@hasna/recordings 0.1.12 → 0.1.14

package/dist/cli/index.js

@@ -7,7 +7,7 @@ var __require = import.meta.require;
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/recordings",
-    version: "0.1.12",
+    version: "0.1.14",
     type: "module",
     description: "Speech-to-text recording tool with MCP and CLI \u2014 records, transcribes, and optionally enhances text using AI",
     repository: {
@@ -9893,15 +9893,40 @@ function runMigrations(db) {
   const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
   const currentLevel = result?.max_id ?? -1;
   for (let i = currentLevel + 1;i < MIGRATIONS.length; i++) {
-    db.run(MIGRATIONS[i]);
     try {
+      db.run(MIGRATIONS[i]);
       db.query("INSERT INTO _migrations (id) VALUES (?)").run(i);
     } catch (e) {
+      if (isBenignMigrationError(e)) {
+        db.query("INSERT OR IGNORE INTO _migrations (id) VALUES (?)").run(i);
+        continue;
+      }
       if (!(e instanceof Error && e.message.includes("UNIQUE constraint failed"))) {
         throw e;
       }
     }
   }
+  repairSchemaDrift(db);
+}
+function isBenignMigrationError(error) {
+  if (!(error instanceof Error))
+    return false;
+  return error.message.includes("duplicate column name");
+}
+function repairSchemaDrift(db) {
+  ensureColumn(db, "recordings", "goal", "TEXT");
+  ensureColumn(db, "recordings", "role", "TEXT");
+  ensureColumn(db, "recordings", "task_list_id", "TEXT");
+  ensureColumn(db, "recordings", "machine_id", "TEXT");
+  ensureColumn(db, "recordings", "metadata", "TEXT DEFAULT '{}'");
+  ensureColumn(db, "agents", "active_project_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
+}
+function ensureColumn(db, table, column, definition) {
+  const rows = db.query(`PRAGMA table_info(${table})`).all();
+  if (rows.some((row) => row.name === column)) {
+    return;
+  }
+  db.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function getAdapter() {
   if (!_adapter) {
@@ -10441,7 +10466,7 @@ async function processText(rawText, config, systemPrompt) {
 }
 
 // src/version.ts
-var VERSION = "0.1.12";
+var VERSION = "0.1.14";
 
