@hasna/recordings 0.3.1 → 0.3.2

package/scripts/macos_artifact.ts

@@ -151,6 +151,7 @@ function localOnlyApprovedTargetsMessage(policyPath?: string): string {
 }
 
 export type ArtifactPolicy = "release" | "local_only";
+export type ArtifactVariant = "full" | "bar";
 export type TargetIdentityKind =
   | typeof LEGACY_LOCAL_TARGET_IDENTITY_KIND
   | "tailscale_node_id_sha256";
@@ -159,6 +160,7 @@ type OperatorTargetIdentityKind = TargetIdentityKind | "none";
 export type BuildProvenance = {
   schema_version: 3 | 4;
   artifact_policy?: "local_only";
+  variant?: ArtifactVariant;
   approved_target?: string;
   approved_target_identity_kind?: TargetIdentityKind;
   approved_target_identity_sha256?: string;
@@ -181,6 +183,9 @@ export type BuildProvenance = {
 
 export type MacOSArtifactManifest = BuildProvenance & {
   artifact_type: "recordings-macos-app";
+  /// The top-level bundle directory name inside the artifact (Recordings.app for the
+  /// full app, HasnaRecordings.app for the bar variant per the fleet naming rule).
+  bundle_name: string;
   app_sha256: string;
   binding: {
     bundle_tree_sha256: string;
@@ -210,7 +215,7 @@ export type MacOSArtifactManifest = BuildProvenance & {
   };
   container: {
     type: "zip";
-    install_locations: ["/Applications/Recordings.app"] | ["~/Applications/Recordings.app"];
+    install_locations: [string];
   };
   nested_code_policy: {
     allowlist_sha256: string;
@@ -825,6 +830,22 @@ function manifestPolicy(manifest: MacOSArtifactManifest): ArtifactPolicy {
   return manifest.schema_version === LOCAL_ARTIFACT_SCHEMA_VERSION ? "local_only" : "release";
 }
 
+/**
+ * The variant an artifact was built as. Older manifests predate the field; they are
+ * full artifacts by definition ("full" was the only variant that existed).
+ */
+function manifestVariant(manifest: MacOSArtifactManifest): ArtifactVariant {
+  const value = manifest.variant ?? "full";
+  if (value !== "full" && value !== "bar") {
+    throw new Error(`manifest variant is unsupported: ${value}`);
+  }
+  return value;
+}
+
+function manifestBundleName(manifest: MacOSArtifactManifest): string {
+  return manifest.bundle_name ?? "Recordings.app";
+}
+
 function manifestTargetIdentityKind(manifest: MacOSArtifactManifest): OperatorTargetIdentityKind {
   if (manifestPolicy(manifest) === "release") return "none";
   return manifest.approved_target_identity_kind ?? LEGACY_LOCAL_TARGET_IDENTITY_KIND;
@@ -1405,6 +1426,7 @@ export function withPrivatelyExtractedArchiveApp<T>(
   operation: (appPath: string) => T,
   platformArchiveTool = "/usr/bin/ditto",
   expectedArchiveSha256?: string,
+  expectedBundleName = "Recordings.app",
 ): T {
   const privateRoot = mkdtempSync(join(tmpdir(), "recordings-artifact-extract-"));
   chmodSync(privateRoot, 0o700);
@@ -1449,13 +1471,17 @@ export function withPrivatelyExtractedArchiveApp<T>(
     inspectZipArchive(pinnedArchivePath);
     run(platformArchiveTool, ["-x", "-k", pinnedArchivePath, extractionRoot]);
     const rootEntries = readdirSync(extractionRoot);
-    if (rootEntries.length !== 1 || rootEntries[0] !== "Recordings.app") {
-      throw new Error("release archive must contain exactly one top-level Recordings.app");
+    if (rootEntries.length !== 1 || rootEntries[0] !== expectedBundleName) {
+      throw new Error(
+        `release archive must contain exactly one top-level ${expectedBundleName}`,
+      );
     }
-    const extractedAppPath = join(extractionRoot, "Recordings.app");
+    const extractedAppPath = join(extractionRoot, expectedBundleName);
     const appDetails = lstatSync(extractedAppPath);
     if (appDetails.isSymbolicLink() || !appDetails.isDirectory()) {
-      throw new Error("release archive top-level Recordings.app must be a regular directory");
+      throw new Error(
+        `release archive top-level ${expectedBundleName} must be a regular directory`,
+      );
     }
     assertRegularArchiveTree(extractedAppPath);
     return operation(extractedAppPath);
@@ -1478,6 +1504,7 @@ export function extractVerifiedArchiveToStaging(
   expectedApprovedTarget: string,
   expectedApprovedTargetIdentitySha256: string,
   expectedApprovedTargetIdentityKind: OperatorTargetIdentityKind,
+  expectedVariant: ArtifactVariant = "full",
   platformArchiveTool = "/usr/bin/ditto",
 ): void {
   if (resolve(stagingTarget) !== stagingTarget) {
@@ -1510,16 +1537,19 @@ export function extractVerifiedArchiveToStaging(
   withPrivatelyExtractedArchiveApp(
     archivePath,
     (appPath) => {
-      const targetAppPath = join(stagingTarget, "Recordings.app");
+      const targetAppPath = join(stagingTarget, manifestBundleName(manifest));
       renameSync(appPath, targetAppPath);
       assertRegularArchiveTree(targetAppPath);
       const entries = readdirSync(stagingTarget);
-      if (entries.length !== 1 || entries[0] !== "Recordings.app") {
-        throw new Error("archive extraction did not produce exactly Recordings.app in staging");
+      if (entries.length !== 1 || entries[0] !== manifestBundleName(manifest)) {
+        throw new Error(
+          `archive extraction did not produce exactly ${manifestBundleName(manifest)} in staging`,
+        );
       }
     },
     platformArchiveTool,
     manifest.archive.sha256,
+    manifestBundleName(manifest),
   );
 }
 
