Agent access on macOS 27: the Files & Folders step

Same slot as the macOS 26 note, same reason. The proxy reads the handshake only inside a tool call, so the block happens on the first question, not at install. The note sits below the row because that's when it applies.

• The button is new. On 26 the fix came to the researcher as a dialog. On 27 they have to go four levels deep into an app we don't own. x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?Privacy_FilesAndFolders was opened on 27.0 and lands on Files & Folders. It's bordered, not filled: Install stays the pane's one prominent action.
• The full path stays in the sentence. The button only gets them to the list. They still have to find Claude under C, expand it and find the switch. Every locale quotes macOS's own pane names, so the words match System Settings.
• Info register, no triangle. Nothing has gone wrong. This is how macOS 27 works, once per agent app.
• Always shown on 27. Bristlenose can't see another app's TCC state, and a blocked proxy never reaches the serve. From our side, a denial looks the same as nobody having asked yet (spec §4).
• Measured for Claude too. In a clean macOS 27 guest with SIP on, Claude was blocked silently on the first question, and turning on Files & Folders ▸ Claude ▸ Bristlenose fixed it (29 Sep 2026).

Today's tab needs no permission step. The TOML stanza connects over HTTP to 127.0.0.1 and never touches the container. Only a plugin that runs our proxy reads the handshake, and only that path meets Files & Folders. So (a) is safe to ship now. It adds the one fact that applies to every ChatGPT route: tools work in Work, not Chat. That was measured for the plugin and is inferred for the TOML path.

• (b) has no Files & Folders note, deliberately. A ChatGPT plugin running the Node proxy is dead on arrival: ChatGPT supplies no Node (measured with a control). So the plugin only exists with the native proxy, and that proxy needs no grant: it's sandboxed and carries our Team-ID app group (measured under ChatGPT, Claude Code and Terminal). Files & Folders becomes recovery-only, reached from the in-chat message and the help page, not pre-announced here.
• The install gesture: the button opens codex://plugins/bristlenose?marketplacePath=…, with the marketplace shipped inside the app. ChatGPT shows its own plugin page, whose button reads "Install plugin". "Install Plugin…" mirrors "Install Extension…"; "Add to ChatGPT" is the alternative. The maintainer's call.
• The config route stays below, as the fallback with no install step.
• "Work" and "Chat" stay in English in every locale until someone reads ChatGPT's own localised labels. They're compiled into its Electron bundle, not shipped as .lproj files.
• The new note uses the same key as the Claude tab with {{app}} = ChatGPT, one string for both.

Redrawn, not a screenshot. The header sentence, the pane name and the host → target nesting match what was seen and described on 29 Sep. The ChatGPT row was turned on and verified to work. The Claude row is drawn by analogy.

• The list is long and alphabetical. On the test Mac, C is below the fold. That's why the note names the app to expand.
• Does the app appear before its first denied read? The header says apps appear once they've requested access. If so, the order is: ask, get blocked, then turn it on. The copy is written for that order. Verify before changing it to "before you ask".
• Two switches, two meanings. This one lets an agent app find Bristlenose at all. Agent Access, per project, still decides which studies it reads. The help page says so, or researchers will revoke in the wrong place.
• macOS also has a Data Access Blocked notification with a Manage button for this service (TCC.framework loctable). None appeared during the test, so the copy mentions it only as "may".