 // src/cli/index.ts
 var program = new Command;
@@ -10767,6 +10792,65 @@ appCommand.command("status").description("Show installed Recordings.app status")
   console.log(`Native sources: ${status.native_sources_available ? "available" : "missing"}`);
   console.log(`Installed app: ${status.installed ? status.installed_app_path : "missing"}`);
   console.log(`Executable: ${status.executable ? "available" : "missing"}`);
+  console.log(`Code hash: ${status.app_code_hash ?? "unavailable"}`);
+  if (process.platform === "darwin") {
+    console.log(`Microphone: ${status.microphone_permission}`);
+    console.log(`Accessibility: ${status.accessibility_permission}`);
+    console.log(`Log: ${status.log_path}`);
+  }
+});
+appCommand.command("permissions").description("Show macOS permission state for Recordings.app").action(() => {
+  const status = getMacOSAppStatus();
+  const permissions = {
+    platform: status.platform,
+    bundle_id: "com.hasna.recordings",
+    microphone: status.microphone_permission,
+    accessibility: status.accessibility_permission,
+    app_code_hash: status.app_code_hash,
+    ad_hoc_signed: status.ad_hoc_signed,
+    log_path: status.log_path
+  };
+  if (program.opts().json) {
+    console.log(JSON.stringify(permissions, null, 2));
+    return;
+  }
+  console.log(`Microphone: ${permissions.microphone}`);
+  console.log(`Accessibility: ${permissions.accessibility}`);
+  console.log(`Log: ${permissions.log_path}`);
+});
+appCommand.command("reset-permissions").description("Reset macOS Microphone and Accessibility permissions for Recordings.app").action(() => {
+  if (process.platform !== "darwin") {
+    console.error(chalk.red("Permission reset is only available on macOS"));
+    process.exit(1);
+  }
+  const services = ["Microphone", "Accessibility"];
+  for (const service of services) {
+    const result = spawnSync("tccutil", ["reset", service, "com.hasna.recordings"], {
+      stdio: "inherit"
+    });
+    if (result.error) {
+      console.error(chalk.red(result.error.message));
+      process.exit(1);
+    }
+  }
+});
+appCommand.command("log").description("Show the Recordings.app diagnostic log").option("-n, --lines <lines>", "Number of lines to print", "120").action((opts) => {
+  const status = getMacOSAppStatus();
+  if (!existsSync6(status.log_path)) {
+    console.log("");
+    return;
+  }
+  const lines = Math.max(1, parseInt(opts.lines, 10) || 120);
+  const result = spawnSync("tail", ["-n", String(lines), status.log_path], {
+    encoding: "utf8"
+  });
+  if (result.error) {
+    console.error(chalk.red(result.error.message));
+    process.exit(1);
+  }
+  process.stdout.write(result.stdout);
+  if (result.stderr)
+    process.stderr.write(result.stderr);
 });
 appCommand.command("open").description("Open the installed Recordings.app").action(() => {
   const status = getMacOSAppStatus();
@@ -11232,8 +11316,11 @@ function getMacOSAppStatus() {
   const home = process.env.HOME || process.env.USERPROFILE || "";
   const installedAppPath = pathJoin(home, ".hasna", "recordings", "Recordings.app");
   const executablePath = pathJoin(installedAppPath, "Contents", "MacOS", "Recordings");
+  const logPath = pathJoin(home, ".hasna", "recordings", "Recordings.log");
   const installerPath = pathJoin(packageRoot, "scripts", "install_macos_app.sh");
   const nativeSourcesPath = pathJoin(packageRoot, "src", "native", "Recordings");
+  const signingInfo = getCodeSigningInfo(installedAppPath);
+  const permissionCodeHash = signingInfo.adHoc ? signingInfo.cdHash : null;
   return {
     platform: process.platform,
     package_root: packageRoot,
@@ -11244,9 +11331,69 @@ function getMacOSAppStatus() {
     installed_app_path: installedAppPath,
     installed: existsSync6(installedAppPath),
     executable_path: executablePath,
-    executable: existsSync6(executablePath)
+    executable: existsSync6(executablePath),
+    app_code_hash: signingInfo.cdHash,
+    ad_hoc_signed: signingInfo.adHoc,
+    microphone_permission: getTccPermission("kTCCServiceMicrophone", home, permissionCodeHash),
+    accessibility_permission: getTccPermission("kTCCServiceAccessibility", home, permissionCodeHash),
+    log_path: logPath
   };
 }
+function getCodeSigningInfo(appPath) {
+  if (process.platform !== "darwin" || !existsSync6(appPath)) {
+    return { cdHash: null, adHoc: false };
+  }
+  const result = spawnSync("codesign", ["-d", "--verbose=4", appPath], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const output = `${result.stdout}
+${result.stderr}`;
+  const cdHash = output.match(/^CDHash=([a-fA-F0-9]+)/m)?.[1]?.toLowerCase() ?? null;
+  const adHoc = /Signature=adhoc/.test(output);
+  return { cdHash, adHoc };
+}
+function getTccPermission(service, home, currentCodeHash) {
+  if (process.platform !== "darwin")
+    return "unsupported";
+  const dbPaths = [
+    pathJoin(home, "Library", "Application Support", "com.apple.TCC", "TCC.db"),
+    pathJoin("/", "Library", "Application Support", "com.apple.TCC", "TCC.db")
+  ];
+  const sql = "select auth_value || '|' || ifnull(hex(csreq), '') from access where service = '" + service.replace(/'/g, "''") + "' and client = 'com.hasna.recordings' order by last_modified desc limit 1;";
+  for (const dbPath of dbPaths) {
+    if (!existsSync6(dbPath))
+      continue;
+    const result = spawnSync("sqlite3", [dbPath, sql], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const value = result.stdout.trim();
+    if (!value)
+      continue;
+    const [authValue, csreqHex = ""] = value.split("|");
+    const label = tccAuthValueLabel(authValue ?? "");
+    if (label === "allowed" && currentCodeHash && csreqHex && !csreqHex.toLowerCase().includes(currentCodeHash.toLowerCase())) {
+      return "stale_allowed_for_previous_app_build";
+    }
+    return label;
+  }
+  return "not_determined";
+}
+function tccAuthValueLabel(value) {
+  switch (value) {
+    case "0":
+      return "denied";
+    case "1":
+      return "unknown";
+    case "2":
+      return "allowed";
+    case "3":
+      return "limited";
+    default:
+      return `unknown(${value})`;
+  }
+}
 function findPackageRoot() {
   let current = dirname3(fileURLToPath(import.meta.url));
   while (true) {

