From 1cf1a8f5a6b5e119f03fdee207c3c8d57b4a1f6d Mon Sep 17 00:00:00 2001
From: Edison Jwa <me@edison.network>
Date: Sun, 7 Jun 2026 18:56:37 +0900
Subject: [PATCH] fix(macos): add network.server entitlement to release sandbox
 for UDP bind
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

apps/chanora_flutter/macos/Runner/Release.entitlements: add com.apple.security.network.server = true. The macOS App Sandbox treats every UDP bind() — including the ephemeral 0.0.0.0:0 that tsclientlib uses for outbound TS3 traffic — as a server operation. Without this entitlement UdpSocket::bind fails with EPERM and the TS3 connect never starts. Debug builds already had this entitlement (needed for flutter run hot-reload); release builds were missing it.

apps/chanora_flutter/macos/Runner/DebugProfile.entitlements: expand the existing network.server comment to document the dual rationale (flutter hot-reload + outbound UDP bind), so the entitlement's purpose is clear without spelunking through tsclientlib.
---
 .../macos/Runner/DebugProfile.entitlements               | 6 ++++--
 apps/chanora_flutter/macos/Runner/Release.entitlements   | 9 +++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/apps/chanora_flutter/macos/Runner/DebugProfile.entitlements b/apps/chanora_flutter/macos/Runner/DebugProfile.entitlements
index 2804dff..a8dff6b 100644
--- a/apps/chanora_flutter/macos/Runner/DebugProfile.entitlements
+++ b/apps/chanora_flutter/macos/Runner/DebugProfile.entitlements
@@ -2,8 +2,10 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<!-- Flutter default: app-sandbox + JIT for the Dart VM + server
-	     listener for `flutter run` hot-reload. -->
+	<!-- Flutter default: app-sandbox + JIT for the Dart VM. network.server is
+	     required for the `flutter run` hot-reload listener AND, on macOS, for
+	     every UDP bind() the app does (tsclientlib binds 0.0.0.0:0 for
+	     outbound TS3 traffic and the sandbox treats that as a server op). -->
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
 	<key>com.apple.security.cs.allow-jit</key>
diff --git a/apps/chanora_flutter/macos/Runner/Release.entitlements b/apps/chanora_flutter/macos/Runner/Release.entitlements
index 5d7d52f..78feed2 100644
--- a/apps/chanora_flutter/macos/Runner/Release.entitlements
+++ b/apps/chanora_flutter/macos/Runner/Release.entitlements
@@ -2,12 +2,17 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<!-- Release builds omit the cs.allow-jit + network.server entitlements
-	     used only by Flutter's debug hot-reload. -->
+	<!-- Release builds omit cs.allow-jit (Flutter hot-reload only). They keep
+	     network.server because the macOS App Sandbox treats every UDP bind()
+	     - including the ephemeral 0.0.0.0:0 that tsclientlib uses for
+	     outbound traffic - as a server operation. Without this entitlement
+	     UdpSocket::bind fails with EPERM and the TS3 connect never starts. -->
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
 	<key>com.apple.security.network.client</key>
 	<true/>
+	<key>com.apple.security.network.server</key>
+	<true/>
 	<key>com.apple.security.device.audio-input</key>
 	<true/>
 </dict>