`setup` reports success on SIP-enabled macOS 26 (Tahoe) but VoiceOver AppleScript control stays disabled — marker file is only written when SIP is disabled

[AlexU-A]

Environment

• macOS 26.5.2 (Tahoe, Darwin 25), SIP enabled (stock configuration)
• @guidepup/setup 0.24.6, @guidepup/guidepup 0.33.2
• Node 24.19.0

Summary

On macOS 26, VoiceOver gates its AppleScript control on the existence of the root-owned marker file /private/var/db/Accessibility/.VoiceOverAppleScriptEnabled. The legacy preference (defaults write com.apple.VoiceOver4/default SCREnableAppleScript -bool true) is no longer honored — VoiceOver 26.5 keeps its live preferences in ~/Library/Group Containers/group.com.apple.VoiceOver/Library/Preferences/com.apple.VoiceOver4/default.plist (with a per-key timestamp journal), and even setting SCREnableAppleScript to true there has no effect while the marker file is absent.

setup knows about the marker file, but lib/commands/setup/macOS/setup.js only writes it when SIP is disabled:

if (!(0, isSipEnabled_1.isSipEnabled)() && !(await (0, enabledDbFile_1.enabledDbFile)())) {
    (0, writeDatabaseFile_1.writeDatabaseFile)();
}

On a stock (SIP-enabled) machine the branch is skipped silently, the legacy defaults write runs as a no-op, and setup finishes with "Environment setup complete 🎉". Every subsequent VoiceOver-suite AppleScript command then fails with -1708:

execution error: VoiceOver got an error: right doesn't understand the "move" message. (-1708)

The symptom is misleading because the standard suite still works (tell application "VoiceOver" to quit succeeds), so it looks like a scripting-dictionary problem rather than the control gate.

Additional macOS 26 data points

• An OS upgrade can silently drop a previously enabled state: this machine had /var/db/Accessibility/.VoiceOverAppleScriptEnabled-Migrated (dated from a past migration) but no enable file, and VoiceOver had rewritten SCREnableAppleScript to false in the group container.
• VoiceOver Utility moved to /System/Applications/Utilities/VoiceOver Utility.app. Its binary symbols (appleScriptEnabledFileExists, createAppleScriptEnabledFileOnSuccess:onError:, waitForAppleScriptEnabledFileExists:systemAuth:adminAuth:) show the checkbox now creates/removes the marker file through an admin-authorized operation.
• sudo touch /private/var/db/Accessibility/.VoiceOverAppleScriptEnabled works with SIP enabled — SIP does not protect this path, so the current isSipEnabled() guard is stricter than necessary; the actual requirement is root, not SIP-off.

After creating the marker file manually, @guidepup/guidepup 0.33.2 works on Tahoe: 3/3 consecutive runs against a WAI-ARIA APG disclosure fixture in Safari captured deterministic spoken-phrase logs (name/role/state, aria-expanded state change, revealed content) with no other changes.

Repro

1. Stock macOS 26 machine, SIP enabled, no /private/var/db/Accessibility/.VoiceOverAppleScriptEnabled.
2. npx @guidepup/setup setup → completes with success message.
3. Any voiceOver.move*/next() via @guidepup/guidepup → -1708.
4. sudo touch /private/var/db/Accessibility/.VoiceOverAppleScriptEnabled → same code now works.

Suggested fix

• Treat the marker file as required on all machines, not only SIP-disabled ones: attempt the write, and when it fails with EPERM/EACCES (or the process isn't root), fail the step (or at minimum end with a prominent warning, not the success banner) and print the two working remedies: tick "Allow VoiceOver to be controlled with AppleScript" in VoiceOver Utility (admin prompt), or sudo touch /private/var/db/Accessibility/.VoiceOverAppleScriptEnabled.
• On Darwin ≥ 25, skip or demote the legacy defaults write com.apple.VoiceOver4/default step — it no longer does anything.
• Consider a post-setup verification probe (start VO, issue one VO-suite command, expect non--1708) so false-success can't ship; the manual-setup guide the CLI links to would also benefit from the macOS 26 marker-file note.

Happy to provide the full probe logs or test candidate fixes on this machine.

[cmorten]

On macOS Tahoe 26.4.1 attempting to create or write to the marker file fails, even with sudo:

sudo touch /private/var/db/Accessibility/.VoiceOverAppleScriptEnabled
touch: /private/var/db/Accessibility/.VoiceOverAppleScriptEnabled: Operation not permitted

So root isn’t sufficient to write this file. Indeed even granting “Full Disk Access” permissions isn’t sufficient, so curious how you’ve come to be able to write this file without SIP disabled or via VoiceOver Utility?

and setup finishes with "Environment setup complete 🎉"

It does, but it also links to the manual VoiceOver setup guide on the lines above, prompting “Please complete remaining setup by following this guide:” which hopefully should be sufficient to hint that additional manual steps needed?

If you are able to provide a reliable means of writing the db file would be open to contribution!

the manual-setup guide the CLI links to would also benefit from the macOS 26 marker-file note.

I don’t follow? Best I can tell macOS 26 doesn’t have anything different about its marker file nor has additional required steps missing from that doc… granted the defaults write is now outdated, is that what you meant? (Not that it does any harm, just moot)