package/dist/db/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/db/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA+F7C,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAiBrD;AA8BD,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAED,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,oEAAoE;AACpE,wBAAgB,UAAU,IAAI,aAAa,CAK1C;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/db/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA+F7C,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAiBrD;AAsED,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAED,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,oEAAoE;AACpE,wBAAgB,UAAU,IAAI,aAAa,CAK1C;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC"}

package/dist/index.js

@@ -9844,15 +9844,40 @@ function runMigrations(db) {
   const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
   const currentLevel = result?.max_id ?? -1;
   for (let i = currentLevel + 1;i < MIGRATIONS.length; i++) {
-    db.run(MIGRATIONS[i]);
     try {
+      db.run(MIGRATIONS[i]);
       db.query("INSERT INTO _migrations (id) VALUES (?)").run(i);
     } catch (e) {
+      if (isBenignMigrationError(e)) {
+        db.query("INSERT OR IGNORE INTO _migrations (id) VALUES (?)").run(i);
+        continue;
+      }
       if (!(e instanceof Error && e.message.includes("UNIQUE constraint failed"))) {
         throw e;
       }
     }
   }
+  repairSchemaDrift(db);
+}
+function isBenignMigrationError(error) {
+  if (!(error instanceof Error))
+    return false;
+  return error.message.includes("duplicate column name");
+}
+function repairSchemaDrift(db) {
+  ensureColumn(db, "recordings", "goal", "TEXT");
+  ensureColumn(db, "recordings", "role", "TEXT");
+  ensureColumn(db, "recordings", "task_list_id", "TEXT");
+  ensureColumn(db, "recordings", "machine_id", "TEXT");
+  ensureColumn(db, "recordings", "metadata", "TEXT DEFAULT '{}'");
+  ensureColumn(db, "agents", "active_project_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
+}
+function ensureColumn(db, table, column, definition) {
+  const rows = db.query(`PRAGMA table_info(${table})`).all();
+  if (rows.some((row) => row.name === column)) {
+    return;
+  }
+  db.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function closeDatabase() {
   if (_db) {

package/dist/mcp/index.js

@@ -21,7 +21,7 @@ var __require = import.meta.require;
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/recordings",
-    version: "0.1.12",
+    version: "0.1.14",
     type: "module",
     description: "Speech-to-text recording tool with MCP and CLI \u2014 records, transcribes, and optionally enhances text using AI",
     repository: {
@@ -14530,15 +14530,40 @@ function runMigrations(db) {
   const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
   const currentLevel = result?.max_id ?? -1;
   for (let i = currentLevel + 1;i < MIGRATIONS.length; i++) {
-    db.run(MIGRATIONS[i]);
     try {
+      db.run(MIGRATIONS[i]);
       db.query("INSERT INTO _migrations (id) VALUES (?)").run(i);
     } catch (e) {
+      if (isBenignMigrationError(e)) {
+        db.query("INSERT OR IGNORE INTO _migrations (id) VALUES (?)").run(i);
+        continue;
+      }
       if (!(e instanceof Error && e.message.includes("UNIQUE constraint failed"))) {
         throw e;
       }
     }
   }
+  repairSchemaDrift(db);
+}
+function isBenignMigrationError(error) {
+  if (!(error instanceof Error))
+    return false;
+  return error.message.includes("duplicate column name");
+}
+function repairSchemaDrift(db) {
+  ensureColumn(db, "recordings", "goal", "TEXT");
+  ensureColumn(db, "recordings", "role", "TEXT");
+  ensureColumn(db, "recordings", "task_list_id", "TEXT");
+  ensureColumn(db, "recordings", "machine_id", "TEXT");
+  ensureColumn(db, "recordings", "metadata", "TEXT DEFAULT '{}'");
+  ensureColumn(db, "agents", "active_project_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
+}
+function ensureColumn(db, table, column, definition) {
+  const rows = db.query(`PRAGMA table_info(${table})`).all();
+  if (rows.some((row) => row.name === column)) {
+    return;
+  }
+  db.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function getAdapter() {
   if (!_adapter) {
@@ -14958,7 +14983,7 @@ async function processText(rawText, config, systemPrompt) {
 }
 
 // src/version.ts
-var VERSION = "0.1.12";
+var VERSION = "0.1.14";
 
 // src/mcp/index.ts
 var config = loadConfig();

