Reported by semotech in #bugs (Discord, message 1534282519237759187).
Report (PII-redacted):
Reinstalled via install.sh on 2019 iMac (macOS 14.7.2 amd64, agent 0.103.0): upgrade OK, already enrolled (no --force). Reinstall restored loginwindow helper → Screen Recording prompts returned after reboot. After console login Breeze shows FDA/SR/Accessibility Granted; Remote Desktop still Missing; Desktop unavailable. Also saw Splashtop Streamer Screen Recording prompt on this host — is Splashtop part of Breeze RD on macOS, and must it be granted separately? Disabling loginwindow plist again as workaround.
Filed automatically by @breeze-discord triage. Verify and add labels/repro as needed.
Triage analysis
Two distinct things in this thread. (1) Splashtop: confirmed not part of Breeze. agent/internal/mgmtdetect/signatures.go lists Splashtop alongside AnyDesk/TeamViewer/LogMeIn purely as a CategoryRemoteAccess signature the agent scans for on the device (management-posture detection of other remote-access tools) — it has no relation to Breeze's own Remote Desktop/Helper consent flow, so its Screen Recording TCC prompt is Splashtop's own and must be granted (or the app removed) independent of Breeze. (2) The agent.sock permission issue the poster keeps hitting on Standard/non-admin macOS accounts is a real code-level bug. agent/internal/sessionbroker/broker_unix.go:30-35 chmods the socket to 0660 with a comment stating the intent is to 'allow normal user helpers ... to connect to the socket', gated only by peer-credential/binary-path checks. But DefaultSocketPath (agent/internal/ipc/auth_darwin.go:102-105) places the socket inside /Library/Application Support/Breeze, which per macOS/BSD default semantics is root:admin — so the socket's group ends up 'admin', not some broadly-joinable group. 0660 + group=admin means only admin users can dial the socket; Standard (non-admin) users get exactly the 'permission denied' the poster observed, contradicting the code's own stated design intent. handlers_desktop_helper.go's startDesktopViaHelper depends on a live sessionBroker helper connection to route desktop/TCC state, so a blocked socket for a Standard user plausibly explains 'Desktop unavailable / Remote Desktop Missing' persisting even after FDA/Screen Recording/Accessibility show Granted, since the agent never gets a live user-session helper link for that account.
Affected code
agent/internal/sessionbroker/broker_unix.go:12-37 — Socket chmod'd 0660 with comment stating intent to allow 'normal user helpers' to connect; no group is set explicitly, so it inherits the parent dir's group.agent/internal/ipc/auth_darwin.go:102-105 — DefaultSocketPath places agent.sock under /Library/Application Support/Breeze, whose default macOS group is admin, so 0660 restricts access to root+admin-group users only.agent/internal/agentapp/service_cmd_darwin.go:17-29 — darwinConfigDir constant confirms the socket's parent directory is /Library/Application Support/Breeze.agent/internal/heartbeat/handlers_desktop_helper.go:95-116 — Desktop session start is routed via sessionBroker's live helper connection; a blocked socket for Standard users means no helper session is ever registered.agent/internal/mgmtdetect/signatures.go:186-197 — Splashtop is one of several third-party remote-access signatures (AnyDesk, LogMeIn, etc.) the agent scans for; it is not part of Breeze's own Remote Desktop stack.
Potential fix
Either explicitly chown the socket (and its parent dir) to a group all local users belong to (e.g. 'everyone'/'staff' on macOS) instead of relying on inherited /Library/Application Support group ownership, or widen the mode to 0666 since the real gate is already peer-credential + binary-path verification (per the existing comment) rather than filesystem group membership.
Triage analysis, affected code, and fix sketch above were produced by automated investigation (@breeze-discord). Verify before relying on them.
Reported by semotech in #bugs (Discord, message 1534282519237759187).
Report (PII-redacted):
Reinstalled via install.sh on 2019 iMac (macOS 14.7.2 amd64, agent 0.103.0): upgrade OK, already enrolled (no --force). Reinstall restored loginwindow helper → Screen Recording prompts returned after reboot. After console login Breeze shows FDA/SR/Accessibility Granted; Remote Desktop still Missing; Desktop unavailable. Also saw Splashtop Streamer Screen Recording prompt on this host — is Splashtop part of Breeze RD on macOS, and must it be granted separately? Disabling loginwindow plist again as workaround.
Filed automatically by @breeze-discord triage. Verify and add labels/repro as needed.
Triage analysis
Two distinct things in this thread. (1) Splashtop: confirmed not part of Breeze. agent/internal/mgmtdetect/signatures.go lists Splashtop alongside AnyDesk/TeamViewer/LogMeIn purely as a CategoryRemoteAccess signature the agent scans for on the device (management-posture detection of other remote-access tools) — it has no relation to Breeze's own Remote Desktop/Helper consent flow, so its Screen Recording TCC prompt is Splashtop's own and must be granted (or the app removed) independent of Breeze. (2) The agent.sock permission issue the poster keeps hitting on Standard/non-admin macOS accounts is a real code-level bug. agent/internal/sessionbroker/broker_unix.go:30-35 chmods the socket to 0660 with a comment stating the intent is to 'allow normal user helpers ... to connect to the socket', gated only by peer-credential/binary-path checks. But DefaultSocketPath (agent/internal/ipc/auth_darwin.go:102-105) places the socket inside /Library/Application Support/Breeze, which per macOS/BSD default semantics is root:admin — so the socket's group ends up 'admin', not some broadly-joinable group. 0660 + group=admin means only admin users can dial the socket; Standard (non-admin) users get exactly the 'permission denied' the poster observed, contradicting the code's own stated design intent. handlers_desktop_helper.go's startDesktopViaHelper depends on a live sessionBroker helper connection to route desktop/TCC state, so a blocked socket for a Standard user plausibly explains 'Desktop unavailable / Remote Desktop Missing' persisting even after FDA/Screen Recording/Accessibility show Granted, since the agent never gets a live user-session helper link for that account.
Affected code
agent/internal/sessionbroker/broker_unix.go:12-37— Socket chmod'd 0660 with comment stating intent to allow 'normal user helpers' to connect; no group is set explicitly, so it inherits the parent dir's group.agent/internal/ipc/auth_darwin.go:102-105— DefaultSocketPath places agent.sock under /Library/Application Support/Breeze, whose default macOS group is admin, so 0660 restricts access to root+admin-group users only.agent/internal/agentapp/service_cmd_darwin.go:17-29— darwinConfigDir constant confirms the socket's parent directory is /Library/Application Support/Breeze.agent/internal/heartbeat/handlers_desktop_helper.go:95-116— Desktop session start is routed via sessionBroker's live helper connection; a blocked socket for Standard users means no helper session is ever registered.agent/internal/mgmtdetect/signatures.go:186-197— Splashtop is one of several third-party remote-access signatures (AnyDesk, LogMeIn, etc.) the agent scans for; it is not part of Breeze's own Remote Desktop stack.Potential fix
Either explicitly chown the socket (and its parent dir) to a group all local users belong to (e.g. 'everyone'/'staff' on macOS) instead of relying on inherited /Library/Application Support group ownership, or widen the mode to 0666 since the real gate is already peer-credential + binary-path verification (per the existing comment) rather than filesystem group membership.
Triage analysis, affected code, and fix sketch above were produced by automated investigation (@breeze-discord). Verify before relying on them.