Menu

#186 fix(install): screenpipe plist uses /bin/sh wrapper — TCC Screen Recording grant keys to sh, not screenpipe binary

open
nobody
None
2026-06-06
2026-06-06
Anonymous
No

Originally created by: adityaharishch

Problem

scripts/com.meridiona.screenpipe.plist launches screenpipe via:

<string>/bin/sh</string>
<string>-c</string>
<string>exec /path/to/screenpipe record ...</string>

Even with exec, macOS TCC attributes Screen Recording permission to /bin/sh (the launched binary), not to the resolved screenpipe Mach-O. This means:

  • The TCC grant is fragile (any system shell update could invalidate it)
  • After a screenpipe npm version bump, the grant is effectively keyed to sh which is stable — but the intent was to key it to the screenpipe binary directly

install-screenpipe-daemon.sh already has logic to find the real Mach-O (walking the npm package tree past Node shims). The plist needs to use that binary directly as ProgramArguments[0] with flags as separate array elements.

Fix

In install-screenpipe-daemon.sh, write the resolved binary path + each flag as separate <string> elements in the plist array, removing the /bin/sh -c exec wrapper entirely.

Discussion


Log in to post a comment.