@lattices/cli 0.4.13 → 0.5.0

package/README.md

@@ -42,15 +42,11 @@ The CLI and app work independently — use either or both.
 git clone https://github.com/arach/lattices.git
 cd lattices
 
-# Build the menu bar app (requires Swift 6.2 / Xcode 26+)
-cd apps/mac && swift build -c release && cd ../..
-
 # Install CLI dependencies
 npm install
 
-# Launch
-bun bin/lattices-app.ts build    # bundle the .app
-bun bin/lattices-app.ts          # launch it
+# Build/install/relaunch the dev app at the stable permission target
+./run.sh
 ```
 
 To build a signed, notarized DMG for distribution:
@@ -59,10 +55,12 @@ To build a signed, notarized DMG for distribution:
 # Requires a Developer ID certificate and notarytool keychain profile
 ./tools/release/build-dmg.sh
 
-# Update v<package.json version> and upload the DMG to GitHub Releases
+# Create/update v<package.json version> and upload DMG assets
 ./tools/release/ship.sh
 ```
 
+See [Release](docs/release.md) for the CI and local maintainer workflows.
+
 ## Quick start
 
 ```sh

package/apps/mac/Info.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
     <key>CFBundleIdentifier</key>
-    <string>com.arach.lattices</string>
+    <string>dev.lattices.app</string>
     <key>CFBundleName</key>
     <string>Lattices</string>
     <key>CFBundleDisplayName</key>
@@ -18,7 +18,7 @@
     <array>
         <dict>
             <key>CFBundleURLName</key>
-            <string>com.arach.lattices</string>
+            <string>dev.lattices.app</string>
             <key>CFBundleURLSchemes</key>
             <array>
                 <string>lattices</string>

package/apps/mac/Lattices.app/Contents/Info.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
     <key>CFBundleIdentifier</key>
-    <string>com.arach.lattices</string>
+    <string>dev.lattices.app</string>
     <key>CFBundleName</key>
     <string>Lattices</string>
     <key>CFBundleDisplayName</key>
@@ -18,7 +18,7 @@
     <array>
         <dict>
             <key>CFBundleURLName</key>
-            <string>com.arach.lattices</string>
+            <string>dev.lattices.app</string>
             <key>CFBundleURLSchemes</key>
             <array>
                 <string>lattices</string>
@@ -26,17 +26,9 @@
         </dict>
     </array>
     <key>CFBundleVersion</key>
-    <string>0.4.13</string>
+    <string>0.5.0</string>
     <key>CFBundleShortVersionString</key>
-    <string>0.4.13</string>
-    <key>LatticesBuildChannel</key>
-    <string>dev</string>
-    <key>LatticesBuildTrack</key>
-    <string>latest</string>
-    <key>LatticesBuildRevision</key>
-    <string>42928c7</string>
-    <key>LatticesBuildTimestamp</key>
-    <string>2026-05-04T17:39:23Z</string>
+    <string>0.5.0</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

package/bin/lattices-app.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 
-import { execSync, spawn } from "node:child_process";
+import { execFileSync, execSync, spawn } from "node:child_process";
 import { existsSync, mkdirSync, chmodSync, createWriteStream, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -23,6 +23,8 @@ const RELEASE_APP_ASSET_NAMES = ["Lattices.dmg"];
 const RELEASE_BINARY_ASSET_NAMES = ["Lattices-macos-arm64", "LatticeApp-macos-arm64"];
 type ReleaseAsset = { name: string; browser_download_url: string };
 const selfScriptPath = resolve(__dirname, "lattices-app.ts");
+const CAPS_LOCK_HID_USAGE = 0x700000039;
+const F18_HID_USAGE = 0x70000006D;
 
 // ── Helpers ──────────────────────────────────────────────────────────
 
@@ -35,21 +37,112 @@ function isRunning(): boolean {
   }
 }
 
-function quit(): boolean {
+function sleep(ms: number): void {
+  execFileSync("/bin/sleep", [(ms / 1000).toString()], { stdio: "ignore" });
+}
+
+function waitForExit(timeoutMs: number): boolean {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!isRunning()) return true;
+    sleep(100);
+  }
+  return !isRunning();
+}
+
+type HIDKeyboardMapping = { src: number; dst: number };
+
