How to get access to Reminders in anything else than Terminal

[Zjaaspoer]

First of all @keith, great tool, works flawlessly! 🙏

The only caveat is that it only work directly in Terminal. If it's being called from any other application you get the "You need to grant reminders access" error generated by the app.

I've looked at #58 (it was solved through Apple Script: is too hacky for my purpose), #13 but that discussion is stale, #4 is related but too much on a programmatic level.

My request is that this app is usable by other apps than the terminal.

My assumption is that the code

`public static func requestAccess() -> Bool {
let semaphore = DispatchSemaphore(value: 0)
var grantedAccess = false
Store.requestAccess(to: .reminder) { granted, _ in
grantedAccess = granted
semaphore.signal()
}

    semaphore.wait()
    return grantedAccess
}

`

works in the terminal and indeed requests access to Reminders, which you can later see here:

Maybe the code can be improved to work also when being called by other apps, and in this way asks permission to the user to grant the current app permission to access Reminders, so it will show up in the list above.

(Not a Swift programmer so there are some big assumptions I made 😅)

Thanks again for your great work 💪

[keith]

thanks for the kinda words. i don't think there is anything we can do here, you'll probably just have to manually add it there if the popup doesn't happen

[Zjaaspoer]

Hi @keith, apologies for cropping the screenshot too much, but in the full view you'll see you can't add apps manually:

(no plus in the

Compared to e.g. Full Disk Access where you can add app by using the plus in the bottom left

Non of the apps outside of terminal trigger asking for access permission

[keith]

oh bummer. afaict there's no alternative API for us to be calling https://developer.apple.com/documentation/eventkit/ekeventstore?language=objc

[Zjaaspoer]

Ok got it. Not an area I'm familiar with so unfortunately not something I can help with. Thanks for thinking along!

[keith]

I think it's up to macOS to prompt for this stuff so I'm not sure why it doesn't in some cases. Maybe when we ask and it fails the app appears there but disabled?

[Zjaaspoer]

So I tried in in different app, e.g. Visual Studio Code. It fails without showing a prompt as discussed, but then doesn't how up in the MacOS settings (shown above) unfortunately. It looks like the asking for permission in those apps is not working?

[keith]

What OS version were you on with this? I started seeing this with Sonoma and have a fix

[keith]

Fixed my case in #70, if 2.4.0 doesn't fix this for you please comment with the error that is now printed and we can try to find a fix.

[Zjaaspoer]

Hey @keith, I'm on Sonoma too now:

Just tested again and these are the outcomes.

I have the latest version

It works perfect if I use my terminal (in this iTerm)

When I use any other program (in this case VSCode) it exits with your new error

I'm not prompted when running in VSCode to allow VSCode to access Reminders & in the privacy settings I still can't add any program manually

[keith]

I guess the lack of an error in the second screenshot means There wasn't an actual error and it really is just a permissions issue.

[Zjaaspoer]

Indeed, if I read the code correctly it looks like there is no error

[keith]

I tried this too and see the same. Previously https://github.com/ChrisJohnsen/tmux-MacOSX-pasteboard solved this, but it doesn't seem to help in this case. It must have something to do with how VSCode spawns its terminal

[rhsev]

When I access the Mac via ssh (Sonoma) and call reminder-cli, I get the same error message.

[keith]

I tried debugging the ssh case a bit, the problem seems to be that the requesting process is the ssh tool. I tried codesigning the reminders-cli binary w/ the proper entitlements to see if that helped but it did not. If anyone finds a workaround for this type of case I'd love to hear it. To debug you can open Console.app, stream logs, and search for tccd. The failing lines in my case debugging ssh looked like this:

