Audio device selection and permission management unreliable

[poodle64]

Description

Audio device enumeration, selection, and macOS permission management have persistent reliability issues. The system reached a "don't touch it" state where it worked but was fragile. Known problems include:

• Device selection not persisting correctly across sessions
• macOS microphone permission grants not being detected reliably
• Accessibility permission checks giving false negatives
• Permission request flow confusing users (multiple system dialogs)

Expected Behaviour

• Device selection persists and works on next launch
• Permission status accurately detected
• Clear, single-path permission request flow
• Graceful handling when permissions are revoked

Investigation Areas

• src-tauri/src/audio/device.rs (device enumeration)
• src-tauri/src/platform/macos.rs (TCC permission checks)
• src-tauri/src/config.rs (device persistence)
• src-tauri/src/commands/mod.rs (set_audio_device, get_audio_device)

Notes

Consider promoting audio device + permissions to a feature-level documentation scope to properly specify the expected behaviour and edge cases.

[m13v]

TCC permission management on macOS is genuinely painful. a few patterns that helped us: check permission status on every app launch, not just once, because users can revoke permissions mid-session through System Settings and your app gets no notification about it. for microphone, AVCaptureDevice.authorizationStatus(for: .audio) is reliable. for screen recording and accessibility, the checks are less straightforward. CGPreflightScreenCaptureAccess() works for screen recording, AXIsProcessTrustedWithOptions for accessibility. the false negatives you mention are almost always caused by the app's code signing identity changing between builds, TCC binds permissions to a specific code signature and rebuilding with ad-hoc signing creates a new identity each time. using a stable Developer ID certificate fixes this. for device persistence, store by UID not by name since device names can change.

[m13v]

our ScreenCaptureKit service that handles TCC permission checks and the audio/video capture pipeline on macOS: https://github.com/m13v/macos-session-replay/blob/main/Sources/SessionReplay/ScreenCaptureService.swift

and the MCP server that handles accessibility permission flow and AXIsProcessTrusted checks: https://github.com/mediar-ai/mcp-server-macos-use/blob/main/Sources/MCPServer/main.swift