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.12";
+export declare const VERSION = "0.1.14";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/recordings",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "type": "module",
   "description": "Speech-to-text recording tool with MCP and CLI — records, transcribes, and optionally enhances text using AI",
   "repository": {

package/scripts/install_macos_app.sh

@@ -73,4 +73,36 @@ rm -rf "$APP_DEST"
 mkdir -p "$DATA_DIR"
 cp -R "$APP_SOURCE" "$APP_DEST" || warn_or_fail "failed to copy app bundle"
 
+current_cdhash() {
+  codesign -d --verbose=4 "$1" 2>&1 | awk -F= '/^CDHash=/ { print toupper($2); exit }'
+}
+
+tcc_csreq_hex() {
+  local db_path="$1"
+  local service="$2"
+  if [ ! -r "$db_path" ] || ! command -v sqlite3 >/dev/null 2>&1; then
+    return 0
+  fi
+  sqlite3 "$db_path" \
+    "SELECT hex(csreq) FROM access WHERE service = '${service}' AND client = 'com.hasna.recordings' ORDER BY last_modified DESC LIMIT 1;" \
+    2>/dev/null || true
+}
+
+reset_stale_permission() {
+  local service="$1"
+  local tcc_service="$2"
+  local db_path="$3"
+  local cdhash="$4"
+  local csreq_hex
+  csreq_hex="$(tcc_csreq_hex "$db_path" "$tcc_service" | tr '[:lower:]' '[:upper:]')"
+  if [ -n "$cdhash" ] && [ -n "$csreq_hex" ] && [[ "$csreq_hex" != *"$cdhash"* ]]; then
+    tccutil reset "$service" com.hasna.recordings >/dev/null 2>&1 || true
+    echo "Reset stale ${service} permission for the newly installed Recordings.app."
+  fi
+}
+
+APP_CDHASH="$(current_cdhash "$APP_DEST" || true)"
+reset_stale_permission "Microphone" "kTCCServiceMicrophone" "${HOME}/Library/Application Support/com.apple.TCC/TCC.db" "$APP_CDHASH"
+reset_stale_permission "Accessibility" "kTCCServiceAccessibility" "/Library/Application Support/com.apple.TCC/TCC.db" "$APP_CDHASH"
+
 echo "Installed Recordings.app from package: ${APP_DEST}"

package/src/native/Recordings/Package.resolved

@@ -1,13 +1,13 @@
 {
-  "originHash" : "99390ba8c7a8c4d4b60ff9bc6f60500c0cc28740d0a509ae347d8785b97022b5",
+  "originHash" : "a63dc0aa4ab0839e19cd7644cfd2bb42729aafbf9ef920adeb5c3ac856b7701e",
   "pins" : [
     {
       "identity" : "keyboardshortcuts",
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/sindresorhus/KeyboardShortcuts",
       "state" : {
-        "revision" : "1aef85578fdd4f9eaeeb8d53b7b4fc31bf08fe27",
-        "version" : "2.4.0"
+        "revision" : "de5b143889b9aa90a997b18e311527095dfb28e0",
+        "version" : "1.12.0"
       }
     },
     {

package/src/native/Recordings/Package.swift

@@ -8,7 +8,7 @@ let package = Package(
         .macOS(.v26)
     ],
     dependencies: [
-        .package(url: "https://github.com/sindresorhus/KeyboardShortcuts", from: "2.0.0"),
+        .package(url: "https://github.com/sindresorhus/KeyboardShortcuts", exact: "1.12.0"),
         .package(url: "https://github.com/apple/swift-testing.git", .upToNextMinor(from: "0.99.0")),
     ],
     targets: [

package/src/native/Recordings/RecordingsLib/MenuBarPopover.swift

@@ -1,5 +1,5 @@
 import SwiftUI
-import KeyboardShortcuts
+@preconcurrency import KeyboardShortcuts
 
 public struct MenuBarPopover: View {
     @ObservedObject public var engine: RecordingEngine

