create-walle 0.9.25 → 0.9.26

package/template/claude-task-manager/bin/ctm-hotkey.swift

@@ -1,12 +1,19 @@
 #!/usr/bin/env swift
 // ctm-hotkey — Global hotkey daemon for CTM
-// Registers Cmd+Shift+S at the macOS event system level.
+// Registers Cmd+Shift+S as a system-wide hotkey via Carbon's RegisterEventHotKey.
 // When triggered, POSTs to CTM's screenshot API.
 //
-// Requirements: Accessibility permission (System Settings > Privacy > Accessibility)
-// Install:      swift build -> launchd plist (see install-hotkey.sh)
+// NO special permission required. RegisterEventHotKey is narrowly scoped — the process only
+// ever learns that this one combo was pressed, never any other input — so macOS does NOT gate
+// it behind the Accessibility ("can read all keystrokes") permission that a CGEventTap or an
+// NSEvent global monitor would require. This is the same API Electron/VS Code/Slack/Alfred use.
+// Removing the Accessibility dependency is the whole point: the prior CGEventTap build bricked
+// itself whenever the end user didn't grant Accessibility in time.
+//
+// Install: swiftc -> launchd plist (see install-hotkey.sh)
 
 import Cocoa
+import Carbon
 import Foundation
 
 // --- Configuration ---
@@ -14,9 +21,9 @@ let CTM_PORT = ProcessInfo.processInfo.environment["CTM_PORT"] ?? "3456"
 let CTM_URL = "http://localhost:\(CTM_PORT)/api/screenshot"
 
 // --- Hotkey: Cmd+Shift+S ---
-// CGEvent key codes: S = 1, modifiers: Cmd = .maskCommand, Shift = .maskShift
-let TARGET_KEYCODE: Int64 = 1  // 'S' key
-let TARGET_MODIFIERS: CGEventFlags = [.maskCommand, .maskShift]
+// kVK_ANSI_S == 1 ('S'); Carbon modifier masks cmdKey | shiftKey.
+let HOTKEY_KEYCODE: UInt32 = UInt32(kVK_ANSI_S)
+let HOTKEY_MODIFIERS: UInt32 = UInt32(cmdKey | shiftKey)
 
 func triggerScreenshot() {
     guard let url = URL(string: CTM_URL) else {
@@ -25,94 +32,73 @@ func triggerScreenshot() {
     }
     var request = URLRequest(url: url)
     request.httpMethod = "POST"
-    request.timeoutInterval = 5
-
-    // Fire and forget — don't block the event tap callback
-    URLSession.shared.dataTask(with: request) { data, response, error in
-        if let error = error {
-            // CTM might not be running — that's fine, fail silently
-            print("[ctm-hotkey] Request failed: \(error.localizedDescription)")
-            return
-        }
-        if let http = response as? HTTPURLResponse, http.statusCode == 200 {
-            print("[ctm-hotkey] Screenshot triggered")
+    // Generous timeout: the server's response only returns AFTER capture+save, which can take a few
+    // seconds on a slow machine or cold start. We don't need the body — this is fire-and-forget — so
+    // a long ceiling just avoids a scary "Request failed: timed out" line when capture is merely slow.
+    request.timeoutInterval = 60
+
+    print("[ctm-hotkey] Screenshot triggered")  // log the FIRE immediately, before the async result
+    URLSession.shared.dataTask(with: request) { _, response, error in
+        if let http = response as? HTTPURLResponse, http.statusCode != 200 {
+            print("[ctm-hotkey] Server returned HTTP \(http.statusCode)")
+        } else if let error = error {
+            // CTM might not be running — that's fine, fail quietly.
+            print("[ctm-hotkey] Request error: \(error.localizedDescription)")
         }
     }.resume()
 }
 
