Fix 'dotnet watch' with sandboxed Mac Catalyst apps by rolfbjarne · Pull Request #25738 · dotnet/macios

rolfbjarne · 2026-06-18T14:05:47Z

When dotnet watch launches a sandboxed Mac Catalyst app, DOTNET_STARTUP_HOOKS points to a DLL in the .NET SDK directory, which is outside the app's sandbox. The app fails with Access is denied.

Fix:

In _PrepareRunDesktop, copy the startup hook DLL into the app's sandbox container directory (~/Library/Containers/<BundleId>/Data/tmp/)
Update RuntimeEnvironmentVariable for DOTNET_STARTUP_HOOKS to point to the new path
For RunWithOpen=false, wrap RunCommand with env to override the env var (since dotnet watch sets it independently)

Test changes:

Add enableSandbox parameter and a new [TestCase (ApplePlatform.MacCatalyst, false, true)] variation
Add com.apple.security.network.client entitlement (needed for hot reload WebSocket; CompileEntitlements auto-adds it for Debug sandboxed builds, but only when the sandbox is detected before CustomEntitlements are processed)
Put the test log file in the sandbox container when sandboxed

Fixes #25700.

🤖 Pull request created by Copilot

Add a new test case variation that enables the app sandbox for the Mac Catalyst HotReloadTestApp by passing EnableSandbox=true as an environment variable to 'dotnet watch'. The shared.csproj conditionally adds the com.apple.security.app-sandbox entitlement when EnableSandbox is set. This test is expected to fail currently because 'dotnet watch' doesn't work with sandboxed apps yet. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

When 'dotnet watch' launches a sandboxed app, the DOTNET_STARTUP_HOOKS environment variable points to a DLL in the .NET SDK directory, which is outside the app's sandbox. The app fails to load it with 'Access is denied'. Fix this by: 1. In _PrepareRunDesktop, copying the startup hook DLL into the app's sandbox container directory (~/Library/Containers/<ApplicationId>/Data/tmp/) 2. Updating RuntimeEnvironmentVariable for DOTNET_STARTUP_HOOKS to point to the new container path 3. For RunWithOpen=false, wrapping RunCommand with 'env' to override the DOTNET_STARTUP_HOOKS environment variable (since dotnet watch sets it directly in the child process environment, independent of RuntimeEnvironmentVariable items) Also add com.apple.security.network.client to the sandbox entitlements in the test app, which is needed for the hot reload WebSocket connection. The CompileEntitlements task normally auto-adds this for Debug sandboxed builds, but it checks for the sandbox BEFORE CustomEntitlements are processed, so it doesn't detect the sandbox when it's added via CustomEntitlements. Also put the test app's log file in the sandbox container directory when running sandboxed, since the app can't write to arbitrary paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use the canonical _BundleIdentifier property (set by _ReadAppManifest) for the sandbox container path, and add _ReadAppManifest to DependsOnTargets to ensure it's available. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vs-mobiletools-engineering-service2 · 2026-06-30T09:44:41Z

✅ [CI Build #2f76ba5] Prepare .NET Release succeeded ✅

📦 Published NuGet packages (32 packages)

iOS

Microsoft.iOS.Ref.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.iOS.Runtime.ios-arm64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.iOS.Runtime.ios.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.iOS.Runtime.iossimulator-arm64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.iOS.Runtime.iossimulator-x64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.iOS.Sdk.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.iOS.Templates.26.5.11771-net11-p7.nupkg
Microsoft.iOS.Windows.Sdk.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.NET.Sdk.iOS.Manifest-11.0.100-preview.6.26.5.11771-net11-p7.nupkg

MacCatalyst

Microsoft.MacCatalyst.Ref.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.MacCatalyst.Runtime.maccatalyst-arm64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.MacCatalyst.Runtime.maccatalyst-x64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.MacCatalyst.Runtime.maccatalyst.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.MacCatalyst.Sdk.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.MacCatalyst.Templates.26.5.11771-net11-p7.nupkg
Microsoft.NET.Sdk.MacCatalyst.Manifest-11.0.100-preview.6.26.5.11771-net11-p7.nupkg

macOS

Microsoft.macOS.Ref.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.macOS.Runtime.osx-arm64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.macOS.Runtime.osx-x64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.macOS.Runtime.osx.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.macOS.Sdk.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.macOS.Templates.26.5.11771-net11-p7.nupkg
Microsoft.NET.Sdk.macOS.Manifest-11.0.100-preview.6.26.5.11771-net11-p7.nupkg

tvOS

Microsoft.NET.Sdk.tvOS.Manifest-11.0.100-preview.6.26.5.11771-net11-p7.nupkg
Microsoft.tvOS.Ref.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.tvOS.Runtime.tvos-arm64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.tvOS.Runtime.tvos.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.tvOS.Runtime.tvossimulator-arm64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.tvOS.Runtime.tvossimulator-x64.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.tvOS.Sdk.net11.0_26.5.26.5.11771-net11-p7.nupkg
Microsoft.tvOS.Templates.26.5.11771-net11-p7.nupkg

Other

Sharpie.Bind.Tool.26.5.0.771-net11-p7.nupkg

Pipeline on Agent
Hash: 2f76ba5228f3571731fe7c8674f982c8d5262fd7 [PR build]

