iterate 0.3.0 → 0.4.0

package/menubar/Iterate.swift

@@ -1,914 +0,0 @@
-// ─────────────────────────────────────────────────────────────────────────────
-// Iterate — a small macOS menu-bar app. Today it's the human-in-the-loop
-// companion for sign-in and computer sharing on OS Next.
-// The legacy approval watcher and UI remain dormant.
-//
-// A thin shell over `iterate ping`, `iterate login`, and
-// `iterate use-my-computer --json`. The CLI owns authentication and transport.
-// Legacy approval models are retained below but are not started on OS Next.
-//
-// Single file, compiled with swiftc and wrapped in a minimal .app bundle by
-// build-menubar-app.sh — no Xcode project, no asset catalog: the 𝑖 icon is
-// drawn from the brand SVG's paths at runtime.
-// ─────────────────────────────────────────────────────────────────────────────
-
-import AppKit
-import Combine
-import Foundation
-import SwiftUI
-import UserNotifications
-
-// MARK: - Config
-
-/// Where to find the CLI and which project to watch. Read from
-/// ~/.config/iterate/menubar.json so the app needs no launch arguments.
-struct MenuBarConfig: Codable {
-  var command: String  // e.g. "iterate", or "bun"
-  var args: [String]  // e.g. [] or ["/path/bin/iterate.js"]
-  var config: String?  // iterate config name, e.g. "preview1"
-  var project: String?  // project id or slug
-  var cwd: String?  // working directory to spawn in
-  var xdgConfigHome: String? = nil
-
-  static func load() -> MenuBarConfig {
-    let path = ("~/.config/iterate/menubar.json" as NSString).expandingTildeInPath
-    guard let data = FileManager.default.contents(atPath: path),
-      let config = try? JSONDecoder().decode(MenuBarConfig.self, from: data)
-    else {
-      return MenuBarConfig(command: "iterate", args: [], config: nil, project: nil, cwd: nil)
-    }
-    return config
-  }
-
-  /// The argv for a subcommand under this config. `login` takes no `--project`
-  /// (it rejects the flag), so callers opt out of it there.
-  func argv(for subcommand: [String], includeProject: Bool = true) -> [String] {
-    var out = args
-    if let config { out += ["--config", config] }
-    out += subcommand
-    if includeProject, let project { out += ["--project", project] }
-    return out
-  }
-}
-
-// MARK: - Model
-
-/// One held approval BATCH (a lone request is a batch of one), keyed by its
-/// requested event's offset. `summary` comes from the CLI ("POST api.stripe.com"
-/// or "12 requests (12x gmail.googleapis.com)"); one decision answers it all.
-struct HeldRequest: Identifiable, Equatable {
-  let offset: Int
-  let summary: String
-  let count: Int
-  let secretPaths: [String]
-  let ruleKey: String
-  let body: String?
-  var submitting = false
-  var id: Int { offset }
-}
-
-final class ApprovalController: ObservableObject {
-  static let shared = ApprovalController()
-
-  @Published var loggedIn = false  // is there a valid session (from the status line)?
-  @Published var connected = false  // is a watcher live and serving right now?
-  @Published var principal: String?
-  @Published var project: String?
-  @Published var keyLabel: String?  // "secure-enclave 9f2c…" or nil (unsigned)
-  @Published var requests: [HeldRequest] = []
-  @Published var lastError: String?
-
-  /// True once UserNotifications authorization succeeded — gates the rich,
-  /// actionable banners; otherwise notify() falls back to osascript.
-  var notificationsAuthorized = false
-
-  private var config = MenuBarConfig.load()
-  private var process: Process?
-  private var loginProcess: Process?
-  private var stdinHandle: FileHandle?
-  private var stdoutHandle: FileHandle?
-  private var buffer = Data()
-  private var sawStatus = false  // did THIS watcher session emit a status line?
-  private var sessionStart = Date()
-  private var reconnectAttempts = 0
-  private var generation = 0  // bumped on every stop(); voids stale queued reconnects
-
-  func configure(_ next: MenuBarConfig) {
-    stop()
-    loginProcess?.terminationHandler = nil
-    loginProcess?.terminate()
-    loginProcess = nil
-    loggedIn = false
-    principal = nil
-    project = nil
-    lastError = nil
-    config = next
-    start()
-  }
-
-  // OS Next has no approval transport. Keep the legacy watcher below dormant;
-  // use a bounded CLI authentication check for the menu bar's sign-in state.
