waterplane 0.1.16 → 0.1.18

package/packages/extensions/desktop/helper/Params.swift

@@ -0,0 +1,133 @@
+// Params: the one parameter object a `config` command carries, clamped here so
+// the rest of the helper never sees an out-of-range value.
+
+import CoreGraphics
+import Foundation
+
+enum Codec: String {
+  case h264
+  case jpeg
+}
+
+enum SourceSpec: Equatable {
+  case display(CGDirectDisplayID?)
+  case window(CGWindowID)
+  case front
+  /// `idle` makes the pattern stand still for half of every 6 s cycle, which is
+  /// what SCK does on a still screen: no frames at all.
+  case synthetic(idle: Bool)
+
+  var kind: String {
+    switch self {
+    case .display: return "display"
+    case .window: return "window"
+    case .front: return "front"
+    case .synthetic: return "synthetic"
+    }
+  }
+
+  /// Two specs that need a different capture object (display ↔ window ↔ front).
+  /// A change inside one kind (another window id) can be re-aimed live.
+  func sameKind(_ o: SourceSpec) -> Bool { kind == o.kind }
+}
+
+/// Normalised 0..1 of the full source.
+struct Crop: Equatable {
+  var x = 0.0, y = 0.0, w = 1.0, h = 1.0
+  var isFull: Bool { x == 0 && y == 0 && w == 1 && h == 1 }
+}
+
+struct Params: Equatable {
+  var codec: Codec = .h264
+  var source: SourceSpec = .display(nil)
+  var crop = Crop()
+  var maxWidth = 1280
+  var fps = 15
+  var bitrateKbps = 1000
+  var jpegQuality = 50
+  var grayscale = false
+  var keyframeEverySec = 0.0
+  var cursor = true
+
+  static func clampBitrate(_ v: Int) -> Int { min(20000, max(50, v)) }
+
+  /// A config is a FULL params object: a field left out takes its default,
+  /// not its previous value. Unknown fields are ignored; wrong types fall back
+  /// to the default with one warning each.
+  static func parse(_ o: [String: Any], warn: (String) -> Void) -> Params {
+    var p = Params()
+    func num(_ k: String) -> Double? {
+      guard let v = o[k] else { return nil }
+      if let n = v as? NSNumber, CFGetTypeID(n) != CFBooleanGetTypeID() { return n.doubleValue }
+      warn("param \(k): expected a number, ignored")
+      return nil
+    }
+    func bool(_ k: String) -> Bool? {
+      guard let v = o[k] else { return nil }
+      if let n = v as? NSNumber, CFGetTypeID(n) == CFBooleanGetTypeID() { return n.boolValue }
+      warn("param \(k): expected true/false, ignored")
+      return nil
+    }
+    if let c = o["codec"] {
+      if let s = c as? String, let k = Codec(rawValue: s) { p.codec = k } else { warn("param codec: expected \"h264\" or \"jpeg\", ignored") }
+    }
+    if let s = o["source"] {
+      if let d = s as? [String: Any], let k = d["kind"] as? String {
+        let id = (d["id"] as? NSNumber)?.uint32Value
+        switch k {
+        case "display": p.source = .display(id)
+        case "window":
+          if let id { p.source = .window(id) } else { warn("param source: a window needs an id, using the main display") }
+        case "front": p.source = .front
+        case "synthetic": p.source = .synthetic(idle: (d["idle"] as? Bool) ?? false)
+        default: warn("param source: unknown kind \(k), using the main display")
+        }
+      } else { warn("param source: expected {kind:…}, using the main display") }
+    }
+    if let c = o["crop"] {
+      if let d = c as? [String: Any] {
+        func f(_ k: String, _ def: Double) -> Double { ((d[k] as? NSNumber)?.doubleValue).map { $0.isFinite ? $0 : def } ?? def }