-// --- CGEvent Tap ---
-// Store the tap globally so the callback can re-enable it
-var globalTap: CFMachPort?
-
-func eventTapCallback(proxy: CGEventTapProxy, type: CGEventType, event: CGEvent, refcon: UnsafeMutableRawPointer?) -> Unmanaged<CGEvent>? {
-    // Re-enable tap if it gets disabled (macOS disables taps that take too long)
-    if type == .tapDisabledByTimeout || type == .tapDisabledByUserInput {
-        if let tap = globalTap {
-            CGEvent.tapEnable(tap: tap, enable: true)
-        }
-        return Unmanaged.passRetained(event)
-    }
-
-    guard type == .keyDown else {
-        return Unmanaged.passRetained(event)
-    }
-
-    let keyCode = event.getIntegerValueField(.keyboardEventKeycode)
-    let flags = event.flags
-
-    // Check: Cmd+Shift held, S key pressed
-    // Mask out caps lock and other irrelevant modifiers
-    let relevantFlags = flags.intersection([.maskCommand, .maskShift, .maskControl, .maskAlternate])
-    if keyCode == TARGET_KEYCODE && relevantFlags == TARGET_MODIFIERS {
-        triggerScreenshot()
-        // Return nil to consume the event (prevent "Save As" in other apps)
-        return nil
-    }
-
-    return Unmanaged.passRetained(event)
+// --- Carbon hot-key handler ---
+// A registered hot key is delivered to us BEFORE the focused app sees it, so the combo is
+// naturally consumed (no "Save As" in the foreground app) without the old return-nil tap hack.
+func hotKeyHandler(_ next: EventHandlerCallRef?, _ event: EventRef?, _ userData: UnsafeMutableRawPointer?) -> OSStatus {
+    triggerScreenshot()
+    return noErr
 }
 
 // --- Main ---
+setbuf(stdout, nil)  // unbuffered: this is a launchd daemon, its log must reflect state live
 print("[ctm-hotkey] Starting global hotkey daemon (Cmd+Shift+S -> CTM Screenshot)")
 print("[ctm-hotkey] CTM endpoint: \(CTM_URL)")
 
-// Check Accessibility permission
-let trusted = AXIsProcessTrustedWithOptions(
-    [kAXTrustedCheckOptionPrompt.takeUnretainedValue(): true] as CFDictionary
-)
-if !trusted {
-    print("[ctm-hotkey] WARNING: Accessibility permission not granted.")
-    print("[ctm-hotkey] Go to: System Settings > Privacy & Security > Accessibility")
-    print("[ctm-hotkey] Add this binary, then restart.")
-    // Continue anyway — the tap will fail gracefully, and the permission dialog is shown
+// A launchd LaunchAgent starts as a background-only process with no window-server connection,
+// so Carbon's hot-key dispatcher would never deliver events to it. Promote to an "accessory"
+// app (no Dock icon, no menu bar) to establish that connection — exactly what menu-bar-less
+// hot-key utilities do. This needs no permission.
+NSApplication.shared.setActivationPolicy(.accessory)
+
+// Install the hot-key event handler once on the dispatcher target.
+var eventType = EventTypeSpec(eventClass: OSType(kEventClassKeyboard), eventKind: UInt32(kEventHotKeyPressed))
+InstallEventHandler(GetEventDispatcherTarget(), hotKeyHandler, 1, &eventType, nil, nil)
+
+var hotKeyRef: EventHotKeyRef?
+let hotKeyID = EventHotKeyID(signature: OSType(0x43544D4B) /* 'CTMK' */, id: 1)
+
+func registerHotKey() -> Bool {
+    if hotKeyRef != nil { return true }
+    let status = RegisterEventHotKey(
+        HOTKEY_KEYCODE, HOTKEY_MODIFIERS, hotKeyID,
+        GetEventDispatcherTarget(), 0, &hotKeyRef
+    )
+    return status == noErr && hotKeyRef != nil
 }
 