+function hasOwnedCapsLockTransportMapping(): boolean {
   try {
-    execSync("pkill -x Lattices", { stdio: "pipe" });
-    // Wait briefly for process to exit
-    try { execSync("sleep 0.5", { stdio: "pipe" }); } catch {}
-    // Force kill if still running
-    if (isRunning()) {
-      execSync("pkill -9 -x Lattices", { stdio: "pipe" });
-    }
-    return true;
+    return execFileSync(
+      "/usr/bin/defaults",
+      ["read", "dev.lattices.app", "keyboardRemaps.capsLockHIDTransportOwned"],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+    ).trim() === "1";
   } catch {
     return false;
   }
 }
 
+function readHIDKeyboardMappings(): HIDKeyboardMapping[] {
+  try {
+    const output = execFileSync(
+      "/usr/bin/hidutil",
+      ["property", "--get", "UserKeyMapping"],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+    );
+    return Array.from(output.matchAll(/HIDKeyboardModifierMappingDst\s*=\s*(\d+);\s*HIDKeyboardModifierMappingSrc\s*=\s*(\d+);/g))
+      .map((match) => ({ dst: Number(match[1]), src: Number(match[2]) }));
+  } catch {
+    return [];
+  }
+}
+
+function writeHIDKeyboardMappings(mappings: HIDKeyboardMapping[]): void {
+  const pairs = mappings.map((mapping) => ({
+    HIDKeyboardModifierMappingSrc: mapping.src,
+    HIDKeyboardModifierMappingDst: mapping.dst,
+  }));
+  execFileSync(
+    "/usr/bin/hidutil",
+    ["property", "--set", JSON.stringify({ UserKeyMapping: pairs })],
+    { stdio: "ignore" }
+  );
+}
+
+function clearOwnedCapsLockTransportMapping(): void {
+  if (!hasOwnedCapsLockTransportMapping()) return;
+
+  const mappings = readHIDKeyboardMappings();
+  const filtered = mappings.filter((mapping) => (
+    mapping.src !== CAPS_LOCK_HID_USAGE || mapping.dst !== F18_HID_USAGE
+  ));
+
+  if (filtered.length !== mappings.length) {
+    try {
+      writeHIDKeyboardMappings(filtered);
+    } catch {
+      console.log("Warning: failed to clear Caps Lock HID transport mapping.");
+      return;
+    }
+  }
+
+  try {
+    execFileSync("/usr/bin/defaults", ["delete", "dev.lattices.app", "keyboardRemaps.capsLockHIDTransportOwned"], { stdio: "ignore" });
+  } catch {}
+  try {
+    execFileSync("/usr/bin/defaults", ["delete", "dev.lattices.app", "keyboardRemaps.capsLockHIDTransportOriginalMappings"], { stdio: "ignore" });
+  } catch {}
+}
+
+function quit(): boolean {
+  if (!isRunning()) {
+    clearOwnedCapsLockTransportMapping();
+    return false;
+  }
+
+  try {
+    execFileSync(
+      "/usr/bin/osascript",
+      ["-e", 'tell application id "dev.lattices.app" to quit'],
+      { stdio: "ignore" }
+    );
+  } catch {}
+
+  if (!waitForExit(2_000)) {
+    try { execSync("pkill -x Lattices", { stdio: "pipe" }); } catch {}
+    waitForExit(1_000);
+  }
+
+  if (isRunning()) {
+    try { execSync("pkill -9 -x Lattices", { stdio: "pipe" }); } catch {}
+    waitForExit(500);
+  }
+
+  clearOwnedCapsLockTransportMapping();
+  return !isRunning();
+}
+
 function hasSwift(): boolean {
   try {
     execSync("which swift", { stdio: "pipe" });
@@ -112,8 +205,8 @@ function relaunchIfNeeded(shouldLaunch: boolean, extraArgs: string[] = []): void
 function resolveSigningIdentity(): string | null {
   try {
     const identities = execSync("security find-identity -v -p codesigning", { stdio: "pipe" }).toString();
-    return identities.match(/"(Developer ID Application:[^"]+)"/)?.[1]
-        || identities.match(/"(Apple Development:[^"]+)"/)?.[1]
+    return identities.match(/^\s*\d+\)\s+([A-F0-9]{40})\s+"Developer ID Application:[^"]+"/m)?.[1]
+        || identities.match(/^\s*\d+\)\s+([A-F0-9]{40})\s+"Apple Development:[^"]+"/m)?.[1]
         || null;
   } catch {
     return null;
@@ -133,7 +226,7 @@ function signBundle(): void {
     console.log(`Signing with: ${identity}`);
     try {
       execSync(
-        `codesign --force --sign '${identity}'${entFlag} --identifier com.arach.lattices '${bundlePath}'`,