package/src/native/Recordings/RecordingsLib/NativeAppDiagnostics.swift

@@ -0,0 +1,36 @@
+import Foundation
+
+enum NativeAppLog {
+    private static let lock = NSLock()
+
+    static func write(_ message: String, homePath: String = FileManager.default.homeDirectoryForCurrentUser.path) {
+        lock.lock()
+        defer { lock.unlock() }
+
+        let dir = "\(homePath)/.hasna/recordings"
+        let path = "\(dir)/Recordings.log"
+        let line = "[\(Self.timestamp())] \(message)\n"
+
+        do {
+            try FileManager.default.createDirectory(atPath: dir, withIntermediateDirectories: true)
+            if FileManager.default.fileExists(atPath: path),
+               let handle = FileHandle(forWritingAtPath: path) {
+                defer { try? handle.close() }
+                try handle.seekToEnd()
+                if let data = line.data(using: .utf8) {
+                    try handle.write(contentsOf: data)
+                }
+            } else {
+                try line.write(toFile: path, atomically: true, encoding: .utf8)
+            }
+        } catch {
+            fputs("[Recordings] log write failed: \(error.localizedDescription)\n", stderr)
+        }
+    }
+
+    private static func timestamp() -> String {
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        return formatter.string(from: Date())
+    }
+}

package/src/native/Recordings/RecordingsLib/RealtimeTranscriptionClient.swift

@@ -121,6 +121,9 @@ public final class RealtimeTranscriptionClient: ObservableObject, @unchecked Sen
     public func finish(timeoutMilliseconds: UInt64 = 1_800) async -> String {
         guard isStreaming else { return accumulatedText }
         let initialCompletedCount = completedEventCount
+        if initialCompletedCount > 0 {
+            return stop()
+        }
         await commitInput()
 
         let deadline = Date().addingTimeInterval(TimeInterval(timeoutMilliseconds) / 1_000)

package/src/native/Recordings/RecordingsLib/RecordingEngine.swift

@@ -1,12 +1,12 @@
 import AVFoundation
 @preconcurrency import ApplicationServices
 import SwiftUI
-import KeyboardShortcuts
+@preconcurrency import KeyboardShortcuts
 
 // MARK: - Custom shortcut (not fn — fn is handled by FnKeyMonitor)
 
 extension KeyboardShortcuts.Name {
-    static let toggleRecording = Self("toggleRecording", default: .init(.f5))
+    @MainActor static let toggleRecording = Self("toggleRecording", default: .init(.f5))
 }
 
 // MARK: - Recording Mode
@@ -127,6 +127,7 @@ public final class RecordingEngine: ObservableObject {
     private var streamingText = ""
     private var recordedPCM = Data()
     private var activeAudioPath: String?
+    private var lastAccessibilityPromptAt: Date?
 
     // fn key monitor (CGEventTap-based, swallows fn to prevent emoji picker)
     private let fnMonitor = FnKeyMonitor()
@@ -142,6 +143,7 @@ public final class RecordingEngine: ObservableObject {
 
     public init() {
         try? FileManager.default.createDirectory(atPath: audioDir, withIntermediateDirectories: true)
+        log("RecordingEngine init; microphone=\(microphonePermissionLabel); accessibility=\(accessibilityPermissionLabel)")
 
         // Load preferences
         if let savedMode = UserDefaults.standard.string(forKey: "recordingMode"),
@@ -188,9 +190,66 @@ public final class RecordingEngine: ObservableObject {
         updateStatus()
     }
 
+    public var microphonePermissionLabel: String {
+        switch AVCaptureDevice.authorizationStatus(for: .audio) {
+        case .authorized:
+            return "Microphone allowed"
+        case .notDetermined:
+            return "Microphone not requested"
+        case .denied:
+            return "Microphone denied"
+        case .restricted:
+            return "Microphone restricted"
+        @unknown default:
+            return "Microphone unknown"
+        }
+    }
+
+    public var accessibilityPermissionLabel: String {
+        AXIsProcessTrusted() ? "Accessibility allowed" : "Accessibility needed"
+    }
+
+    public func requestMicrophonePermission() {
+        log("requestMicrophonePermission status=\(AVCaptureDevice.authorizationStatus(for: .audio).rawValue)")
+        AVCaptureDevice.requestAccess(for: .audio) { [weak self] granted in
+            Task { @MainActor [weak self] in
+                guard let self else { return }
+                self.log("requestMicrophonePermission result granted=\(granted)")
+                self.statusMessage = granted
+                    ? "Microphone allowed"
+                    : "Enable Microphone permission for Recordings in System Settings"
+                self.objectWillChange.send()
+            }
+        }
+    }
+
+    public func requestAccessibilityPermission() {
+        let trusted = ensureAccessibilityPermission(prompt: true)
+        log("requestAccessibilityPermission trusted=\(trusted)")
+        statusMessage = trusted
+            ? "Accessibility allowed"
+            : "Enable Accessibility permission for Recordings to paste"
+        objectWillChange.send()
+    }
+
+    public func openMicrophoneSettings() {
+        openPrivacySettings("Privacy_Microphone")
+    }
+
+    public func openAccessibilitySettings() {
+        openPrivacySettings("Privacy_Accessibility")
+    }
+
+    private func openPrivacySettings(_ pane: String) {
+        if let url = URL(string: "x-apple.systempreferences:com.apple.preference.security?\(pane)") {
+            NSWorkspace.shared.open(url)
+        }
+    }
+
     private func updateFnMonitor() {
         if useFnKey {
             let ok = fnMonitor.start()
+            log("fn monitor start ok=\(ok)")
             if !ok {
                 statusMessage = "fn needs Input Monitoring / Accessibility permission, and Globe must be set to Do Nothing"
             }
@@ -214,6 +273,7 @@ public final class RecordingEngine: ObservableObject {
 