-  func start() {
-    stop()
-    let process = Process()
-    process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
-    process.arguments = [config.command] + config.argv(for: ["ping"], includeProject: false)
-    if let cwd = config.cwd { process.currentDirectoryURL = URL(fileURLWithPath: cwd) }
-    if let home = config.xdgConfigHome {
-      var environment = ProcessInfo.processInfo.environment
-      environment["XDG_CONFIG_HOME"] = home
-      process.environment = environment
-    }
-    process.standardOutput = FileHandle.nullDevice
-    let session = generation
-    process.terminationHandler = { [weak self] child in
-      DispatchQueue.main.async {
-        guard let self, self.generation == session else { return }
-        self.process = nil
-        self.loggedIn = child.terminationStatus == 0
-        self.connected = self.loggedIn
-        self.principal = self.loggedIn ? "Signed in" : nil
-        self.project = self.config.project
-        self.lastError = self.loggedIn ? nil : "Sign in or check your connection."
-      }
-    }
-    do {
-      try process.run()
-      self.process = process
-      DispatchQueue.main.asyncAfter(deadline: .now() + 30) { [weak self] in
-        guard let self, self.generation == session, process.isRunning else { return }
-        process.terminate()
-      }
-    } catch {
-      loggedIn = false
-      lastError = "Could not launch iterate: \(error.localizedDescription)"
-    }
-  }
-
-  private func startLegacyApprovalWatcher() {
-    stop()
-    sawStatus = false
-    sessionStart = Date()
-    let process = Process()
-    process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
-    process.arguments = [config.command] + config.argv(for: ["approve", "--json"])
-    if let cwd = config.cwd { process.currentDirectoryURL = URL(fileURLWithPath: cwd) }
-    if let home = config.xdgConfigHome {
-      var environment = ProcessInfo.processInfo.environment
-      environment["XDG_CONFIG_HOME"] = home
-      process.environment = environment
-    }
-
-    let stdout = Pipe()
-    let stdin = Pipe()
-    process.standardOutput = stdout
-    process.standardInput = stdin
-    self.stdinHandle = stdin.fileHandleForWriting
-    self.stdoutHandle = stdout.fileHandleForReading
-
-    // This session's identity: a chunk that lands after the session ends
-    // (generation moved on) is stale and must not touch state.
-    let session = generation
-    stdout.fileHandleForReading.readabilityHandler = { [weak self] handle in
-      let chunk = handle.availableData
-      // Empty data means EOF: clear the handler so it stops firing (otherwise
-      // it busy-loops on the closed pipe).
-      if chunk.isEmpty {
-        handle.readabilityHandler = nil
-        return
-      }
-      DispatchQueue.main.async {
-        guard let self, self.generation == session else { return }  // stale chunk
-        self.ingest(chunk)
-      }
-    }
-    process.terminationHandler = { [weak self] _ in
-      DispatchQueue.main.async {
-        // Guard on the session: a late callback from a process we already
-        // replaced must not tear down the new one.
-        guard let self, self.generation == session else { return }
-        self.watcherExited()
-      }
-    }
-    do {
-      try process.run()
-      self.process = process
-    } catch {
-      // Launch failed — that's a broken CLI path, NOT a lost session. stop()
-      // already cleared `connected`/`requests`; leave `loggedIn` alone so a
-      // valid session shows Disconnected + Reconnect rather than routing to a
-      // needless browser login.
-      self.lastError = "Could not launch iterate: \(error.localizedDescription)"
-    }
-  }
-
-  /// The watcher process exited. Drop stale rows; don't touch `loggedIn` (the
-  /// status line is authoritative). Reconnect only if this session actually
-  /// connected (emitted a status) and still believes it's signed in — bounded,
-  /// so a watcher that never connects or keeps dying fast won't hot-loop.
-  private func watcherExited() {
-    generation += 1  // end this session so any late stdout chunk is ignored
-    detachIO()  // drop the dead pipes/handle so a click can't write to a corpse
-    requests = []
-    connected = false  // no live watcher until one reconnects and emits status
-    if Date().timeIntervalSince(sessionStart) > 10 { reconnectAttempts = 0 }  // it was stable
-    guard loggedIn, sawStatus else { return }  // never connected → no reconnect
-    if reconnectAttempts < 5 {
-      reconnectAttempts += 1
-      // Void this reconnect if the user meanwhile signs in / quits (which
-      // bumps the generation) so it can't overlap a login or a fresh watcher.