+        var x = min(0.98, max(0, f("x", 0))), y = min(0.98, max(0, f("y", 0)))
+        var w = min(1, max(0.02, f("w", 1))), h = min(1, max(0.02, f("h", 1)))
+        if x + w > 1 { w = 1 - x }
+        if y + h > 1 { h = 1 - y }
+        if w < 0.02 { x = 0.98; w = 0.02 }
+        if h < 0.02 { y = 0.98; h = 0.02 }
+        p.crop = Crop(x: x, y: y, w: w, h: h)
+      } else { warn("param crop: expected {x,y,w,h}, ignored") }
+    }
+    if let v = num("maxWidth") { p.maxWidth = v <= 0 ? 0 : min(8192, max(64, Int(v))) }
+    if let v = num("fps") { p.fps = min(60, max(1, Int(v.rounded()))) }
+    if let v = num("bitrateKbps") { p.bitrateKbps = clampBitrate(Int(v)) }
+    if let v = num("jpegQuality") { p.jpegQuality = min(100, max(1, Int(v))) }
+    if let v = bool("grayscale") { p.grayscale = v }
+    if let v = num("keyframeEverySec") { p.keyframeEverySec = v <= 0 ? 0 : min(3600, v) }
+    if let v = bool("cursor") { p.cursor = v }
+    return p
+  }
+}
+
+/// What one source looks like right now, and what we encode out of it.
+struct Geometry: Equatable {
+  /// Full source size in pixels (display or window, NOT the crop).
+  var srcWidth: Int
+  var srcHeight: Int
+  /// Full source bounds in global display points (top-left origin, CGEvent space).
+  var globalBounds: CGRect
+  /// Encoded output size, even numbers.
+  var outWidth: Int
+  var outHeight: Int
+}
+
+/// Output size for a crop of a source: keep aspect, never upscale, even numbers.
+func outputSize(srcW: Int, srcH: Int, crop: Crop, maxWidth: Int, codec: Codec) -> (Int, Int) {
+  let cw = max(2.0, Double(srcW) * crop.w), ch = max(2.0, Double(srcH) * crop.h)
+  var w = maxWidth == 0 ? cw : min(cw, Double(maxWidth))
+  var h = w * ch / cw
+  // The H.264 hardware encoder tops out at 4096 on either side.
+  let cap = codec == .h264 ? 4096.0 : 8192.0
+  if h > cap { w = w * cap / h; h = cap }
+  if w > cap { h = h * cap / w; w = cap }
+  func even(_ v: Double) -> Int { max(16, Int(v / 2) * 2) }
+  return (even(w), even(h))
+}

package/packages/extensions/desktop/helper/Probe.swift

@@ -0,0 +1,119 @@
+// Probe: what this Mac offers and what this binary is allowed, without ever
+// asking. Nothing here can raise a permission dialog:
+//   - CGPreflightScreenCaptureAccess() only reads the Screen Recording grant.
+//   - AXIsProcessTrustedWithOptions with prompt=false only reads Accessibility.
+//   - CGGetActiveDisplayList / display modes need no grant at all.
+// Both grants are checked for the RESPONSIBLE process (see Responsibility.swift).
+
+import ApplicationServices
+import CoreGraphics
+import Foundation
+
+/// `--no-capture` (selftest): behave as if Screen Recording were not granted,
+/// so a test can exercise the refusal path without any chance of capturing.
+var captureForbidden = false
+
+func screenRecordingGranted() -> Bool {
+  if captureForbidden { return false }
+  return CGPreflightScreenCaptureAccess()
+}
+
+func accessibilityTrusted() -> Bool {
+  let key = kAXTrustedCheckOptionPrompt.takeUnretainedValue() as String
+  return AXIsProcessTrustedWithOptions([key: false] as CFDictionary)
+}
+
+let screenRecordingSentence =
+  "Screen Recording is not granted to wp-desktop. On the Mac, open System Settings → Privacy & Security → "
+  + "Screen Recording, turn on wp-desktop, then open the desktop view again."
