Permissions

macOS ties Accessibility, notification authorization, and launch-at-login trust to the installed code-signing identity, not only the bundle identifier. Keep one stable identity ("Bob Mac Capture Local") for the life of an install; see Install. Settings that request or display these grants are in Settings.

Recovery steps for a stale Accessibility switch, denied notifications, or a lingering Login Items row are in Restore Mac Capture permissions.

Accessibility¶

Bob Mac Capture needs Accessibility to read Highlights tabs and observe ⌘S while Highlights is frontmost. Settings › References shows "Highlights tabs: Allowed / Not allowed" and never prompts. Tabs never asks at launch. Open Accessibility Settings from the Tabs card (an explicit gesture) clears a stale grant with tccutil reset Accessibility org.bobs.bob-mac-capture and then shows the system prompt; if the prompt does not grant trust it opens System Settings › Privacy & Security › Accessibility.

Accessibility is used only against Highlights: it reads window/tab attributes, selects or closes tabs, and passively checks key-down characters and modifier flags for ⌘S. It never consumes or re-posts the key; key-event text is not stored or logged. Names stay in memory. Bob Refs quits Highlights only after closing its last document. Tab names and closed-tab entries are never persisted.

macOS ties an ad-hoc app's grant to its exact cdhash, so every ad-hoc just install silently revokes the grant while System Settings still shows it on. Ad-hoc Settings caption: "Grants reset when an ad-hoc build is reinstalled." Signing every install with the stable identity keeps the grant across reinstalls. When an install changes the code signature, the installer clears the stale Accessibility row; grant the app again from Bob Refs › Tabs › Open Accessibility Settings.

Notifications¶

Notification delivery and authorization persistence require the installed, signed Bob Mac Capture.app bundle (just bundle + just install), not swift run or a raw .build binary. Settings › Notifications shows live authorization (Not requested, Denied — enable in System Settings, Authorized, Provisional, Ephemeral, or Unknown), a button to request authorization while that is still possible, a link to the system notification settings pane, and a test-notification action. Settings › Diagnostics reports the current signing state.

An install never prompts for notification permission. Denied or not-yet-requested authorization is silent and non-fatal. Notification copy and the install-complete banner are in Settings. Scan notifications may show reference titles, as capture notifications already show task text.

Launch at login¶

Launch at login is controlled from Settings via SMAppService.mainApp. Status values are Enabled, Requires approval in System Settings, Not registered, App bundle not found, or Unknown. If macOS reports "Requires approval in System Settings," open System Settings → General → Login Items and approve Bob Mac Capture there; the app cannot grant that approval for itself.

Uninstalling removes the launch-at-login registration's target, though macOS may keep a stale, non-functional Login Items entry until the next login — remove it manually from System Settings → General → Login Items if it lingers.

Privacy¶

What is stored on disk, what stays in memory, and what diagnostic logs omit:

• Raw draft text lives only in the panel's in-memory draft and in the arguments passed directly to bob; it is never logged, written to UserDefaults, or emitted in a signpost or Diagnostics entry. BobClientError.description explicitly redacts the trailing draft argument from every command it echoes, and failure notifications carry only that bounded error message. Success notifications include Bob's semantic task/note text from the capture response, not the raw draft syntax; see Settings › Notification copy.
• Canceled drafts retained with Control-C are stored in ~/Library/Application Support/org.bobs.bob-mac-capture/canceled-draft-stash.json (directory mode 0700, file mode 0600). If the stash file is unreadable, it is renamed to canceled-draft-stash.corrupt.json, which can also hold captured text. They are never written to UserDefaults, notifications, signposts, logs, or Diagnostics. Settings' Clear Stash... action and capacity 0 delete both files.
• Diagnostics and Recent Activity in Settings are metadata only — status strings like "Ready," "Hotkey conflict," or "Target cache stale," never note content.
• Signposts carry event names and durations for Instruments, not payloads. See Diagnostics.
• Wikilink note paths, aliases, heading text, and block previews are read locally by bob to build completion candidates and are held only in the in-memory completion response and the visible row content. They are never logged, written to UserDefaults, or included in a notification, signpost, or Diagnostics entry — the same guarantee the draft itself gets.
• @route+ task completion metadata, task-section titles, and a user-authored block ID are sent only to the local bob subprocess. The app never opens or rewrites Markdown notes directly; Bob performs the vault write through capture-task-id, and the app updates the draft only after Bob confirms success.

Bob Refs on disk and in memory¶

Refs files live outside the vault, every file mode 0600 in 0700 directories: the snapshot cache, open log, and NEW marks (refs-snapshot.json, refs-open-log.json, refs-new-marks.json) under ~/Library/Application Support/org.bobs.bob-mac-capture/, and the intrinsics cache (intrinsics-v2.json) with thumbnails (thumbs-v2/<sha256>.png) under ~/Library/Caches/org.bobs.bob-mac-capture/refs/. The first v2 run removes the legacy intrinsics.json and thumbs/, so stale 224 × 290 thumbnails are never upscaled. Annotation images that bob ref show names are read from the vault, read-only, and the decoded previews stay in a bounded in-memory cache; nothing new is written to disk. The References settings persist a small set of UserDefaults keys (the ⌃⇧⌘O binding flag, the Highlights-frontmost open key, the Highlights Tabs key (refsHighlightsTabsKey, default cmdT), the Highlights override path, the scan-after-Highlights-save toggle, and the preview notes page size). Accessibility is used only against Highlights: it reads window and tab attributes, selects or closes tabs, and checks key-down characters and modifiers only for ⌘S. Key-event text is never stored or logged. Bob Refs quits Highlights only after closing its last document. Tab names and closed-tab entries stay in memory and are never persisted. Signposts carry event names only, never note text. Scan notifications may show reference titles, as capture notifications already show task text; the Just scanned mark itself lives in memory only and is never written to disk.

Uninstalling removes ~/Library/Application Support/org.bobs.bob-mac-capture. The app stores only non-sensitive preferences (bob path, vault path, hotkey choice, canceled-draft stash capacity, Refs keys above) in UserDefaults under org.bobs.bob-mac-capture.