@laylzj777/my-apple-apple-eventkit 1.1.0

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@laylzj777/my-apple-apple-eventkit",
+  "version": "1.1.0",
+  "description": "Apple Calendar & Reminders MCP server with a prebuilt EventKit CLI and lenient date-input normalization. Based on mcp-server-apple-events (FradSer, MIT).",
+  "author": "my-apple-apple-eventkit contributors",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lay777/my-apple-apple-eventkit.git"
+  },
+  "keywords": [
+    "mcp",
+    "apple",
+    "reminders",
+    "calendar",
+    "events",
+    "automation"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "bin": {
+    "apple-calendar-mcp": "./dist/bin/apple-calendar.js",
+    "apple-reminders-mcp": "./dist/bin/apple-reminders.js"
+  },
+  "files": [
+    "bin/event",
+    "bin/event-disclaim",
+    "dist/",
+    "scripts/postinstall.mjs",
+    "scripts/build-event.mjs",
+    "scripts/event-Info.plist",
+    "scripts/event.entitlements",
+    "scripts/disclaim.c",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build:ts": "tsc -p tsconfig.build.json",
+    "build:event": "node scripts/build-event.mjs",
+    "build": "pnpm run clean && pnpm run build:ts && pnpm run build:event",
+    "notarize": "node scripts/notarize.mjs",
+    "build:release": "pnpm run clean && pnpm run build:ts && pnpm run build:event && pnpm run notarize",
+    "postinstall": "node scripts/postinstall.mjs",
+    "test": "NODE_NO_WARNINGS=1 jest",
+    "test:ci": "NODE_NO_WARNINGS=1 jest --coverage",
+    "lint": "pnpm exec biome check --write --unsafe && pnpm exec tsc --noEmit --project tsconfig.json",
+    "check": "pnpm run lint && pnpm run test:ci"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "exit-on-epipe": "^1.0.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.2",
+    "@swc/core": "^1.15.43",
+    "@swc/jest": "^0.2.39",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^26.1.0",
+    "jest": "^30.4.2",
+    "typescript": "^6.0.3"
+  },
+  "peerDependencies": {
+    "typescript": ">=5.0.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "test-exclude": "^8.0.0",
+      "glob": "^13.0.6"
+    },
+    "onlyBuiltDependencies": [
+      ",",
+      "b",
+      "d",
+      "e",
+      "i",
+      "k",
+      "l",
+      "o",
+      "r",
+      "s",
+      "u",
+      "unrs-resolver",
+      "w"
+    ]
+  },
+  "packageManager": "pnpm@10.28.2+sha512.41872f037ad22f7348e3b1debbaf7e867cfd448f2726d9cf74c08f19507c31d2c8e7a11525b983febc2df640b5438dee6023ebb1f84ed43cc2d654d2bc326264"
+}

package/scripts/build-event.mjs

@@ -0,0 +1,513 @@
+import { execFile } from 'node:child_process';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+// Use `execFile` with an argv array so paths containing shell metacharacters
+// (spaces, `$`, backticks) reach the tool intact.
+async function run(command, args, options = {}) {
+  try {
+    const { stdout, stderr } = await execFileAsync(command, args, options);
+    return { stdout: stdout ?? '', stderr: stderr ?? '' };
+  } catch (error) {
+    error.stdout = error.stdout ?? '';
+    error.stderr = error.stderr ?? '';
+    throw error;
+  }
+}
+
+// macOS 26+ SDKs ship a Foundation.swiftinterface that older swiftc cannot
+// parse, surfacing as `could not build module 'Foundation'` /
+// `SDK is not supported by the compiler` (see issue #85). The vendored
+// `event` package requires Swift 6.2+ (swift-tools-version in its
+// Package.swift) and is compiled by the host's swiftc, so we still need the
+// same minimum-version guard.