-      let scheduled = generation
-      DispatchQueue.main.asyncAfter(deadline: .now() + 2) { [weak self] in
-        guard let self, self.generation == scheduled else { return }
-        self.start()
-      }
-    } else {
-      lastError = "Approver keeps exiting — click Sign in to retry."
-    }
-  }
-
-  func stop() {
-    generation += 1  // any in-flight reconnect scheduled before now is void
-    connected = false
-    process?.terminationHandler = nil
-    process?.terminate()
-    process = nil
-    detachIO()
-    requests = []
-  }
-
-  /// Drop the current session's pipes/handles and any half-read line, so no
-  /// late chunk or stray write can touch the next session.
-  private func detachIO() {
-    stdoutHandle?.readabilityHandler = nil
-    stdoutHandle = nil
-    stdinHandle = nil
-    buffer = Data()
-  }
-
-  /// Kick off `iterate login` (browser OAuth), then restart the watcher. Stop
-  /// the current watcher first so login never overlaps a running approve.
-  func login() {
-    guard loginProcess == nil else { return }  // one browser login at a time
-    stop()
-    reconnectAttempts = 0  // an explicit retry clears the give-up counter
-    let process = Process()
-    process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
-    process.arguments = [config.command] + config.argv(for: ["login"], includeProject: false)
-    if let cwd = config.cwd { process.currentDirectoryURL = URL(fileURLWithPath: cwd) }
-    if let home = config.xdgConfigHome {
-      var environment = ProcessInfo.processInfo.environment
-      environment["XDG_CONFIG_HOME"] = home
-      process.environment = environment
-    }
-    process.terminationHandler = { [weak self] _ in
-      Task { @MainActor in
-        self?.loginProcess = nil
-        self?.start()
-      }
-    }
-    do {
-      try process.run()
-      loginProcess = process
-    } catch {
-      // Login couldn't even launch — don't leave the app with no watcher.
-      lastError = "Could not start login: \(error.localizedDescription)"
-      start()
-    }
-  }
-
-  /// Relay a verdict for one held request — from the dropdown OR a notification
-  /// action. The CLI does the signing (Touch ID pops there); the row shows a
-  /// spinner until the settle/error comes back.
-  func decide(offset: Int, _ decision: String) {
-    setSubmitting(offset, true)
-    let line = #"{"offset":\#(offset),"decision":"\#(decision)"}"# + "\n"
-    stdinHandle?.write(Data(line.utf8))
-  }
-
-  // MARK: NDJSON ingestion
-
-  private func ingest(_ chunk: Data) {
-    buffer.append(chunk)
-    while let newline = buffer.firstIndex(of: 0x0A) {
-      let lineData = buffer.subdata(in: buffer.startIndex..<newline)
-      buffer.removeSubrange(buffer.startIndex...newline)
-      guard let object = try? JSONSerialization.jsonObject(with: lineData) as? [String: Any] else {
-        continue
-      }
-      handle(object)
-    }
-  }
-
-  private func handle(_ event: [String: Any]) {
-    switch event["type"] as? String {
-    case "status":
-      sawStatus = true  // this watcher connected and spoke
-      loggedIn = event["loggedIn"] as? Bool ?? false
-      connected = loggedIn  // a live, authed watcher is serving
-      lastError = nil
-      principal = event["principal"] as? String
-      project = event["projectId"] as? String
-      if let key = event["key"] as? [String: Any] {
-        keyLabel = "\(key["kind"] as? String ?? "key") \((key["keyId"] as? String ?? "").prefix(8))"
-      } else {
-        keyLabel = nil
-      }
-    case "requested":
-      guard let offset = event["offset"] as? Int else { return }
-      let held = event["requests"] as? [[String: Any]] ?? []
-      // A body preview only makes sense for a batch of one.
-      var bodyContent: String?
-      if held.count == 1, let body = held[0]["body"] as? [String: Any] {
-        bodyContent = body["content"] as? String
-        if body["encoding"] as? String == "base64", let content = bodyContent {
-          bodyContent = "[base64] \(content)"
-        }
-      }
-      var request = HeldRequest(
-        offset: offset,
-        summary: event["summary"] as? String ?? "held egress request",
-        count: event["count"] as? Int ?? held.count,
-        secretPaths: event["secretPaths"] as? [String] ?? [],
-        ruleKey: event["ruleKey"] as? String ?? "",
-        body: bodyContent
-      )
-      // A backlog batch that already has a decision is shown awaiting the door
-      // (spinner), not as a fresh Approve prompt.