-// Create event tap for keyDown events
-let eventMask = (1 << CGEventType.keyDown.rawValue)
-
-let machPort = CGEvent.tapCreate(
-    tap: .cgSessionEventTap,
-    place: .headInsertEventTap,
-    options: .defaultTap,
-    eventsOfInterest: CGEventMask(eventMask),
-    callback: eventTapCallback,
-    userInfo: nil
-)
-
-globalTap = machPort
-guard let tap = machPort else {
-    print("[ctm-hotkey] ERROR: Failed to create event tap.")
-    print("[ctm-hotkey] This usually means Accessibility permission is not granted.")
-    print("[ctm-hotkey] Go to: System Settings > Privacy & Security > Accessibility")
-    exit(1)
+if registerHotKey() {
+    print("[ctm-hotkey] Global hotkey registered. Press Cmd+Shift+S anywhere to screenshot.")
+} else {
+    // NEVER exit on failure — that's what bricked the old CGEventTap daemon (clean exit +
+    // KeepAlive/SuccessfulExit:false → launchd refuses to restart). Stay alive and retry so a
+    // transient failure (e.g. another app momentarily holding the combo) self-heals.
+    print("[ctm-hotkey] WARNING: hotkey registration failed; retrying every 5s…")
+    Timer.scheduledTimer(withTimeInterval: 5, repeats: true) { timer in
+        if registerHotKey() {
+            print("[ctm-hotkey] Global hotkey registered. Press Cmd+Shift+S anywhere to screenshot.")
+            timer.invalidate()
+        }
+    }
 }
 
-let runLoopSource = CFMachPortCreateRunLoopSource(kCFAllocatorDefault, tap, 0)
-CFRunLoopAddSource(CFRunLoopGetCurrent(), runLoopSource, .commonModes)
-CGEvent.tapEnable(tap: tap, enable: true)
-
-print("[ctm-hotkey] Global hotkey registered. Press Cmd+Shift+S anywhere to screenshot.")
 print("[ctm-hotkey] Press Ctrl+C to stop.")
 
-// Run the event loop (blocks forever)
-CFRunLoopRun()
+// Run the Cocoa run loop (pumps Carbon hot-key events); blocks forever.
+NSApp.run()

package/template/claude-task-manager/bin/ctm-screen-auth.swift

@@ -0,0 +1,37 @@
+// ctm-screen-auth — request macOS Screen Recording ("Screen & System Audio Recording")
+// permission for the current macOS responsible process.
+//
+// `screencapture` is checked by TCC against its responsible process, not only its own
+// binary. CTM may capture directly under the CTM bundle identity, or through the
+// ctm-disclaim + real-node bridge. This helper must run through that same responsible
+// process path so CGRequestScreenCaptureAccess() prompts for the identity that the next
+// `screencapture` call will actually use.
+//
+// `screencapture` never reliably surfaces the permission prompt; it just fails.
+// CGRequestScreenCaptureAccess() DOES surface the prompt. After the user enables the
+// permission, CTM should be relaunched for macOS to honor the new Screen Recording grant.
+//
+// Output (stdout): "granted" if access is already present, "requested" if we triggered the
+// system prompt, "denied" if the request returned without access. Exit 0 only when granted.
+
+import CoreGraphics
+import Foundation
+
+func emit(_ s: String) { FileHandle.standardOutput.write((s + "\n").data(using: .utf8)!) }
+
+// --preflight: report the current grant WITHOUT ever surfacing a prompt. Used to probe several
+// candidate node identities and pick one that is ALREADY granted, so the common case needs no
+// user action at all. (CGRequestScreenCaptureAccess would pop a dialog for each ungranted probe.)
+if CommandLine.arguments.contains("--preflight") {
+    let ok = CGPreflightScreenCaptureAccess()
+    emit(ok ? "granted" : "denied")
+    exit(ok ? 0 : 1)
+}
+
+if CGPreflightScreenCaptureAccess() {
+    emit("granted")
+    exit(0)
+}
+let granted = CGRequestScreenCaptureAccess()
+emit(granted ? "granted" : "requested")
+exit(granted ? 0 : 2)