@@ -1547,6 +1577,20 @@ export function assertManifestShape(manifest: MacOSArtifactManifest): void {
   }
   if (manifest.artifact_type !== "recordings-macos-app") throw new Error("unexpected artifact type");
   if (manifest.bundle_id !== BUNDLE_ID) throw new Error("unexpected bundle identifier");
+  if (
+    manifest.bundle_name !== undefined &&
+    (typeof manifest.bundle_name !== "string" ||
+      !/^[A-Za-z0-9][A-Za-z0-9 .-]*\.app$/.test(manifest.bundle_name))
+  ) {
+    throw new Error("manifest bundle name must be a *.app bundle directory name");
+  }
+  if (
+    manifest.variant !== undefined &&
+    manifest.variant !== "full" &&
+    manifest.variant !== "bar"
+  ) {
+    throw new Error(`manifest variant is unsupported: ${manifest.variant}`);
+  }
   const artifactPolicy = manifestPolicy(manifest);
   for (const [label, value] of [
     ["bundle version", manifest.bundle_version],
@@ -1755,6 +1799,7 @@ export function verifyArchiveManifest(
   expectedApprovedTarget: string = RELEASE_APPROVED_TARGET,
   expectedApprovedTargetIdentitySha256: string = "none",
   expectedApprovedTargetIdentityKind: OperatorTargetIdentityKind = LEGACY_LOCAL_TARGET_IDENTITY_KIND,
+  expectedVariant: ArtifactVariant = "full",
 ): MacOSArtifactManifest {
   if (!expectedTeamId) throw new Error("expected Team ID is required");
   const manifest = readAuthenticatedManifest<MacOSArtifactManifest>(
@@ -1765,6 +1810,11 @@ export function verifyArchiveManifest(
   if (manifestPolicy(manifest) !== expectedPolicy) {
     throw new Error("manifest artifact policy does not match the explicit operator selection");
   }
+  if (manifestVariant(manifest) !== expectedVariant) {
+    throw new Error(
+      `manifest variant ${manifestVariant(manifest)} does not match the explicit operator selection ${expectedVariant}`,
+    );
+  }
   const actualApprovedTarget = manifest.approved_target ?? RELEASE_APPROVED_TARGET;
   if (actualApprovedTarget !== expectedApprovedTarget) {
     throw new Error("manifest approved target does not match the exact operator-approved target");
@@ -1817,6 +1867,7 @@ function assertProvenanceMatchesManifest(
     "builder_identity_kind",
     "builder_identity_sha256",
     "non_notarized",
+    "variant",
     "bundle_id",
     "bundle_version",
     "git_sha",
@@ -1989,11 +2040,17 @@ export function verifyExtractedApp(
   expectedApprovedTarget: string = RELEASE_APPROVED_TARGET,
   expectedApprovedTargetIdentitySha256: string = "none",
   expectedApprovedTargetIdentityKind: OperatorTargetIdentityKind = LEGACY_LOCAL_TARGET_IDENTITY_KIND,
+  expectedVariant: ArtifactVariant = "full",
 ): MacOSArtifactManifest {
   const manifest = readAuthenticatedManifest<MacOSArtifactManifest>(
     manifestPath,
     expectedManifestSha256,
   );
+  if (manifestVariant(manifest) !== expectedVariant) {
+    throw new Error(
+      `manifest variant ${manifestVariant(manifest)} does not match the explicit operator selection ${expectedVariant}`,
+    );
+  }
   verifyAppAgainstManifest(
     appPath,
     manifest,
@@ -2063,6 +2120,7 @@ function verifySuppliedAndArchivedApps(
     },
     "/usr/bin/ditto",
     manifest.archive.sha256,
+    manifestBundleName(manifest),
   );
