Rust CLI for managing macOS TCC privacy permission databases. Single static binary; no runtime dependencies.
make verify # selective cached fmt + clippy + test (pre-push)
make verify-full # forced CI gate (+ coverage + release build)make verify runs independent stale lanes in parallel. Timestamp freshness is
an edit-loop optimization; use make verify-full after deleting or renaming
Rust sources and before claims that require exhaustive proof. CI always runs the
full gate.
cargo build --release- Prefer safe Rust; keep
unsafelimited to the existinggeteuidcheck - System DB writes need
sudo; SIP may still block on newer macOS - Binary name stays
tccutil-rsso it does not clash with Apple'stccutil
scripts/setup-hooks.sh- README: install, commands, SIP limits
- Contributing: setup, verify, pull requests
- Releases: Conventional Commits publish path
- Security: private vulnerability reporting