perf(macos): keep full disk probe off main thread

src/main/ipc/developer-permissions.test.ts

@@ -79,7 +79,7 @@ describe('registerDeveloperPermissionHandlers', () => {
     getMediaAccessStatusMock.mockReset()
     isTrustedAccessibilityClientMock.mockReset()
     getMacosFullDiskAccessStatusMock.mockReset()
-    getMacosFullDiskAccessStatusMock.mockReturnValue('denied')
+    getMacosFullDiskAccessStatusMock.mockResolvedValue('denied')
     execFileMock.mockReset()
     execFileMock.mockImplementation((...args: unknown[]) => {
       const callback = args.at(-1)
@@ -128,7 +128,7 @@ describe('registerDeveloperPermissionHandlers', () => {
   }
 
   it('returns the Full Disk Access read-probe status', async () => {
-    getMacosFullDiskAccessStatusMock.mockReturnValue('granted')
+    getMacosFullDiskAccessStatusMock.mockResolvedValue('granted')
     registerDeveloperPermissionHandlers()
 
     const call = handleMock.mock.calls.find(

src/main/ipc/developer-permissions.ts

@@ -148,7 +148,7 @@ async function getPermissionState(id: DeveloperPermissionId): Promise<DeveloperP
     case 'accessibility':
       return { id, status: getAccessibilityStatus() }
     case 'full-disk-access':
-      return { id, status: getMacosFullDiskAccessStatus() }
+      return { id, status: await getMacosFullDiskAccessStatus() }
     case 'automation':
     case 'local-network':
       return { id, status: unsupportedOffMac() ?? 'unknown' }

src/main/macos-full-disk-access-status.test.ts

@@ -24,40 +24,40 @@ afterEach(() => {
 })
 
 describe('probeMacosFullDiskAccess', () => {
-  it('reports granted only when the TCC database opens for reading', () => {
-    const readProbe = vi.fn()
+  it('reports granted only when the TCC database opens for reading', async () => {
+    const readProbe = vi.fn().mockResolvedValue(undefined)
 
-    expect(probeMacosFullDiskAccess({ homeDirectory, readProbe })).toBe('granted')
+    await expect(probeMacosFullDiskAccess({ homeDirectory, readProbe })).resolves.toBe('granted')
     expect(readProbe).toHaveBeenCalledWith(databasePath)
   })
 
-  it.each(['EACCES', 'EPERM'])('reports denied for %s', (code) => {
-    expect(
+  it.each(['EACCES', 'EPERM'])('reports denied for %s', async (code) => {
+    await expect(
       probeMacosFullDiskAccess({
         homeDirectory,
-        readProbe: () => {
+        readProbe: async () => {
           throw fileSystemError(code)
         }
       })
-    ).toBe('denied')
+    ).resolves.toBe('denied')
   })
 
-  it.each(['ENOENT', 'ENOTDIR', 'EBUSY'])('keeps %s failures unknown', (code) => {
-    expect(
+  it.each(['ENOENT', 'ENOTDIR', 'EBUSY'])('keeps %s failures unknown', async (code) => {
+    await expect(
       probeMacosFullDiskAccess({
         homeDirectory,
-        readProbe: () => {
+        readProbe: async () => {
           throw fileSystemError(code)
         }
       })
-    ).toBe('unknown')
+    ).resolves.toBe('unknown')
   })
 })
 
 describe('getMacosFullDiskAccessStatus', () => {
-  it('is unsupported off macOS', () => {
+  it('is unsupported off macOS', async () => {
     Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
 
-    expect(getMacosFullDiskAccessStatus()).toBe('unsupported')
+    await expect(getMacosFullDiskAccessStatus()).resolves.toBe('unsupported')
   })
 })

src/main/macos-full-disk-access-status.ts

@@ -1,13 +1,13 @@
-import { closeSync, openSync } from 'node:fs'
+import { open } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import type { DeveloperPermissionStatus } from '../shared/developer-permissions-types'
 
-type ReadProbe = (filePath: string) => void
+type ReadProbe = (filePath: string) => Promise<void>
 
-function openForRead(filePath: string): void {
-  const descriptor = openSync(filePath, 'r')
-  closeSync(descriptor)
+async function openForRead(filePath: string): Promise<void> {
+  const handle = await open(filePath, 'r')
+  await handle.close()
 }
 
 function errorCode(error: unknown): string | undefined {
@@ -16,13 +16,13 @@ function errorCode(error: unknown): string | undefined {
     : undefined
 }
 
-export function probeMacosFullDiskAccess({
+export async function probeMacosFullDiskAccess({
   homeDirectory = homedir(),
   readProbe = openForRead
 }: {
   homeDirectory?: string
   readProbe?: ReadProbe
-} = {}): DeveloperPermissionStatus {
+} = {}): Promise<DeveloperPermissionStatus> {
   const databasePath = join(
     homeDirectory,
     'Library',
@@ -31,7 +31,7 @@ export function probeMacosFullDiskAccess({
     'TCC.db'
   )
   try {
-    readProbe(databasePath)
+    await readProbe(databasePath)
     return 'granted'
   } catch (error) {
     const code = errorCode(error)
@@ -39,6 +39,6 @@ export function probeMacosFullDiskAccess({
   }
 }
 
-export function getMacosFullDiskAccessStatus(): DeveloperPermissionStatus {
+export async function getMacosFullDiskAccessStatus(): Promise<DeveloperPermissionStatus> {
   return process.platform === 'darwin' ? probeMacosFullDiskAccess() : 'unsupported'
 }