feat(cua-driver-rs)(uninstall): opt-in --reset-tcc to revoke TCC grants

[f-trycua]

Adds an opt-in --reset-tcc flag to uninstall.sh that revokes Accessibility + Screen Recording + Automation grants for com.trycua.driver.

Off by default on purpose: the bundle id is shared with the retired Swift driver, and keeping grants across a reinstall avoids a re-prompt — so wiping OS privacy state is a deliberate choice, not a silent side effect of uninstall (consistent with brew/most uninstallers). The default run keeps the manual-reset hint, now also mentioning the flag.

Verified: bash -n clean; default + --reset-tcc paths covered in both Rust and Swift branches.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added an optional --reset-tcc flag to the uninstaller that revokes system permissions granted to the driver during uninstallation on macOS.
  • Added guidance prompting users to re-run the uninstaller with the flag if permissions weren't reset.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	May 29, 2026 5:37pm

[coderabbitai]

📝 Walkthrough

Walkthrough

The uninstall script adds an opt-in --reset-tcc flag that revokes TCC grants for com.trycua.driver on macOS. A conditional helper function checks platform, tool availability, and flag state before executing tccutil reset for three TCC categories. Both uninstall branches integrate the helper and conditionally display usage guidance.

Changes

macOS TCC Reset Feature

Layer / File(s)	Summary
Flag declaration and argument parsing libs/cua-driver/scripts/uninstall.sh	New RESET_TCC variable and CLI argument parsing recognize --reset-tcc to enable TCC grant revocation.
TCC reset helper function libs/cua-driver/scripts/uninstall.sh	maybe_reset_tcc helper conditionally runs on macOS only, checks for tccutil availability, and revokes TCC grants (Accessibility, ScreenCapture, AppleEvents) for com.trycua.driver.
Integration into uninstall flows libs/cua-driver/scripts/uninstall.sh	Both Rust and Swift uninstall branches invoke the TCC reset helper before final messaging and suppress reset guidance when the --reset-tcc flag was used.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related PRs

• trycua/cua#1558: Modifies the same uninstall script's flag/dispatch logic to add backend selection delegation.
• trycua/cua#1562: Eliminates false "granted" status after tccutil reset revokes ScreenCapture permission, which this PR's TCC revocation directly complements.
• trycua/cua#1758: Wraps the binary into a CuaDriver.app bundle with stable identifier com.trycua.driver for TCC attribution, which this PR's TCC reset targets.

Poem

🐰 Grants revoked with a gentle flag,
--reset-tcc lifts the TCC bag,
On Darwin's shores, permissions fade,
Tidy cleanup that installers made! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding an opt-in --reset-tcc flag to the uninstall script that revokes TCC grants. It is concise, directly related to the primary changeset, and provides meaningful context about the feature.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/uninstall-reset-tcc-flag

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

libs/cua-driver/scripts/uninstall.sh (1)

511-529: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Manual hint omits the Automation (AppleEvents) grant that --reset-tcc revokes.

maybe_reset_tcc revokes three services (Accessibility, ScreenCapture, AppleEvents), but this hint — offered as the equivalent alternative ("or re-run with --reset-tcc") — lists only the first two. Following the printed commands leaves the Automation grant in place, so the manual path isn't actually the "clean re-install flow" it claims to be. Add the third command for parity.

Separately, the header comment at Line 53 (Does NOT revoke TCC grants on macOS) is now stale given the new opt-in flag and is worth updating.

📝 Align the manual hint with what --reset-tcc does

   tccutil reset Accessibility com.trycua.driver
   tccutil reset ScreenCapture com.trycua.driver
+  tccutil reset AppleEvents com.trycua.driver

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@libs/cua-driver/scripts/uninstall.sh` around lines 511 - 529, The manual
uninstall message in uninstall.sh omits the AppleEvents (Automation) tcc reset
that maybe_reset_tcc actually revokes; update the printed hint block (the
heredoc under the Darwin uninstall branch) to include the third command "tccutil
reset AppleEvents com.trycua.driver" so the manual steps match maybe_reset_tcc,
and also update the header comment that currently reads "Does NOT revoke TCC
grants on macOS" to reflect the new opt-in --reset-tcc behavior; changes should
reference maybe_reset_tcc and the Darwin uninstall heredoc/FINALUNMSG and the
stale header comment string so reviewers can find where to edit.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@libs/cua-driver/scripts/uninstall.sh`:
- Around line 511-529: The manual uninstall message in uninstall.sh omits the
AppleEvents (Automation) tcc reset that maybe_reset_tcc actually revokes; update
the printed hint block (the heredoc under the Darwin uninstall branch) to
include the third command "tccutil reset AppleEvents com.trycua.driver" so the
manual steps match maybe_reset_tcc, and also update the header comment that
currently reads "Does NOT revoke TCC grants on macOS" to reflect the new opt-in
--reset-tcc behavior; changes should reference maybe_reset_tcc and the Darwin
uninstall heredoc/FINALUNMSG and the stale header comment string so reviewers
can find where to edit.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9477eb50-13a2-4213-b61e-814aa573aa45

📥 Commits

Reviewing files that changed from the base of the PR and between 057fdf1 and 9181ccb.

📒 Files selected for processing (1)

• libs/cua-driver/scripts/uninstall.sh