-
Notifications
You must be signed in to change notification settings - Fork 0
Known Limitations
Below are limitations discovered during the development and testing of Viscosity OTP. These are based on my own experience and findings — if you have a correction, workaround, or solution to any of these, contributions and feedback are very welcome! Feel free to open an issue or pull request.
Each time you connect to a VPN, macOS may show a permission dialog asking whether osascript can access application data. This is the SystemPolicyAppData TCC (Transparency, Consent, and Control) prompt.
Viscosity runs Before Connect scripts using osascript, the system AppleScript runner. Because osascript is a generic interpreter (not a unique application), macOS cannot grant it persistent TCC permissions — it has no stable code-signing identity to remember consent for.
Specifically, osascript is ad-hoc signed, which means TCC records the permission with an empty csreq (code signing requirement) blob. macOS treats this as a temporary grant that doesn't persist across sessions.
Click "Allow" each time — This is the simplest approach. The prompt appears briefly before each connection.
MDM PPPC Profile — If your Mac is managed, an administrator can deploy a Privacy Preferences Policy Control (PPPC) profile via MDM that pre-approves the SystemPolicyAppData permission for osascript. This suppresses the prompt entirely.
Apple Developer ID signing — Wrapping the script in a properly signed .app bundle with an Apple Developer ID certificate would give TCC a stable identity. However, this adds significant complexity and cost (Apple Developer Program membership required).
- Self-signed certificates — macOS does not accept self-signed certificates for code signing in a way that satisfies TCC.
-
Ad-hoc signing (
codesign -s -) — This is whatosascriptalready uses; it doesn't help. -
Resetting TCC (
tcsutil reset) — The permission is re-prompted regardless.
Viscosity caches the contents of Before Connect scripts. If you update BeforeConnect.applescript, you must clear and re-add it in Viscosity's connection settings. Simply replacing the file on disk is not enough.
See Troubleshooting for the steps to clear and re-add the script.
display notification does not work from osascript when invoked by Viscosity — notifications are likely disabled for the osascript process. The script uses display dialog for error reporting instead, which does work reliably.
do shell script in AppleScript runs with a minimal shell environment. It does not source your .zshrc, .bashrc, or .bash_profile. Always use absolute paths for CLI tools in your OTP commands (e.g. /usr/local/bin/op instead of op).
Viscosity/OpenVPN imposes a timeout (~60 seconds) on Before Connect scripts. If your OTP command takes too long (e.g. waiting for Touch ID approval, slow network calls), Viscosity may terminate the script and proceed without the OTP.