   if (sha256ArchiveFile(archivePath) !== manifest.archive.sha256) {
     throw new Error("release archive changed during exact-byte verification");
@@ -2080,6 +2138,7 @@ function writeProvenance(
   approvedTargetIdentitySha256: string,
   builderIdentityKind: OperatorTargetIdentityKind,
   builderIdentitySha256: string,
+  variant: ArtifactVariant,
 ): void {
   const executablePath = join(appPath, "Contents", "MacOS", "Recordings");
   const helperPath = join(appPath, "Contents", "Helpers", "recordings");
@@ -2089,6 +2148,7 @@ function writeProvenance(
       artifactPolicy === "release"
         ? RELEASE_ARTIFACT_SCHEMA_VERSION
         : LOCAL_ARTIFACT_SCHEMA_VERSION,
+    variant,
     bundle_id: plistValue(appPath, "CFBundleIdentifier"),
     bundle_version: plistValue(appPath, "CFBundleShortVersionString"),
     bundle_build_version: plistValue(appPath, "CFBundleVersion"),
@@ -2151,6 +2211,7 @@ function finalizeArtifact(
   notaryLogPath: string,
   notarySubmissionId: string,
   submittedArchiveSha256: string,
+  expectedVariant: ArtifactVariant = "full",
 ): void {
   assertCurrentSourceRevision(packageRoot, expectedSourceSha);
   const executablePath = join(appPath, "Contents", "MacOS", "Recordings");
@@ -2160,6 +2221,14 @@ function finalizeArtifact(
   if (provenance.git_sha !== expectedSourceSha) {
     throw new Error("embedded provenance does not match the pinned source SHA");
   }
+  if (expectedVariant !== "full" && expectedVariant !== "bar") {
+    throw new Error(`finalize variant is unsupported: ${expectedVariant}`);
+  }
+  if ((provenance.variant ?? "full") !== expectedVariant) {
+    throw new Error(
+      `finalize variant ${expectedVariant} does not match the embedded provenance variant`,
+    );
+  }
   assertExpectedCodeLayout(appPath);
   const outerSigning = signingEvidence(appPath, expectedTeamId, APP_ENTITLEMENTS, executablePath);
   const helperSigning = signingEvidence(helperPath, expectedTeamId, HELPER_ENTITLEMENTS);
@@ -2172,9 +2241,14 @@ function finalizeArtifact(
   const notaryLog = JSON.parse(notaryLogSnapshot.toString("utf8")) as unknown;
   assertAcceptedNotaryLog(notaryLog, notarySubmissionId, submittedArchiveSha256);
   const items = nestedItems(appPath, expectedTeamId, "release", outerSigning, helperSigning);
+  const bundleName = basename(appPath);
+  if (!bundleName.endsWith(".app")) {
+    throw new Error(`release app bundle must be named *.app: ${appPath}`);
+  }
   const manifest: MacOSArtifactManifest = {
     ...provenance,
     artifact_type: "recordings-macos-app",
+    bundle_name: bundleName,
     app_sha256: sha256File(executablePath),
     binding: { bundle_tree_sha256: treeDigest(appPath) },
     provenance_sha256: sha256File(embeddedPath),
@@ -2201,7 +2275,7 @@ function finalizeArtifact(
     },
     container: {
       type: "zip",
-      install_locations: ["/Applications/Recordings.app"],
+      install_locations: [`/Applications/${bundleName}`],
     },
     nested_code_policy: {
       allowlist_sha256: nestedPolicyDigest(items),
@@ -2278,11 +2352,15 @@ function finalizeLocalArtifact(
   approvedTargetIdentityKind: TargetIdentityKind,
   approvedTargetIdentitySha256: string,
   expectedTeamId: string = "ADHOC",
+  expectedVariant: ArtifactVariant = "full",