-      request.submitting = event["submitted"] as? Bool ?? false
-      if !requests.contains(where: { $0.offset == offset }) {
-        requests.append(request)
-        if !request.submitting { notify(request) }
-      }
-    case "submitted":
-      // A decision landed (this app's or another approver's): show the row
-      // awaiting the door rather than a fresh prompt, and pull any delivered
-      // banner — the door only honors the first decision anyway.
-      if let offset = event["offset"] as? Int {
-        setSubmitting(offset, true)
-        ApprovalNotifications.withdraw(offset)
-      }
-    case "settled":
-      if let offset = event["offset"] as? Int {
-        requests.removeAll { $0.offset == offset }
-        ApprovalNotifications.withdraw(offset)
-      }
-    case "unsettled":
-      // The door ignored the decision (key not enrolled / revoked) and the hold is
-      // still open — clear the spinner so Approve/Reject return, and say why.
-      if let offset = event["offset"] as? Int {
-        setSubmitting(offset, false)
-      }
-      lastError = "A decision wasn’t accepted — is this Mac’s approval key enrolled? (iterate approve --keys)"
-    case "error":
-      lastError = event["message"] as? String
-      // A signing/append failure (e.g. cancelled Touch ID) leaves the request
-      // pending — clear its spinner so Approve/Reject come back for a retry.
-      setSubmitting(event["offset"] as? Int, false)
-    default:
-      break
-    }
-  }
-
-  /// Set a row's spinner, reassigning the element so the @Published array
-  /// reliably republishes.
-  private func setSubmitting(_ offset: Int?, _ value: Bool) {
-    guard let offset, let index = requests.firstIndex(where: { $0.offset == offset }) else { return }
-    var updated = requests[index]
-    updated.submitting = value
-    requests[index] = updated
-  }
-
-  /// Ping the human when a request lands, even with the dropdown closed. When
-  /// UserNotifications authorization succeeded (needs a signed bundle — see
-  /// build-menubar-app.sh SIGN_IDENTITY), post a rich banner with the 𝑖 logo
-  /// and Approve/Reject actions that come back through `decide`. Otherwise fall
-  /// back to a plain osascript notification — zero setup, works everywhere.
-  private func notify(_ request: HeldRequest) {
-    let title = request.count == 1 ? "Approval needed" : "Approvals needed"
-    let secrets =
-      request.secretPaths.isEmpty ? "" : " · spends \(request.secretPaths.joined(separator: ", "))"
-    let body = "\(request.summary)\(secrets)"
-
-    if notificationsAuthorized {
-      let content = UNMutableNotificationContent()
-      content.title = title
-      content.body = body
-      content.categoryIdentifier = ApprovalNotifications.categoryId
-      content.userInfo = ["offset": request.offset]
-      if let url = IterateIcon.logoPNGURL,
-        let attachment = try? UNNotificationAttachment(identifier: "logo", url: url)
-      {
-        content.attachments = [attachment]
-      }
-      let notification = UNNotificationRequest(
-        identifier: ApprovalNotifications.identifier(request.offset), content: content, trigger: nil)
-      UNUserNotificationCenter.current().add(notification)
-      return
-    }
-
-    let script = "display notification \(quote(body)) with title \(quote(title))"
-    let process = Process()
-    process.executableURL = URL(fileURLWithPath: "/usr/bin/osascript")
-    process.arguments = ["-e", script]
-    try? process.run()
-  }
-
-  private func quote(_ text: String) -> String {
-    "\"" + text.replacingOccurrences(of: "\\", with: "\\\\").replacingOccurrences(of: "\"", with: "\\\"") + "\""
-  }
-}
-
-// MARK: - Use my computer
-
-/// One agent call to this computer, for the activity list. `running` flips off
-/// when its `call-done` lands.
-struct ComputerCall: Identifiable, Equatable {
-  let id: Int
-  let method: String
-  let summary: String
-  var running: Bool
-  var ok = true  // set from call-done; a failed local call must not read as success
-}
-
-/// Drives `iterate use-my-computer --json`: lends this Mac to the project's
-/// agents and surfaces each call they make, so the menu bar can show it in use.
-///
-/// Deliberately simpler than ApprovalController: sharing is opt-in (a conscious
-/// act), so if the watcher exits we just stop sharing and let the human
-/// re-enable — no silent auto-reconnect that would re-lend the machine.
