From a315a07f3665a3d07173cc438d292141b791b9b3 Mon Sep 17 00:00:00 2001
From: Lucas Fernandes Nogueira <lucas@tauri.app>
Date: Tue, 22 Sep 2026 06:05:04 -0300
Subject: [PATCH] refactor(fs)!: remove the unwatch permission (#3606)

There has been no `unwatch` command since v2.0 (`Watcher.close()` releases
the resource), so `allow-unwatch` and `deny-unwatch` never granted anything.
---
 .changes/fs-remove-unwatch.md                 |  5 ++++
 plugins/fs/build.rs                           |  2 --
 .../fs/permissions/autogenerated/reference.md | 26 -------------------
 plugins/fs/permissions/read-all.toml          |  1 -
 4 files changed, 5 insertions(+), 29 deletions(-)
 create mode 100644 .changes/fs-remove-unwatch.md

diff --git a/.changes/fs-remove-unwatch.md b/.changes/fs-remove-unwatch.md
new file mode 100644
index 000000000..c7dba9a9f
--- /dev/null
+++ b/.changes/fs-remove-unwatch.md
@@ -0,0 +1,5 @@
+---
+"fs": major
+---
+
+**Breaking:** Removed the `allow-unwatch` and `deny-unwatch` permissions. There has been no `unwatch` command since v2.0 (`Watcher.close()` releases the resource instead), so they never granted anything.
diff --git a/plugins/fs/build.rs b/plugins/fs/build.rs
index fd0e7b5dd..aa9e521f5 100644
--- a/plugins/fs/build.rs
+++ b/plugins/fs/build.rs
@@ -97,8 +97,6 @@ const COMMANDS: &[&str] = &[
     "fstat",
     "exists",
     "watch",
-    // TODO: Remove this in v3
-    "unwatch",
     "size",
     "start_accessing_security_scoped_resource",
     "stop_accessing_security_scoped_resource",
diff --git a/plugins/fs/permissions/autogenerated/reference.md b/plugins/fs/permissions/autogenerated/reference.md
index da64bd29b..20451832f 100644
--- a/plugins/fs/permissions/autogenerated/reference.md
+++ b/plugins/fs/permissions/autogenerated/reference.md
@@ -564,32 +564,6 @@ Denies the truncate command without any pre-configured scope.
 <tr>
 <td>
 
-`fs:allow-unwatch`
-
-</td>
-<td>
-
-Enables the unwatch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`fs:deny-unwatch`
-
-</td>
-<td>
-
-Denies the unwatch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
 `fs:allow-watch`
 
 </td>
diff --git a/plugins/fs/permissions/read-all.toml b/plugins/fs/permissions/read-all.toml
index fa61906a5..74bb1c17c 100644
--- a/plugins/fs/permissions/read-all.toml
+++ b/plugins/fs/permissions/read-all.toml
@@ -16,5 +16,4 @@ commands.allow = [
   "fstat",
   "exists",
   "watch",
-  "unwatch",
 ]