[install] Stop resetting TCC grants on a Developer ID rebuild

A changed cdhash only invalidates a grant when the cdhash IS the
designated requirement, which is the ad-hoc case the check was written
for. A Developer ID signature's requirement is identifier plus Team ID
and is stable across rebuilds, so the grant survives one.

Resetting regardless meant re-granting Accessibility after every single
install — the exact cost that signing properly is supposed to remove.
Observed doing it twice within an hour of the switch to a Developer ID
build, each time telling the user that ad-hoc signing was the reason
while the bundle carried a full chain and a secure timestamp.

Solves: Accessibility re-prompt on every reinstall of a signed build
Tests: the ad-hoc check must precede and return before the tccutil call;
       verified live — a forced cdhash mismatch on the signed bundle now
       reports the grants carry over instead of clearing them

Author: drycode

install-client.sh

@@ -328,6 +328,20 @@ reset_stale_grants_on_identity_change() {
   # First install, or the same binary reinstalled: nothing to invalidate.
   [[ -n "$old_hash" && "$old_hash" != "$new_hash" ]] || return 0
 
+  # A changed cdhash only invalidates the grant when the DESIGNATED REQUIREMENT
+  # is the cdhash — which is the ad-hoc case. A Developer ID signature's
+  # requirement is identifier + Team ID, so it is stable across rebuilds and the
+  # grant survives one. Resetting anyway makes the user re-grant Accessibility
+  # after every single install, which is precisely the cost that signing
+  # properly is supposed to remove.
+  local sig_info
+  sig_info="$(codesign -dvvv "$APP_DST" 2>&1 || true)"
+  if ! grep -q '^Signature=adhoc' <<<"$sig_info"; then
+    log "the agent binary changed, but it is signed with a Developer ID —"
+    log "its designated requirement is stable, so the grants carry over."
+    return 0
+  fi
+
   warn "the agent binary changed (${old_hash:0:12}… -> ${new_hash:0:12}…)."
   warn "Ad-hoc signing ties TCC grants to that hash, so the Accessibility grant"
   warn "no longer applies — and macOS would still show its toggle switched ON."

tests/test_app_dir_resolution.py

@@ -109,3 +109,31 @@ def test_uninstall_does_not_delete_a_brew_owned_bundle(self):
         guard = uninstall.index('"$APP_MANAGED" -eq 1')
         removal = uninstall.index('rm -rf "$APP_DST"')
         assert guard < removal, "the removal must be guarded by the managed check"
+
+
+class TestGrantResetIsSignatureAware:
+    """A cdhash change only invalidates TCC when the cdhash IS the requirement.
+
+    That is the ad-hoc case. A Developer ID signature's designated requirement
+    is identifier + Team ID, stable across rebuilds, so the grant survives one.
+    Resetting regardless made the user re-grant Accessibility after every
+    install — exactly the cost that signing properly exists to remove, and it
+    was observed doing so on 2026-08-05 immediately after the switch to a
+    Developer ID build.
+    """
+
+    def test_the_reset_is_skipped_for_a_developer_id_signature(self):
+        code = CLIENT.read_text()
+        # Match the DEFINITION, not the earlier comment that names the
+        # function — indexing on the bare name lands in a comment and slices
+        # a completely different function's body.
+        fn = code[code.index("reset_stale_grants_on_identity_change() {"):]
+        fn = fn[:fn.index("\n}\n")]
+        adhoc_check = fn.index("Signature=adhoc")
+        reset_call = fn.index("tccutil reset Accessibility")
+        assert adhoc_check < reset_call, (
+            "the ad-hoc check must gate the reset, not follow it"
+        )
+        assert "return 0" in fn[adhoc_check:reset_call], (
+            "a non-ad-hoc signature must return before resetting anything"
+        )