-final class ComputerController: ObservableObject {
-  static let shared = ComputerController()
-
-  @Published var enabled = false  // the human asked to share
-  @Published var sharing = false  // the capability is mounted and live
-  @Published var reconnecting = false  // mount dropped; the CLI is re-establishing it
-  @Published var computerName: String?  // the itx.<name> agents call
-  @Published var recentCalls: [ComputerCall] = []  // capped display list
-  @Published private var activeCalls = 0  // in-flight count, independent of the cap
-  @Published var lastError: String?
-
-  /// A call is running right now — the menu bar's "in use" indicator. Counted
-  /// separately from `recentCalls` so a slow call that scrolls off the capped
-  /// display list still keeps the indicator honest.
-  var inUse: Bool { activeCalls > 0 }
-
-  private var config = MenuBarConfig.load()
-  private var process: Process?
-  private var stdinHandle: FileHandle?
-  private var stdoutHandle: FileHandle?
-  private var buffer = Data()
-  private var generation = 0  // bumped on every stop(); voids stale stdout chunks
-  private var cancellables = Set<AnyCancellable>()
-
-  private init() {
-    // If the app loses its session, stop sharing immediately — the mount is
-    // dead anyway, and otherwise the computer could stay lent while the toggle
-    // greys out with no way to revoke but quitting.
-    ApprovalController.shared.$loggedIn
-      .dropFirst()
-      .sink { [weak self] loggedIn in
-        if !loggedIn { self?.stop() }
-      }
-      .store(in: &cancellables)
-  }
-
-  func configure(_ next: MenuBarConfig) {
-    stop()  // revoke the old project's share before accepting a new project
-    config = next
-  }
-
-  /// Turn sharing on or off — safe to drive straight from a Toggle binding.
-  func setEnabled(_ on: Bool) {
-    guard on != enabled else { return }
-    enabled = on
-    if on { start() } else { stop() }
-  }
-
-  private func start() {
-    stop()
-    enabled = true  // stop() cleared it; we ARE (re)starting
-    lastError = nil
-    let process = Process()
-    process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
-    process.arguments = [config.command] + config.argv(for: ["use-my-computer", "--json"])
-    if let cwd = config.cwd { process.currentDirectoryURL = URL(fileURLWithPath: cwd) }
-    if let home = config.xdgConfigHome {
-      var environment = ProcessInfo.processInfo.environment
-      environment["XDG_CONFIG_HOME"] = home
-      process.environment = environment
-    }
-
-    let stdout = Pipe()
-    let stdin = Pipe()  // held open so the child lives; closing it stops sharing
-    process.standardOutput = stdout
-    process.standardInput = stdin
-    self.stdoutHandle = stdout.fileHandleForReading
-    self.stdinHandle = stdin.fileHandleForWriting
-
-    let session = generation
-    stdout.fileHandleForReading.readabilityHandler = { [weak self] handle in
-      let chunk = handle.availableData
-      if chunk.isEmpty {  // EOF — the child closed stdout, i.e. it has exited.
-        handle.readabilityHandler = nil
-        DispatchQueue.main.async {
-          // Tear down HERE, on EOF, NOT in terminationHandler. EOF is delivered on
-          // this same handle after every data chunk, so a final `conflict` status
-          // line is ingested (and sets the takeover message) before we exit.
-          // Terminating off the process's death instead is a separate event that
-          // can win the race, bump `generation`, and drop that last line —
-          // leaving the generic "Stopped sharing" instead of the takeover error.
-          guard let self, self.generation == session else { return }
-          self.watcherExited()
-        }
-        return
-      }
-      DispatchQueue.main.async {
-        guard let self, self.generation == session else { return }  // stale chunk
-        self.ingest(chunk)
-      }
-    }
-    process.terminationHandler = { [weak self] _ in
-      // Teardown is driven by stdout EOF (above), which is ordered after the
-      // child's final line; just release the finished process here. A late
-      // callback from a process we already replaced is voided by the guard.
-      DispatchQueue.main.async {
-        guard let self, self.generation == session else { return }
-        self.process = nil
-      }
-    }
-    do {
-      try process.run()
-      self.process = process
-    } catch {
-      enabled = false
-      detachIO()
-      lastError = "Could not share your computer: \(error.localizedDescription)"
-    }
-  }
-
-  func stop() {
-    generation += 1  // any late stdout chunk from this session is now stale
-    enabled = false
-    process?.terminationHandler = nil
-    process?.terminate()
-    process = nil
-    detachIO()
-    sharing = false
-    reconnecting = false
-    recentCalls = []
-    activeCalls = 0
-  }
-
-  /// The watcher exited on its own (lost socket, needs-login, crash). We're no
-  /// longer sharing — say so honestly rather than silently re-lending the Mac.