+
+let accessibilitySentence =
+  "Control needs Accessibility for wp-desktop. On the Mac, open System Settings → Privacy & Security → "
+  + "Accessibility and turn on wp-desktop; until then taps and keys are dropped."
+
+struct DisplayInfo {
+  let id: CGDirectDisplayID
+  let pixelWidth: Int
+  let pixelHeight: Int
+  let bounds: CGRect  // global points, top-left origin
+  let main: Bool
+  var scale: Double { bounds.width > 0 ? Double(pixelWidth) / Double(bounds.width) : 1 }
+
+  var json: [String: Any] {
+    [
+      "id": Int(id), "width": pixelWidth, "height": pixelHeight, "scale": scale, "main": main,
+      "bounds": ["x": bounds.minX, "y": bounds.minY, "w": bounds.width, "h": bounds.height],
+    ]
+  }
+}
+
+func activeDisplays() -> [DisplayInfo] {
+  var count: UInt32 = 0
+  guard CGGetActiveDisplayList(0, nil, &count) == .success, count > 0 else { return [] }
+  var ids = [CGDirectDisplayID](repeating: 0, count: Int(count))
+  guard CGGetActiveDisplayList(count, &ids, &count) == .success else { return [] }
+  let main = CGMainDisplayID()
+  return ids.prefix(Int(count)).map { id in
+    let mode = CGDisplayCopyDisplayMode(id)
+    let pw = mode?.pixelWidth ?? CGDisplayPixelsWide(id)
+    let ph = mode?.pixelHeight ?? CGDisplayPixelsHigh(id)
+    return DisplayInfo(id: id, pixelWidth: pw, pixelHeight: ph, bounds: CGDisplayBounds(id), main: id == main)
+  }
+}
+
+func osString() -> String {
+  let v = ProcessInfo.processInfo.operatingSystemVersion
+  return "macOS \(v.majorVersion).\(v.minorVersion).\(v.patchVersion)"
+}
+
+func probeObject() -> [String: Any] {
+  let r = responsibility()
+  return [
+    "t": "probe",
+    "screenRecording": screenRecordingGranted(),
+    "accessibility": accessibilityTrusted(),
+    "displays": activeDisplays().map { $0.json },
+    "os": osString(),
+    "helperVersion": helperVersion,
+    "pid": Int(r.pid),
+    "responsiblePid": Int(r.responsible),
+    "responsibleSelf": r.pid == r.responsible,
+  ]
+}
+
+/// On-screen windows, metadata only (owner, bounds; the title only where the
+/// system hands it out). CGWindowListCopyWindowInfo never prompts. Not part of
+/// the default probe.
+func windowList() -> [[String: Any]] {
+  guard let arr = CGWindowListCopyWindowInfo([.optionOnScreenOnly, .excludeDesktopElements], kCGNullWindowID)
+    as? [[String: Any]]
+  else { return [] }
+  return arr.compactMap { w in
+    guard let id = w[kCGWindowNumber as String] as? Int, let layer = w[kCGWindowLayer as String] as? Int, layer == 0,
+      let b = w[kCGWindowBounds as String] as? [String: Any], let rect = CGRect(dictionaryRepresentation: b as CFDictionary)
+    else { return nil }
+    var o: [String: Any] = [
+      "id": id, "pid": w[kCGWindowOwnerPID as String] as? Int ?? 0,
+      "owner": w[kCGWindowOwnerName as String] as? String ?? "",
+      "bounds": ["x": rect.minX, "y": rect.minY, "w": rect.width, "h": rect.height],
+    ]
+    if let n = w[kCGWindowName as String] as? String, !n.isEmpty { o["name"] = n }
+    return o
+  }
+}
+
+/// Global bounds (points) of one window, or of the frontmost normal window.