+const MIN_SWIFT_MAJOR_FOR_MACOS_26 = 6;
+const MIN_SWIFT_MINOR_FOR_MACOS_26 = 3;
+
+async function getSwiftVersion() {
+  try {
+    const { stdout } = await run('xcrun', ['swiftc', '--version']);
+    const match = stdout.match(/Apple Swift version (\d+)\.(\d+)(?:\.(\d+))?/);
+    if (!match) return null;
+    return {
+      major: Number.parseInt(match[1], 10),
+      minor: Number.parseInt(match[2], 10),
+      raw: match[0].replace(/^Apple Swift version /, ''),
+    };
+  } catch {
+    return null;
+  }
+}
+
+async function getSdkVersion() {
+  try {
+    const { stdout } = await run('xcrun', ['--show-sdk-version']);
+    const trimmed = stdout.trim();
+    const [maj, min] = trimmed.split('.');
+    return {
+      major: Number.parseInt(maj, 10),
+      minor: Number.parseInt(min ?? '0', 10),
+      raw: trimmed,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function isSdkTooNewForSwift(swift, sdk) {
+  if (!swift || !sdk) return false;
+  if (sdk.major < 26) return false;
+  if (swift.major > MIN_SWIFT_MAJOR_FOR_MACOS_26) return false;
+  if (swift.major < MIN_SWIFT_MAJOR_FOR_MACOS_26) return true;
+  return swift.minor < MIN_SWIFT_MINOR_FOR_MACOS_26;
+}
+
+function printIncompatibilityRemediation(swift, sdk) {
+  const swiftStr = swift ? swift.raw : 'unknown';
+  const sdkStr = sdk ? sdk.raw : 'unknown';
+  console.error(
+    [
+      '',
+      `Error: Swift toolchain ${swiftStr} cannot build against the macOS ${sdkStr} SDK.`,
+      `The macOS 26+ SDK requires Swift ${MIN_SWIFT_MAJOR_FOR_MACOS_26}.${MIN_SWIFT_MINOR_FOR_MACOS_26} or newer; older swiftc fails with`,
+      `"could not build module 'Foundation'" because the SDK's Foundation.swiftinterface`,
+      'uses availability markers older compilers do not understand.',
+      '',
+      'See: https://github.com/FradSer/mcp-server-apple-events/issues/85',
+      '',
+      'Fixes (pick one):',
+      '  1. Install Xcode 26.x from the App Store (ships Swift 6.3+).',
+      '  2. Update Command Line Tools to a version that ships Swift 6.3+:',
+      '       softwareupdate --list',
+      '       sudo softwareupdate -i "Command Line Tools for Xcode-<latest>"',
+      '  3. If both Xcode and Command Line Tools are installed, point xcode-select',
+      '     at the full Xcode that has the matching toolchain:',
+      '       sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer',
+      '',
+    ].join('\n'),
+  );
+}
+
+function looksLikeFoundationModuleMismatch(stderr) {
+  if (!stderr) return false;
+  return (
+    /could not build module 'Foundation'/.test(stderr) ||
+    /SDK is not supported by the compiler/.test(stderr) ||
+    /module compiled with Swift [\d.]+ cannot be imported/.test(stderr)
+  );
+}
+
+/**
+ * Resolves the code-signing identity to use.
+ *
+ * Priority order:
+ *   1. APPLE_SIGNING_IDENTITY env var (explicit override)
+ *   2. First "Developer ID Application:" cert found in the login keychain
+ *   3. Ad-hoc ("-") with a warning
+ *
+ * A Developer ID signature makes `event` the TCC-responsible process
+ * regardless of which parent process spawned it, fixing Calendar permission
+ * dialogs on OCLP Sequoia and macOS 26+.
+ */
+async function resolveSigningIdentity() {
+  if (process.env.APPLE_SIGNING_IDENTITY) {
+    return process.env.APPLE_SIGNING_IDENTITY;
+  }
+
+  try {
+    const { stdout } = await run('security', [
+      'find-identity',
+      '-v',
+      '-p',
+      'codesigning',
+    ]);
+    const lines = stdout.split('\n');
+
+    // Prefer Developer ID Application (trusted on all Macs) over Apple Development
+    // (trusted only on the developer's own machine, but sufficient for local use).
