From abf25bd897aaddfe9069373f1985c6b392ca7fcc Mon Sep 17 00:00:00 2001
From: Rune Olsen <rune@rune.pm>
Date: Tue, 21 Jul 2026 14:59:39 +0200
Subject: [PATCH] Fix Contacts TCC entitlement key: contacts -> addressbook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Confirmed root cause via tccd's own log output: the hardened-runtime
hardened-runtime prompting policy checks for
com.apple.security.personal-information.addressbook (the Contacts
framework's TCC service is still internally named kTCCServiceAddressBook,
a holdover from the old AddressBook framework), not
com.apple.security.personal-information.contacts as the entitlements
file had. With the correct key, tccd allows the prompt and access is
now granted correctly on both macOS 27 beta and 26.5.1 stable — this
was never an OS bug, notarization requirement, or beta-only issue.

Also keeps the fuller CNError domain/code/userInfo logging added while
diagnosing this, in case Contacts TCC issues resurface.
---
 oAI/Services/ContactsService.swift | 3 ++-
 oAI/oAI.entitlements               | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/oAI/Services/ContactsService.swift b/oAI/Services/ContactsService.swift
index 058ab42..1863c4e 100644
--- a/oAI/Services/ContactsService.swift
+++ b/oAI/Services/ContactsService.swift
@@ -63,7 +63,8 @@ class ContactsService {
             store.requestAccess(for: .contacts) { granted, error in
                 let after = CNContactStore.authorizationStatus(for: .contacts)
                 if let error {
-                    Log.mcp.error("ContactsService.requestAccess: error=\(error.localizedDescription); granted=\(granted); status after = \(Self.describe(after)) (raw=\(after.rawValue))")
+                    let nsError = error as NSError
+                    Log.mcp.error("ContactsService.requestAccess: error=\(error.localizedDescription) domain=\(nsError.domain) code=\(nsError.code) userInfo=\(nsError.userInfo); granted=\(granted); status after = \(Self.describe(after)) (raw=\(after.rawValue))")
                 } else {
                     Log.mcp.info("ContactsService.requestAccess: granted=\(granted); status after = \(Self.describe(after)) (raw=\(after.rawValue))")
                 }
diff --git a/oAI/oAI.entitlements b/oAI/oAI.entitlements
index 97a7c31..a86f180 100644
--- a/oAI/oAI.entitlements
+++ b/oAI/oAI.entitlements
@@ -12,7 +12,7 @@
 	<true/>
 	<key>com.apple.security.personal-information.reminders</key>
 	<true/>
-	<key>com.apple.security.personal-information.contacts</key>
+	<key>com.apple.security.personal-information.addressbook</key>
 	<true/>
 	<key>com.apple.security.personal-information.location</key>
 	<true/>