     public func startRecording(trigger: RecordingTrigger = .manual) {
         guard !isRecording else { return }
+        log("startRecording trigger=\(trigger) microphoneStatus=\(AVCaptureDevice.authorizationStatus(for: .audio).rawValue) accessibility=\(AXIsProcessTrusted())")
         activeTrigger = trigger
         keyboardShortcutIsDown = trigger == .keyboardShortcut
 
@@ -237,9 +297,11 @@ public final class RecordingEngine: ObservableObject {
             startNativeRecording()
         case .notDetermined:
             statusMessage = "Allow microphone access to record"
+            log("requesting microphone access before recording")
             AVCaptureDevice.requestAccess(for: .audio) { [weak self] granted in
                 Task { @MainActor [weak self] in
                     guard let self else { return }
+                    self.log("microphone access response granted=\(granted)")
                     if granted {
                         self.startNativeRecording()
                     } else {
@@ -250,6 +312,7 @@ public final class RecordingEngine: ObservableObject {
             }
         case .denied, .restricted:
             resetRecordingIntent()
+            log("microphone permission blocked status=\(AVCaptureDevice.authorizationStatus(for: .audio).rawValue)")
             statusMessage = "Enable Microphone permission for Recordings in System Settings"
         @unknown default:
             resetRecordingIntent()
@@ -262,12 +325,18 @@ public final class RecordingEngine: ObservableObject {
         pcmStreamState = streamState
 
         let apiKey = openAIAPIKey
+        log("startNativeRecording apiKeyConfigured=\(!apiKey.isEmpty)")
         if !apiKey.isEmpty {
             startRealtimeStreaming(apiKey: apiKey)
         }
 
         let client = realtimeClient
+        let homePath = home
+        let firstChunkLogged = LockedFlag()
         let recorder = NativePCMRecorder { [weak client] data in
+            if firstChunkLogged.take() {
+                NativeAppLog.write("native recorder received first PCM chunk bytes=\(data.count)", homePath: homePath)
+            }
             Task {
                 let chunks = await streamState.append(data, chunkSize: 4_800)
                 for chunk in chunks {
@@ -278,6 +347,7 @@ public final class RecordingEngine: ObservableObject {
 
         do {
             try recorder.start()
+            log("native recorder started")
             nativeRecorder = recorder
             isRecording = true
             recordingDuration = 0
@@ -298,6 +368,7 @@ public final class RecordingEngine: ObservableObject {
                 }
             }
         } catch {
+            log("native recorder failed error=\(error.localizedDescription)")
             realtimeClient?.stop()
             realtimeClient = nil
             streamingTask?.cancel()
@@ -314,9 +385,11 @@ public final class RecordingEngine: ObservableObject {
         let systemPrompt = projectStore?.effectiveSystemPrompt ?? ""
         let client = RealtimeTranscriptionClient(apiKey: apiKey, homePath: home)
         realtimeClient = client
+        log("realtime streaming task starting")
 
         streamingTask = Task {
             await client.startStreaming(systemPrompt: systemPrompt)
+            self.log("realtime start completed streaming=\(client.isStreaming) error=\(client.error ?? "")")
 
