Name the Local Network permission when it blocks a connection #3668

Problem

On macOS 15 and later, a connection to a local network address (192.168.x.x, 10.x.x.x, .local) needs the Local Network permission. When TablePro does not have it, the connect fails fast with "No route to host" (connections/ssh-tunneling.mdx). The connection window then shows the driver's own error, with Try Again, Manage Connections… and Copy Details (features/tabs.mdx, "What survives a restart"). Nothing in that error names the permission, so the user is told the host is unreachable when the cause is a privacy setting on their own Mac.

What exists today:

• apple/TablePro/Info.plist:11 declares NSLocalNetworkUsageDescription, so the system prompt says why TablePro asks.
• The docs explain the permission in troubleshooting.mdx, connections/ssh-tunneling.mdx and connections/socks-proxy.mdx.
• No macOS code checks for the permission: a search for "Local Network", EHOSTUNREACH and "No route to host" under apple/TablePro finds only the Info.plist entry and an unrelated commit diagnosis (apple/TablePro/Core/Services/Execution/CommitOutcomeDiagnosis.swift:50).
• The iOS app already handles it. LocalNetworkPermission probes the host with a UDP connection and reads the denial off the path (apple/TableProMobile/TableProMobile/Platform/LocalNetworkPermission.swift), and the error reads Local Network Access Required with the steps to turn it on (apple/TableProMobile/TableProMobile/Helpers/AppError.swift:124, iOS: LocalNetworkPermission classifies by address range and infers permission state #2040).

Proposed solution

• When a connect to a host that is not loopback fails, probe the same host the way the iOS app does. If the path reports the Local Network permission as denied, show Local Network Access Required in the connection window instead of the driver's error, and say which host was blocked.
• Add a recovery button that opens System Settings > Privacy & Security > Local Network, next to Try Again.
• Apply it to every hop that can be on the local network: the database host, an SSH tunnel or jump host, and a SOCKS proxy.
• Keep the driver's text under Copy Details.

Done when a connect to a LAN host with the permission off shows the permission by name and a button to the setting, and a test covers the classification with an injected path result.

Alternatives considered

Read troubleshooting.mdx and turn the permission on by hand.

Platform

macOS

Related database type

N/A / General