@hasna/recordings 0.1.13 → 0.1.14

package/dist/cli/index.js

@@ -7,7 +7,7 @@ var __require = import.meta.require;
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/recordings",
-    version: "0.1.13",
+    version: "0.1.14",
     type: "module",
     description: "Speech-to-text recording tool with MCP and CLI \u2014 records, transcribes, and optionally enhances text using AI",
     repository: {
@@ -10466,7 +10466,7 @@ async function processText(rawText, config, systemPrompt) {
 }
 
 // src/version.ts
-var VERSION = "0.1.13";
+var VERSION = "0.1.14";
 
 // src/cli/index.ts
 var program = new Command;
@@ -10792,6 +10792,7 @@ appCommand.command("status").description("Show installed Recordings.app status")
   console.log(`Native sources: ${status.native_sources_available ? "available" : "missing"}`);
   console.log(`Installed app: ${status.installed ? status.installed_app_path : "missing"}`);
   console.log(`Executable: ${status.executable ? "available" : "missing"}`);
+  console.log(`Code hash: ${status.app_code_hash ?? "unavailable"}`);
   if (process.platform === "darwin") {
     console.log(`Microphone: ${status.microphone_permission}`);
     console.log(`Accessibility: ${status.accessibility_permission}`);
@@ -10805,6 +10806,8 @@ appCommand.command("permissions").description("Show macOS permission state for R
     bundle_id: "com.hasna.recordings",
     microphone: status.microphone_permission,
     accessibility: status.accessibility_permission,
+    app_code_hash: status.app_code_hash,
+    ad_hoc_signed: status.ad_hoc_signed,
     log_path: status.log_path
   };
   if (program.opts().json) {
@@ -11316,6 +11319,8 @@ function getMacOSAppStatus() {
   const logPath = pathJoin(home, ".hasna", "recordings", "Recordings.log");
   const installerPath = pathJoin(packageRoot, "scripts", "install_macos_app.sh");
   const nativeSourcesPath = pathJoin(packageRoot, "src", "native", "Recordings");
+  const signingInfo = getCodeSigningInfo(installedAppPath);
+  const permissionCodeHash = signingInfo.adHoc ? signingInfo.cdHash : null;
   return {
     platform: process.platform,
     package_root: packageRoot,
@@ -11327,19 +11332,35 @@ function getMacOSAppStatus() {
     installed: existsSync6(installedAppPath),
     executable_path: executablePath,
     executable: existsSync6(executablePath),
-    microphone_permission: getTccPermission("kTCCServiceMicrophone", home),
-    accessibility_permission: getTccPermission("kTCCServiceAccessibility", home),
+    app_code_hash: signingInfo.cdHash,
+    ad_hoc_signed: signingInfo.adHoc,
+    microphone_permission: getTccPermission("kTCCServiceMicrophone", home, permissionCodeHash),
+    accessibility_permission: getTccPermission("kTCCServiceAccessibility", home, permissionCodeHash),
     log_path: logPath
   };
 }
-function getTccPermission(service, home) {
+function getCodeSigningInfo(appPath) {
+  if (process.platform !== "darwin" || !existsSync6(appPath)) {
+    return { cdHash: null, adHoc: false };
+  }
+  const result = spawnSync("codesign", ["-d", "--verbose=4", appPath], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const output = `${result.stdout}
+${result.stderr}`;
+  const cdHash = output.match(/^CDHash=([a-fA-F0-9]+)/m)?.[1]?.toLowerCase() ?? null;
+  const adHoc = /Signature=adhoc/.test(output);
+  return { cdHash, adHoc };
+}
+function getTccPermission(service, home, currentCodeHash) {
   if (process.platform !== "darwin")
     return "unsupported";
   const dbPaths = [
     pathJoin(home, "Library", "Application Support", "com.apple.TCC", "TCC.db"),
     pathJoin("/", "Library", "Application Support", "com.apple.TCC", "TCC.db")
   ];
-  const sql = "select auth_value from access where service = '" + service.replace(/'/g, "''") + "' and client = 'com.hasna.recordings' order by last_modified desc limit 1;";
+  const sql = "select auth_value || '|' || ifnull(hex(csreq), '') from access where service = '" + service.replace(/'/g, "''") + "' and client = 'com.hasna.recordings' order by last_modified desc limit 1;";
   for (const dbPath of dbPaths) {
     if (!existsSync6(dbPath))
       continue;
@@ -11348,8 +11369,14 @@ function getTccPermission(service, home) {
       stdio: ["ignore", "pipe", "ignore"]
     });
     const value = result.stdout.trim();
-    if (value)
-      return tccAuthValueLabel(value);
+    if (!value)
+      continue;
+    const [authValue, csreqHex = ""] = value.split("|");
+    const label = tccAuthValueLabel(authValue ?? "");
+    if (label === "allowed" && currentCodeHash && csreqHex && !csreqHex.toLowerCase().includes(currentCodeHash.toLowerCase())) {
+      return "stale_allowed_for_previous_app_build";
+    }
+    return label;
   }
   return "not_determined";
 }