+func windowBounds(_ id: CGWindowID?) -> (CGWindowID, CGRect)? {
+  let opts: CGWindowListOption = id == nil ? [.optionOnScreenOnly, .excludeDesktopElements] : [.optionIncludingWindow]
+  guard let arr = CGWindowListCopyWindowInfo(opts, id ?? kCGNullWindowID) as? [[String: Any]] else { return nil }
+  for w in arr {
+    guard let wid = w[kCGWindowNumber as String] as? Int, (w[kCGWindowLayer as String] as? Int) == 0,
+      let b = w[kCGWindowBounds as String] as? [String: Any],
+      let rect = CGRect(dictionaryRepresentation: b as CFDictionary), rect.width >= 40, rect.height >= 40
+    else { continue }
+    // Skip our own and the window server's helper windows when following the front.
+    if id == nil, let owner = w[kCGWindowOwnerName as String] as? String, owner == "Window Server" { continue }
+    return (CGWindowID(wid), rect)
+  }
+  return nil
+}

package/packages/extensions/desktop/helper/Protocol.swift

@@ -0,0 +1,224 @@
+// Protocol: the process contract (PROTOCOL.md). stdin = JSON lines, stdout =
+// length-prefixed binary records, stderr = human log lines.
+
+import Foundation
+
+let helperVersion = "0.1.0"
+
+enum RecordKind: UInt8 {
+  case h264 = 1
+  case jpeg = 2
+  case json = 4
+}
+
+enum RecordFlag {
+  static let key: UInt8 = 1
+}
+
+/// CLOCK_UPTIME_RAW in µs: the clock of mach_absolute_time, of CoreMedia's host
+/// time clock (so SCK's sample times), and of node's process.hrtime on macOS.
+@inline(__always) func nowMicros() -> UInt64 { clock_gettime_nsec_np(CLOCK_UPTIME_RAW) / 1000 }
+
+private let logLock = NSLock()
+func log(_ s: String) {
+  let line = "wp-desktop: \(s)\n"
+  logLock.lock()
+  defer { logLock.unlock() }
+  line.withCString { p in _ = Darwin.write(2, p, strlen(p)) }
+}
+
+/// Which region of the source a frame was encoded for. `seq` grows by one on every config that
+/// changes the crop or the source, and on every source restart; frames carry the region that was
+/// current when they were SUBMITTED, so the VideoToolbox thread's late output still says which
+/// config produced it.
+struct Region: Equatable {
+  let seq: Int
+  let crop: Crop
+}
+
+/// stdout. One lock so records from the encoder thread and the control queue
+/// never interleave. A failed write means the reader is gone: exit.
+///
+/// The lock also owns the region the OUTPUT is in (`announced`): a video record whose region is not
+/// the announced one is preceded, under the same lock, by a status record naming the new region, and
+/// every status written carries the announced region. So on this one ordered stream a status naming
+/// region N is followed by that region's frames and by no earlier region's (PROTOCOL.md, "Regions").
+final class Output {
+  static let shared = Output()
+  private let lock = NSLock()
+  private(set) var bytesOut: UInt64 = 0
+  private var announced: Region?
+  private var lastStatus: [String: Any]?
+
+  /// A non-video record that carries no region.
+  func record(_ kind: RecordKind, key: Bool, pts: UInt64, payload: Data) {
+    lock.lock()
+    defer { lock.unlock() }
+    put(kind, key: key, pts: pts, payload: payload)
+  }
+
+  /// A video record of `region`. The first of a new region announces it with a status record first.
+  func frame(_ kind: RecordKind, key: Bool, pts: UInt64, payload: Data, region: Region) {
+    lock.lock()
+    defer { lock.unlock() }
+    if announced?.seq != region.seq {
+      announced = region
+      var o = lastStatus ?? ["t": "status", "state": "running"]
+      stamp(&o)
+      putJSON(o)
+    }
+    put(kind, key: key, pts: pts, payload: payload)
+  }
+
+  /// A status record: remembered (the announcing status is a copy of the newest one) and stamped
+  /// with the region the output is in right now, which is not necessarily the newest config's.