+        `codesign --force --options runtime --deep --sign '${identity}'${entFlag} --identifier dev.lattices.app '${bundlePath}'`,
         { stdio: "pipe" }
       );
       return;
@@ -145,7 +238,7 @@ function signBundle(): void {
   }
 
   execSync(
-    `codesign --force --sign -${entFlag} --identifier com.arach.lattices '${bundlePath}'`,
+    `codesign --force --options runtime --deep --sign -${entFlag} --identifier dev.lattices.app '${bundlePath}'`,
     { stdio: "pipe" }
   );
 
@@ -188,7 +281,7 @@ function writeInfoPlist(metadata: BundleBuildMetadata = {}): void {
 <plist version="1.0">
 <dict>
     <key>CFBundleIdentifier</key>
-    <string>com.arach.lattices</string>
+    <string>dev.lattices.app</string>
     <key>CFBundleName</key>
     <string>Lattices</string>
     <key>CFBundleDisplayName</key>
@@ -203,7 +296,7 @@ function writeInfoPlist(metadata: BundleBuildMetadata = {}): void {
     <array>
         <dict>
             <key>CFBundleURLName</key>
-            <string>com.arach.lattices</string>
+            <string>dev.lattices.app</string>
             <key>CFBundleURLSchemes</key>
             <array>
                 <string>lattices</string>
@@ -256,7 +349,7 @@ function buildFromSource(): boolean {
 
   mkdirSync(binaryDir, { recursive: true });
   execSync(`cp '${builtPath}' '${binaryPath}'`);
-  writeInfoPlist({ channel: "dev", track: "latest" });
+  writeInfoPlist();
   syncBundleResources();
 
   // Re-sign the bundle so macOS TCC recognizes a stable identity across rebuilds.

package/bin/lattices-build

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# lattices-build - explicit dev/package/dist build entry points
+
+set -euo pipefail
+
+SCRIPT_PATH="$(readlink -f "$0" 2>/dev/null || python3 -c "import os,sys; print(os.path.realpath(sys.argv[1]))" "$0")"
+ROOT="$(cd "$(dirname "$SCRIPT_PATH")/.." && pwd)"
+
+DEV_APPS_DIR="${LATTICES_DEV_APPS_DIR:-$HOME/Applications/dev/Lattices}"
+DEV_BUNDLE="${LATTICES_DEV_APP:-$DEV_APPS_DIR/Lattices.app}"
+DEV_BUNDLE_ID="${LATTICES_DEV_BUNDLE_ID:-dev.lattices.app.dev}"
+RELEASE_BUNDLE="$ROOT/apps/mac/Lattices.app"
+RELEASE_BUNDLE_ID="dev.lattices.app"
+DIST_BUNDLE="$ROOT/dist/Lattices.app"
+DIST_DMG="$ROOT/dist/Lattices.dmg"
+PROD_INSTALL_BUNDLE="/Applications/Lattices.app"
+
+green() { printf "\033[32m%s\033[0m\n" "$*"; }
+dim()   { printf "\033[2m%s\033[0m\n" "$*"; }
+red()   { printf "\033[31m%s\033[0m\n" "$*"; }
+
+usage() {
+    cat <<EOF
+lattices-build - build Lattices without mixing dev and release identities
+
+Usage:
+  bin/lattices-build dev           Build/install dev app
+  bin/lattices-build dev:restart   Build/install/relaunch dev app
+  bin/lattices-build package       Build repo app bundle for npm packaging
+  bin/lattices-build dist          Build signed/notarized release DMG
+  bin/lattices-build dist:local    Build local release DMG without notarizing
+  bin/lattices-build where         Show canonical paths and bundle ids
+
+Channels:
+  dev      $DEV_BUNDLE_ID -> $DEV_BUNDLE
+  release  $RELEASE_BUNDLE_ID -> $PROD_INSTALL_BUNDLE via $DIST_DMG
+EOF
+}
+
+plist_value() {
+    local app="$1"
+    local key="$2"
+    [ -d "$app" ] || return 0
+    /usr/bin/defaults read "$app/Contents/Info.plist" "$key" 2>/dev/null || true
+}
+
+show_app() {
+    local label="$1"
+    local app="$2"
+
+    echo "$label"
+    echo "  path: $app"
+    if [ -d "$app" ]; then
+        echo "  bundle id: $(plist_value "$app" CFBundleIdentifier)"
+        echo "  channel:   $(plist_value "$app" LatticesBuildChannel)"
+        echo "  built at:  $(plist_value "$app" LatticesBuildTimestamp)"
+    else
+        echo "  status:    not built"
+    fi
+}
+
+cmd_dev() {
+    "$ROOT/bin/lattices-dev" build
+    show_app "Dev app" "$DEV_BUNDLE"
+    green "Dev permission target: $DEV_BUNDLE"
+}
+
+cmd_dev_restart() {
+    "$ROOT/bin/lattices-dev" restart
+    show_app "Running dev app" "$DEV_BUNDLE"
+}
+
+cmd_package() {
+    if ! command -v bun >/dev/null 2>&1; then
+        red "bun is required for package builds."
