Server setup in the app

api/openapi.yaml

@@ -1043,6 +1043,20 @@ paths:
             application/json:
               schema: { $ref: "#/components/schemas/Status" }
 
+  /api/admin/permissions:
+    post:
+      operationId: checkPermissions
+      description: Tests the service's macOS privacy grants by running byre-hands' check, which asks macOS for any grant not yet decided. Waits while macOS shows an Automation prompt, up to 50 seconds.
+      responses:
+        "200":
+          description: One result per grant.
+          content:
+            application/json:
+              schema:
+                type: array
+                items: { $ref: "#/components/schemas/Permission" }
+        "500": { $ref: "#/components/responses/Error" }
+
   /api/workflows:
     get:
       operationId: listWorkflows
@@ -1755,6 +1769,18 @@ components:
         cols: { type: integer, minimum: 1 }
         rows: { type: integer, minimum: 1 }
 
+    Permission:
+      type: object
+      required: [name, status, detail, settings]
+      properties:
+        name: { type: string, description: "The privacy grant, such as Screen Recording." }
+        status:
+          type: string
+          enum: [granted, missing, unchecked]
+          description: unchecked when the test couldn't run, such as Automation of Orion while Orion isn't running.
+        detail: { type: string, description: "What the test did or why it failed, and what to switch on." }
+        settings: { type: string, description: The x-apple.systempreferences URL of the grant's System Settings pane. }
+
     Status:
       type: object
       required: [started_at, db_bytes, last_event_seq, projects, active_tasks, sse_clients, clients, live_agents, running_turns, rate_limits, agent_processes, zombies, stuck_after_seconds, protocol_errors]