package/template/claude-task-manager/bin/install-hotkey.sh

@@ -1,29 +1,89 @@
 #!/bin/bash
-# install-hotkey.sh — Compile and install CTM global hotkey daemon
+# install-hotkey.sh — Build + install the CTM global screenshot hotkey as a signed .app bundle.
 # Usage: bash install-hotkey.sh [install|uninstall|status]
+#
+# Why a .app bundle (not a bare binary): RegisterEventHotKey only delivers a global hotkey to a GUI
+# app the window server recognizes. A bare launchd executable — even with setActivationPolicy(.accessory)
+# — registers but never receives the keypress. Wrapping it in an LSUIElement .app (Info.plist + bundle
+# identity), a peer of Coding Task Manager.app / Wall-E.app, is what makes it fire. NO TCC permission
+# is needed (Carbon RegisterEventHotKey is not gated behind Accessibility).
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-BINARY="$HOME/.local/bin/ctm-hotkey"
+SOURCE="$SCRIPT_DIR/ctm-hotkey.swift"
+BUNDLE_DIR="$HOME/.walle/bundles/CTM-Screenshot.app"
+EXEC="$BUNDLE_DIR/Contents/MacOS/ctm-hotkey"
+BUNDLE_ID="com.walle.ctm.hotkey"
+LEGACY_BINARY="$HOME/.local/bin/ctm-hotkey"   # pre-bundle build; removed on install
 PLIST_NAME="com.ctm.hotkey"
 PLIST="$HOME/Library/LaunchAgents/${PLIST_NAME}.plist"
-SOURCE="$SCRIPT_DIR/ctm-hotkey.swift"
 
 case "${1:-install}" in
   install)
     echo "=== CTM Global Hotkey Installer ==="
     echo ""
 
-    # 1. Compile
-    echo "[1/3] Compiling ctm-hotkey..."
-    mkdir -p "$(dirname "$BINARY")"
-    swiftc -O -o "$BINARY" "$SOURCE" -framework Cocoa
-    chmod +x "$BINARY"
-    echo "      Binary: $BINARY ($(du -h "$BINARY" | cut -f1 | xargs))"
+    # 1. Compile the Carbon swift straight into the bundle's Contents/MacOS.
+    echo "[1/4] Compiling hotkey app..."
+    mkdir -p "$(dirname "$EXEC")"
+    # Carbon: RegisterEventHotKey / InstallEventHandler. Cocoa: NSApplication (GUI app context).
+    swiftc -O -o "$EXEC" "$SOURCE" -framework Cocoa -framework Carbon
+    chmod +x "$EXEC"
+    echo "      Exec: $EXEC"
+
+    # 2. Write the bundle Info.plist (LSUIElement menu-bar accessory; bundle identity is what lets
+    #    RegisterEventHotKey receive the global hotkey).
+    echo "[2/4] Writing Info.plist..."
+    cat > "$BUNDLE_DIR/Contents/Info.plist" <<PLISTEOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>CTM Screenshot</string>
+  <key>CFBundleDisplayName</key><string>CTM Screenshot</string>
+  <key>CFBundleIdentifier</key><string>${BUNDLE_ID}</string>
+  <key>CFBundleExecutable</key><string>ctm-hotkey</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleVersion</key><string>1.0</string>
+  <key>CFBundleShortVersionString</key><string>1.0</string>
+  <key>LSUIElement</key><true/>
+  <key>LSMinimumSystemVersion</key><string>11.0</string>
+  <key>NSPrincipalClass</key><string>NSApplication</string>
+</dict>
+</plist>
+PLISTEOF
 