 ): void {
   assertCurrentSourceRevision(packageRoot, expectedSourceSha);
   if (approvedTargetIdentityKind !== "tailscale_node_id_sha256") {
     throw new Error("new local-only artifacts require a Tailscale node ID identity hash");
   }
+  if (expectedVariant !== "full" && expectedVariant !== "bar") {
+    throw new Error(`finalize variant is unsupported: ${expectedVariant}`);
+  }
   const localSigningMode = localOnlySigningMode(expectedTeamId);
   const executablePath = join(appPath, "Contents", "MacOS", "Recordings");
   const helperPath = join(appPath, "Contents", "Helpers", "recordings");
@@ -2300,6 +2378,11 @@ function finalizeLocalArtifact(
   ) {
     throw new Error("embedded provenance is not approved for this local-only target");
   }
+  if ((provenance.variant ?? "full") !== expectedVariant) {
+    throw new Error(
+      `finalize variant ${expectedVariant} does not match the embedded provenance variant`,
+    );
+  }
   assertExpectedCodeLayout(appPath);
   const outerSigning = signingEvidence(
     appPath,
@@ -2316,9 +2399,14 @@ function finalizeLocalArtifact(
     "local_only",
   );
   const items = nestedItems(appPath, expectedTeamId, "local_only", outerSigning, helperSigning);
+  const bundleName = basename(appPath);
+  if (!bundleName.endsWith(".app")) {
+    throw new Error(`local app bundle must be named *.app: ${appPath}`);
+  }
   const manifest: MacOSArtifactManifest = {
     ...provenance,
     artifact_type: "recordings-macos-app",
+    bundle_name: bundleName,
     app_sha256: sha256File(executablePath),
     binding: { bundle_tree_sha256: treeDigest(appPath) },
     provenance_sha256: sha256File(embeddedPath),
@@ -2346,7 +2434,7 @@ function finalizeLocalArtifact(
     },
     container: {
       type: "zip",
-      install_locations: ["~/Applications/Recordings.app"],
+      install_locations: [`~/Applications/${bundleName}`],
     },
     nested_code_policy: {
       allowlist_sha256: nestedPolicyDigest(items),
@@ -2516,6 +2604,7 @@ function verifyActiveApp(
   expectedApprovedTarget: string,
   expectedApprovedTargetIdentitySha256: string,
   expectedApprovedTargetIdentityKind: OperatorTargetIdentityKind,
+  expectedVariant: ArtifactVariant = "full",
 ): void {
   const manifest = verifyExtractedApp(
     appPath,
@@ -2526,6 +2615,7 @@ function verifyActiveApp(
     expectedApprovedTarget,
     expectedApprovedTargetIdentitySha256,
     expectedApprovedTargetIdentityKind,
+    expectedVariant,
   );
   const helperPath = join(appPath, "Contents", "Helpers", "recordings");
   if (companionVersion(helperPath) !== manifest.companion.version) {
@@ -5188,6 +5278,9 @@ function manifestGet(path: string, expectedManifestSha256: string, field: string
   }
   else if (field === "approved_target_identity_sha256") console.log(manifest.approved_target_identity_sha256);
   else if (field === "builder_identity_kind") console.log(manifestBuilderIdentityKind(manifest));
+  else if (field === "variant") console.log(manifestVariant(manifest));
+  // Pre-variant manifests carry no bundle_name; they are full builds by definition.
+  else if (field === "bundle_name") console.log(manifestBundleName(manifest));
   else throw new Error(`unsupported manifest field: ${field}`);
 }
 