+        exit 1
+    fi
+
+    bun "$ROOT/bin/lattices-app.ts" build
+    show_app "Package app bundle" "$RELEASE_BUNDLE"
+    green "Package bundle ready: $RELEASE_BUNDLE"
+}
+
+cmd_dist() {
+    "$ROOT/tools/release/build-dmg.sh" "$@"
+    show_app "Release app artifact" "$DIST_BUNDLE"
+    [ -f "$DIST_DMG" ] && ls -lh "$DIST_DMG"
+}
+
+cmd_dist_local() {
+    LATTICES_SKIP_NOTARIZE=1 "$ROOT/tools/release/build-dmg.sh" "$@"
+    show_app "Local release app artifact" "$DIST_BUNDLE"
+    [ -f "$DIST_DMG" ] && ls -lh "$DIST_DMG"
+}
+
+cmd_where() {
+    show_app "Dev app" "$DEV_BUNDLE"
+    echo "  expected bundle id: $DEV_BUNDLE_ID"
+    echo
+    show_app "Package app bundle" "$RELEASE_BUNDLE"
+    echo "  expected bundle id: $RELEASE_BUNDLE_ID"
+    echo
+    show_app "Release app artifact" "$DIST_BUNDLE"
+    echo "  expected install target: $PROD_INSTALL_BUNDLE"
+    [ -f "$DIST_DMG" ] && echo "  dmg: $DIST_DMG"
+}
+
+cmd="${1:-help}"
+shift || true
+
+case "$cmd" in
+    dev)         cmd_dev ;;
+    dev:restart|restart) cmd_dev_restart ;;
+    package)     cmd_package ;;
+    dist)        cmd_dist "$@" ;;
+    dist:local)  cmd_dist_local "$@" ;;
+    where)       cmd_where ;;
+    help|-h|--help) usage ;;
+    *)
+        red "Unknown command: $cmd"
+        echo
+        usage
+        exit 1
+        ;;
+esac

package/bin/lattices-dev

@@ -8,10 +8,14 @@ APP_DIR="$(cd "$(dirname "$SCRIPT_PATH")/../apps/mac" && pwd)"
 ROOT="$(cd "$(dirname "$SCRIPT_PATH")/.." && pwd)"
 LOG_FILE="$HOME/.lattices/lattices.log"
 BINARY="$APP_DIR/.build/release/Lattices"
-BUNDLE="$APP_DIR/Lattices.app"
+BUILD_BASE="$ROOT/build/macos/Lattices"
+BUNDLE="$BUILD_BASE/Build/Products/Debug/Lattices.app"
+DEV_APPS_DIR="${LATTICES_DEV_APPS_DIR:-$HOME/Applications/dev/Lattices}"
+INSTALL_BUNDLE="${LATTICES_DEV_APP:-$DEV_APPS_DIR/Lattices.app}"
 BUNDLE_BIN="$BUNDLE/Contents/MacOS/Lattices"
 RESOURCES_DIR="$BUNDLE/Contents/Resources"
 ENTITLEMENTS="$APP_DIR/Lattices.entitlements"
+BUNDLE_ID="${LATTICES_DEV_BUNDLE_ID:-dev.lattices.app.dev}"
 ICON="$ROOT/assets/AppIcon.icns"
 TAP_SOUND="$APP_DIR/Resources/tap.wav"
 VERSION="$(node -p "require('$ROOT/package.json').version" 2>/dev/null || echo '0.1.0')"
@@ -25,9 +29,14 @@ dim()   { printf "\033[2m%s\033[0m\n" "$*"; }
 select_sign_identity() {
     local identities identity=""
     identities="$(security find-identity -v -p codesigning 2>/dev/null || true)"
-    identity="$(printf '%s\n' "$identities" | sed -n 's/.*"\(Developer ID Application:[^"]*\)".*/\1/p' | head -n 1)"
+    # Prefer Developer ID Application: its designated requirement pins to the stable
+    # team OU, so TCC permissions survive rebuilds and Apple Development cert rotations.