+    for (const prefix of ['Developer ID Application:', 'Apple Development:']) {
+      const matches = lines.filter((line) => line.includes(prefix));
+      if (matches.length === 1) {
+        const m = matches[0].match(/"([^"]+)"/);
+        if (m) return m[1];
+      }
+      if (matches.length > 1) {
+        console.warn(`Multiple "${prefix}" certificates found in keychain.`);
+        console.warn(
+          'Set APPLE_SIGNING_IDENTITY to the exact certificate name to avoid ambiguity.',
+        );
+        break;
+      }
+    }
+  } catch {
+    // security binary unavailable — fall through to ad-hoc
+  }
+
+  console.warn(
+    'No Apple code-signing certificate found. Using ad-hoc signing (-).',
+  );
+  console.warn(
+    'Calendar TCC permission dialogs may be suppressed on OCLP Sequoia and macOS 26+.',
+  );
+  console.warn(
+    'To fix this, set APPLE_SIGNING_IDENTITY="Developer ID Application: Your Name (TEAMID)".',
+  );
+  return '-';
+}
+
+// `event`'s Package.swift declares an SSH dependency
+// (git@github.com:FradSer/apple-sync-kit.git). Most build hosts have no SSH
+// key registered with GitHub, so a plain `swift build` fails resolving that
+// dependency. `event`'s own CI works around this by rewriting SSH GitHub
+// URLs to HTTPS for the duration of the git-fetch child process (see
+// FradSer/event@bf34a4c, "Configure git to fetch SSH dependencies via
+// HTTPS"). Do the same here via `GIT_CONFIG_*` env vars scoped only to the
+// `swift build` child processes below — this never touches the invoking
+// user's global ~/.gitconfig.
+const SSH_TO_HTTPS_GIT_ENV = {
+  GIT_CONFIG_COUNT: '1',
+  GIT_CONFIG_KEY_0: 'url.https://github.com/.insteadOf',
+  GIT_CONFIG_VALUE_0: 'git@github.com:',
+};
+
+/**
+ * Resolve the Info.plist used for codesigning: when APP_EVENT_DISPLAY_NAME is
+ * unset, use the source file as-is; when set, replace CFBundleName /
+ * CFBundleDisplayName with that value and write a temporary plist under bin/
+ * (this generated file is not part of the npm files whitelist).
+ */
+async function resolveInfoPlist(sourceFile, outDir) {
+  const displayName = process.env.APP_EVENT_DISPLAY_NAME;
+  if (!displayName) return sourceFile;
+
+  const escaped = displayName
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+  const source = await fs.readFile(sourceFile, 'utf-8');
+  const patched = source
+    .replace(
+      /(<key>CFBundleName<\/key>\s*<string>)[^<]*(<\/string>)/,
+      `$1${escaped}$2`,
+    )
+    .replace(
+      /(<key>CFBundleDisplayName<\/key>\s*<string>)[^<]*(<\/string>)/,
+      `$1${escaped}$2`,
+    );
+  await fs.mkdir(outDir, { recursive: true });
+  const generated = path.join(outDir, 'event-Info.generated.plist');
+  await fs.writeFile(generated, patched, 'utf-8');
+  console.log(`Display name overridden via APP_EVENT_DISPLAY_NAME: ${displayName}`);
+  return generated;
+}
+
+async function main() {
+  console.log(
+    'Building vendored `event` CLI (FradSer/event) for Apple Reminders MCP Server...',
+  );
+
+  if (process.platform !== 'darwin') {
+    console.error('Error: This project requires macOS to compile `event`.');
+    process.exit(1);
+  }
+
+  try {
+    await run('xcrun', ['--find', 'lipo']);
+  } catch (_error) {
+    console.error(
+      'Error: lipo not found. Required for universal binary creation.',
+    );
+    console.error(
+      'Please install Xcode or Xcode Command Line Tools: xcode-select --install',
+    );
+    process.exit(1);
+  }
+
+  // Resolve paths relative to script location, not process.cwd()
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = path.dirname(__filename);
+  const projectRoot = path.resolve(__dirname, '..');
+  const eventPackagePath = path.join(projectRoot, 'vendor', 'event');
+  const eventPackageManifest = path.join(eventPackagePath, 'Package.swift');
+  const binDir = path.join(projectRoot, 'bin');
+  const outputFile = path.join(binDir, 'event');
+  const scriptsDir = path.join(projectRoot, 'scripts');
+  // The TCC prompt display name is build-time configurable: APP_EVENT_DISPLAY_NAME
+  // overrides CFBundleName/CFBundleDisplayName in the plist (a temp plist is
+  // generated for codesigning; the source file stays untouched).
