Getting perms error - file is readable but not to visualdiffer

[matthewsht]

What happens?

App displays an error for some (but not all) files in git repo. One example is:
12/09/25, 15:09:46 /Users/matthewsht/code/cloud/ssa-terraform/main/aws/production/.terraform/providers/registry.terraform.io/hashicorp/cloudinit/2.3.7/darwin_arm64: The file “darwin_arm64” couldn’t be opened because you don’t have permission to view it.

Its only complaining about binaries, no text files - I'm not sure what that signifies.

In Preferences, Trusted Paths I have added "/Users/matthewsht/code" as the sole entry, so the above path should be covered.

In System Settings, Privacy & Security, Full disk access I've added visualdiffer and restarted the app. This appears to make no difference.

What did you expect to happen?

I'd like VD to compare/diff those files.

A way to "reauth" it if necessary in the preferences would be cool.

Steps to reproduce

No response

Environment

• OS: 15.7.1
• App: 2.0.1-alpha.4 (2.0.1-alpha.4)

Logs / screenshots (optional)

No response

[dafi]

I can't reproduce the problem but I think it is related to Apple sandbox and it's not easy to resolve

Sometimes (I don't know if this is the case) there are symbolic links where resolved paths point outside the "trusted" zone and so the app hasn't the permission to read

You can try to add the entire filesystem to trusted path / but I'm pretty sure this doesn't resolve and adding / is a dirty and usafe way to bypass sandbox

In your example I see code from terraform files? Is it a public repo code? May I download it to try to reproduce the problem?

[matthewsht]

The repo isn't public, but any repo with a "terraform init" performed inside it will show those kinds of files. If you cant' repo it I'll try and create a public repo for you.

[dafi]

can you check if the file 'darwin_arm64' is a symbolic link?

[matthewsht]

Excellent catch - it is.

❯ ll /Users/matthewsht/code/cloud/ssa-terraform/main/aws/ssa-ephemeral/vaultdev/.terraform/providers/registry.terraform.io/hashicorp/external/2.3.5
total 0
lrwxr-xr-x  1 matthewsht  staff   103B Aug  7 16:10 darwin_arm64@ -> /Users/matthewsht/.terraform.d/plugin-cache/registry.terraform.io/hashicorp/external/2.3.5/darwin_arm64
matthewsht@HG-02254242-LM ~/code/cloud/ssa-terraform
❯ /Applications/VisualDiffer.app/Contents/Helpers/visdiff main rocky-10-update
Left path doesn't exist

I added the top of that tree "/Users/matthewsht/.terraform.d" to the trusted paths and restarted visualdiffer from the command line - No change. I do still have "Full Disk Access" set in system settings for VD.

[dafi]

Well, actually, this is one of the classic problems with symlinks and sandboxes.
I improved the error message, but there's no real solution because the sandbox requires the exact path to the symlink's destination.
I need to do more research, but the problem is strictly related to the sandbox layer.

[matthewsht]

I appreciate you looking into this - do you want me to leave this open against further research?

[dafi]

Yes, let's leave it open because I need to figure out if there's a workaround.

Thanks for the support.

[dafi]

Hi,

I added a workaround that checks for symbolic links. Now adding a parent directory to the ‘Trusted Path’ should work.
The error message is now clearer and provides a hint for fixing the problem.

Permission denied: symbolic link at path1 points to destination symlink. Add the destination to 'Trusted Paths' to allow access.

I don't want to waste your time so feel free to ignore this update but in case you want to give it a try, version 2.1.1-alpha.1 contains the fix

Consider that I couldn't reproduce your environment so I went in blind

[matthewsht]

I retested with 2.1.1-alpha.1 as suggested
with the link target included as a "trusted path" works as expected (nor error)
without link target included as a "trusted path" error reports with suggested fix.

So I consider this fully fixed - Thank You!