macOS Sonoma shows an icon in the menubar with "AltTab is sharing your screen"

[5cj]

Describe the bug

Alert on boot after updating to Sonoma Developer Beta (14.0):

Alert "AltTab" is using a deprecated API that will be removed in the future. Please contact the developer for an updated version.

Screenshots / video

Steps to reproduce the bug

1. Update to Sonoma Developer Beta
2. Start AltTab
3. Observe alert

Your environment

• AltTab version: Version 6.59.0
• macOS version: Sonoma Developer Beta (14.0)

[lockieluke]

In the menu bar there’s also an icon indicating that AlrTab is actively monitoring your screen which the icon was not there before the beta 2 update possibly due to newly deprecated APIs

[5cj]

In the menu bar there’s also an icon indicating that AlrTab is actively monitoring your screen which the icon was not there before the beta 2 update possibly due to newly deprecated APIs

Screenshot for context, can't find a way to disable or hide it. Unsure if it warrants a separate issue, they may be related.

[ajnart]

Same issue here. I've updated to the latest update but have this icon constantly

[lwouis]

I already closed these duplicates:

• Alert "AltTab" is using a deprecated API that will be removed in the future. Please contact the developer for an updated version. #2599
• Alttab is sharing your screen #2600
• MacOs Sonoma Deprecating some library #2604

This time, I'll keep this ticket open so people can hopefully see it and stop creating new tickets.

Now regarding the topic itself: a beta is unstable software. Let's wait for Sonoma to go live to discuss if there are things to deal with, for AltTab. Hopefully by then, Apple will have fixed their issues.

[lockieluke]

Interesting take on the issue, a developer beta is for developers to first optimise and fix their apps for the upcoming releases instead of starting to work on it after public release drops

[lwouis]

@lockieluke previous macOS beta have introduced similar issues in the past, which they then fixed before the end of the beta. That's what I mean by unstable. Apple develops the OS actively during the beta. For Sonoma, it seems they are working on various UIs to share info about the app to the users. These UI elements look obnoxious and most big apps would display it, so I wouldn't be surprised that it all goes away before the end of the beta.

Please keep in mind #1179. I want to minimize the work on AltTab's side, so it makes sense to wait for Apple to be done moving things around until I try my best at fixing what they broke.

[5cj]

Please keep in mind #1179. I want to minimize the work on AltTab's side, so it makes sense to wait for Apple to be done moving things around until I try my best at fixing what they broke.

Fair, but closing issues typically delays progress, especially in a situation like this where it seems Apple is providing a notice.

For anyone looking for a place to start, I think the deprecated method may be 'activate(ignoringOtherApps:)', though I'm not super confident that's solely responsible for the alert since I have minimal exposure to AppKit development. I found that Apple's documentation has it listed as deprecated in 14.0, and it appears in the codebase a few times.

[ghost]

This appears to be an intentionally deprecated API, not a bug. In fact, it was already deprecated in Ventura, but it could still be used if your app targets a lower version.

ATS and ATSUI

Deprecations

Starting macOS 14 Sonoma, whenever the OS detects the usage of ATS or ATSUI APIs, the user will be presented a dialog stating that the application needs to be updated. Once the dialog is dismissed by the user, the application will exit. (100521621)

https://developer.apple.com/documentation/macos-release-notes/macos-14-release-notes#ATS-and-ATSUI

[flexlixrup]

I guess the screen sharing and the deprecated method are 2 different issues. The deprecated API, which throws the error popup has to be fixed before public release of macOS 14. The issue with the screen sharing could be tuned on Apples side before fall.
I suggest opening 2 seperate issues on these topics.

Regarding the deprecated method:
macOS 14 introduces a new 'activate()' method without the flag. The behavior has to be checked as the documentation is minimal but if I would have to guess, ignoringOtherApps is set to false on this new method, so if it changes the behavior of the App, a workaround has to be implemented in time.

[zacharee]

It might be possible to use NSApplicationDelegate.yieldActivation(to: NSRunningApplication) before activate() when switching windows, where the NSApplicationDelegate is the app set to be unfocused.

Edit: strike that. There are only NSRunningApplication references for other apps.

[zacharee]

There's a hidden API that supposedly has the same functionality as the deprecated activate() API, so I put up a PR implementing it: #2620.