+  // It is not runtime-configurable — the name is baked into the binary via code
+  // signing, which is how the system prevents permission-prompt spoofing.
+  const infoPlistFile = await resolveInfoPlist(
+    path.join(scriptsDir, 'event-Info.plist'),
+    binDir,
+  );
+  const entitlementsFile = path.join(scriptsDir, 'event.entitlements');
+  const disclaimSourceFile = path.join(scriptsDir, 'disclaim.c');
+  const disclaimOutputFile = path.join(binDir, 'event-disclaim');
+
+  // Run the independent pre-flight checks (toolchain probe, manifest access,
+  // bin dir creation) concurrently so `pnpm install`'s postinstall hook
+  // doesn't serialise them.
+  const [swift, sdk, manifestExists] = await Promise.all([
+    getSwiftVersion(),
+    getSdkVersion(),
+    fs.access(eventPackageManifest).then(
+      () => true,
+      () => false,
+    ),
+    fs.mkdir(binDir, { recursive: true }),
+  ]);
+
+  if (!swift) {
+    console.error('Error: Swift compiler (swiftc) not found via xcrun.');
+    console.error(
+      'Please install Xcode or Xcode Command Line Tools: xcode-select --install',
+    );
+    process.exit(1);
+  }
+  if (isSdkTooNewForSwift(swift, sdk)) {
+    printIncompatibilityRemediation(swift, sdk);
+    process.exit(1);
+  }
+  if (!manifestExists) {
+    console.error(
+      `Error: vendor/event/Package.swift not found at ${eventPackageManifest}`,
+    );
+    console.error(
+      'The `event` source tree is vendored as a git submodule. Run:',
+    );
+    console.error('  git submodule update --init --recursive');
+    process.exit(1);
+  }
+
+  console.log(
+    `Compiling vendor/event in release mode (swift ${swift.raw}, sdk ${sdk?.raw ?? 'unknown'})...`,
+  );
+
+  // Build a universal (fat) binary containing both arm64 and x86_64 slices.
+  // Modern SwiftPM (as of this Swift toolchain) has no public `--arch` flag
+  // that emits a universal Mach-O from a single `swift build` invocation, so
+  // each slice is built separately — pinned to `event`'s own deployment
+  // target (`platforms: [.macOS(.v14)]` in vendor/event/Package.swift) via
+  // `--triple`, with a dedicated `--scratch-path` so the two builds don't
+  // clobber each other's `.build` cache — then merged with `lipo`. This
+  // mirrors what the old EventKitCLI build (`swiftc -target ...` per slice +
+  // `lipo -create`) did for the same reason.
+  const gitEnv = { ...process.env, ...SSH_TO_HTTPS_GIT_ENV };
+  const slices = [
+    {
+      triple: 'arm64-apple-macosx14.0',
+      scratchPath: path.join(eventPackagePath, '.build-arm64'),
+      label: 'arm64',
+    },
+    {
+      triple: 'x86_64-apple-macosx14.0',
+      scratchPath: path.join(eventPackagePath, '.build-x86_64'),
+      label: 'x86_64',
+    },
+  ];
+
+  let builtBinaries;
+  try {
+    // Ask SwiftPM for the actual release output directory per slice instead
+    // of assuming a `.build/<triple>/release` layout, since that convention
+    // is not a stable public contract.
+    builtBinaries = await Promise.all(
+      slices.map(async (s) => {
+        const { stdout: binPathOut } = await run(
+          'swift',
+          [
+            'build',
+            '--show-bin-path',
+            '-c',
+            'release',
+            '--package-path',
+            eventPackagePath,
+            '--scratch-path',
+            s.scratchPath,
+            '--triple',
+            s.triple,
+          ],
+          { env: gitEnv },
+        );
+        return path.join(binPathOut.trim(), 'event');
+      }),
+    );
+
+    // SwiftPM's incremental build does not track the -sectcreate Info.plist
+    // as a link input, so editing scripts/event-Info.plist alone would leave
+    // a stale plist embedded in the cached executable. Deleting the slice
+    // outputs forces a relink (object files stay cached — this costs seconds,
+    // not a rebuild).
+    await Promise.all(
+      slices.map((_, i) => fs.rm(builtBinaries[i], { force: true })),
+    );
+
+    // Slices are independent — build in parallel to roughly halve build time.