-  private func watcherExited() {
-    generation += 1
-    detachIO()
-    sharing = false
-    reconnecting = false
-    recentCalls = []
-    activeCalls = 0
-    if enabled {
-      enabled = false
-      if lastError == nil { lastError = "Stopped sharing your computer." }
-    }
-  }
-
-  /// Drop this session's pipes/handles and any half-read line.
-  private func detachIO() {
-    stdoutHandle?.readabilityHandler = nil
-    stdoutHandle = nil
-    stdinHandle = nil
-    buffer = Data()
-  }
-
-  private func ingest(_ chunk: Data) {
-    buffer.append(chunk)
-    while let newline = buffer.firstIndex(of: 0x0A) {
-      let lineData = buffer.subdata(in: buffer.startIndex..<newline)
-      buffer.removeSubrange(buffer.startIndex...newline)
-      guard let object = try? JSONSerialization.jsonObject(with: lineData) as? [String: Any] else {
-        continue
-      }
-      handle(object)
-    }
-  }
-
-  private func handle(_ event: [String: Any]) {
-    switch event["type"] as? String {
-    case "status":
-      if event["conflict"] as? Bool == true {
-        // Another session took the name — the CLI is stopping; reflect that.
-        stop()
-        lastError = "Another session took over sharing this computer."
-      } else if event["loggedIn"] as? Bool == true {
-        // `reconnecting:true` = the mount dropped and the CLI is re-establishing
-        // it; the plain status (no flag) means we're live again.
-        reconnecting = event["reconnecting"] as? Bool == true
-        sharing = true
-        computerName = event["name"] as? String
-      } else {
-        // No session — login is the approver's job; just stop and say so.
-        stop()
-        lastError = "Sign in first, then share your computer."
-      }
-    case "call":
-      guard let id = event["id"] as? Int else { return }
-      activeCalls += 1
-      recentCalls.insert(
-        ComputerCall(
-          id: id,
-          method: event["method"] as? String ?? "?",
-          summary: event["summary"] as? String ?? "",
-          running: true),
-        at: 0)
-      if recentCalls.count > 5 { recentCalls.removeLast(recentCalls.count - 5) }
-    case "call-done":
-      guard let id = event["id"] as? Int else { return }
-      // Decrement the in-flight count even if the row already scrolled off the
-      // capped list, so `inUse` and the menu-bar dot don't stay stuck on.
-      if activeCalls > 0 { activeCalls -= 1 }
-      guard let index = recentCalls.firstIndex(where: { $0.id == id }) else { return }
-      // Reassign the whole element (not a nested mutation) so the @Published
-      // array reliably republishes. Same idiom as ApprovalController.setSubmitting.
-      var call = recentCalls[index]
-      call.running = false
-      call.ok = event["ok"] as? Bool ?? true  // a failed local call is shown as failed, not done
-      recentCalls[index] = call
-    default:
-      break
-    }
-  }
-}
-
-// MARK: - Views
-
-struct DropdownView: View {
-  @EnvironmentObject var controller: ApprovalController
-  @EnvironmentObject var computer: ComputerController
-
-  var body: some View {
-    VStack(alignment: .leading, spacing: 10) {
-      header
-      Divider()
-      if controller.requests.isEmpty {
-        Text("Approvals are not available on OS Next yet.")
-          .foregroundStyle(.secondary)
-          .font(.callout)
-          .padding(.vertical, 4)
-      } else {
-        ForEach(controller.requests) { request in
-          RequestRow(request: request)
-        }
-      }
-      Divider()
-      computerSection
-      Divider()
-      HStack {
-        if let error = controller.lastError ?? computer.lastError {
-          Text(error).font(.caption).foregroundStyle(.red).lineLimit(2)
-        }
-        Spacer()
-        Button("Quit") { NSApp.terminate(nil) }.buttonStyle(.borderless).foregroundStyle(.secondary)
-      }
-    }
-    .padding(14)
-    .frame(width: 340)
-  }
-
-  /// "Use my computer" — a toggle to lend this Mac to the project's agents, and,
-  /// while shared, a live list of the calls they make (the machine "in use").
