From f7c10905d90b82522771707650d3cfb3a4b22ec7 Mon Sep 17 00:00:00 2001
From: Emil Wagman <emil@norditech.se>
Date: Tue, 4 Aug 2026 08:50:23 +0200
Subject: [PATCH 1/2] fix(desktop): allow microphone access

---
 scripts/build-desktop-artifact.test.ts | 1 +
 scripts/build-desktop-artifact.ts      | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/scripts/build-desktop-artifact.test.ts b/scripts/build-desktop-artifact.test.ts
index 7d2b7410a9e7..85719422c72a 100644
--- a/scripts/build-desktop-artifact.test.ts
+++ b/scripts/build-desktop-artifact.test.ts
@@ -433,6 +433,7 @@ it.layer(NodeServices.layer)("build-desktop-artifact", (it) => {
     assert.include(entitlements, "<string>webcredentials:clerk.example.com</string>");
     assert.include(entitlements, "<string>webcredentials:example.clerk.accounts.dev</string>");
     assert.include(entitlements, "<key>com.apple.security.cs.allow-jit</key>");
+    assert.include(entitlements, "<key>com.apple.security.device.audio-input</key>");
   });
 
   it("rejects incomplete macOS passkey signing configuration", () => {
diff --git a/scripts/build-desktop-artifact.ts b/scripts/build-desktop-artifact.ts
index a3c999692569..8e0d0b2f8de8 100644
--- a/scripts/build-desktop-artifact.ts
+++ b/scripts/build-desktop-artifact.ts
@@ -853,6 +853,8 @@ export function renderMacPasskeyEntitlements(
     <array>
 ${associatedDomains}
     </array>
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
     <key>com.apple.security.cs.allow-jit</key>
     <true/>
     <key>com.apple.security.cs.allow-unsigned-executable-memory</key>

From 12ea55e637914220d2770534359dae82699f12b3 Mon Sep 17 00:00:00 2001
From: Emil Wagman <emil@norditech.se>
Date: Thu, 20 Aug 2026 14:56:52 +0200
Subject: [PATCH 2/2] fix(desktop): inherit microphone entitlement

---
 scripts/build-desktop-artifact.test.ts | 1 +
 scripts/build-desktop-artifact.ts      | 1 +
 2 files changed, 2 insertions(+)

diff --git a/scripts/build-desktop-artifact.test.ts b/scripts/build-desktop-artifact.test.ts
index 85719422c72a..88d3afa2e1e4 100644
--- a/scripts/build-desktop-artifact.test.ts
+++ b/scripts/build-desktop-artifact.test.ts
@@ -527,6 +527,7 @@ it.layer(NodeServices.layer)("build-desktop-artifact", (it) => {
       const mac = config.mac as Record<string, unknown>;
       assert.equal(config.appId, "com.t3tools.t3code");
       assert.equal(mac.entitlements, "/tmp/entitlements.mac.plist");
+      assert.equal(mac.entitlementsInherit, "/tmp/entitlements.mac.plist");
       assert.equal(mac.provisioningProfile, "/tmp/t3code.provisionprofile");
       assert.deepStrictEqual(mac.protocols, [
         { name: "T3 Code", schemes: ["t3code", "t3code-dev"] },
diff --git a/scripts/build-desktop-artifact.ts b/scripts/build-desktop-artifact.ts
index 8e0d0b2f8de8..4323120157a5 100644
--- a/scripts/build-desktop-artifact.ts
+++ b/scripts/build-desktop-artifact.ts
@@ -1579,6 +1579,7 @@ export const createBuildConfig = Effect.fn("createBuildConfig")(function* (
       ...(macPasskeySigning
         ? {
             entitlements: macPasskeySigning.entitlementsPath,
+            entitlementsInherit: macPasskeySigning.entitlementsPath,
             provisioningProfile: macPasskeySigning.provisioningProfilePath,
           }
         : {}),