package/dist/mcp/index.js

@@ -21,7 +21,7 @@ var __require = import.meta.require;
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/recordings",
-    version: "0.1.13",
+    version: "0.1.14",
     type: "module",
     description: "Speech-to-text recording tool with MCP and CLI \u2014 records, transcribes, and optionally enhances text using AI",
     repository: {
@@ -14983,7 +14983,7 @@ async function processText(rawText, config, systemPrompt) {
 }
 
 // src/version.ts
-var VERSION = "0.1.13";
+var VERSION = "0.1.14";
 
 // src/mcp/index.ts
 var config = loadConfig();

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.13";
+export declare const VERSION = "0.1.14";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/recordings",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "type": "module",
   "description": "Speech-to-text recording tool with MCP and CLI — records, transcribes, and optionally enhances text using AI",
   "repository": {

package/scripts/install_macos_app.sh

@@ -73,4 +73,36 @@ rm -rf "$APP_DEST"
 mkdir -p "$DATA_DIR"
 cp -R "$APP_SOURCE" "$APP_DEST" || warn_or_fail "failed to copy app bundle"
 
+current_cdhash() {
+  codesign -d --verbose=4 "$1" 2>&1 | awk -F= '/^CDHash=/ { print toupper($2); exit }'
+}
+
+tcc_csreq_hex() {
+  local db_path="$1"
+  local service="$2"
+  if [ ! -r "$db_path" ] || ! command -v sqlite3 >/dev/null 2>&1; then
+    return 0
+  fi
+  sqlite3 "$db_path" \
+    "SELECT hex(csreq) FROM access WHERE service = '${service}' AND client = 'com.hasna.recordings' ORDER BY last_modified DESC LIMIT 1;" \
+    2>/dev/null || true
+}
+
+reset_stale_permission() {
+  local service="$1"
+  local tcc_service="$2"
+  local db_path="$3"
+  local cdhash="$4"
+  local csreq_hex
+  csreq_hex="$(tcc_csreq_hex "$db_path" "$tcc_service" | tr '[:lower:]' '[:upper:]')"
+  if [ -n "$cdhash" ] && [ -n "$csreq_hex" ] && [[ "$csreq_hex" != *"$cdhash"* ]]; then
+    tccutil reset "$service" com.hasna.recordings >/dev/null 2>&1 || true
+    echo "Reset stale ${service} permission for the newly installed Recordings.app."
+  fi
+}
+
+APP_CDHASH="$(current_cdhash "$APP_DEST" || true)"
+reset_stale_permission "Microphone" "kTCCServiceMicrophone" "${HOME}/Library/Application Support/com.apple.TCC/TCC.db" "$APP_CDHASH"
+reset_stale_permission "Accessibility" "kTCCServiceAccessibility" "/Library/Application Support/com.apple.TCC/TCC.db" "$APP_CDHASH"
+
 echo "Installed Recordings.app from package: ${APP_DEST}"

package/src/native/Recordings/RecordingsLib/MenuBarPopover.swift

@@ -1,5 +1,5 @@
 import SwiftUI
-import KeyboardShortcuts
+@preconcurrency import KeyboardShortcuts
 
 public struct MenuBarPopover: View {
     @ObservedObject public var engine: RecordingEngine