@@ -5214,6 +5307,14 @@ function repeatedArguments(name: string): string[] {
   return values;
 }
 
+function variantArgument(defaultVariant: ArtifactVariant): ArtifactVariant {
+  const value = optionalArgument("--variant") ?? defaultVariant;
+  if (value !== "full" && value !== "bar") {
+    throw new Error(`artifact variant must be full or bar; got: ${value}`);
+  }
+  return value;
+}
+
 function artifactPolicyArgument(): ArtifactPolicy {
   const value = argument("--artifact-policy");
   if (value !== "release" && value !== "local_only") {
@@ -5276,6 +5377,7 @@ function main(): void {
       argument("--approved-target-identity-sha256"),
       builderIdentityKindArgument(policy),
       argument("--builder-identity-sha256"),
+      variantArgument("full"),
     );
   } else if (command === "finalize") {
     const sourceSha = argument("--source-sha");
@@ -5290,6 +5392,7 @@ function main(): void {
       argument("--notary-log"),
       argument("--notary-submission-id"),
       argument("--submitted-archive-sha256"),
+      variantArgument("full"),
     );
   } else if (command === "finalize-local") {
     const sourceSha = argument("--source-sha");
@@ -5303,6 +5406,7 @@ function main(): void {
       targetIdentityKindArgument(undefined, true),
       argument("--approved-target-identity-sha256"),
       optionalArgument("--expected-team-id") ?? "ADHOC",
+      variantArgument("full"),
     );
   } else if (command === "verify-archive") {
     const teamId = argument("--team-id");
@@ -5318,6 +5422,7 @@ function main(): void {
       argument("--approved-target"),
       argument("--approved-target-identity-sha256"),
       targetIdentityKindArgument(policy),
+      variantArgument("full"),
     );
   } else if (command === "extract-verified-archive") {
     const teamId = argument("--team-id");
@@ -5334,6 +5439,7 @@ function main(): void {
       argument("--approved-target"),
       argument("--approved-target-identity-sha256"),
       targetIdentityKindArgument(policy),
+      variantArgument("full"),
     );
   } else if (command === "verify-app") {
     const teamId = argument("--team-id");
@@ -5347,6 +5453,7 @@ function main(): void {
       argument("--approved-target"),
       argument("--approved-target-identity-sha256"),
       targetIdentityKindArgument(policy),
+      variantArgument("full"),
     );
   } else if (command === "verify-active") {
     const teamId = argument("--team-id");
@@ -5360,6 +5467,7 @@ function main(): void {
       argument("--approved-target"),
       argument("--approved-target-identity-sha256"),
       targetIdentityKindArgument(policy),
+      variantArgument("full"),
     );
   } else if (command === "assert-release") {
     assertExpectedRelease(