-    # 2. Create launchd plist
-    echo "[2/3] Installing launchd agent..."
-    mkdir -p "$(dirname "$PLIST")"
+    # 3. Sign the whole bundle so it runs for every user (arm64 won't execute an unsigned binary):
+    #    Developer ID Application first (stable, branded Team Identifier — like the daemon bundles),
+    #    else the stable self-signed local cert, else ad-hoc. The hotkey needs NO TCC permission, so
+    #    any valid signature suffices for it to register and fire.
+    echo "[3/4] Signing bundle..."
+    DEVID_HASH="$(security find-identity -v -p codesigning 2>/dev/null | awk '/Developer ID Application/ { print $2; exit }')"
+    if [ -n "$DEVID_HASH" ] && codesign --force --deep --sign "$DEVID_HASH" --identifier "$BUNDLE_ID" "$BUNDLE_DIR" 2>/dev/null; then
+      echo "      Signed (Developer ID)"
+    else
+      SIGN_KEYCHAIN="$HOME/.walle/walle-signing.keychain-db"
+      SIGN_IDENTITY=""
+      if [ -f "$SIGN_KEYCHAIN" ]; then
+        security unlock-keychain -p walle "$SIGN_KEYCHAIN" 2>/dev/null || true
+        SIGN_IDENTITY="$(security find-certificate -a -c "Wall-E Local Signing" -Z "$SIGN_KEYCHAIN" 2>/dev/null | awk '/SHA-1 hash:/ { print $3; exit }')"
+      fi
+      if [ -n "$SIGN_IDENTITY" ] && {
+        security set-key-partition-list -S apple-tool:,apple: -s -k walle "$SIGN_KEYCHAIN" >/dev/null 2>&1 || true
+        codesign --force --deep --sign "$SIGN_IDENTITY" --identifier "$BUNDLE_ID" --keychain "$SIGN_KEYCHAIN" "$BUNDLE_DIR" 2>/dev/null
+      }; then
+        echo "      Signed (Wall-E Local Signing)"
+      else
+        codesign --force --deep --sign - "$BUNDLE_DIR" 2>/dev/null && echo "      Signed (ad-hoc)" || echo "      Signing failed; continuing (hotkey needs no permission)."
+      fi
+    fi
+    rm -f "$LEGACY_BINARY" 2>/dev/null || true  # migrate off any pre-bundle bare binary
+
+    # 4. Create launchd plist (points at the bundle exec) + load it. Modern domain-target API:
+    #    legacy `load`/`unload` fail "5: Input/output error" when the label carries a stale *disabled*
+    #    override; `enable` clears it so bootstrap can re-load.
+    echo "[4/4] Installing + starting LaunchAgent..."
+    mkdir -p "$(dirname "$PLIST")" "$HOME/.local/log"
     cat > "$PLIST" <<PLISTEOF
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -33,7 +93,7 @@ case "${1:-install}" in
   <string>${PLIST_NAME}</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${BINARY}</string>
+    <string>${EXEC}</string>
   </array>
   <key>EnvironmentVariables</key>
   <dict>
@@ -43,7 +103,10 @@ case "${1:-install}" in
   <key>RunAtLoad</key>
   <true/>
   <key>KeepAlive</key>
-  <true/>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
   <key>StandardOutPath</key>
   <string>${HOME}/.local/log/ctm-hotkey.log</string>
   <key>StandardErrorPath</key>
@@ -52,58 +115,43 @@ case "${1:-install}" in
 </plist>
 PLISTEOF
 
-    mkdir -p "$HOME/.local/log"
-
-    # 3. Load the agent
-    echo "[3/3] Starting daemon..."
-    launchctl unload "$PLIST" 2>/dev/null || true
-    launchctl load "$PLIST"
+    UID_N="$(id -u)"
+    SVC="gui/${UID_N}/${PLIST_NAME}"
+    launchctl bootout "$SVC" 2>/dev/null || true
+    launchctl enable "$SVC" 2>/dev/null || true
+    launchctl bootstrap "gui/${UID_N}" "$PLIST" 2>/dev/null || launchctl load "$PLIST"
+    launchctl kickstart -k "$SVC" 2>/dev/null || true
 
     echo ""
     echo "=== Installed! ==="
     echo "  Hotkey:  Cmd+Shift+S (global, works in any app)"
-    echo "  Action:  Triggers CTM screenshot + annotation editor"
-    echo "  Daemon:  Auto-starts on login"
+    echo "  App:     $BUNDLE_DIR"
     echo "  Log:     ~/.local/log/ctm-hotkey.log"
     echo ""
-    echo "IMPORTANT: You need to grant Accessibility permission:"
-    echo "  System Settings > Privacy & Security > Accessibility"
-    echo "  Add: $BINARY"
+    echo "No permission prompt needed — the hotkey works immediately."
+    echo "(The screenshot capture itself uses Screen Recording, handled by CTM.)"
     echo ""
     echo "To uninstall: bash $0 uninstall"
     ;;
 