+    # Apple Development is only a fallback (its DR pins a specific cert that Xcode rotates,
+    # which silently resets every granted permission). Keep this order in sync with
+    # resolveSigningIdentity() in bin/lattices-app.ts.
+    identity="$(printf '%s\n' "$identities" | sed -n 's/^[[:space:]]*[0-9]*)[[:space:]]*\([A-F0-9]\{40\}\)[[:space:]]*"Developer ID Application:[^"]*".*/\1/p' | head -n 1)"
     if [ -z "$identity" ]; then
-        identity="$(printf '%s\n' "$identities" | sed -n 's/.*"\(Apple Development:[^"]*\)".*/\1/p' | head -n 1)"
+        identity="$(printf '%s\n' "$identities" | sed -n 's/^[[:space:]]*[0-9]*)[[:space:]]*\([A-F0-9]\{40\}\)[[:space:]]*"Apple Development:[^"]*".*/\1/p' | head -n 1)"
     fi
     printf '%s' "$identity"
 }
@@ -45,7 +54,7 @@ sign_bundle() {
     identity="$(select_sign_identity)"
     if [ -n "$identity" ]; then
         dim "Signing with: $identity"
-        if ! codesign --force --sign "$identity" "${ent_flags[@]}" --identifier com.arach.lattices "$BUNDLE"; then
+        if ! codesign --force --options runtime --deep --sign "$identity" "${ent_flags[@]}" --identifier "$BUNDLE_ID" "$BUNDLE"; then
             red "Signing with '$identity' failed. Falling back to ad-hoc."
             sign_status=1
         fi
@@ -55,12 +64,62 @@ sign_bundle() {
 
     if [ "$sign_status" -ne 0 ]; then
         dim "No usable signing identity found. Using ad-hoc signature."
-        codesign --force --sign - "${ent_flags[@]}" --identifier com.arach.lattices "$BUNDLE"
+        codesign --force --options runtime --deep --sign - "${ent_flags[@]}" --identifier "$BUNDLE_ID" "$BUNDLE"
     fi
 
     rm -f "$BUNDLE_BIN".cstemp
 }
 
+sync_bundle_copy() {
+    local destination="$1"
+
+    mkdir -p "$(dirname "$destination")"
+    rm -rf "$destination"
+    ditto "$BUNDLE" "$destination"
+    xattr -dr com.apple.quarantine "$destination" 2>/dev/null || true
+    touch "$destination" "$destination/Contents"
+}
+
+ensure_install_bundle() {
+    if [ -d "$INSTALL_BUNDLE" ]; then
+        return
+    fi
+
+    if [ -d "$BUNDLE" ]; then
+        sync_bundle_copy "$INSTALL_BUNDLE"
+        return
+    fi
+
+    cmd_build
+}
+
+clear_lattices_drag_cache() {
+    local cache_dir
+
+    for cache_dir in "$HOME"/Library/Caches/com.apple.SwiftUI.Drag-*; do
+        [ -d "$cache_dir" ] || continue
+        if [ -d "$cache_dir/Lattices.app" ]; then
+            rm -rf "$cache_dir/Lattices.app"
+            rmdir "$cache_dir" 2>/dev/null || true
+        fi
+    done
+}
+
+is_install_bundle_running() {
+    local target="$INSTALL_BUNDLE/Contents/MacOS/Lattices"
+    local pid args
+
+    while IFS= read -r pid; do
+        [ -n "$pid" ] || continue
+        args="$(ps -p "$pid" -o args= 2>/dev/null || true)"
+        case "$args" in
+            "$target"|"${target} "*) return 0 ;;
+        esac
+    done < <(pgrep -x Lattices 2>/dev/null || true)
+
+    return 1
+}
+
 write_info_plist() {
     mkdir -p "$BUNDLE/Contents"
     cat > "$BUNDLE/Contents/Info.plist" <<PLIST
@@ -69,7 +128,7 @@ write_info_plist() {
 <plist version="1.0">
 <dict>
     <key>CFBundleIdentifier</key>
-    <string>com.arach.lattices</string>
+    <string>$BUNDLE_ID</string>
     <key>CFBundleName</key>
     <string>Lattices</string>
     <key>CFBundleDisplayName</key>
@@ -84,7 +143,7 @@ write_info_plist() {
     <array>
         <dict>
             <key>CFBundleURLName</key>
-            <string>com.arach.lattices</string>
+            <string>$BUNDLE_ID</string>
             <key>CFBundleURLSchemes</key>
             <array>
                 <string>lattices</string>
@@ -117,10 +176,11 @@ PLIST
 }
 
 cmd_build() {
-    echo "Building release..."
