homebrew MacOS upgrade to 3.3.0 fails

[sf105]

on my machine (MacOS 26.5.1 (25F80)), upgrading 3.2.3 -> 3.3.0 via Homebrew fails because

Permission denied @ rb_check_realpath_internal - /Users/<my user name>/Documents

[yavorpanayotov]

Thanks for the report — the exact error text pointed straight at the likely cause.

Hypothesis

We think this is a macOS TCC (privacy) interaction rather than anything in the Allium formula. rb_check_realpath_internal is Ruby's File.realpath; Permission denied … /Users/<you>/Documents is the OS returning EPERM when Homebrew tries to resolve a path that routes through ~/Documents. On macOS Tahoe (26.x), ~/Documents, ~/Desktop and ~/Downloads are TCC-protected — a process only gets through if its host terminal app has been granted access.

The most likely trigger is Homebrew resolving its current working directory, i.e. brew upgrade was run from inside ~/Documents (or a subfolder of it). We confirmed Homebrew does guard on this — with an unreadable cwd it refuses to run at all. (It could alternatively be a custom HOMEBREW_CACHE/HOMEBREW_TEMP/HOMEBREW_PREFIX living under ~/Documents, which brew config would reveal.)

Nothing in the formula touches ~/Documents (install is just bin.install "allium", no post_install/caveats), so we'd expect the same failure from any formula under these conditions. The 3.2.3 → 3.3.0 timing is most likely coincidental: a macOS update between the two installs would reset the terminal's TCC grant, and/or the upgrade happened to be run from within ~/Documents this time.

What we tried

On macOS 26.5 (Tahoe), Homebrew 6.0.1, Apple Silicon, Terminal.app:

• Revoked Terminal's folder access (tccutil reset … com.apple.Terminal) and answered Don't Allow at the Desktop/Downloads prompts.
• cd ~/Desktop && brew install allium → fails; cd <readable dir> && brew install allium → proceeds normally.

So we reproduced the failure and the mechanism. One caveat, for accuracy: our run produced Homebrew's newer friendly guard —

Error: The current working directory must be readable to <user> to run brew.

— rather than the raw rb_check_realpath_internal exception you saw. On our machine the folder denial only blocked reading directory contents; File.realpath on the directory itself still succeeded, so Homebrew's readability check tripped first. The raw rb_check_realpath_internal/EPERM form needs a stricter (stat-level) denial, or a Homebrew old enough to lack that guard. Same root cause, different surface depending on Homebrew version and exactly how the folder is locked down — your brew --version would help us pin which it is.

What to try

1. Quickest check — run it from outside the protected folders:

   cd ~ && brew upgrade allium
   

   If that works, the working directory was the culprit.
2. If you'd rather keep working from ~/Documents, grant your terminal access: System Settings → Privacy & Security → Full Disk Access (or Files and Folders → Documents) → enable your terminal app, then fully quit and relaunch it.

To help us confirm the exact path, if you have a moment:

brew --version
brew config                  # HOMEBREW_PREFIX / CACHE / TEMP locations
pwd                          # where you were when it failed
brew upgrade allium --verbose --debug 2>&1 | tail -40

Happy to add a note to the docs/caveats if this turns out to catch others on Tahoe.

[sf105]

cd ~ && brew upgrade allium
✔︎ JSON API packages.arm64_tahoe.jws.json                                                                                                                Downloaded   15.2MB/ 15.2MB
==> Would upgrade 1 outdated package
juxt/allium/allium 3.2.3 -> 3.3.0
==> Do you want to proceed with the upgrade? [y/n]
==> Upgrading 1 outdated package:
juxt/allium/allium 3.2.3 -> 3.3.0
==> Fetching downloads for: allium
✔︎ Formula allium (3.3.0)                                                                                                                                Verified    554.4KB/554.4KB
==> Upgrading juxt/allium/allium
  3.2.3 -> 3.3.0 
Error: Permission denied @ rb_check_realpath_internal - /Users/<my account>/Documents

Homebrew 6.0.1

 brew config
HOMEBREW_VERSION: 6.0.1
ORIGIN: https://github.com/Homebrew/brew
HEAD: 109191be4988470b51a60a5ef1998520aa24c01b
Last commit: 5 days ago
Branch: stable
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 24
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 12
HOMEBREW_REQUIRE_TAP_TRUST: set
Homebrew Ruby: 4.0.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.5_1/bin/ruby
CPU: dodeca-core 64-bit arm_brava
Clang: 21.0.0 build 2100
Git: 2.54.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.5.1-arm64
CLT: 26.5.0.0.1777544298
Xcode: N/A
Rosetta 2: false