package/scripts/smoke_macos_app.sh

@@ -2,10 +2,26 @@
 set -euo pipefail
 umask 077
 
-if [ "$#" -ne 2 ]; then
-  echo "Usage: $0 <Recordings.app> <explicit absolute Bun executable path>" >&2
-  exit 2
+SMOKE_VARIANT="full"
+if [ "$#" -ge 3 ]; then
+  case "$3" in
+    --variant)
+      SMOKE_VARIANT="${4:-full}"
+      ;;
+    *)
+      echo "Usage: $0 <Recordings.app> <explicit absolute Bun executable path> [--variant full|bar]" >&2
+      exit 2
+      ;;
+  esac
+  case "$SMOKE_VARIANT" in
+    full|bar) ;;
+    *)
+      echo "SMOKE_VARIANT must be full or bar; got: $SMOKE_VARIANT" >&2
+      exit 2
+      ;;
+  esac
 fi
+readonly SMOKE_VARIANT
 
 HOST_UNAME_EXECUTABLE="/usr/bin/uname"
 SYSTEM_DIRNAME_EXECUTABLE="/usr/bin/dirname"
@@ -345,6 +361,12 @@ run_smoke() {
   if [ "$mode" = "permission-helper" ]; then
     arguments=(--request-permissions "${arguments[@]}")
   fi
+  if [ "$SMOKE_VARIANT" = "bar" ]; then
+    # Bar builds are bar-only by construction (compile-time RECORDINGS_BAR_ONLY); the
+    # explicit argument is a belt-and-suspenders self-describing launch record so the
+    # launch is attributable to the variant even without the build define.
+    arguments=(--bar-only "${arguments[@]}")
+  fi
 
   SMOKE_PID=""
   SMOKE_PID_START_IDENTITY=""
@@ -428,6 +450,7 @@ run_smoke() {
     PATH="$SANITIZED_PATH" \
     TMPDIR="$WORK_DIR" \
     SMOKE_MODE="$mode" \
+    SMOKE_VARIANT="$SMOKE_VARIANT" \
     SMOKE_FOCUS_EVIDENCE="$SMOKE_FOCUS_EVIDENCE" \
     EXPECTED_HELPER="$APP_PATH/Contents/Helpers/recordings" \
     "$BUN_EXECUTABLE" -e '
@@ -454,19 +477,38 @@ run_smoke() {
       if (JSON.stringify(result.renderedStatusLabels) !== JSON.stringify(expected)) {
         fail(`unexpected status labels ${JSON.stringify(result.renderedStatusLabels)}`);
       }
-      if (result.windowCreationCount !== 1 || result.windowActivationCount !== 2) {
-        fail("retained-window activation path was not exercised twice");
-      }
-      if (result.retainedWindowReused !== true) fail("main window was not retained");
-      if (result.applicationActivationPolicy !== 0) fail("main window did not set regular activation policy");
-      if (!result.mainWindowIsVisible || !result.mainWindowCanBecomeKey) {
-        fail("retained main window was not visible and capable of becoming key");
-      }
-      if (!result.applicationIsActive || !result.mainWindowIsKey) {
-        if (process.env.SMOKE_FOCUS_EVIDENCE !== "ssh-unavailable") {
-          fail("Open Recordings did not make the retained window active and key");
+      if (process.env.SMOKE_VARIANT === "bar") {
+        // The bar variant launches windowless by construction: no workspace window is
+        // ever created, activated, or reused, the app stays an accessory (LSUIElement),
+        // and no window is exposed. This is the runtime half of the P1 #2 regression —
+        // the full-build smoke below must keep creating the window.
+        if (result.windowCreationCount !== 0 || result.windowActivationCount !== 0) {
+          fail("bar-only launch created or activated a workspace window");
+        }
+        if (result.retainedWindowReused !== false) {
+          fail("bar-only launch reused a workspace window");
+        }
+        if (result.mainWindowIsVisible || result.mainWindowCanBecomeKey || result.mainWindowIsKey) {
+          fail("bar-only launch exposed a main window");
+        }
+        if (result.applicationActivationPolicy !== 1) {
+          fail("bar-only launch did not stay an accessory activation policy");
+        }
+      } else {
+        if (result.windowCreationCount !== 1 || result.windowActivationCount !== 2) {
+          fail("retained-window activation path was not exercised twice");
+        }
+        if (result.retainedWindowReused !== true) fail("main window was not retained");
+        if (result.applicationActivationPolicy !== 0) fail("main window did not set regular activation policy");
+        if (!result.mainWindowIsVisible || !result.mainWindowCanBecomeKey) {
+          fail("retained main window was not visible and capable of becoming key");
+        }
+        if (!result.applicationIsActive || !result.mainWindowIsKey) {
+          if (process.env.SMOKE_FOCUS_EVIDENCE !== "ssh-unavailable") {
+            fail("Open Recordings did not make the retained window active and key");
+          }
+          focusEvidenceStatus = "ssh-unavailable";
         }
-        focusEvidenceStatus = "ssh-unavailable";
       }
     } else if (mode === "resolver") {
       if (result.menuBarSurfaceCount !== 0 || result.globalHandlersInstalled !== false) {
@@ -570,4 +612,8 @@ run_smoke() {
 run_smoke normal
 run_smoke permission-helper
 run_smoke resolver
-echo "Recordings.app runtime smoke passed: menu bar, retained window, helper isolation, and packaged resolver."
+if [ "$SMOKE_VARIANT" = "bar" ]; then
+  echo "Recordings.app runtime smoke passed (bar variant): menu bar, windowless launch, helper isolation, and packaged resolver."
+else
+  echo "Recordings.app runtime smoke passed: menu bar, retained window, helper isolation, and packaged resolver."
+fi