default	19:58:08.244867-0700	tccd	AUTHREQ_ATTRIBUTION: msgID=3284.253, attribution={responsible={TCCDProcess: identifier=com.apple.sshd-keygen-wrapper, pid=10390, auid=501, euid=0, responsible_path=/usr/libexec/sshd-keygen-wrapper, binary_path=/usr/sbin/sshd}, accessing={TCCDProcess: identifier=com.smileykeith.reminders-cli, pid=13404, auid=501, euid=501, binary_path=/private/tmp/reminders}, requesting={TCCDProcess: identifier=com.apple.calaccessd, pid=3284, auid=501, euid=501, binary_path=/System/Library/PrivateFrameworks/CalendarDaemon.framework/Support/calaccessd}, },
default	19:58:08.244894-0700	tccd	requestor: TCCDProcess: identifier=com.apple.calaccessd, pid=3284, auid=501, euid=501, binary_path=/System/Library/PrivateFrameworks/CalendarDaemon.framework/Support/calaccessd is checking access for accessor TCCDProcess: identifier=com.smileykeith.reminders-cli, pid=13404, auid=501, euid=501, binary_path=/private/tmp/reminders
default	19:58:08.250096-0700	tccd	Policy disallows prompt for Sub:{/usr/libexec/sshd-keygen-wrapper}Resp:{TCCDProcess: identifier=com.apple.sshd-keygen-wrapper, pid=10390, auid=501, euid=0, responsible_path=/usr/libexec/sshd-keygen-wrapper, binary_path=/usr/sbin/sshd}; access to kTCCServiceReminders denied

There are some unsupported ways around to try and add something to the tcc db from the command line but I haven't treid any of them https://forums.developer.apple.com/forums/thread/119373, it's possible that if you add whatever app you're launching reminders-cli from that it would start working. Let me know if you find any workarounds!

[aizerin]

I have a similar problem but with launchctl. I have a scheduled job

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.test.todo-export</string>
        <key>StandardErrorPath</key>
        <string>/tmp/mycommand.err</string>
        <key>StandardOutPath</key>
        <string>/tmp/mycommand.out</string>
        <key>ProgramArguments</key>
        <array>
                <string>sh /Users/asdf/reminders_sync.sh</string>
        </array>
        <key>StartInterval</key>
        <integer>1800</integer>
</dict>
</plist>

with shell script reminders_sync.sh

#!/bin/sh

/opt/homebrew/bin/reminders show-all

When I run it for test with launchctl start com.test.todo-export then it will always ask for permissions in every single run and show no data.

It seems that reminder-cli app is added to the reminder permissions, so I have no idea why it is not working.

When I run same script from terminal then there is no problem.

[aizerin]

I found a workaround. It seems that reminders-cli cannot use granted permissions (I don't know why). So I've created script in nodejs

const { exec } = require('child_process');

exec(`osascript -e 'tell application "Reminders" to show (first list whose name is "blabla")'`, (error, stdout, stderr) => {
    if (error) {
        console.error(`Error: ${error.message}`);
        return;
    }
    if (stderr) {
        console.error(`Stderr: ${stderr}`);
        return;
    }
    console.log(`Stdout: ${stdout}`);
});

which populate permission for current running application. For example if you run it in VSCode, then vscode will get Reminders permissions and then you can use reminders-cli directly from vscode ... 🤯

To use it in launchctl just use this script for first time

#!/bin/bash

node /path/reminders_permissions.js

then you can give permissions to nodejs executable

After that you will need to create wrapper around reminders-cli command in nodejs. For example

const { spawn } = require("child_process");

const runCommand = (command, args) => {
  const process = spawn(command, args);

  process.stdout.on("data", (data) => {
    const output = data.toString();
    console.log(output);
  });

  process.stderr.on("data", (data) => {
    console.error(`Stderr: ${data}`);
    exit(1);
  });
};

runCommand("/opt/homebrew/bin/reminders", [
  "show",
  "prace",
  "--format",
  "json",
]);

and than you can use it in bash script which you will run from launchctl. for example

#!/bin/bash

export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"

todos=`node /path/reminders_sync.js`

curl -X POST -H "Content-Type: application/json" -d "$todos" http://dietpi.local:3010/api/todo

🎉🎉🎉🎉🎉🎉
🤯🤯🤯🤯🤯🤯

btw: thanks for this tool 🙏