             // Receive deltas
             while client.isStreaming {
@@ -332,6 +405,7 @@ public final class RecordingEngine: ObservableObject {
 
             if let message = client.error, !message.isEmpty {
                 await MainActor.run {
+                    self.log("realtime unavailable message=\(message)")
                     self.statusMessage = "Realtime unavailable — will transcribe after recording"
                 }
             }
@@ -342,6 +416,7 @@ public final class RecordingEngine: ObservableObject {
 
     public func stopAndTranscribe() {
         guard isRecording else { return }
+        log("stopAndTranscribe")
 
         recordingTimer?.invalidate()
         recordingTimer = nil
@@ -370,6 +445,7 @@ public final class RecordingEngine: ObservableObject {
                 }
                 self.recordedPCM = await pcmStreamState.capturedPCM()
             }
+            self.log("captured pcm bytes=\(self.recordedPCM.count)")
 
             let streamingResult = await client?.finish() ?? ""
 
@@ -382,6 +458,7 @@ public final class RecordingEngine: ObservableObject {
             self.liveTranscriptionText = ""
 
             if let text {
+                self.log("finish using realtime text chars=\(text.count)")
                 self.isTranscribing = false
                 self.finishWithText(
                     text,
@@ -391,6 +468,7 @@ public final class RecordingEngine: ObservableObject {
                     activeProjectName: activeProjectName
                 )
             } else if let audioPath, self.writeCapturedWAV(to: audioPath) {
+                self.log("falling back to CLI transcription audioPath=\(audioPath)")
                 self.fallbackTranscribe(
                     audioPath: audioPath,
                     curMode: curMode,
@@ -399,6 +477,7 @@ public final class RecordingEngine: ObservableObject {
                     activeProjectName: activeProjectName
                 )
             } else {
+                self.log("no audio captured")
                 self.finish("No audio captured")
             }
 
@@ -408,6 +487,7 @@ public final class RecordingEngine: ObservableObject {
     }
 
     private func finishWithText(_ text: String, curMode: RecordingMode, targetAppBundleIdentifier: String?, activeProjectId: String?, activeProjectName: String?) {
+        log("finishWithText mode=\(curMode.rawValue) chars=\(text.count)")
         if curMode == .command {
             runCommandMode(instruction: text)
             return
@@ -439,8 +519,10 @@ public final class RecordingEngine: ObservableObject {
                 bitsPerSample: 16,
                 to: URL(fileURLWithPath: path)
             )
+            log("wrote wav path=\(path) pcmBytes=\(recordedPCM.count)")
             return true
         } catch {
+            log("failed to save wav error=\(error.localizedDescription)")
             statusMessage = "Failed to save audio"
             return false
         }
@@ -504,17 +586,24 @@ public final class RecordingEngine: ObservableObject {
         Task.detached {
             let output = CLIRunner.run(["--json", "transcribe", audioPath, "--no-enhance"], home: homePath)
             if let error = CLIRunner.parseError(output) {
-                await MainActor.run { self.finish(error) }
+                await MainActor.run {
+                    self.log("fallback transcription failed error=\(error)")
+                    self.finish(error)
+                }
                 return
             }
 
             let text = CLIRunner.parseJSON(output)
             guard let text, !text.isEmpty else {
-                await MainActor.run { self.finish("Empty transcription") }
+                await MainActor.run {
+                    self.log("fallback transcription empty output=\(output.prefix(160))")
+                    self.finish("Empty transcription")
+                }
                 return
             }
 
             await MainActor.run {
+                self.log("fallback transcription succeeded chars=\(text.count)")
                 self.isTranscribing = false
                 self.finishWithText(
                     text,
@@ -534,6 +623,7 @@ public final class RecordingEngine: ObservableObject {
     }
 
     private func finish(_ msg: String) {
+        log("finish status=\(msg)")
         isTranscribing = false
         liveTranscriptionText = ""
         statusMessage = msg
@@ -549,7 +639,8 @@ public final class RecordingEngine: ObservableObject {
     // MARK: - Command Mode
 
     private func runCommandMode(instruction: String) {
-        guard ensureAccessibilityPermission(prompt: true) else {
+        guard ensureAccessibilityPermission(prompt: shouldPromptAccessibility()) else {
+            log("command mode blocked by accessibility permission")
             statusMessage = "Enable Accessibility permission for Recordings to rewrite selected text"
             return
         }
@@ -609,12 +700,17 @@ public final class RecordingEngine: ObservableObject {
     // MARK: - Paste
 
     func pasteIntoFrontApp(_ text: String, targetAppBundleIdentifier: String? = nil) {
+        log("paste requested chars=\(text.count) target=\(targetAppBundleIdentifier ?? "nil") accessibility=\(AXIsProcessTrusted())")
         let pb = NSPasteboard.general
         pb.clearContents()
         pb.setString(text, forType: .string)
 
