Sign desktop with the Apple Events entitlement so macOS can prompt

[RhysSullivan]

The desktop app and its bundled daemon are hardened-runtime signed without
com.apple.security.automation.apple-events. tccd therefore refuses to show
the Automation consent prompt at all ("Policy disallows prompt"): every
Messages call is denied silently, no row is ever created under Privacy &
Security → Automation, and there is nothing the user can enable by hand.

On the add screen this presented as "Checking…" for a full minute (the denied
Apple Event blocks until the MCP request timeout) followed by "Could not start
the plugin. Check that Codex is installed and signed in." — wrong on every
count.

• Add the entitlement to entitlements.mac.plist (signs both the app and the
  bundled daemon) and an NSAppleEventsUsageDescription via extendInfo.
• Cap the access probe at 25s and report a hang as what it is: macOS has not
  answered yet — answer the permission prompt, then check again.

Verified live on a 1.6.6 install by re-signing with the new entitlements:
before, tccd logs AccessRequestIndirect: Policy disallows prompt for sh.executor.desktop; access to kTCCServiceAppleEvents denied; after, it logs
Prompting for access to indirect object Codex Computer Use by Executor and
the consent dialog appears.

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	9a1100d	Commit Preview URL Branch Preview URL	Aug 30 2026, 05:25 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	9a1100d	Aug 30 2026, 05:27 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1876

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1876

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1876

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1876

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1876

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1876

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1876

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1876

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1876

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1876

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1876

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1876

executor

npm i https://pkg.pr.new/executor@1876

commit: 9a1100d