Skip to content

Known Limitations

James Wragg edited this page Feb 28, 2026 · 1 revision

Below are limitations discovered during the development and testing of Viscosity OTP. These are based on my own experience and findings — if you have a correction, workaround, or solution to any of these, contributions and feedback are very welcome! Feel free to open an issue or pull request.

macOS TCC Permission Prompt

The Problem

Each time you connect to a VPN, macOS may show a permission dialog asking whether osascript can access application data. This is the SystemPolicyAppData TCC (Transparency, Consent, and Control) prompt.

Why It Happens

Viscosity runs Before Connect scripts using osascript, the system AppleScript runner. Because osascript is a generic interpreter (not a unique application), macOS cannot grant it persistent TCC permissions — it has no stable code-signing identity to remember consent for.

Specifically, osascript is ad-hoc signed, which means TCC records the permission with an empty csreq (code signing requirement) blob. macOS treats this as a temporary grant that doesn't persist across sessions.

Workarounds

Click "Allow" each time — This is the simplest approach. The prompt appears briefly before each connection.

MDM PPPC Profile — If your Mac is managed, an administrator can deploy a Privacy Preferences Policy Control (PPPC) profile via MDM that pre-approves the SystemPolicyAppData permission for osascript. This suppresses the prompt entirely.

Apple Developer ID signing — Wrapping the script in a properly signed .app bundle with an Apple Developer ID certificate would give TCC a stable identity. However, this adds significant complexity and cost (Apple Developer Program membership required).

What Doesn't Work

  • Self-signed certificates — macOS does not accept self-signed certificates for code signing in a way that satisfies TCC.
  • Ad-hoc signing (codesign -s -) — This is what osascript already uses; it doesn't help.
  • Resetting TCC (tcsutil reset) — The permission is re-prompted regardless.

Viscosity Script Caching

Viscosity caches the contents of Before Connect scripts. If you update BeforeConnect.applescript, you must clear and re-add it in Viscosity's connection settings. Simply replacing the file on disk is not enough.

See Troubleshooting for the steps to clear and re-add the script.

Notifications Not Supported

display notification does not work from osascript when invoked by Viscosity — notifications are likely disabled for the osascript process. The script uses display dialog for error reporting instead, which does work reliably.

Shell Environment

do shell script in AppleScript runs with a minimal shell environment. It does not source your .zshrc, .bashrc, or .bash_profile. Always use absolute paths for CLI tools in your OTP commands (e.g. /usr/local/bin/op instead of op).

Script Timeout

Viscosity/OpenVPN imposes a timeout (~60 seconds) on Before Connect scripts. If your OTP command takes too long (e.g. waiting for Touch ID approval, slow network calls), Viscosity may terminate the script and proceed without the OTP.

Clone this wiki locally