+  func status(_ obj: [String: Any]) {
+    lock.lock()
+    defer { lock.unlock() }
+    lastStatus = obj
+    var o = obj
+    stamp(&o)
+    putJSON(o)
+  }
+
+  func json(_ obj: [String: Any]) {
+    lock.lock()
+    defer { lock.unlock() }
+    putJSON(obj)
+  }
+
+  private func stamp(_ o: inout [String: Any]) {
+    guard let r = announced else { return }
+    o["crop"] = ["x": r.crop.x, "y": r.crop.y, "w": r.crop.w, "h": r.crop.h]
+    o["regionSeq"] = r.seq
+  }
+
+  private func putJSON(_ obj: [String: Any]) {
+    guard JSONSerialization.isValidJSONObject(obj),
+      let d = try? JSONSerialization.data(withJSONObject: obj, options: [.sortedKeys])
+    else {
+      log("internal: status object is not JSON-serialisable")
+      return
+    }
+    put(.json, key: false, pts: nowMicros(), payload: d)
+  }
+
+  /// Caller holds the lock.
+  private func put(_ kind: RecordKind, key: Bool, pts: UInt64, payload: Data) {
+    var hdr = [UInt8](repeating: 0, count: 14)
+    let len = UInt32(10 + payload.count)
+    for i in 0..<4 { hdr[i] = UInt8(truncatingIfNeeded: len >> (8 * UInt32(i))) }
+    hdr[4] = kind.rawValue
+    hdr[5] = key ? RecordFlag.key : 0
+    for i in 0..<8 { hdr[6 + i] = UInt8(truncatingIfNeeded: pts >> (8 * UInt64(i))) }
+    hdr.withUnsafeBytes { writeAll($0.baseAddress!, $0.count) }
+    payload.withUnsafeBytes { if $0.count > 0 { writeAll($0.baseAddress!, $0.count) } }
+    bytesOut += UInt64(14 + payload.count)
+  }
+
+  private func writeAll(_ p: UnsafeRawPointer, _ n: Int) {
+    var off = 0
+    while off < n {
+      let r = Darwin.write(1, p + off, n - off)
+      if r > 0 { off += r; continue }
+      if r < 0 && errno == EINTR { continue }
+      // EPIPE (SIGPIPE is ignored) or anything else: nobody is reading.
+      log("stdout closed (\(String(cString: strerror(errno)))), exiting")
+      exit(0)
+    }
+  }
+}
+
+enum Command {
+  case config([String: Any])
+  case keyframe
+  case bitrate(Int)
+  case input([String: Any])
+  case stop
+  case probe
+}
+
+func parseCommand(_ line: Substring) -> Command? {
+  let trimmed = line.trimmingCharacters(in: .whitespaces)
+  if trimmed.isEmpty { return nil }
+  guard let obj = try? JSONSerialization.jsonObject(with: Data(trimmed.utf8)) as? [String: Any],
+    let t = obj["t"] as? String
+  else {
+    log("ignored a stdin line that is not a JSON object with \"t\": \(trimmed.prefix(120))")
+    return nil
+  }
+  switch t {
+  case "config": return .config(obj)
+  case "keyframe": return .keyframe
+  case "bitrate":
+    guard let k = (obj["kbps"] as? NSNumber)?.intValue else {
+      log("ignored bitrate without a numeric kbps")
+      return nil
+    }
+    return .bitrate(k)
+  case "input":
+    guard let ev = obj["ev"] as? [String: Any] else {
+      log("ignored input without an ev object")
+      return nil
+    }
+    return .input(ev)
+  case "stop": return .stop
+  case "probe": return .probe
+  default:
+    log("ignored unknown command t=\(t)")
+    return nil
+  }
+}
+
+/// Reads stdin on its own thread; EOF ⇒ `onEOF`. A line longer than 1 MB is
+/// dropped whole (an input text chunk is never that long).