-  @ViewBuilder private var computerSection: some View {
-    VStack(alignment: .leading, spacing: 6) {
-      HStack(alignment: .top) {
-        VStack(alignment: .leading, spacing: 2) {
-          Text("Use my computer").font(.callout).bold()
-          Text(computerStatusLine).font(.caption2).foregroundStyle(.secondary).lineLimit(2)
-        }
-        Spacer()
-        Toggle("", isOn: Binding(get: { computer.enabled }, set: { computer.setEnabled($0) }))
-          .labelsHidden()
-          .toggleStyle(.switch)
-          // Need a session to START sharing, but never trap an ACTIVE share
-          // behind a greyed-out switch — always allow turning it off.
-          .disabled(!controller.loggedIn && !computer.enabled)
-      }
-      if computer.sharing {
-        if computer.recentCalls.isEmpty {
-          Text("Waiting for an agent to use it…").font(.caption).foregroundStyle(.secondary)
-        } else {
-          ForEach(computer.recentCalls) { call in
-            HStack(spacing: 6) {
-              if call.running {
-                ProgressView().controlSize(.small)
-              } else if call.ok {
-                Image(systemName: "checkmark.circle").foregroundStyle(.secondary)
-              } else {
-                Image(systemName: "xmark.circle").foregroundStyle(.orange)
-              }
-              Text("\(call.method) · \(call.summary)")
-                .font(.caption)
-                .foregroundStyle(call.running ? .primary : .secondary)
-                .lineLimit(1)
-            }
-          }
-        }
-      }
-    }
-  }
-
-  private var computerStatusLine: String {
-    if !controller.loggedIn { return "Sign in to lend this Mac to agents." }
-    if computer.sharing {
-      let name = computer.computerName.map { "itx.\($0)" } ?? "your computer"
-      if computer.reconnecting { return "Reconnecting \(name)…" }
-      return computer.inUse ? "In use now — \(name)" : "\(name) is live for this project."
-    }
-    if computer.enabled { return "Starting…" }
-    return "Let agents run dialogs, notifications and Swift here."
-  }
-
-  @ViewBuilder private var header: some View {
-    if !controller.loggedIn {
-      HStack {
-        Text("Not signed in").font(.headline)
-        Spacer()
-        Button("Sign in") { controller.login() }.buttonStyle(.borderedProminent)
-      }
-    } else if !controller.connected {
-      // Valid session, but no watcher is live (it died and is retrying or gave
-      // up) — say so honestly and offer a manual reconnect.
-      HStack {
-        VStack(alignment: .leading, spacing: 2) {
-          Text(controller.principal ?? "signed in").font(.headline)
-          Text("Disconnected").font(.caption).foregroundStyle(.orange)
-        }
-        Spacer()
-        Button("Reconnect") { controller.start() }.buttonStyle(.bordered)
-      }
-    } else {
-      VStack(alignment: .leading, spacing: 2) {
-        Text(controller.principal ?? "signed in").font(.headline)
-        if let project = controller.project {
-          Text(project).font(.caption).foregroundStyle(.secondary)
-        }
-        Text("OS Next")
-          .font(.caption2).foregroundStyle(.secondary)
-      }
-    }
-  }
-}
-
-struct RequestRow: View {
-  @EnvironmentObject var controller: ApprovalController
-  let request: HeldRequest
-
-  var body: some View {
-    VStack(alignment: .leading, spacing: 6) {
-      Text(request.summary).font(.system(.body, design: .monospaced)).bold()
-      if !request.secretPaths.isEmpty {
-        Text("spends \(request.secretPaths.joined(separator: ", "))")
-          .font(.caption).foregroundStyle(.orange)
-      }
-      if let body = request.body, !body.isEmpty {
-        Text(body).font(.caption).foregroundStyle(.secondary).lineLimit(2)
-      }
-      HStack {
-        Text("rule: \(request.ruleKey)").font(.caption2).foregroundStyle(.secondary)
-        Spacer()
-        if request.submitting {
-          ProgressView().controlSize(.small)
-        } else {
-          Button(request.count == 1 ? "Reject" : "Reject all") {
-            controller.decide(offset: request.offset, "reject")
-          }
-          .buttonStyle(.bordered)
-          Button(request.count == 1 ? "Approve" : "Approve all \(request.count)") {
-            controller.decide(offset: request.offset, "approve")
-          }
-          .buttonStyle(.borderedProminent)
-        }
-      }
-    }
-    .padding(10)
-    .background(.quaternary.opacity(0.4), in: RoundedRectangle(cornerRadius: 8))
-  }
-}
-
-// MARK: - Notifications
-
-/// The one actionable-notification category: Approve / Reject, mapped back to
-/// `decide` by the delegate. Delivery needs a signed bundle, so it's an
-/// opt-in upgrade over the osascript fallback (see notify()).
