Help

SSH from iPhone — file access on macOS

If you SSH into your Mac and see “Operation not permitted” inside Documents, Desktop, Downloads or iCloud Drive, that’s a macOS privacy gate, not a bug. Here’s the one-time fix.

Symptom: ls works in your home folder but cd ~/Documents && ls returns ls: .: Operation not permitted. Tools like Claude Code, Codex, or anything that reads the current folder exit silently because they can’t even list it.

Why this happens

macOS gates access to certain folders behind a privacy permission called Full Disk Access. By default the SSH daemon — sshd — is not on the list, so any shell it spawns is treated like a random untrusted process. Your local Terminal.app session is fine because Terminal already has the permissions it needs; the SSH session is a different process with a different sandbox.

The protected folders include:

~/Documents
~/Desktop
~/Downloads
iCloud Drive
External volumes and removable storage
Some app sandboxes (Photos, Mail, Messages, etc.)

Fix: grant SSH Full Disk Access

One-time setup on the Mac you’re SSH-ing into:

Open System Settings → Privacy & Security → Full Disk Access.
Click the + button. macOS will open a Finder picker.
Press ⌘ ⇧ G to “Go to Folder” and paste:
```
/usr/libexec/sshd-keygen-wrapper
```
Click Open. The wrapper appears in the list with its toggle on.
Disconnect any existing SSH sessions and reconnect. The next shell will inherit the new permission.

That single entry covers all protected folders for every future SSH session. You don’t need to grant per-folder access.

How to confirm it worked

After reconnecting, run:

cd ~/Documents
ls

If you see your files instead of Operation not permitted, you’re done. Claude Code, Codex and any other tool that touches the working directory will now launch normally.

If you don’t want to grant access

Keep your SSH-from-iPhone work in unprotected folders. Anything under your home folder that isn’t in the list above will work without granting permissions:

mkdir ~/work
cd ~/work
claude

Or clone repos into ~/code, ~/projects, etc. — those paths aren’t TCC-protected.

Security note

Granting sshd-keygen-wrapper Full Disk Access meansanyone who successfully authenticates over SSH to this Maccan read every file on it. That’s the trade-off. If you only use password or public-key auth from devices you control, and your Mac is on a trusted network, it’s a reasonable choice — and it’s no different from the access a local Terminal.app session has. If your Mac is internet-exposed or shared, prefer the unprotected-folder workaround above.