+final class StdinReader {
+  private let onCommand: (Command) -> Void
+  private let onEOF: () -> Void
+
+  init(onCommand: @escaping (Command) -> Void, onEOF: @escaping () -> Void) {
+    self.onCommand = onCommand
+    self.onEOF = onEOF
+  }
+
+  func start() {
+    let t = Thread { [self] in self.loop() }
+    t.name = "stdin"
+    t.start()
+  }
+
+  private func loop() {
+    var buf = [UInt8]()
+    var chunk = [UInt8](repeating: 0, count: 64 * 1024)
+    var discarding = false
+    while true {
+      let n = chunk.withUnsafeMutableBytes { Darwin.read(0, $0.baseAddress!, $0.count) }
+      if n < 0 && errno == EINTR { continue }
+      if n <= 0 { break }
+      var start = 0
+      for i in 0..<n where chunk[i] == 0x0A {
+        if !discarding {
+          buf.append(contentsOf: chunk[start..<i])
+          if let s = String(bytes: buf, encoding: .utf8), let c = parseCommand(Substring(s)) { onCommand(c) }
+        }
+        buf.removeAll(keepingCapacity: true)
+        discarding = false
+        start = i + 1
+      }
+      if start < n && !discarding {
+        buf.append(contentsOf: chunk[start..<n])
+        if buf.count > 1 << 20 {
+          log("ignored a stdin line longer than 1 MB")
+          buf.removeAll()
+          discarding = true
+        }
+      }
+    }
+    onEOF()
+  }
+}
+
+func jsonLine(_ obj: [String: Any]) -> String {
+  guard let d = try? JSONSerialization.data(withJSONObject: obj, options: [.sortedKeys]) else { return "{}" }
+  return String(decoding: d, as: UTF8.self)
+}

package/packages/extensions/desktop/helper/Request.swift

@@ -0,0 +1,51 @@
+// Request: the only code in wp-desktop that asks macOS for a grant. Everything else only reads
+// (Probe.swift: "Nothing here can raise a permission dialog").
+//
+//   wp-desktop request [screen|accessibility]      both when no name is given
+//
+// Run through the same responsibility-disclaim path as `serve` (main.swift), so the dialog and the
+// row it adds in System Settings name wp-desktop, not node. It returns at once: both calls only
+// START the dialog, which the system shows on the desktop's screen and the person answers there.
+// The grant is read later by `probe`.
+//
+//   - Screen Recording: CGRequestScreenCaptureAccess(). It lists the binary in the Screen & System
+//     Audio Recording pane and shows the dialog the first time; asked again for the same binary it
+//     may show nothing, which is why the host then opens the pane instead.
+//   - Accessibility: AXIsProcessTrustedWithOptions with the prompt option on.
+//
+// `--dry-request` reads the current state and calls neither request API (selftest, and anything
+// else that must not risk a dialog).
+
+import ApplicationServices
+import CoreGraphics
+import Foundation
+
+/// The names `request` takes, in the order a bare `request` asks them.
+let requestableKinds = ["screen", "accessibility"]
+
+/// One kind's answer: whether it was already granted before the call, and whether it is now.
+/// `asked` is false when it was already granted, or in a dry run: no request API was called.
+func requestAccess(_ kind: String, dry: Bool) -> [String: Any] {
+  switch kind {
+  case "screen":
+    let before = CGPreflightScreenCaptureAccess()
+    if before || dry { return ["already": before, "granted": before, "asked": false] }
+    let granted = CGRequestScreenCaptureAccess()
+    return ["already": false, "granted": granted, "asked": true]
+  default:
+    let key = kAXTrustedCheckOptionPrompt.takeUnretainedValue() as String
+    let before = AXIsProcessTrustedWithOptions([key: false] as CFDictionary)
+    if before || dry { return ["already": before, "granted": before, "asked": false] }
+    let granted = AXIsProcessTrustedWithOptions([key: true] as CFDictionary)
+    return ["already": false, "granted": granted, "asked": true]
+  }
+}
+
+/// `request`'s stdout object; nil when `what` names nothing requestable.