[fifafu]

I have also faced the deprecated API message in my app BetterTouchTool. I'm pretty sure it's not caused by the activateIgnoringOtherApps method. Way too many apps are using that method to just deprecate and remove it like this.
Currently the best guess is the CGDisplayStreamCreate API, which is also used in AltTab to check screen recording permissions.

[koekeishiya]

I believe you should be using func CGPreflightScreenCaptureAccess() -> Bool to check for access,
and func CGRequestScreenCaptureAccess() -> Bool to request access if it is not granted already,
to manage screen recording permissions.

https://developer.apple.com/documentation/coregraphics/3656523-cgpreflightscreencaptureaccess
https://developer.apple.com/documentation/coregraphics/3656524-cgrequestscreencaptureaccess

[fifafu]

Yes, but this API is not a full replacement. It doesn't update while the app is started and also it is incorrectly marked as available on macOS 10.15 - which will just crash your app if you try to use it on that macOS version.

[lwouis]

Absolutely. I tried to use it in the past as it looks on paper like the proper way to do things, but the hacky alternative we use today is more robust and more flexible.

[caffeinum]

Not sure if it grants a separate issue, but on MacOS Sonoma, they've also updated UI for a language switcher.

For some reason, AltTab detects it as a separate window, and shows in the app list. It doesn't go away ever, once you switch a language this way once.

[lwouis]

Hi @caffeinum,

There was an issue with the new language-switch UI. They fixed it in a later beta release. They will probably continue working on / fixing this feature. Let's review it when Sonoma goes live.

[Rithari]

I believe it is safe to say that the issues can be addressed now, seeing as Sonoma goes public Sept. 18th.

[lwouis]

I tried to create a VM of the Release Candidate 2:

I couldn't get it to start. This means that I'll only be able to experience Sonoma after it's released. Only then, will I be able to observe the issue, and potentially change the app to improve things, if it can be done.

If anyone on Sonoma has an improvement to share, please share a PR and I'll do my best to review it 👍

[rami3l]

@lwouis Don’t worry, the official stable release will arrive within this week :)

[ShlomoCode]

@lwouis You can easily upgrade by searching in the System Settings "Software Update" and then click on the icon next to "Beta updates" and choose "macOS Sonoma Developer Beta" and OK, then you will have the option to upgrade with the click of a button to macOS sonoma (I myself used this method successfully a few days ago)

[ventsislavnikolov]

Hi, I'm currently using the RC2 of Sonoma as you can see in the screenshot and I still have the notification for AltTab is recording your screen, just to confirm. And its annoying :)

[lwouis]

Anyone knows what this new UI is meant to do?

AltTab needs Screen Recording permissions for its operations. Without it, we can't get screenshots of the windows to show the user. We can't even get the window names.

This new UI seems to imply that we are constantly recording the screen, which is not the case. We take screenshots of windows when they change (resized, moved, minimized, etc).

I don't understand what the idea is with this new UI. Maybe it's intended that AltTab is shown there? Maybe Apple's implementation shouldn't trigger here since we are not constantly recording like a video stream? Is there any documentation from Apple somewhere which explains their intent with this new UI system?

[fifafu]

I think Apple intents for it to be like this. It goes away after a while when not doing any screen captures for some time. There is no (non-hacky) way to hide that UI, it's part of the Control Center process.

Accessing meta information about windows does not trigger the icon to be shown though (at least in my apps), AFAIK it's just real captures that make it show up.

It's stupid, there should at least be an option to exclude apps from it - especially as it doesn't improve security at all. However this is feedback that needs to go to Apple. I filed it as FB13205878

[ShlomoCode]

This new UI seems to imply that we are constantly recording the screen, which is not the case. We take screenshots of windows when they change (resized, moved, minimized, etc).

Why not just when pressing the alt-tab shortcut?

[DownrightNifty]

I'm now on 14.1.1. My experience is similar to other reports here: the icon now mysteriously shows from time to time. Shows less often, but inconsistent. Still quite annoying.

But I noticed something interesting. Hammerspoon seems to be able to capture windows without tripping the indicator. I used the config provided by fungiboletus, which was designed specifically to make the indicator show, but it doesn't seem to ever appear on 14.1.1. I've even tried restarting the app and computer multiple times. They might be using an API that doesn't trip it somehow. This should be investigated.

