MCP: confirmation panel beginSheet may be hidden in fullscreen/multi-monitor; silent timeout-denial #26

New Issue

2026-05-12T19:05:41Z

KofTwentyTwo commented

2026-05-12 19:05:41 +00:00

(Migrated from github.com)

Summary

ConfirmationPresenter uses beginSheet against a hidden (alphaValue = 0) owner panel at level = .floating. If the user is in a fullscreen app on a different Space, orderFront(nil) may not be enough — the sheet attaches but the user can't see it. The broker waits the full 60s timeout, synthesizes .timeout, and the tool call is denied without the user ever seeing the prompt.

Evidence

File: packages/MCP/Sources/MCP/ConfirmationPresenter.swift:121-128:

owner.alphaValue = 0
owner.orderFront(nil)
owner.beginSheet(panel) { _ in }

HUD itself overlays cross-Space; confirmation prompt does not share that logic

Impact

Not a correctness bug at the protocol level (broker correctly times out), but UX-wise: tool call silently denied because user never saw the prompt.

Recommended fix

Route through HUDBanner (already overlays cross-Space) for the confirmation card instead of beginSheet. The banner coordinator could accept a "requires response" variant that blocks dismissal until accept/deny.

Alternatively, route through the WKWebView HUD overlay since it's always-on-top across Spaces.

Test

Manual UAT: trigger run_applescript while user is in fullscreen app on another Space → confirmation prompt visible
Behavioral: confirmation panel appears regardless of frontmost-app state

Source

Audit: .planning/audit-2026-05-12/mcp-agent-audit.md (2026-05-12) — finding MED-2

## Summary `ConfirmationPresenter` uses `beginSheet` against a hidden (`alphaValue = 0`) owner panel at `level = .floating`. If the user is in a fullscreen app on a different Space, `orderFront(nil)` may not be enough — the sheet attaches but the user can't see it. The broker waits the full 60s timeout, synthesizes `.timeout`, and the tool call is denied without the user ever seeing the prompt. ## Evidence - File: `packages/MCP/Sources/MCP/ConfirmationPresenter.swift:121-128`: ```swift owner.alphaValue = 0 owner.orderFront(nil) owner.beginSheet(panel) { _ in } ``` - HUD itself overlays cross-Space; confirmation prompt does not share that logic ## Impact Not a correctness bug at the protocol level (broker correctly times out), but UX-wise: tool call silently denied because user never saw the prompt. ## Recommended fix Route through `HUDBanner` (already overlays cross-Space) for the confirmation card instead of `beginSheet`. The banner coordinator could accept a "requires response" variant that blocks dismissal until accept/deny. Alternatively, route through the WKWebView HUD overlay since it's always-on-top across Spaces. ## Test - Manual UAT: trigger `run_applescript` while user is in fullscreen app on another Space → confirmation prompt visible - Behavioral: confirmation panel appears regardless of frontmost-app state ## Source - Audit: `.planning/audit-2026-05-12/mcp-agent-audit.md` (2026-05-12) — finding MED-2

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Jarvis#26