+func requestObject(_ what: String?, dry: Bool) -> [String: Any]? {
+  let kinds = what.map { [$0] } ?? requestableKinds
+  guard kinds.allSatisfy({ requestableKinds.contains($0) }) else { return nil }
+  var out: [String: Any] = ["dry": dry, "responsibleSelf": responsibility().pid == responsibility().responsible]
+  for k in kinds { out[k] = requestAccess(k, dry: dry) }
+  return out
+}

package/packages/extensions/desktop/helper/Responsibility.swift

@@ -0,0 +1,133 @@
+// Responsibility: which process TCC charges for this helper's Screen Recording
+// and Accessibility checks.
+//
+// macOS attributes a TCC request to the RESPONSIBLE process. A process launched
+// by launchd is responsible for itself; a child spawned with plain fork/
+// posix_spawn inherits its parent's. The host is node under a
+// LaunchAgent (measured: every child of the live host reports node's pid as its
+// responsible pid), so a plainly spawned wp-desktop would be judged as
+// /opt/homebrew/bin/node: the grant would land on node (every node script gets
+// it, and a Homebrew upgrade of node silently drops it).
+//
+// Fix, done here so the host needs nothing native:
+//  1. If this process is not responsible for itself, re-exec the same binary in
+//     place (POSIX_SPAWN_SETEXEC keeps pid, stdin, stdout, stderr) with
+//     responsibility_spawnattrs_setdisclaim(attr, 1).
+//  2. If the re-exec'd image is STILL not responsible for itself, fall back to
+//     a disclaimed child: posix_spawn without SETEXEC, the child inherits the
+//     same stdio fds, the parent forwards TERM/INT/HUP and exits with the
+//     child's status. The child exits when its parent goes (Server watchdog).
+// The SPI lives in libSystem (macOS 10.14+); Chromium, LLDB and Qt Creator use
+// it for the same reason. It is looked up with dlsym, so a missing symbol
+// degrades to "not disclaimed", reported as responsibleSelf:false.
+//
+// WP_DESKTOP_DISCLAIMED records the stage: "exec" after step 1, "child" in step 2.
+
+import Darwin
+import Foundation
+
+private typealias GetResponsible = @convention(c) (pid_t) -> pid_t
+private typealias SetDisclaim = @convention(c) (UnsafeMutablePointer<posix_spawnattr_t?>, Int32) -> Int32
+
+private let libSystem = dlopen(nil, RTLD_NOW)
+
+func responsibility() -> (pid: pid_t, responsible: pid_t) {
+  let me = getpid()
+  guard let sym = dlsym(libSystem, "responsibility_get_pid_responsible_for_pid") else { return (me, -1) }
+  return (me, unsafeBitCast(sym, to: GetResponsible.self)(me))
+}
+
+func executablePath() -> String? {
+  var size: UInt32 = 0
+  _NSGetExecutablePath(nil, &size)
+  var buf = [CChar](repeating: 0, count: Int(size) + 1)
+  guard _NSGetExecutablePath(&buf, &size) == 0 else { return nil }
+  var real = [CChar](repeating: 0, count: Int(PATH_MAX))
+  guard realpath(buf, &real) != nil else { return String(cString: buf) }
+  return String(cString: real)
+}
+
+/// Re-exec (or, failing that, spawn a child) with responsibility disclaimed when
+/// needed. Returns only in the process that should go on running the command.
+/// `force` / `forceChild` take a path even when already responsible (selftest).