   uninstall)
     echo "=== CTM Global Hotkey Uninstaller ==="
-    if [ -f "$PLIST" ]; then
-      echo "Stopping daemon..."
-      launchctl unload "$PLIST" 2>/dev/null || true
-      rm -f "$PLIST"
-      echo "Removed: $PLIST"
-    fi
-    if [ -f "$BINARY" ]; then
-      rm -f "$BINARY"
-      echo "Removed: $BINARY"
-    fi
+    # bootout (not `disable`): tear the job down but leave the label *enabled* so a future reinstall
+    # isn't blocked by a disabled override.
+    echo "Stopping daemon..."
+    launchctl bootout "gui/$(id -u)/${PLIST_NAME}" 2>/dev/null || true
+    rm -f "$PLIST" 2>/dev/null && echo "Removed: $PLIST" || true
+    rm -rf "$BUNDLE_DIR" 2>/dev/null && echo "Removed: $BUNDLE_DIR" || true
+    rm -f "$LEGACY_BINARY" 2>/dev/null || true
     echo "Done. Hotkey disabled."
     ;;
 
   status)
     echo "=== CTM Global Hotkey Status ==="
-    if [ -f "$BINARY" ]; then
-      echo "Binary:  $BINARY (exists)"
-    else
-      echo "Binary:  not installed"
-    fi
-    if [ -f "$PLIST" ]; then
-      echo "Plist:   $PLIST (exists)"
-    else
-      echo "Plist:   not installed"
-    fi
-    if launchctl list | grep -q "$PLIST_NAME" 2>/dev/null; then
-      echo "Daemon:  running"
-      PID=$(launchctl list | grep "$PLIST_NAME" | awk '{print $1}')
-      echo "PID:     $PID"
+    [ -x "$EXEC" ] && echo "App:     $BUNDLE_DIR (installed)" || echo "App:     not installed"
+    [ -f "$PLIST" ] && echo "Plist:   $PLIST (exists)" || echo "Plist:   not installed"
+    if launchctl list 2>/dev/null | grep -q "$PLIST_NAME"; then
+      echo "Daemon:  running (PID $(launchctl list | awk -v l="$PLIST_NAME" '$0 ~ l {print $1; exit}'))"
     else
       echo "Daemon:  not running"
     fi

package/template/claude-task-manager/bin/restart-ctm.sh

@@ -10,6 +10,20 @@ CTM_PORT="${CTM_PORT:-3456}"
 LABEL="com.walle.server"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 
+# Provision a STABLE-IDENTITY daemon node BEFORE the restart, so the node launchd respawns runs
+# under a notarized / Developer-ID-signed identity whose macOS TCC grants persist across restarts
+# (stops the recurring "access data from other apps" prompt). Best-effort and OFF the launchd boot
+# path: the FIRST run may download the notarized Node once (cached under ~/.walle/notarized-node);
+# every later run is instant. Never blocks the restart — ctm-launch.sh just prefers the result.
+if [[ "$(uname -s)" == "Darwin" ]]; then
+  REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+  PROV_NODE="$(bash "$REPO_ROOT/bin/node-bin.sh" 2>/dev/null || command -v node 2>/dev/null || true)"
+  if [[ -n "$PROV_NODE" && -f "$REPO_ROOT/bin/ensure-stable-node.js" ]]; then
+    STABLE_NODE="$("$PROV_NODE" "$REPO_ROOT/bin/ensure-stable-node.js" 2>/dev/null || true)"
+    [[ -n "$STABLE_NODE" ]] && echo "Stable daemon node: $STABLE_NODE"
+  fi
+fi
+
 _health_ok() { curl -sf "http://localhost:${CTM_PORT}/api/health" >/dev/null 2>&1; }
 
 # True iff launchd reports a live (non-zero) pid for the job -- i.e. it respawned CTM,