Show HN: Auto Dismiss Mac OS "Allow <app> to find devices on local networks?"

What it is

dontallow is a two-file Swift launchd agent, MIT licensed, with no dependencies, that presses "Don't Allow" on the macOS 15 Sequoia and later prompt "Allow <app> to find devices on local networks?". It installs with brew install johncassil/tap/dontallow or make && make install, followed by dontallow install.

How it works

The prompt is a window owned by the system process UserNotificationCenter. The agent registers an Accessibility observer for window creation on that process and sleeps until one fires, so idle CPU is zero. It reads the dialog text, confirms it is a local network prompt, checks pause and allowlist state, then performs the Accessibility press action on the Don't Allow button. If the press is refused, it falls back to a synthetic click at the button's location. The default delay before pressing is 0.25 seconds. The page says it never modifies system files, never disables protections and never chooses Allow.

The page states the prompt keeps returning because macOS keys the Local Network decision to the app's path. Chromium browsers (Chrome, Brave, Edge, Island, Arc) copy their bundle to a random temp folder at each launch, so every launch looks like a new app and leaves duplicate "Google Chrome.app" rows in Privacy settings. Apps with versioned install paths (.../versions/1.2.3/) get a new row per update. macOS may also attribute a prompt to a "responsible" app that is not running.

The page says there is no supported way to prune the list, no MDM payload to pre-deny the permission, and that tccutil reset does not cover it.

Preconditions / Affected

• The prompt exists only on macOS 15 Sequoia and later. Building needs macOS 13 or later and Command Line Tools only, not Xcode.
• The agent needs the Accessibility permission. dontallow install opens the Settings pane and prints the path to add.
• Only English-localized macOS is supported, because the matcher keys on the dialog text and the "Don't Allow" button title.
• Tested so far on Intel, macOS 26.6.

What to do

Commands:

For apps that legitimately need the permission (Chromecast and AirPlay discovery, LAN games, printer and scanner utilities), use one of three options:

dontallow pause 10m

Then launch the app and click Allow yourself. Alternatively, add the app name to ~/.config/dontallow/allowlist, one per line, as a case-insensitive substring. Or flip the toggle in System Settings > Privacy & Security > Local Network. A dismissed prompt records a deny, which can be reversed there. Setting ~/.config/dontallow/grace to a number of seconds changes the delay before the press.

For fleets, build once, sign with a Developer ID, and ship the binary with a PPPC profile granting Accessibility to its code requirement. Then run dontallow install per user, with no manual Settings step.

After any upgrade, including brew upgrade, run dontallow status. Each build has a new code signature, so the Accessibility grant may be missing. If so, remove the dontallow row in Accessibility settings and add it back from the printed path. The agent re-attaches within ten seconds.

Caveats

• Each dismissal posts a notification naming the app and the pause command. It can be muted in System Settings.
• A future Developer ID signed release is planned to remove the re-grant step after upgrades.
• Unit tests run with make test and cover parsing, allowlist matching, plist generation and the rule decoder against a fixture. The end-to-end press can only be checked on a Mac with Accessibility granted, using the recipe in Tests/INTEGRATION.md.
• Localized strings are planned but not yet supported.