+func disclaimResponsibilityIfNeeded(force: Bool, forceChild: Bool) {
+  let env = ProcessInfo.processInfo.environment
+  if env["WP_DESKTOP_NO_DISCLAIM"] == "1" { return }
+  let stage = env["WP_DESKTOP_DISCLAIMED"]
+  if stage == "child" { return }
+  let r = responsibility()
+  let isSelf = r.responsible == r.pid
+  if stage == "exec" {
+    if isSelf && !forceChild { return }
+    log("still judged for pid \(r.responsible) after re-exec; starting a disclaimed child instead")
+    runDisclaimedChild()
+    return
+  }
+  if forceChild {
+    runDisclaimedChild()
+    return
+  }
+  if isSelf && !force { return }
+  var attr: posix_spawnattr_t?
+  guard let path = executablePath(), disclaimAttr(&attr) else { return }
+  defer { posix_spawnattr_destroy(&attr) }
+  posix_spawnattr_setflags(&attr, Int16(POSIX_SPAWN_SETEXEC))
+  var pid: pid_t = 0
+  let rc = spawn(&pid, path, &attr, stage: "exec")
+  // Only reached on failure: SETEXEC replaces this image on success.
+  log("re-exec with disclaimed responsibility failed (\(String(cString: strerror(rc)))); trying a child")
+  runDisclaimedChild()
+}
+
+private func disclaimAttr(_ attr: inout posix_spawnattr_t?) -> Bool {
+  guard let set = dlsym(libSystem, "responsibility_spawnattrs_setdisclaim") else {
+    log("cannot disclaim responsibility on this system; permissions will be judged for pid \(responsibility().responsible)")
+    return false
+  }
+  posix_spawnattr_init(&attr)
+  guard unsafeBitCast(set, to: SetDisclaim.self)(&attr, 1) == 0 else {
+    log("responsibility_spawnattrs_setdisclaim failed; permissions will be judged for pid \(responsibility().responsible)")
+    return false
+  }
+  return true
+}
+
+private func spawn(_ pid: inout pid_t, _ path: String, _ attr: inout posix_spawnattr_t?, stage: String) -> Int32 {
+  var argv: [UnsafeMutablePointer<CChar>?] = CommandLine.arguments.map { strdup($0) }
+  argv[0] = strdup(path)
+  argv.append(nil)
+  var envp: [UnsafeMutablePointer<CChar>?] =
+    ProcessInfo.processInfo.environment.filter { $0.key != "WP_DESKTOP_DISCLAIMED" }.map { strdup("\($0.key)=\($0.value)") }
+  envp.append(strdup("WP_DESKTOP_DISCLAIMED=\(stage)"))
+  envp.append(nil)
+  return posix_spawn(&pid, path, nil, &attr, argv, envp)
+}
+
+/// Spawns the disclaimed child on the same stdio, then waits and mirrors its
+/// exit. Returns only if the child could not be started (the caller then runs
+/// the command itself, not disclaimed).
+private func runDisclaimedChild() {
+  var attr: posix_spawnattr_t?
+  guard let path = executablePath(), disclaimAttr(&attr) else { return }
+  defer { posix_spawnattr_destroy(&attr) }
+  var pid: pid_t = 0
+  let rc = spawn(&pid, path, &attr, stage: "child")
+  guard rc == 0 else {
+    log("disclaimed child failed to start (\(String(cString: strerror(rc)))); running undisclaimed")
+    return
+  }
+  var sources = [DispatchSourceSignal]()
+  for sig in [SIGTERM, SIGINT, SIGHUP] {
+    signal(sig, SIG_IGN)
+    let s = DispatchSource.makeSignalSource(signal: sig, queue: .global())
+    s.setEventHandler { kill(pid, sig) }
+    s.resume()
+    sources.append(s)
+  }
+  // The child reads stdin and writes stdout; this process only waits.
+  var st: Int32 = 0
+  while waitpid(pid, &st, 0) < 0 && errno == EINTR {}
+  _ = sources
+  let sig = st & 0x7f
+  exit(sig == 0 ? (st >> 8) & 0xff : 128 + sig)
+}