+    const results = await Promise.all(
+      slices.map((s) =>
+        run(
+          'swift',
+          [
+            'build',
+            '-c',
+            'release',
+            '--package-path',
+            eventPackagePath,
+            '--scratch-path',
+            s.scratchPath,
+            '--triple',
+            s.triple,
+            // Embed the Info.plist (bundle id + EventKit usage strings) into
+            // the executable so TCC can prompt for `event` itself when the
+            // binary is spawned disclaimed (see scripts/disclaim.c). A bare
+            // Mach-O has no bundle, so the plist rides in the __info_plist
+            // section of __TEXT — the documented location TCC reads for
+            // command-line tools.
+            '-Xlinker',
+            '-sectcreate',
+            '-Xlinker',
+            '__TEXT',
+            '-Xlinker',
+            '__info_plist',
+            '-Xlinker',
+            infoPlistFile,
+          ],
+          { env: gitEnv },
+        ),
+      ),
+    );
+    results.forEach(({ stdout, stderr }, i) => {
+      if (stderr) console.warn(`${slices[i].label} build warnings:\n${stderr}`);
+      if (stdout) console.log(stdout);
+    });
+
+    await run('xcrun', [
+      'lipo',
+      '-create',
+      '-output',
+      outputFile,
+      ...builtBinaries,
+    ]);
+
+    console.log(
+      `Compilation successful! Universal binary saved to ${outputFile}`,
+    );
+  } catch (error) {
+    console.error('Compilation failed!');
+    const stderr = error?.stderr ?? '';
+    if (looksLikeFoundationModuleMismatch(stderr)) {
+      printIncompatibilityRemediation(swift, sdk);
+    }
+    console.error(error);
+    process.exit(1);
+  }
+
+  await fs.chmod(outputFile, '755');
+  console.log('Binary is now executable.');
+
+  // Compile the disclaim shim (scripts/disclaim.c). It posix_spawns `event`
+  // with TCC responsibility disclaimed, so the Reminders/Calendar permission
+  // prompt is attributed to `event` itself (which ships the usage strings
+  // above) instead of the desktop MCP client that launched the server —
+  // clients like Codex Desktop declare no EventKit usage strings, and TCC
+  // refuses the request outright when they are the responsible process
+  // (issue #93). clang emits a universal Mach-O directly from repeated
+  // -arch flags; the deployment target matches `event`'s macosx14.0 triples.
+  try {
+    await run('xcrun', [
+      'clang',
+      '-O2',
+      '-mmacosx-version-min=14.0',
+      '-arch',
+      'arm64',
+      '-arch',
+      'x86_64',
+      '-o',
+      disclaimOutputFile,
+      disclaimSourceFile,
+    ]);
+    await fs.chmod(disclaimOutputFile, '755');
+    console.log(`Disclaim shim saved to ${disclaimOutputFile}`);
+  } catch (error) {
+    console.error('Disclaim shim compilation failed!');
+    console.error(error);
+    process.exit(1);
+  }
+
+  const signingIdentity = await resolveSigningIdentity();
+  const isAdHoc = signingIdentity === '-';
+
+  console.log(
+    isAdHoc
+      ? 'Signing with ad-hoc identity...'
+      : `Signing with Developer ID: ${signingIdentity}`,
+  );
+
+  // --options runtime: Hardened Runtime, required for notarization and for
+  //   macOS 26+ TCC prompting policy.
+  // --timestamp: secure timestamp from Apple CA; included for Developer ID
+  //   signatures to ensure long-term validity; omitted for ad-hoc (no CA).
+  // --entitlements (event only): hardened-runtime binaries must hold the
+  //   com.apple.security.personal-information.{calendars,reminders}
+  //   entitlements to be allowed to request EventKit access when they are
+  //   the TCC-responsible process (which they are when spawned disclaimed).
+  // --identifier (event only): pinned to the CFBundleIdentifier in
+  //   scripts/event-Info.plist so the TCC grant is recorded under a stable,
+  //   deterministic identity across rebuilds.