Here's a minimal example:

i = 1

function captureWindow()
  local window = hs.window.frontmostWindow()
  local snapshot = window:snapshot()
  snapshot:saveToFile(string.format("/tmp/window%d.png", i))
  i = i + 1
end

captureWindow()
timer = hs.timer.doEvery(9, captureWindow)

You will see new window snapshots appear every 9 seconds in /tmp, without ever tripping the indicator.

Edit: Here's the code responsible for taking a screenshot: https://github.com/Hammerspoon/hammerspoon/blob/5f2212d015c96c287eb4f913348daed232eb217d/Hammerspoon/HSuicore.m#L611

It uses CGWindowListCreateImage().

[onurcagan]

Just checking in to see if there's any work on this as this is quite annoying. I can also look into this if @DownrightNifty's solution seems to be able to achieve what everyone wants.

[lwouis]

CGWindowListCreateImage is what we used to use before switching to the private API . Please see

alt-tab-macos/src/api-wrappers/CGWindowID.swift

Line 29 in 9e03d5f

// return CGWindowListCreateImage(.null, .optionIncludingWindow, self, [.boundsIgnoreFraming, .bestResolution])

I would also be surprised it would not show the indicator. Or at least differ from other APIs like the one we use

[DownrightNifty]

@lwouis I compiled AltTab with those APIs swapped out and the indicator still shows up (inconsistently).

It's really weird that Hammerspoon doesn't trip the indicator at all though. I haven't gotten the time to do an in-depth investigation, but I figure it might have something to do with the frequency of the API calls?

Based on the tip from @fifafu that the code responsible for this is located in Control Center, I'd like to pop /System/Library/CoreServices/ControlCenter.app/Contents/MacOS/ControlCenter into Ghidra, if I get the time before school starts back up for me...

[DownrightNifty]

If you disable SIP, you could actually make patches to the ControlCenter binary to disable the indicator for AltTab, with root access. This of course opens up security vulnerabilities but if the indicator annoys you that bad, maybe it's worth it, I don't know. I probably wouldn't do it myself. (Though I have temporarily disabled SIP in the past to do dynamic analysis on macOS system binaries 😅.)

[DownrightNifty]

$ strings /System/Library/CoreServices/ControlCenter.app/Contents/MacOS/ControlCenter | grep "capturing your screen"
 is capturing your screen.

Just based on this basic smoke test, it seems very likely that this is indeed the binary responsible for the indicator :)

[SarcevicAntonio]

Not sure what happened, but I'm running macOS 14.2.1 and right now the indicator doesn't seem to appear anymore when using AltTab.

[Duc-NSH]

Not sure what happened, but I'm running macOS 14.2.1 and right now the indicator doesn't seem to appear anymore when using AltTab.

Hmm, it is weird, I am currently on 14.2.1 too but the indicator still appears occasionally

[lwouis]

As someone mentioned in that thread, i believe that Apple has patched their purple indicator over time.

It used to trigger exactly on usage of the APIs. Now it seems to trigger on a more complex logic. Probably some kind of heuristic to show it when an app does it the first time, but then only show it after a certain time if the app spam calls.

So in the case of AltTab, we see it only occasionally these days. This is what people here mostly wanted so i guess Apple improved things.

[aubreypwd]

If an app (like AltTab) needs to grab part of the screen (to generate a thumbnail for the selected window) it will report to macOS that it is recording your screen (because it is).

This is normal behavior.

Doesn't mean I like the big giant purple square Apple chose (a dot would have sufficed), but I am still shocked this is still an issue. Disable thumbnails to make it go away.

[DownrightNifty]

Disable thumbnails to make it go away.

I imagine for most people, myself included, the main appeal of the app is the thumbnails.

[DownrightNifty]

I found a way to allow user-specified apps to bypass the indicator without creating new security issues or disabling SIP, but unfortunately it's (tangentially) related to a security issue I reported to Apple, so I don't want to risk talking about it just yet. I'll post an update when I get a response from Apple. (The fix for this issue won't prevent the method I found from working.)

[mayeths]

Every month I check this thread for any new messages, and I still use MacOS 13.2 because of this. Disappointing to Apple for such a thing.