rew upgrade allium --verbose --debug 2>&1 | tail

/usr/bin/env /opt/homebrew/Library/Homebrew/shims/shared/curl --disable --cookie /dev/null --globoff --show-error --user-agent Homebrew/6.0.1\ \(Macintosh\;\ arm64\ Mac\ OS\ X\ 26.5.1\)\ curl/8.7.1 --header Accept-Language:\ en --retry 3 --location https://api.github.com/repos/juxt/homebrew-allium --header Accept:\ application/vnd.github+json --write-out '
'\%\{http_code\} --header X-GitHub-Api-Version:2022-11-28 --dump-header /private/tmp/github_api_headers20260616-51951-biyhae
Error: Permission denied @ rb_check_realpath_internal - /Users/<my account>/Documents
/opt/homebrew/Library/Homebrew/sandbox.rb:477:in 'Pathname#realpath'
/opt/homebrew/Library/Homebrew/sandbox.rb:477:in 'Sandbox#expand_realpath'
/opt/homebrew/Library/Homebrew/sandbox.rb:436:in 'Sandbox#path_filter'
/opt/homebrew/Library/Homebrew/sandbox.rb:182:in 'Sandbox#deny_read'
/opt/homebrew/Library/Homebrew/sandbox.rb:187:in 'Sandbox#deny_read_path'
/opt/homebrew/Library/Homebrew/sandbox.rb:230:in 'block in Sandbox#deny_read_home'
/opt/homebrew/Library/Homebrew/sandbox.rb:228:in 'Array#each'
/opt/homebrew/Library/Homebrew/sandbox.rb:228:in 'Sandbox#deny_read_home'
/opt/homebrew/Library/Homebrew/formula_installer.rb:1145:in 'FormulaInstaller#build'
/opt/homebrew/Library/Homebrew/formula_installer.rb:619:in 'FormulaInstaller#install'
/opt/homebrew/Library/Homebrew/install.rb:674:in 'Homebrew::Install.install_formula'
/opt/homebrew/Library/Homebrew/upgrade.rb:427:in 'Homebrew::Upgrade.upgrade_formula'
/opt/homebrew/Library/Homebrew/upgrade.rb:144:in 'block in Homebrew::Upgrade.upgrade_formulae'
/opt/homebrew/Library/Homebrew/upgrade.rb:143:in 'Array#each'
/opt/homebrew/Library/Homebrew/upgrade.rb:143:in 'Homebrew::Upgrade.upgrade_formulae'
/opt/homebrew/Library/Homebrew/cmd/upgrade.rb:686:in 'Homebrew::Cmd::UpgradeCmd#upgrade_outdated_formulae!'
/opt/homebrew/Library/Homebrew/cmd/upgrade.rb:297:in 'Homebrew::Cmd::UpgradeCmd#run'
/opt/homebrew/Library/Homebrew/brew.rb:114:in '<main>'
ln -s ../Cellar/allium/3.2.3/bin/allium allium

[yavorpanayotov]

Thanks — the --verbose --debug trace was decisive, and it moved the diagnosis off our first guess (which was wrong).

Root cause

Your trace points at Homebrew's build sandbox, not the working directory:

sandbox.rb               Sandbox#deny_read_home → Pathname#realpath
formula_installer.rb:1145  FormulaInstaller#build

The allium formula ships no bottle, so brew install/upgrade runs the formula's install from source inside Homebrew's build sandbox. On macOS Tahoe that sandbox's deny_read_home calls realpath on your TCC-protected home folders (~/Documents); when the terminal hasn't been granted access the OS returns EPERM and the upgrade aborts. That's why it reproduced from ~ with an all-standard brew config — it's independent of cwd and of HOMEBREW_* overrides. (Apologies for the earlier current-directory hypothesis; your run from ~ ruled it out.)

What we did and didn't reproduce

On a matching machine (macOS 26.5 Tahoe, Homebrew 6.0.2) we reproduced the mechanism deterministically:

• an un-bottled formula install runs the from-source build sandbox (the deny_read_home → realpath path), and
• a bottled formula pours and skips that path entirely.

We also confirmed Homebrew 6.0.2 still contains the same deny_read_home code, so simply updating Homebrew won't avoid it.

What we did not get to fire is the literal rb_check_realpath_internal … /Documents EPERM itself — and we did try. Revoking the terminal's Documents access via the standard "Don't Allow" prompt blocks directory listing (ls/readdir) but leaves realpath/stat of the folder working, so realpath(~/Documents) kept returning normally and the error never surfaced. Reproducing the exact EPERM needs a stricter, stat-level denial than that prompt produces; your machine is evidently in such a state. So we reproduced everything around the failing call — the build sandbox reaching realpath(~/Documents), and the bottle that avoids it — and treat your stack trace as ground truth for the EPERM leaf.

The fix (and our confidence)

Ship bottles, so brew install/upgrade pours a prebuilt package and never enters the build sandbox. We built a bottle from the actual v3.4.0 arm64 binary and confirmed it pours on Tahoe.

Confidence: high on the mechanism — pouring provably never runs deny_read_home, so the failing realpath can't be reached. The caveat we want to be straight about: we couldn't exercise it under your exact TCC-denied state, so there's a small chance your environment has another wrinkle we haven't seen. We'll ship the bottles in 3.4.1 and would appreciate you confirming brew update && brew upgrade allium works once it's out.

Tracking: fix in juxt/allium-tools#50, reproduction harness in juxt/homebrew-allium#4.

[yavorpanayotov]

Reopening — this was auto-closed when the 3.4.1 version-bump PR (which referenced this issue) merged; that was an accidental linked-closure, not a confirmed resolution. Leaving it open until you've had a chance to try brew update && brew upgrade allium on 3.4.1 once it's published and confirm the bottle pours cleanly on your machine. Since we couldn't reproduce the exact rb_check_realpath_internal denial on our hardware, your confirmation is what closes this out.