The DotNetWatch test has turned out to be obnoxious and hard to debug, so add extensive logging that can be opted into by setting the DOTNET_WATCH_TEST_LOG environment variable. When enabled, everything we log is teed to: * The current terminal. The test runner captures Console output (so Console.WriteLine won't show up until the test ends, which is exactly when things have already gone wrong when the test hangs), so we locate the terminal device ourselves using a libc `ttyname` P/Invoke (with a /dev/tty fallback) and write directly to it. * A well-known file (/tmp/DotNetWatchTestOutput.txt), which can be tailed while the test is running. The path being logged to is printed to the terminal at the very beginning of the test (not using Console.WriteLine). All log statements now go through a timestamped Log() helper, and many more log statements were added throughout the test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Don't dispose 'debugLog': output can still arrive after the test has finished, since things are happening on other threads. Leave it for the GC. * Move the synchronization from the inline Log() helper into TeeTextWriter, so that writes are also synchronized when 'debugLog' is passed to Execution.RunWithCallbacksAsync (which writes to it without any locking on our part). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

We're looking for a terminal to write to, so only check the file descriptors we write to (stdout/stderr); querying stdin made no sense. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Task.WhenAny (...).GetResult () would block forever if neither the app started nor the build failed, so wait with a 1-minute timeout and fail otherwise. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…-maccatalyst

vs-mobiletools-engineering-service2 · 2026-06-30T18:53:07Z

✅ [PR Build #d36d392] Build passed (Build packages) ✅

Pipeline on Agent
Hash: d36d392e0c3c8794c1ddc01d1787ecef95e40ddc [PR build]

vs-mobiletools-engineering-service2 · 2026-06-30T19:09:48Z

✅ [PR Build #d36d392] Build passed (Build macOS tests) ✅

Pipeline on Agent
Hash: d36d392e0c3c8794c1ddc01d1787ecef95e40ddc [PR build]

vs-mobiletools-engineering-service2 · 2026-06-30T19:09:57Z

✅ [PR Build #d36d392] Build passed (Detect API changes) ✅

Pipeline on Agent
Hash: d36d392e0c3c8794c1ddc01d1787ecef95e40ddc [PR build]

vs-mobiletools-engineering-service2 · 2026-06-30T19:24:37Z

✅ API diff for current PR / commit

NET (empty diffs)

iOS: vsdrops gist ( No breaking changes )
tvOS: vsdrops gist ( No breaking changes )
MacCatalyst: vsdrops gist ( No breaking changes )
macOS: vsdrops gist ( No breaking changes )

✅ API diff vs stable

NET (empty diffs)

iOS: vsdrops gist ( No breaking changes )
tvOS: vsdrops gist ( No breaking changes )
MacCatalyst: vsdrops gist ( No breaking changes )
macOS: vsdrops gist ( No breaking changes )

ℹ️ Generator diff

Generator Diff: vsdrops (html) vsdrops (raw diff) gist (raw diff) - Please review changes)

Pipeline on Agent
Hash: d36d392e0c3c8794c1ddc01d1787ecef95e40ddc [PR build]

vs-mobiletools-engineering-service2 · 2026-06-30T20:27:13Z

🔥 [CI Build #d36d392] Test results 🔥

Test results

❌ Tests failed on VSTS: test results

0 tests crashed, 1 tests failed, 207 tests passed.

Failures

❌ monotouch tests (macOS)

1 tests failed, 17 tests passed.

Failed tests

monotouch-test/macOS/Release (static registrar): Failed (Test run failed.
Tests run: 3718 Passed: 3586 Inconclusive: 13 Failed: 1 Ignored: 131)

Html Report (VSDrops) Download

Successes

✅ assembly-processing: All 1 tests passed. Html Report (VSDrops) Download
✅ cecil: All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (iOS): All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (MacCatalyst): All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (macOS): All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (Multiple platforms): All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (tvOS): All 1 tests passed. Html Report (VSDrops) Download
✅ framework: All 2 tests passed. Html Report (VSDrops) Download
✅ fsharp: All 4 tests passed. Html Report (VSDrops) Download
✅ generator: All 5 tests passed. Html Report (VSDrops) Download
✅ interdependent-binding-projects: All 4 tests passed. Html Report (VSDrops) Download
✅ introspection: All 4 tests passed. Html Report (VSDrops) Download
✅ linker (iOS): All 21 tests passed. Html Report (VSDrops) Download
✅ linker (MacCatalyst): All 21 tests passed. Html Report (VSDrops) Download
✅ linker (macOS): All 21 tests passed. Html Report (VSDrops) Download
✅ linker (tvOS): All 21 tests passed. Html Report (VSDrops) Download
✅ monotouch (iOS): All 18 tests passed. Html Report (VSDrops) Download
✅ monotouch (MacCatalyst): All 18 tests passed. Html Report (VSDrops) Download
✅ monotouch (tvOS): All 18 tests passed. Html Report (VSDrops) Download
✅ msbuild: All 2 tests passed. Html Report (VSDrops) Download
✅ sharpie: All 1 tests passed. Html Report (VSDrops) Download
✅ windows: All 3 tests passed. Html Report (VSDrops) Download
✅ xcframework: All 4 tests passed. Html Report (VSDrops) Download
✅ xtro: All 1 tests passed. Html Report (VSDrops) Download

macOS tests

✅ Tests on macOS Sonoma (14): All 5 tests passed. Html Report (VSDrops) Download
✅ Tests on macOS Sequoia (15): All 5 tests passed. Html Report (VSDrops) Download
✅ Tests on macOS Tahoe (26): All 5 tests passed. Html Report (VSDrops) Download