package/src/native/Recordings/App/MenuBarStatusView.swift

@@ -24,6 +24,9 @@ struct MenuBarStatusLabel: View {
 struct MenuBarStatusView: View {
     @ObservedObject var store: RecordingsStore
     let openRecordings: () -> Void
+    /// Bar-only builds have no workspace window to open; the entry point is hidden so
+    /// the affordance does not exist where the surface cannot exist.
+    let barOnly: Bool
 
     var body: some View {
         VStack(alignment: .leading, spacing: 12) {
@@ -50,11 +53,13 @@ struct MenuBarStatusView: View {
 
             Divider()
 
-            Button(action: openRecordings) {
-                Label("Open Recordings", systemImage: "macwindow")
-                    .frame(maxWidth: .infinity, alignment: .leading)
+            if !barOnly {
+                Button(action: openRecordings) {
+                    Label("Open Recordings", systemImage: "macwindow")
+                        .frame(maxWidth: .infinity, alignment: .leading)
+                }
+                .buttonStyle(.plain)
             }
-            .buttonStyle(.plain)
 
             SettingsLink {
                 Label("Settings", systemImage: "gearshape")

package/src/native/Recordings/App/RecordingsApp.swift

@@ -56,6 +56,8 @@ final class RecordingsAppDelegate: NSObject, NSApplicationDelegate {
 final class RecordingsAppState: ObservableObject {
     let store: RecordingsStore?
     let declaresMenuBar: Bool
+    let barOnly: Bool
+    let declaresWindow: Bool
     let runtimeSmokeProbe: RuntimeSmokeProbe?
     private let runtimeSmokeMode: String?
     private let runtimeSmokeOutputPath: String?
@@ -67,6 +69,8 @@ final class RecordingsAppState: ObservableObject {
 
     init(plan: PermissionRequestLaunchPlan) {
         declaresMenuBar = plan.declaresMenuBar
+        barOnly = plan.isBarOnly
+        declaresWindow = plan.declaresWindow
         runtimeSmokeMode = plan.runtimeSmokeMode
         runtimeSmokeOutputPath = plan.runtimeSmokeOutputPath
         runtimeSmokeAcknowledgementPath = plan.runtimeSmokeAcknowledgementPath
@@ -86,6 +90,14 @@ final class RecordingsAppState: ObservableObject {
     }
 
     func openRecordings() {
+        // Bar launches never create the workspace window — on any path, including the
+        // reopen handler and the runtime smoke. Keyed on declaresWindow (NOT on
+        // declaresMainWindow, which excludes every runtime smoke): a full build's
+        // normal-mode smoke must keep exercising the window, and only bar builds finish
+        // windowless. This was the cycle-2 P1 of the terminated PR #269 lineage — a
+        // windowless branch keyed on declaresMainWindow made the FULL smoke fail
+        // deterministically on every build.
+        guard declaresWindow else { return }
         if let store {
             showWindow(contentView: NSHostingView(rootView: ContentView(store: store)))
         } else if runtimeSmokeMode == "normal" {
@@ -181,6 +193,23 @@ final class RecordingsAppState: ObservableObject {
         runtimeSmokeProbe.completed = { [weak self, weak runtimeSmokeProbe] in
             guard let self, let runtimeSmokeProbe else { return }
             let accessibility = RuntimeSmokeAccessibilitySnapshot.processMenuBarExtras()
+            if self.barOnly {
+                // Windowless by construction: the bar smoke must never create the
+                // workspace window, and it reports the windowless state directly. This
+                // branch keys on barOnly, NOT on declaresMainWindow — that property
+                // excludes every runtime smoke and made the FULL build's smoke fail
+                // deterministically in the terminated PR #269 lineage (cycle-2 P1). A
+                // nil-window comparison would also read as a retained window (nil ===
+                // nil), so the windowless result is finished here explicitly.
+                self.finishRuntimeSmoke(
+                    mode: mode,
+                    surfaceCount: runtimeSmokeProbe.surfaceAppearances,
+                    labels: runtimeSmokeProbe.renderedLabels,
+                    accessibility: accessibility,
+                    retainedWindowReused: false
+                )
+                return
+            }
             self.openRecordings()
             let firstWindow = self.mainWindow
             self.openRecordings()
@@ -202,6 +231,9 @@ final class RecordingsAppState: ObservableObject {
         retainedWindowReused: Bool,
         attempt: Int = 0
     ) {
+        // Only the non-bar smoke reaches this (bar launches finish windowless in the
+        // probe completion handler above), so the settled state is exactly the retained
+        // window being key, unchanged from the base contract.
         let windowSettled = NSApplication.shared.isActive && (mainWindow?.isKeyWindow ?? false)
         guard windowSettled || attempt >= 60 else {
             DispatchQueue.main.asyncAfter(deadline: .now() + 0.05) { [weak self] in
@@ -316,7 +348,11 @@ struct RecordingsApp: App {
     @SceneBuilder var body: some Scene {
         MenuBarExtra(isInserted: menuBarInsertion) {
             if let store = state.store {
-                MenuBarStatusView(store: store, openRecordings: state.openRecordings)
+                MenuBarStatusView(
+                    store: store,
+                    openRecordings: state.openRecordings,
+                    barOnly: state.barOnly
+                )
             } else if state.runtimeSmokeProbe != nil {
                 EmptyView()
             }

