macOS permissions

The TCC permissions Zanei uses, and how zanei doctor diagnoses and guides you through granting them.

Depending on what you capture (the capture.sources setting), Zanei uses up to three macOS permissions (TCC). Screen recording is not one of them.

Required permissions

Permission	System Settings item	Used for	Related event types
Accessibility	Accessibility	Window titles, focus, UI elements	`window.` `ui.`
Input Monitoring	Input Monitoring	Detecting keys, scrolling, clicks	`input.` `ui.click` `clipboard.`
Automation	Automation (per target app)	Reading the current URL and tab info from Chrome	`browser.navigate`

Two important properties:

App launch, termination, and switching (app.*) require no permissions. With nothing granted, Zanei still records app-level activity.
A permission counts as required only when a source that needs it is enabled. With input removed from capture.sources, for example, the diagnosis reports ok even if Input Monitoring is not granted.

Diagnose with `doctor`

zanei doctor

Checks the granted state of each permission against your current configuration. If anything is missing, it explains what to grant and which System Settings pane to use, then exits with code 3.

zanei doctor --fix

--fix opens the System Settings pane for each missing permission directly (the granting itself is always your action).

For agents and scripts: `--json`

zanei doctor --json

{
  "ok": false,
  "capture_sources": ["app", "window", "ui", "input", "browser"],
  "permissions": {
    "accessibility":     { "status": "granted" },
    "input_monitoring":  { "status": "denied", "required_for": ["input.key", "input.scroll", "clipboard.copy", "clipboard.paste", "ui.click"] },
    "automation":        { "per_app": { "com.google.Chrome": "not_determined" } }
  },
  "missing_required": ["input_monitoring"],
  "settings_pane": "x-apple.systempreferences:com.apple.preference.security?Privacy_ListenEvent"
}

status is one of granted / denied / not_determined. Missing permissions use the dedicated exit code 3, so agents and scripts can detect a permission problem without parsing output (see exit codes).

Granting manually

Enable zanei under System Settings → Privacy & Security:

Permission	Location
Accessibility	Privacy & Security → Accessibility
Input Monitoring	Privacy & Security → Input Monitoring
Automation	Privacy & Security → Automation (also confirmed via a dialog on the first Apple Event)

Permissions and code signing

macOS ties permissions to the code-signing identity of the executable. Release binaries are signed and notarized, so granted permissions survive upgrades even though the binary is replaced. Homebrew distribution is still in preparation; for now, Zanei is installed by building from source (see the warning below).

Scope

Zanei does not grant permissions or touch the TCC database; macOS does not allow it. Its scope is detection, guidance, and diagnosis.
If start detects missing permissions, it exits with code 3 explaining what is missing rather than running in a partial state.