[DownrightNifty]

Hey all, Apple has unfortunately been quite slow to respond, so in the meantime I thought I would share another method of running AltTab without activating the indicator.

Paste this into Apple Terminal (not a third party terminal):

pkill AltTab; screen -dmS AltTab /Applications/AltTab.app/Contents/MacOS/AltTab

Then grant Terminal screen recording permission.

It's not automated, but it works for the time being. I'm still waiting on Apple and I'll provide a better solution when they get back to me.

[Duc-NSH]

Hey all, Apple has unfortunately been quite slow to respond, so in the meantime I thought I would share another method of running AltTab without activating the indicator.

Paste this into Apple Terminal (not a third party terminal):

pkill AltTab; screen -dmS AltTab /Applications/AltTab.app/Contents/MacOS/AltTab

Then grant Terminal screen recording permission.

It's not automated, but it works for the time being. I'm still waiting on Apple and I'll provide a better solution when they get back to me.

So by manually giving the screen recording permission via the terminal, the system does not indicate that anymore?

[caff2code]

I'll provide a better solution when they get back to me.

The one you provided already works perfectly, thank you! I wanted it to autostart with my mac so I made a alttab.command file and paste that in there (minus the pkill AltTab), then System preferences > Login items > + > alttab.command.

# alttab.command
screen -dmS AltTab /Applications/AltTab.app/Contents/MacOS/AltTab

.command is different to .sh, it will open in Apple's terminal always. Only minor caveat is you see the flash of a console window every reboot. But think of it as a reminder of the "good old days" of random background Windows command prompt flashes :)

As far as how it works, I guess Apple allows Apple's own apps to bypass the sharing icon, which is why, e.g. Screenshot.app doesn't activate it. Fingers crossed they don't remove it. I cannot see why they would do such a thing, because only advanced users would take advantage of this.

@lwouis Did you see this?

[conker-rsc]

Seconding the workaround - I added a startup trigger on BTT to execute the terminal command @Duc-NSH posted and it's been working perfectly. Thank you so much!

[arozbiz]

Does this disable the purple screen-recording notification icon or does it just keep it on permanently?

[conker-rsc]

Does this disable the purple screen-recording notification icon or does it just keep it on permanently?

It prevents the purple icon from showing up at all

[jckpn]

For anyone else who was getting a permissions error, you might need to modify the file with chmod 755 ~/alttab.command (or whatever path to your command file).

[lockieluke]

I have a script for auto starting AltTab:

1. Create a file at ~/Library/LaunchAgents/local.alttab.plist and paste this in:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Label</key>
	<string>local.alttab</string>
	<key>ProgramArguments</key>
	<array>
		<string>/bin/sh</string>
		<string>-c</string>
		<string>/usr/bin/osascript $HOME/Scripts/alttab.scpt</string>
	</array>
	<key>RunAtLoad</key>
	<true/>
</dict>
</plist>

2. Make sure you turn off Launch at login in AltTab
3. Create a file at ~/Scripts/alttab.scpt and paste this in:

tell application "Terminal"
	do script "screen -dmS AltTab /Applications/AltTab.app/Contents/MacOS/AltTab"
    delay 1.5
    if it is running then quit
end tell

4. Run launchctl load ~/Library/LaunchAgents/local.alttab.plist to load the launch agent profile you just created
5. Logout and log back in, you might see the Terminal flash for a fraction of a second as it's starting AltTab but it should start working in a second

[phendan]

@lockieluke This solution doesn't seem to be working for me anymore. Is it still working for you, and if not, is there a new workaround?

[mikluko]

@lockieluke This solution doesn't seem to be working for me anymore. Is it still working for you, and if not, is there a new workaround?

Still working for me.

[mikluko]

Here is a bit improved version of @lockieluke's solution:

https://gist.github.com/mikluko/4618cc2f69bbb09d26d02f99a2897b66

How to use:

Boot out the existing launchd agent (if you have one):

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/local.alttab.plist

Install the new launchd agent:

curl -sl https://gist.githubusercontent.com/mikluko/4618cc2f69bbb09d26d02f99a2897b66/raw/b0e949de3c0171d936af4e932db489881944639e/local.alttab.plist > ~/Library/LaunchAgents/local.alttab.plist
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/local.alttab.plist