-enum ApprovalNotifications {
-  static let categoryId = "APPROVAL"
-
-  static func identifier(_ offset: Int) -> String { "approval-\(offset)" }
-
-  static func register(_ center: UNUserNotificationCenter) {
-    let approve = UNNotificationAction(identifier: "APPROVE", title: "Approve", options: [.foreground])
-    let reject = UNNotificationAction(
-      identifier: "REJECT", title: "Reject", options: [.destructive])
-    center.setNotificationCategories([
-      UNNotificationCategory(
-        identifier: categoryId, actions: [approve, reject], intentIdentifiers: [], options: [])
-    ])
-  }
-
-  /// Pull a delivered banner once its request is no longer answerable here — a
-  /// decision landed or it settled — so a stale Reject tap can't send a
-  /// dead-weight contradiction (the door only honors the first decision).
-  static func withdraw(_ offset: Int) {
-    UNUserNotificationCenter.current().removeDeliveredNotifications(
-      withIdentifiers: [identifier(offset)])
-  }
-}
-
-// MARK: - App
-
-final class AppDelegate: NSObject, NSApplicationDelegate, UNUserNotificationCenterDelegate {
-  private var receivedConfiguration = false
-
-  // `open -a Iterate.app menubar.json` delivers this even to a running app.
-  // Unlike launch arguments it can safely retarget the existing menu bar.
-  func application(_ sender: NSApplication, openFiles filenames: [String]) {
-    do {
-      guard filenames.count == 1, let path = filenames.first else {
-        throw CocoaError(.fileReadInvalidFileName)
-      }
-      let data = try Data(contentsOf: URL(fileURLWithPath: path))
-      let config = try JSONDecoder().decode(MenuBarConfig.self, from: data)
-      ComputerController.shared.configure(config)
-      ApprovalController.shared.configure(config)
-      receivedConfiguration = true
-      sender.reply(toOpenOrPrint: .success)
-    } catch {
-      ApprovalController.shared.lastError = "Could not load configuration: \(error.localizedDescription)"
-      sender.reply(toOpenOrPrint: .failure)
-    }
-  }
-
-  func applicationDidFinishLaunching(_ notification: Notification) {
-    NSApp.setActivationPolicy(.accessory)  // menu-bar only, no dock icon
-
-    // Approval notifications stay dormant until OS Next supports approvals.
-    if !receivedConfiguration { ApprovalController.shared.start() }
-    // Computer sharing is opt-in — it stays idle until the human flips it on.
-  }
-
-  /// Tear down both watchers on quit so we never leave the computer shared (or an
-  /// approver running) behind a closed menu bar.
-  func applicationWillTerminate(_ notification: Notification) {
-    ComputerController.shared.stop()
-    ApprovalController.shared.stop()
-  }
-
-  /// Show the banner even when the app is frontmost.
-  func userNotificationCenter(
-    _ center: UNUserNotificationCenter, willPresent notification: UNNotification,
-    withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void
-  ) {
-    completionHandler([.banner, .sound])
-  }
-
-  /// An Approve/Reject tap on a banner routes straight to `decide` (signing —
-  /// and Touch ID — happen in the CLI, exactly as from the dropdown).
-  func userNotificationCenter(
-    _ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse,
-    withCompletionHandler completionHandler: @escaping () -> Void
-  ) {
-    if let offset = response.notification.request.content.userInfo["offset"] as? Int {
-      switch response.actionIdentifier {
-      case "APPROVE": ApprovalController.shared.decide(offset: offset, "approve")
-      case "REJECT": ApprovalController.shared.decide(offset: offset, "reject")
-      default: break
-      }
-    }
-    completionHandler()
-  }
-}
-
-@main
-struct IterateApp: App {
-  @NSApplicationDelegateAdaptor(AppDelegate.self) private var delegate
-  @StateObject private var controller = ApprovalController.shared
-  @StateObject private var computer = ComputerController.shared
-
-  var body: some Scene {
-    MenuBarExtra {
-      DropdownView().environmentObject(controller).environmentObject(computer)
-    } label: {
-      // The 𝑖 template mark, a count when requests are waiting, and a green dot
-      // while an agent is actively using this computer.
-      Image(nsImage: IterateIcon.mark)
-      if controller.requests.count > 0 {
-        Text("\(controller.requests.count)")
-      }
-      if computer.inUse {
-        Image(systemName: "circle.fill").foregroundStyle(.green)
-      }
-    }
-    .menuBarExtraStyle(.window)
-  }
-}