Pearl th-b85641: th doctor detects external-volume workspace + FDA helper - #308
Merged
Conversation
…lume + guided FDA helper Big Smooth's workspace on smoo-hub is ~/dev -> /Volumes/smoo-ext (external USB volume). macOS gates external volumes behind TCC (RemovableVolumes); the daemon and th lack the grant, so every fs op there returns EPERM and the agent looks jailed in its own workspace. This is separate from the seatbelt sandbox (allow-by-default). FDA can't be granted programmatically (SIP-protected TCC.db), so th doctor now DETECTS the trap and th doctor --fix-fda GUIDES the one-time manual grant (opens the FDA pane, reveals th + the daemon binary in Finder), warning that an ad-hoc-signed th loses the grant on rebuild. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G2Gv86zBefzdtdFvxHJ2bh
🦋 Changeset detectedLatest commit: 08d9a27 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
brentrager
enabled auto-merge (squash)
July 28, 2026 20:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Big Smooth on smoo-hub looked jailed in its own workspace — "no home dir", couldn't do basically anything. Root cause: its workspace is
~/dev, a symlink to/Volumes/smoo-ext/dev(external USB volume). macOS gates external volumes behind TCC (kTCCServiceSystemPolicyRemovableVolumes); the daemon (com.smooai.smooth-daemon) has no grant andthis explicitly denied, so every filesystem op there returnsEPERM.This is separate from the seatbelt sandbox (
smooth-tools/sandbox.rs), which is allow-by-default now. And Full Disk Access can't be granted programmatically — the TCC DB is SIP-protected;tccutilonly resets.Solution
th doctor): a macOS check that flags when the resolved workspace lives on a non-boot/Volumespath, and whether access is already denied. Boot-volume workspaces report ✓ (no FDA needed).th doctor --fix-fda): opens the Full Disk Access settings pane and revealsth+ the daemon binary in Finder to drag in — the fastest a manual grant can be. Warns that an ad-hoc-signedthloses the grant on everypnpm install:threbuild (stable signing, or keeping the workspace on the boot volume, is the durable fix).New
fda.rsmodule holds the pure, tested logic (external-volume predicate, access probe, grant targets, workspace resolution); presentation stays incmd_doctor/cmd_doctor_fix_fda.Verification
cargo test -p smooai-smooth-cli→ 432 passed (5 new fda tests).cargo fmt --checkclean,cargo clippy0 errors, no new warnings from the module.th doctoron a boot-volume box reports ✓ (positive/Volumescase covered by unit tests — no external volume mounted locally).🤖 Generated with Claude Code
https://claude.ai/code/session_01G2Gv86zBefzdtdFvxHJ2bh