __APPLE__
  if (!EnsureMacScreenRecordingPermission()) {
    return -1;
  }
 #endif
  if (!screen_capturer_) {
    screen_capturer_ = (ScreenCapturer*)screen_capturer_factory_->Create();
  }
@@ -705,6 +711,12 @@ int Render::ScreenCapturerInit() {
 }
 int Render::StartScreenCapturer() {
 #ifdef __APPLE__
  if (!EnsureMacScreenRecordingPermission()) {
    return -1;
  }
 #endif
  if (!screen_capturer_) {
    LOG_INFO("Screen capturer instance missing, recreating before start");
    if (0 != ScreenCapturerInit()) {
@@ -769,6 +781,12 @@ int Render::StopSpeakerCapturer() {
 }
 int Render::StartMouseController() {
 #ifdef __APPLE__
  if (!EnsureMacAccessibilityPermission()) {
    return -1;
  }
 #endif
  if (!device_controller_factory_) {
    LOG_INFO("Device controller factory is nullptr");
    return -1;
@@ -826,6 +844,13 @@ int Render::StopMouseController() {
 int Render::StartKeyboardCapturer() {
  keyboard_capturer_uses_sdl_events_ = false;
 #ifdef __APPLE__
  if (!EnsureMacAccessibilityPermission()) {
    keyboard_capturer_uses_sdl_events_ = true;
    return 0;
  }
 #endif
 #if defined(__linux__) && !defined(__APPLE__)
  if (IsWaylandSession()) {
    keyboard_capturer_uses_sdl_events_ = true;
@@ -296,6 +296,9 @@ class Render {
  void OpenScreenRecordingPreferences();
  void OpenAccessibilityPreferences();
  bool DrawToggleSwitch(const char* id, bool active, bool enabled);
  void RefreshMacPermissionStatus(bool force);
  bool EnsureMacScreenRecordingPermission();
  bool EnsureMacAccessibilityPermission();
 #endif
 public:
@@ -699,6 +702,12 @@ class Render {
  double new_version_icon_render_start_time_ = 0.0;
 #ifdef __APPLE__
  bool show_request_permission_window_ = true;
  bool mac_permission_status_initialized_ = false;
  uint32_t mac_permission_last_check_tick_ = 0;
  bool mac_screen_recording_permission_granted_ = false;
  bool mac_accessibility_permission_granted_ = false;
  bool mac_screen_recording_permission_requested_ = false;
  bool mac_accessibility_permission_requested_ = false;
 #endif
  char client_id_[10] = "";
  char client_id_display_[12] = "";
@@ -6,11 +6,27 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <CoreGraphics/CoreGraphics.h>
 #import <Foundation/Foundation.h>
 #include <unistd.h>
 #include <cstdlib>
 #include <string>
 namespace crossdesk {
 namespace {
 constexpr uint32_t kPermissionRefreshIntervalVisibleMs = 500;
 void OpenPrivacyPreferences(const char* pane) {
  if (pane == nullptr || pane[0] == '\0') {
    return;
  }
  std::string command =
      "open \"x-apple.systempreferences:com.apple.preference.security?";
  command += pane;
  command += "\"";
  system(command.c_str());
 }
 }  // namespace
 bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {
  const float TRACK_HEIGHT = ImGui::GetFrameHeight();
  const float TRACK_WIDTH = TRACK_HEIGHT * 1.8f;
@@ -35,16 +51,19 @@ bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {
  bool hovered = ImGui::IsItemHovered();
  bool clicked = ImGui::IsItemClicked() && enabled;
-  ImVec4 track_color = active ? (hovered && enabled ? COLOR_ACTIVE_HOVER : COLOR_ACTIVE)
+  ImVec4 track_color =
-                              : (hovered && enabled ? COLOR_INACTIVE_HOVER : COLOR_INACTIVE);
+      active ? (hovered && enabled ? COLOR_ACTIVE_HOVER : COLOR_ACTIVE)
             : (hovered && enabled ? COLOR_INACTIVE_HOVER : COLOR_INACTIVE);
  if (!enabled) {
    track_color.w *= DISABLED_ALPHA;
  }
  ImVec2 track_min = ImVec2(track_pos.x, track_pos.y + 0.5f);
-  ImVec2 track_max = ImVec2(track_pos.x + TRACK_WIDTH, track_pos.y + TRACK_HEIGHT - 0.5f);
+  ImVec2 track_max = ImVec2(track_pos.x + TRACK_WIDTH,
-  draw_list->AddRectFilled(track_min, track_max, ImGui::GetColorU32(track_color), TRACK_RADIUS);
+                            track_pos.y + TRACK_HEIGHT - 0.5f);
  draw_list->AddRectFilled(track_min, track_max,
                           ImGui::GetColorU32(track_color), TRACK_RADIUS);
  float knob_position = active ? 1.0f : 0.0f;
  float knob_min_x = track_pos.x + KNOB_PADDING;
@@ -59,7 +78,8 @@ bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {
  ImVec2 knob_min = ImVec2(knob_x, knob_y);
  ImVec2 knob_max = ImVec2(knob_x + KNOB_WIDTH, knob_y + KNOB_HEIGHT);
-  draw_list->AddRectFilled(knob_min, knob_max, ImGui::GetColorU32(knob_color), KNOB_RADIUS);
+  draw_list->AddRectFilled(knob_min, knob_max,
                           ImGui::GetColorU32(knob_color), KNOB_RADIUS);
  return clicked;
 }
@@ -81,29 +101,82 @@ bool Render::CheckAccessibilityPermission() {
 }
