feat(output): show blocked macos grants in capability summary - #1178
Merged
Conversation
Previously, macOS user-granted paths that were silently blocked by deny groups were logged as individual warnings. This could lead to a large number of warnings when a broad user grant (e.g., `~/Library`) overlapped with multiple deny groups. This commit refactors the logic to collect these blocked grants and present them in the capability summary. The new display is collapsed into a single line by default, indicating the number of paths blocked. Using the `-v` (verbose) flag expands the summary to list each specific path and the deny rule that blocks it, along with a hint about how to use `--bypass-protection`. This significantly improves readability and user experience by folding multiple related warnings into a concise summary. Signed-off-by: Luke Hinds <lukehinds@gmail.com>
Contributor
PR Review SummarySize
Affected crates
Blast radius — ContainedThis PR touches: source code Updated automatically on each push to this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request refactors how silently blocked user-granted paths on macOS are handled. Instead of printing individual warnings immediately, they are now collected into blocked_grants and folded into a single row in the capability summary (expandable with -v). The review feedback suggests two performance optimizations in crates/nono-cli/src/output.rs to avoid unnecessary string allocations when grouping and rendering these blocked paths.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
- Use `Path::to_string_lossy` for displaying paths in `print_blocked_grants`. This provides more robust handling of non-UTF-8 characters and avoids unnecessary `String` allocations compared to `Path::display().to_string()`. - Optimize string handling when grouping blocked grants by deferring `.to_string()` calls until group names are inserted into the `groups` vector, reducing temporary allocations. - Reorder test module imports in `output.rs` for minor style consistency. Signed-off-by: Luke Hinds <lukehinds@gmail.com>
oscarmackjr-twg
pushed a commit
to OscarMackJr/nono
that referenced
this pull request
Jun 23, 2026
…-ai#1178) * feat(output): show blocked macos grants in capability summary Previously, macOS user-granted paths that were silently blocked by deny groups were logged as individual warnings. This could lead to a large number of warnings when a broad user grant (e.g., `~/Library`) overlapped with multiple deny groups. This commit refactors the logic to collect these blocked grants and present them in the capability summary. The new display is collapsed into a single line by default, indicating the number of paths blocked. Using the `-v` (verbose) flag expands the summary to list each specific path and the deny rule that blocks it, along with a hint about how to use `--bypass-protection`. This significantly improves readability and user experience by folding multiple related warnings into a concise summary. Signed-off-by: Luke Hinds <lukehinds@gmail.com> * refactor(output): improve path display and string allocations - Use `Path::to_string_lossy` for displaying paths in `print_blocked_grants`. This provides more robust handling of non-UTF-8 characters and avoids unnecessary `String` allocations compared to `Path::display().to_string()`. - Optimize string handling when grouping blocked grants by deferring `.to_string()` calls until group names are inserted into the `groups` vector, reducing temporary allocations. - Reorder test module imports in `output.rs` for minor style consistency. Signed-off-by: Luke Hinds <lukehinds@gmail.com> --------- Signed-off-by: Luke Hinds <lukehinds@gmail.com> (cherry picked from commit a0bba5e) Signed-off-by: oscarmackjr-twg <oscar.mack.jr@gmail.com>
klassm
pushed a commit
to klassm/nono
that referenced
this pull request
Jul 3, 2026
…-ai#1178) * feat(output): show blocked macos grants in capability summary Previously, macOS user-granted paths that were silently blocked by deny groups were logged as individual warnings. This could lead to a large number of warnings when a broad user grant (e.g., `~/Library`) overlapped with multiple deny groups. This commit refactors the logic to collect these blocked grants and present them in the capability summary. The new display is collapsed into a single line by default, indicating the number of paths blocked. Using the `-v` (verbose) flag expands the summary to list each specific path and the deny rule that blocks it, along with a hint about how to use `--bypass-protection`. This significantly improves readability and user experience by folding multiple related warnings into a concise summary. Signed-off-by: Luke Hinds <lukehinds@gmail.com> * refactor(output): improve path display and string allocations - Use `Path::to_string_lossy` for displaying paths in `print_blocked_grants`. This provides more robust handling of non-UTF-8 characters and avoids unnecessary `String` allocations compared to `Path::display().to_string()`. - Optimize string handling when grouping blocked grants by deferring `.to_string()` calls until group names are inserted into the `groups` vector, reducing temporary allocations. - Reorder test module imports in `output.rs` for minor style consistency. Signed-off-by: Luke Hinds <lukehinds@gmail.com> --------- Signed-off-by: Luke Hinds <lukehinds@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, macOS user-granted paths that were silently blocked by deny groups were logged as individual warnings. This could lead to a large number of warnings when a broad user grant (e.g.,
~/Library) overlapped with multiple deny groups.This commit refactors the logic to collect these blocked grants and present them in the capability summary. The new display is collapsed into a single line by default, indicating the number of paths blocked. Using the
-v(verbose) flag expands the summary to list each specific path and the deny rule that blocks it, along with a hint about how to use--bypass-protection. This significantly improves readability and user experience by folding multiple related warnings into a concise summary.Linked Issue
Closes #1176
CHANGELOG.mdif needed