+    echo "Building dev app..."
     cd "$APP_DIR" && swift build -c release
-    # Refresh the bundle so dev builds and published bundles are complete.
-    rm -rf "$BUNDLE/Contents/MacOS" "$RESOURCES_DIR"
+    # Build into a repo-local dev artifact, then install to a stable app path
+    # that macOS permissions can trust across rebuilds.
+    rm -rf "$BUNDLE"
     mkdir -p "$(dirname "$BUNDLE_BIN")" "$RESOURCES_DIR"
     cp "$BINARY" "$BUNDLE_BIN"
     if [ -f "$ICON" ]; then
@@ -132,18 +192,26 @@ cmd_build() {
     write_info_plist
     # Re-sign so TCC permissions persist across rebuilds
     sign_bundle
+    touch "$BUNDLE" "$BUNDLE/Contents"
+    sync_bundle_copy "$INSTALL_BUNDLE"
+    clear_lattices_drag_cache
     green "Build complete."
+    dim "Installed: $INSTALL_BUNDLE"
 }
 
 cmd_restart() {
     echo "Restarting Lattices..."
+    /usr/bin/osascript -e 'tell application id "dev.lattices.app.dev" to quit' >/dev/null 2>&1 || true
+    /usr/bin/osascript -e 'tell application id "dev.lattices.app" to quit' >/dev/null 2>&1 || true
     pkill -x Lattices 2>/dev/null && sleep 1 || true
     cmd_build
-    open "$BUNDLE"
+    open "$INSTALL_BUNDLE" --args --lattices-cli-root "$ROOT" "$@"
     green "Lattices restarted."
 }
 
 cmd_quit() {
+    /usr/bin/osascript -e 'tell application id "dev.lattices.app.dev" to quit' >/dev/null 2>&1 || true
+    /usr/bin/osascript -e 'tell application id "dev.lattices.app" to quit' >/dev/null 2>&1 || true
     if pkill -x Lattices 2>/dev/null; then
         green "Lattices stopped."
     else
@@ -152,10 +220,15 @@ cmd_quit() {
 }
 
 cmd_launch() {
-    if pgrep -x Lattices >/dev/null 2>&1; then
-        dim "Lattices is already running."
+    if is_install_bundle_running; then
+        dim "Lattices dev app is already running."
     else
-        open "$BUNDLE"
+        if pgrep -x Lattices >/dev/null 2>&1; then
+            dim "A different Lattices bundle is running. Switching to the dev permission target."
+            cmd_quit
+        fi
+        ensure_install_bundle
+        open "$INSTALL_BUNDLE" --args --lattices-cli-root "$ROOT" "$@"
         green "Lattices launched."
     fi
 }
@@ -249,10 +322,10 @@ cmd_help() {
 case "${1:-help}" in
     link)       cmd_link ;;
     unlink)     cmd_unlink ;;
-    restart)    cmd_restart ;;
+    restart)    cmd_restart "${@:2}" ;;
     build)      cmd_build ;;
     quit|stop)  cmd_quit ;;
-    launch|start) cmd_launch ;;
+    launch|start) cmd_launch "${@:2}" ;;
     logs)       cmd_logs ;;
     log)        cmd_log "${2:-30}" ;;
     clear-logs) cmd_clear_logs ;;