 void Render::OpenAccessibilityPreferences() {
-  NSDictionary* options = @{(__bridge id)kAXTrustedCheckOptionPrompt : @YES};
+  if (!mac_accessibility_permission_requested_) {
-  AXIsProcessTrustedWithOptions((__bridge CFDictionaryRef)options);
+    NSDictionary* options = @{(__bridge id)kAXTrustedCheckOptionPrompt : @YES};
-
+    AXIsProcessTrustedWithOptions((__bridge CFDictionaryRef)options);
-  system("open "
+  } else {
-         "\"x-apple.systempreferences:com.apple.preference.security?Privacy_"
+    OpenPrivacyPreferences("Privacy_Accessibility");
-         "Accessibility\"");
+  }
 }
 void Render::OpenScreenRecordingPreferences() {
  if (@available(macOS 10.15, *)) {
-    CGRequestScreenCaptureAccess();
+    if (!mac_screen_recording_permission_requested_) {
      CGRequestScreenCaptureAccess();
    } else {
      OpenPrivacyPreferences("Privacy_ScreenCapture");
    }
  } else {
    OpenPrivacyPreferences("Privacy_ScreenCapture");
  }
 }
 void Render::RefreshMacPermissionStatus(bool force) {
  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
  if (!force && mac_permission_status_initialized_ &&
      now - mac_permission_last_check_tick_ <
          kPermissionRefreshIntervalVisibleMs) {
    return;
  }
-  system("open "
+  const bool old_screen_recording_granted =
-         "\"x-apple.systempreferences:com.apple.preference.security?Privacy_"
+      mac_screen_recording_permission_granted_;
-         "ScreenCapture\"");
+  const bool old_accessibility_granted = mac_accessibility_permission_granted_;
  mac_screen_recording_permission_granted_ =
      CheckScreenRecordingPermission();
  mac_accessibility_permission_granted_ = CheckAccessibilityPermission();
  mac_permission_last_check_tick_ = now;
  mac_permission_status_initialized_ = true;
  if (old_screen_recording_granted !=
          mac_screen_recording_permission_granted_ ||
      old_accessibility_granted != mac_accessibility_permission_granted_) {
    LOG_INFO("macOS permission status: screen_recording={}, accessibility={}",
             mac_screen_recording_permission_granted_,
             mac_accessibility_permission_granted_);
  }
 }
 bool Render::EnsureMacScreenRecordingPermission() {
  RefreshMacPermissionStatus(false);
  if (mac_screen_recording_permission_granted_) {
    return true;
  }
  show_request_permission_window_ = true;
  return false;
 }
 bool Render::EnsureMacAccessibilityPermission() {
  RefreshMacPermissionStatus(false);
  if (mac_accessibility_permission_granted_) {
    return true;
  }
  show_request_permission_window_ = true;
  return false;
 }
 int Render::RequestPermissionWindow() {
-  bool screen_recording_granted = CheckScreenRecordingPermission();
+  RefreshMacPermissionStatus(false);
  bool accessibility_granted = CheckAccessibilityPermission();
-  show_request_permission_window_ = !screen_recording_granted || !accessibility_granted;
+  const bool screen_recording_granted =
      mac_screen_recording_permission_granted_;
  const bool accessibility_granted = mac_accessibility_permission_granted_;
  show_request_permission_window_ =
      !screen_recording_granted || !accessibility_granted;
  if (!show_request_permission_window_) {
    return 0;
@@ -162,8 +235,10 @@ int Render::RequestPermissionWindow() {
  if (accessibility_granted) {
    DrawToggleSwitch("accessibility_toggle_on", true, false);
  } else {
-    if (DrawToggleSwitch("accessibility_toggle", accessibility_granted, !accessibility_granted)) {
+    if (DrawToggleSwitch("accessibility_toggle", false, true)) {
      OpenAccessibilityPreferences();
      mac_accessibility_permission_requested_ = true;
      RefreshMacPermissionStatus(true);
    }
  }
@@ -178,12 +253,12 @@ int Render::RequestPermissionWindow() {
  ImGui::AlignTextToFramePadding();
  ImGui::SetCursorPosX(checkbox_padding);
  if (screen_recording_granted) {
    ImGui::SetCursorPosX(ImGui::GetCursorPosX() + 10.0f);
    DrawToggleSwitch("screen_recording_toggle_on", true, false);
  } else {
-    if (DrawToggleSwitch("screen_recording_toggle", screen_recording_granted,
+    if (DrawToggleSwitch("screen_recording_toggle", false, true)) {
                         !screen_recording_granted)) {
      OpenScreenRecordingPreferences();
      mac_screen_recording_permission_requested_ = true;
      RefreshMacPermissionStatus(true);
    }
  }
Author	SHA1	Message	Date
dijunkun	8f3959e6c6	[fix] reset stale macOS permissions during install	2026-05-28 01:34:02 +08:00
dijunkun	5ff6b601c7	[fix] improve macOS permission request flow	2026-05-28 01:33:50 +08:00