+  const signBinary = async (file, extraArgs) => {
+    const codesignArgs = [
+      '--force',
+      '--sign',
+      signingIdentity,
+      '--options',
+      'runtime',
+      ...(isAdHoc ? [] : ['--timestamp']),
+      ...extraArgs,
+      file,
+    ];
+    const { stdout: csOut, stderr: csErr } = await run(
+      'codesign',
+      codesignArgs,
+    );
+    if (csErr) {
+      console.warn(`codesign warnings:\n${csErr}`);
+    }
+    if (csOut) {
+      console.log(csOut);
+    }
+  };
+
+  try {
+    await signBinary(outputFile, [
+      '--identifier',
+      'io.github.lay777.calendar-event-cli',
+      '--entitlements',
+      entitlementsFile,
+    ]);
+    await signBinary(disclaimOutputFile, []);
+    console.log(
+      isAdHoc
+        ? 'Binaries signed (ad-hoc) with hardened runtime.'
+        : 'Binaries signed with Developer ID and hardened runtime.',
+    );
+  } catch (error) {
+    console.error('codesign failed!');
+    console.error(error);
+    process.exit(1);
+  }
+
+  console.log('event CLI build complete!');
+}
+
+main().catch((error) => {
+  console.error(
+    'An unexpected error occurred during the build process:',
+    error,
+  );
+  process.exit(1);
+});

package/scripts/disclaim.c

@@ -0,0 +1,69 @@
+/*
+ * disclaim.c — TCC responsibility disclaim shim (issue #93).
+ *
+ * Usage: event-disclaim <binary> [args...]
+ *
+ * Re-execs <binary> via posix_spawn with POSIX_SPAWN_SETEXEC and TCC
+ * responsibility disclaimed, making <binary> its own TCC-responsible
+ * process. macOS then reads the EventKit usage strings from <binary>'s
+ * embedded Info.plist and can show the Reminders/Calendar permission
+ * prompt even when the process tree was started by a GUI MCP client
+ * (Codex Desktop, Claude Desktop, ...) that declares no such strings —
+ * without the disclaim, TCC attributes the request to that client and
+ * refuses it before EventKit is reached.
+ *
+ * POSIX_SPAWN_SETEXEC replaces this process image in place (exec
+ * semantics), so stdio, exit codes, and signals need no proxying.
+ */
+#include <spawn.h>
+#include <stdio.h>
+#include <string.h>
+
+extern char **environ;
+
+/*
+ * Private libSystem API (macOS 10.14+), the same call Chromium uses to make
+ * helper processes self-responsible for TCC. Declared weakly so the shim
+ * degrades to a plain exec — the pre-shim, host-attributed behavior — if a
+ * future macOS removes the symbol.
+ */
+extern int responsibility_spawnattrs_setdisclaim(posix_spawnattr_t *attrs,
+                                                 int disclaim)
+    __attribute__((weak_import));
+
+int main(int argc, char *argv[]) {
+  if (argc < 2) {
+    fprintf(stderr, "usage: %s <binary> [args...]\n",
+            argc > 0 ? argv[0] : "event-disclaim");
+    return 64;
+  }
+
+  posix_spawnattr_t attr;
+  int rc = posix_spawnattr_init(&attr);
+  if (rc != 0) {
+    fprintf(stderr, "event-disclaim: posix_spawnattr_init: %s\n",
+            strerror(rc));
+    return 127;
+  }
+  rc = posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETEXEC);
+  if (rc != 0) {
+    /* Without SETEXEC, posix_spawn would fork instead of exec-replacing
+       this process — fail loudly rather than leave a confusing parent. */
+    posix_spawnattr_destroy(&attr);
+    fprintf(stderr, "event-disclaim: posix_spawnattr_setflags: %s\n",
+            strerror(rc));
+    return 127;
+  }
+  if (responsibility_spawnattrs_setdisclaim) {
+    responsibility_spawnattrs_setdisclaim(&attr, 1);
+  }
+
+  pid_t pid;
+  rc = posix_spawn(&pid, argv[1], NULL, &attr, &argv[1], environ);
+  /* Reached only when the spawn itself failed — with SETEXEC a successful
+     spawn never returns. */
+  posix_spawnattr_destroy(&attr);
+  fprintf(stderr, "event-disclaim: failed to exec %s: %s\n", argv[1],
+          strerror(rc));
+  return 127;
+}