App Groups and macOS 15

@zulfishah Please keep me updated if you find a solution. The prompts are extremely annoying, and worst of all, it doesn’t respect the "Allow" setting.

I went to Settings -> Privacy & Security -> Full Disk Access, and enabled the setting there for my app. That stopped all the warnings coming up.

I have a bunch of info about this issue in my App Groups: macOS vs iOS: Fight! I recommend that you read that before committing to any solution for the production deployment of your app.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer I haven’t been able to resolve the issue, and I’ve also decided to skip trying full access permissions.

The problem only occurs in the debug build. This setup involves a macCatalyst app that includes a secondary macCatalyst command-line app. Both apps share the same application group (com.apple.security.application-groups). The second app functions as a native messaging host for browsers like Chrome and Firefox, serving as the interface between the browser extension and the main app to facilitate data exchange.

This setup was working without issues on macOS 14, but since updating to macOS 15, I keep seeing the permissions dialog. However, even when selecting “Allow,” the action isn’t being accepted or processed. In the release build, everything functions as expected without triggering any permissions dialog.

Is there a way to debug or resolve this permissions issue effectively? Any insights would be much appreciated!

Thanks in advance!

This setup involves a macCatalyst app that includes a secondary macCatalyst command-line app.

Is the secondary “app” packaged in an app-like wrapper? Or is it just a standalone executable? That is, does your bundle look like this:

MyApp.app/
    Contents/
        MacOS/
            MyApp
            MySecondaryApp
        …

Or like this:

MyApp.app/
    Contents/
        MacOS/
            MyApp
            MySecondaryApp.app/
                Contents/
                    MacOS/
                        MySecondaryApp
                    …
        …

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

The secondary app is packaged in an app-like wrapper and worked perfect on macOS 14 without permission dialogs and it works in release builds on macOS 15 without permission dialogs.

MyApp.app/
    Contents/
        MacOS/
            MyApp
            MySecondaryApp.app/
                Contents/
                    MacOS/
                        MySecondaryApp

Thanks for confirming that.

I would expect this to work. When you use an iOS-style app group ID in a Mac Catalyst app, Xcode generates a provisioning profile to authorise that use. So this use falls under case D in App Groups: macOS vs iOS: Fight!.

Consider this tiny test app I just created:

% codesign -d --entitlements - Debug-maccatalyst/Test766580.app
Executable=/Users/quinn/Library/Developer/Xcode/DerivedData/Test766580-beavevigoaauqrfhkfssttblupau/Build/Products/Debug-maccatalyst/Test766580.app/Contents/MacOS/Test766580
[Dict]
    …
    [Key] com.apple.security.application-groups
    [Value]
        [Array]
            [String] group.eskimo1.test
	[Key] com.apple.security.get-task-allow
	[Value]
		[Bool] true
    …
% security cms -D -i Debug-maccatalyst/Test766580.app/Contents/embedded.provisionprofile | plutil -p -
{
  …
  "Entitlements" => {
    …
    "com.apple.security.application-groups" => [
      0 => "group.eskimo1.test"
    ]
    …
  }
  …
}

Note the presence of com.apple.security.get-task-allow, showing that this is a development build. And that group.eskimo1.test is claimed by the entitlements and that claim is authorised by the profile.

Please run these commands over the development build of MyApp and confirm that the group entitlement and profile are as expected. Then do the same for the copy of MySecondaryApp embedded within MyApp.

IMPORTANT Make sure to look at the embedded app, because that’s the app that matters. There’ll likely be a copy of MySecondaryApp in Debug-maccatalyst, but that’s the app before it’s been embedded, and there’s a possibility that Xcode’s embedding is changing things.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"