macOS validation campaign¶

YazSes has no Mac in its CI that can click a permission prompt, and the maintainer owns none, so every fact about the .app on a real Mac comes from a volunteer. This page audits the open Mac issues, says what is known and unknown, and lists the next five tests. It builds on the evidence standard; the results table is the validation matrix.

Status as of 2026-10-16, with every issue state read from GitHub that day. The latest release is v2.42.0. This page changed nothing on GitHub: the recommendations below are for the maintainer.

What is known on Apple silicon¶

All hardware evidence is from one person's Mac mini (Apple M2, macOS 26.6.2). The other Mac runs on record used a stale Homebrew tap at 2.18.2. Details and links are in the matrix, rows E1 to E5.

• Works: download, drag to Applications, the Gatekeeper override, launch and the menu-bar icon (v2.37.2 and v2.40.0). Capture, the silence gate and an on-device transcription ran from the command line on v2.29.0.
• Does not work: on v2.40.0 the hold-to-talk key does nothing. doctor and the daemon log say Accessibility and Input Monitoring are denied while both toggles show on, and the state did not change after tccutil reset for this app (#562). No Mac has yet shown a typed character.
• Unknown: whether it is that machine or that macOS build; whether the fixes since v2.42.0 change anything (they are not released); whether any Mac updates in place without losing its grants; and everything about pipx and Homebrew on a current release.

What is unverified on Intel¶

Everything that needs a person. CI builds the x86_64 .dmg and runs its CLI on an Intel runner, but no human has opened it, answered a prompt, or used pipx on an Intel Mac. The route that outlives GitHub's Intel runners (see platform support) is pipx.

The open Mac issues¶

Housekeeping for the maintainer, not done here: refresh #182 and #216, close #264 with the ADR link, and keep #24 as the catch-all.

Findings that should become permanent checks¶

• Two permission switches for one key. Accessibility and Input Monitoring are separate, and doctor reports them in separate rows. This is check USE-2 for every Mac report.
• A grant can look on and not apply. The bundle is unsigned, and the verified evidence (the codesign output in #562) shows an ad hoc signature with no team identifier. Whether that is why the grants stop applying is a hypothesis, not a result. Check UPG-3 covers it.
• Which program is asked. doctor run from Terminal may be judged by Terminal's permission, not the app's. This is also a hypothesis from one report; the daemon log is the reliable witness.
• The Gatekeeper path changed in practice. The documented route is right-click, Open. The report on macOS 26.6.2 had to use System Settings, Privacy & Security, Open Anyway (#562). The install page does not mention it yet. This is a documentation gap to confirm on a second Mac.

The permission checks every Mac tester runs¶

Run these in order and record the result of each separately. A pass on one says nothing about the next.

Quit and relaunch YazSes after each grant: the permission is read when the keyboard tap is created. To forget one decision for this app only, keep the bundle id; without it the command resets every app on the Mac:

tccutil reset Accessibility com.yazses.app
tccutil reset ListenEvent com.yazses.app
tccutil reset Microphone com.yazses.app

Install routes to repeat after every release¶

The next five tests¶

Each is a volunteer task. Say on the linked issue that you are taking it, so nobody duplicates it. You do not need to test more than one.

1. Retest the hotkey on the first release after v2.42.0 (Apple silicon, .dmg; #562, #578). Install it, run the reporter script, hold Right Option once and say whether a prompt appeared, then press Quit in the menu-bar and run the "after Quit" lines. Done when: the script output is attached and the log shows either CGEventTap enabled or the new warning.
2. Open the x86_64 .dmg on an Intel Mac (#216). Gatekeeper, first launch, the four permission steps, doctor. Done when: the script output and the Gatekeeper path you took are attached. A failure to open is a valid result.
3. Homebrew cask on today's tap (Apple silicon; #182). brew tap MSKazemi/yazses, brew trust MSKazemi/yazses, brew install --cask yazses, then the script. Done when: the cask version matches the release and the app stays running.
4. Reproduce or refute #562 on a different Mac (Apple silicon, not the M2 Mac mini, ideally a different macOS 26 patch level). Done when: the script output from a second machine is attached. This tells us whether the dead key is the build or the one machine.
5. pipx on a Mac (either chip; #182, #216). pipx install yazses, yazses quickstart, grant the permissions to your terminal app. Done when: the output of yazses doctor and the name of the app that received each prompt are attached.

Reporter script¶

This script only reads. It changes no setting and sends nothing anywhere. It writes a file to your Desktop with your user name, computer name and home folder masked. Open the file and read it before you attach it. It contains no audio and no dictated text, but the log is yours to check.

Paste it into Terminal as one block. For tasks that use pipx or Homebrew, change APP and yz to match what you installed.

APP=/Applications/YazSes.app
yz() { "$APP/Contents/MacOS/YazSes" --cli "$@"; }      # for pipx, use: yz() { yazses "$@"; }
OUT="$HOME/Desktop/yazses-mac-report.txt"
H=$(hostname -s)
redact() { sed -e "s|$HOME|~|g" -e "s|$H|<host>|g" -e "s|$USER|<user>|g"; }
{
  echo "## Date";            date -u +%Y-%m-%dT%H:%MZ
  echo; echo "## Device and OS"; sw_vers; uname -m; sysctl -n machdep.cpu.brand_string
  echo; echo "## YazSes version"; yz --version
  echo; echo "## Signature";    codesign -dv --verbose=2 "$APP" 2>&1 | grep -E 'Identifier|Signature|TeamIdentifier'
  echo; echo "## Install route"; brew list --cask 2>/dev/null | grep -ix yazses && echo "Homebrew cask"
  echo; echo "## doctor";       yz doctor 2>&1
  echo; echo "## Processes";    ps aux | grep -i '[y]azses'
  echo; echo "## launchd";      launchctl list | grep -i yazses
  echo; echo "## Daemon log (last 60 lines)"; tail -n 60 "$HOME/Library/Logs/yazses/daemon.log" 2>&1
} 2>&1 | redact > "$OUT"
echo "Wrote $OUT"

Then do these by hand, in this order, and write the answers in your report:

1. Quit YazSes from the menu-bar icon, open it from Applications, hold Right Option once. Did a prompt appear? Name it (Input Monitoring, Accessibility or Microphone). Allow it, quit, reopen.
2. Open an empty TextEdit document, put the cursor in it, run yz verify --type and say only "testing one two three". Did that text appear in TextEdit? (verify prints what it heard, so speak only that phrase.)
3. Press Quit in the menu-bar icon, then append the process state to the file:

{ echo; echo "## After Quit"; ps aux | grep -i '[y]azses'; launchctl list | grep -i yazses; } 2>&1 | redact >> "$OUT"

What to post¶

Reply on the issue for your task with this, and attach the Desktop file (or paste it in a <details> block). Leave a line as "not tested" rather than deleting it.

**Tester:** @your-handle      **Date:** YYYY-MM-DD
**Mac:** model, chip, macOS version (from the file)      **Route:** .dmg / Homebrew / pipx
**YazSes version:** (from the file)

- Gatekeeper path I took: …
- Prompts I saw, in order (Accessibility / Input Monitoring / Microphone / none): …
- Did holding Right Option produce a prompt or any effect: …
- `verify --type` typed the test phrase into TextEdit: yes / no / not tested
- After Quit, a YazSes process was still listed: yes / no / not tested
- Not tested / could not verify: …