package/src/native/Recordings/RecordingsLib/Info.plist

@@ -17,11 +17,11 @@
     <key>CFBundleIdentifier</key>
     <string>com.hasna.recordings</string>
     <key>CFBundleVersion</key>
-    <string>0.3.1</string>
+    <string>0.3.2</string>
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>0.3.1</string>
+    <string>0.3.2</string>
     <key>LSMinimumSystemVersion</key>
     <string>26.0</string>
     <key>NSMicrophoneUsageDescription</key>

package/src/native/Recordings/RecordingsLib/PermissionRequestLaunchPlan.swift

@@ -7,10 +7,19 @@ public struct PermissionRequestLaunchPlan: Sendable, Equatable {
     public let runtimeSmokeOutputPath: String?
     public let runtimeSmokeAcknowledgementPath: String?
     public let runtimeSmokeCompletionPath: String?
+    public let isBarOnly: Bool
 
     public var isRuntimeSmoke: Bool { runtimeSmokeMode != nil }
     public var installsGlobalHandlers: Bool { !isHelper && !isRuntimeSmoke }
-    public var declaresMainWindow: Bool { !isHelper && !isRuntimeSmoke }
+    /// The workspace window may be created only when this holds: never for the permission
+    /// helper, never for a bar launch, and regardless of runtime-smoke mode — a full
+    /// build's smoke keeps exercising the window deterministically, and only bar builds
+    /// finish windowless.
+    public var declaresWindow: Bool { !isHelper && !isBarOnly }
+    /// Controls the init auto-open and the reopen handler ONLY. Runtime smoke launches
+    /// are excluded so the smoke controls window creation deterministically, and bar
+    /// launches are excluded so a real bar launch never auto-opens the workspace window.
+    public var declaresMainWindow: Bool { !isHelper && !isRuntimeSmoke && !isBarOnly }
     public var declaresMenuBar: Bool {
         if isRuntimeSmoke { return runtimeSmokeMode == "normal" }
         return !isHelper
@@ -31,6 +40,17 @@ public struct PermissionRequestLaunchPlan: Sendable, Equatable {
             "--runtime-smoke-completion",
             arguments: arguments
         )
+        #if RECORDINGS_BAR_ONLY
+        // A bar build is bar-only by construction on EVERY launch path — installer
+        // relaunch, manual `open`, LaunchAgent, smoke. Relying on the argument alone left
+        // real launches of the installed bar behaviorally identical to the full app
+        // (review lineage hasna/apps#269, cycle-1 P1). The explicit --bar-only argument
+        // remains a belt-and-suspenders self-describing launch record; it is never the
+        // only carrier of the bar property.
+        isBarOnly = true
+        #else
+        isBarOnly = arguments.contains("--bar-only")
+        #endif
     }
 
     private static func optionValue(_ name: String, arguments: [String]) -> String? {