package/src/native/Recordings/RecordingsLib/RealtimeTranscriptionClient.swift

@@ -121,6 +121,9 @@ public final class RealtimeTranscriptionClient: ObservableObject, @unchecked Sen
     public func finish(timeoutMilliseconds: UInt64 = 1_800) async -> String {
         guard isStreaming else { return accumulatedText }
         let initialCompletedCount = completedEventCount
+        if initialCompletedCount > 0 {
+            return stop()
+        }
         await commitInput()
 
         let deadline = Date().addingTimeInterval(TimeInterval(timeoutMilliseconds) / 1_000)

package/src/native/Recordings/RecordingsLib/RecordingEngine.swift

@@ -127,6 +127,7 @@ public final class RecordingEngine: ObservableObject {
     private var streamingText = ""
     private var recordedPCM = Data()
     private var activeAudioPath: String?
+    private var lastAccessibilityPromptAt: Date?
 
     // fn key monitor (CGEventTap-based, swallows fn to prevent emoji picker)
     private let fnMonitor = FnKeyMonitor()
@@ -638,7 +639,7 @@ public final class RecordingEngine: ObservableObject {
     // MARK: - Command Mode
 
     private func runCommandMode(instruction: String) {
-        guard ensureAccessibilityPermission(prompt: true) else {
+        guard ensureAccessibilityPermission(prompt: shouldPromptAccessibility()) else {
             log("command mode blocked by accessibility permission")
             statusMessage = "Enable Accessibility permission for Recordings to rewrite selected text"
             return
@@ -704,9 +705,12 @@ public final class RecordingEngine: ObservableObject {
         pb.clearContents()
         pb.setString(text, forType: .string)
 
-        guard ensureAccessibilityPermission(prompt: true) else {
+        let prompted = shouldPromptAccessibility()
+        guard ensureAccessibilityPermission(prompt: prompted) else {
             log("paste blocked by accessibility permission; copied to clipboard")
-            self.statusMessage = "Copied — enable Accessibility permission for Recordings to paste"
+            self.statusMessage = prompted
+                ? "Copied — approve Accessibility for this Recordings app"
+                : "Copied — waiting for Accessibility approval"
             return
         }
 
@@ -744,14 +748,27 @@ public final class RecordingEngine: ObservableObject {
     }
 
     private func ensureAccessibilityPermission(prompt: Bool) -> Bool {
+        if AXIsProcessTrusted() {
+            return true
+        }
         if !prompt {
-            return AXIsProcessTrusted()
+            return false
         }
         return AXIsProcessTrustedWithOptions(
             ["AXTrustedCheckOptionPrompt" as CFString: true] as CFDictionary
         )
     }
 
+    private func shouldPromptAccessibility() -> Bool {
+        let now = Date()
+        if let lastAccessibilityPromptAt,
+           now.timeIntervalSince(lastAccessibilityPromptAt) < 20 {
+            return false
+        }
+        lastAccessibilityPromptAt = now
+        return true
+    }
+
     private func log(_ message: String) {
         NativeAppLog.write(message, homePath: home)
     }

package/src/native/Recordings/RecordingsLib/SettingsView.swift

@@ -1,5 +1,5 @@
 import SwiftUI
-import KeyboardShortcuts
+@preconcurrency import KeyboardShortcuts
 
 public struct SettingsView: View {
     @ObservedObject public var engine: RecordingEngine
@@ -45,6 +45,32 @@ public struct SettingsView: View {
                     .foregroundStyle(.secondary)
             }
 
+            Section("Permissions") {
+                HStack {
+                    Text("Microphone")
+                    Spacer()
+                    Text(engine.microphonePermissionLabel)
+                        .foregroundStyle(.secondary)
+                }
+                Button("Request Microphone") {
+                    engine.requestMicrophonePermission()
+                }
+                HStack {
+                    Text("Accessibility")
+                    Spacer()
+                    Text(engine.accessibilityPermissionLabel)
+                        .foregroundStyle(.secondary)
+                }
+                HStack {
+                    Button("Request Accessibility") {
+                        engine.requestAccessibilityPermission()
+                    }
+                    Button("Open Accessibility Settings") {
+                        engine.openAccessibilitySettings()
+                    }
+                }
+            }
+
             Section("System Prompt") {
                 TextEditor(text: $projectStore.settings.globalSystemPrompt)
                     .frame(height: 80)