-        guard ensureAccessibilityPermission(prompt: true) else {
-            self.statusMessage = "Copied — enable Accessibility permission for Recordings to paste"
+        let prompted = shouldPromptAccessibility()
+        guard ensureAccessibilityPermission(prompt: prompted) else {
+            log("paste blocked by accessibility permission; copied to clipboard")
+            self.statusMessage = prompted
+                ? "Copied — approve Accessibility for this Recordings app"
+                : "Copied — waiting for Accessibility approval"
             return
         }
 
@@ -629,6 +725,7 @@ public final class RecordingEngine: ObservableObject {
         })
 
         guard let app = targetApp else {
+            log("paste target app not found")
             self.statusMessage = "No target app found"
             return
         }
@@ -645,18 +742,49 @@ public final class RecordingEngine: ObservableObject {
                 down.post(tap: .cgSessionEventTap)
                 up.post(tap: .cgSessionEventTap)
             }
+            self.log("paste event posted")
             self.statusMessage = "Pasted (\(text.count) chars)"
         }
     }
 
     private func ensureAccessibilityPermission(prompt: Bool) -> Bool {
+        if AXIsProcessTrusted() {
+            return true
+        }
         if !prompt {
-            return AXIsProcessTrusted()
+            return false
         }
         return AXIsProcessTrustedWithOptions(
             ["AXTrustedCheckOptionPrompt" as CFString: true] as CFDictionary
         )
     }
+
+    private func shouldPromptAccessibility() -> Bool {
+        let now = Date()
+        if let lastAccessibilityPromptAt,
+           now.timeIntervalSince(lastAccessibilityPromptAt) < 20 {
+            return false
+        }
+        lastAccessibilityPromptAt = now
+        return true
+    }
+
+    private func log(_ message: String) {
+        NativeAppLog.write(message, homePath: home)
+    }
+}
+
+private final class LockedFlag: @unchecked Sendable {
+    private let lock = NSLock()
+    private var value = true
+
+    func take() -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        guard value else { return false }
+        value = false
+        return true
+    }
 }
 
 // MARK: - CLI Runner

package/src/native/Recordings/RecordingsLib/SettingsView.swift

@@ -1,5 +1,5 @@
 import SwiftUI
-import KeyboardShortcuts
+@preconcurrency import KeyboardShortcuts
 
 public struct SettingsView: View {
     @ObservedObject public var engine: RecordingEngine
@@ -45,6 +45,32 @@ public struct SettingsView: View {
                     .foregroundStyle(.secondary)
             }
 
+            Section("Permissions") {
+                HStack {
+                    Text("Microphone")
+                    Spacer()
+                    Text(engine.microphonePermissionLabel)
+                        .foregroundStyle(.secondary)
+                }
+                Button("Request Microphone") {
+                    engine.requestMicrophonePermission()
+                }
+                HStack {
+                    Text("Accessibility")
+                    Spacer()
+                    Text(engine.accessibilityPermissionLabel)
+                        .foregroundStyle(.secondary)
+                }
+                HStack {
+                    Button("Request Accessibility") {
+                        engine.requestAccessibilityPermission()
+                    }
+                    Button("Open Accessibility Settings") {
+                        engine.openAccessibilitySettings()
+                    }
+                }
+            }
+
             Section("System Prompt") {
                 TextEditor(text: $projectStore.settings.globalSystemPrompt)
                     .frame(height: 80)

package/src/native/Recordings/RecordingsTests/NativeAppDiagnosticsTests.swift

@@ -0,0 +1,23 @@
+import Foundation
+import Testing
+@testable import RecordingsLib
+
+struct NativeAppDiagnosticsTests {
+    @Test("Native app log writes to recordings log file")
+    func logWritesFile() throws {
+        let home = try makeHome()
+
+        NativeAppLog.write("diagnostic-test", homePath: home)
+
+        let path = "\(home)/.hasna/recordings/Recordings.log"
+        let text = try String(contentsOfFile: path, encoding: .utf8)
+        #expect(text.contains("diagnostic-test"))
+    }
+
+    private func makeHome() throws -> String {
+        let url = FileManager.default.temporaryDirectory
+            .appendingPathComponent("recordings-diagnostics-tests-\(UUID().uuidString)")
+        try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
+        return url.path
+    }
+}