fix(desktop): make the macOS dev TCC grant durable, behind an opt-in

[Astro-Han]

Summary

#1920 established the mechanism macOS TCC requires: an ad-hoc-signed Maka Dev.app launched through LaunchServices. That stays. This PR removes the session protocol built around it, scopes the grant per worktree, and puts the whole workflow behind MAKA_DEV_TCC.

The session protocol was unnecessary. open returns at the LaunchServices handoff and the system can relaunch the app at any time, so launch-time context was pushed through session.json, app.pid, launch-status.json, a runtime lock, stale-session recovery, a startup handshake, and a launch-record probe injected into main.ts. All of it existed to let a detached app pretend it was still a child process. Make the bootstrap depend on build-time constants instead, and publish the environment as ownerless 0600 data, and a relaunch with no arguments and no environment reproduces a correct app by itself. main.ts returns to its pre-#1920 state.

The grant is scoped per worktree, not pinned to a forgeable identity. TCC keys its rows on the bundle identifier, so the shared com.maka.dev meant each worktree silently overwrote the others' row. The identifier is now com.maka.dev.<worktree-id>.

An earlier revision of this PR also pinned designated => identifier "com.maka.dev" so the grant would survive rebuilds, arguing that this was not weaker because the bundle loads dist/main/main.js from outside the signature seal. That argument was wrong and the change is reverted. It only shows that repository write access implies use of the grant; it does not show the converse. codesign --sign - is available to every unprivileged process, so any binary anywhere on the disk can claim the identifier and satisfy the requirement — demonstrated with a 15-line C program in /tmp that satisfies the identifier requirement and fails a cdhash one. And because TCC rows outlive the code they were granted to, the token stays redeemable after this repository is deleted, at which point "anyone who can write the repo" describes nothing at all. The ad-hoc default cdhash requirement stands instead. A rebuild now costs a re-grant, but a rebuild only happens on an Electron bump or a repository move — not on an ordinary npm run dev, which is a marker cache hit.

npm run dev and npm start were the same logic twice, and the copies had drifted into different bugs rather than different behaviour. npm start never followed the log, so under MAKA_DEV_TCC it was completely silent — including bootstrap failures — while the README promised streamed logs. It also republished the environment with no Vite URL, so running it beside a live npm run dev silently killed that app and brought up a replacement on the stale prebuilt renderer. Both now go through one startDevelopmentApp.

Launch and rebuild reclaim a leftover app. Electron's single-instance lock is keyed on userData, so an app surviving a hard-killed session absorbed the new launch: the new process exited 0, the OLD window came forward against a dead Vite URL, and the liveness probe still reported success.

Claims from earlier revisions that were wrong

Independent review plus direct experiment refuted several things earlier revisions asserted in comments:

Claim	Reality
An identifier requirement is not weaker here	Refuted by experiment; see above. Reverted to the cdhash default.
LaunchServices does not inherit the shell environment	open forwards the whole parent environment. The env file earns its place for Dock/Spotlight/"Quit & Reopen", which have no parent shell.
Resources/app would flip app.isPackaged to true	isPackaged is basename(execPath) !== 'electron'. Only the executable's name keeps the dev gates on.
ditto drops quarantine; xattr -r is too new	man ditto: --qtn is the default. man xattr: -r is in the first synopsis line.

Excluding TERM from the recorded environment turned out to matter more than "it goes stale": shell-env.ts short-circuits when TERM is present, so a recorded one would leave a Dock launch on launchd's minimal PATH.

Also fixed: pkill -f/pgrep -f take an extended regex, so an unescaped path under e.g. ~/Dropbox (Personal) matched nothing and left the app unkillable, while a pattern error was read as "not running"; the single 5s liveness check reported a false failure when the app was quit early, never noticed a quit after 5s (hanging the terminal), and could kill a slow first launch — it is now a monitor that waits for the app to appear and treats a later disappearance as an ordinary session end; signal handlers are registered before the launch await, since a signal arriving during the codesign rebuild took the default action and orphaned the app (observed: exit 130 with the app and its log tail leaked); app.log is created 0600; a failed rebuild no longer leaves ~250 MB of staging behind; the stale ElectronAsarIntegrity record is removed; and .maka-dev-session/ stays gitignored because the pre-opt-in launcher ran unconditionally and its leftover session.json holds forwarded API keys.

Refs #1920

Verification

On-device, macOS 25.5.0 / Electron 43.1.1:

• Identity and requirement — Identifier=com.maka.dev.5b9c7a5a7a17, designated => cdhash H"12ce55…", helpers keep com.github.Electron.helper, --verify --deep --strict passes. An ad-hoc-signed impostor claiming the same identifier is rejected (exit 3); against the previous revision's identifier requirement it was accepted (exit 0).
• Cache — a second prepare:dev-app leaves the cdhash unchanged, so ordinary development does not churn the bundle the grant is anchored to.
• Lifecycle — Ctrl-C on both npm run dev and npm start: exit 0, no leftover app, no leftover tail, Vite port released. Quitting the app mid-session ends the dev session cleanly (Maka Dev.app quit) instead of hanging.
• npm start fixes — terminal now shows [startup] app ready; the published Vite URL survives a reclaiming launch instead of being dropped.
• Modes — app.log and dev-env.json both 0600.
• Default path — without MAKA_DEV_TCC it runs node .bin/electron <desktopDir> and never touches the bundle.
• npm run test:scripts 78/78 · typecheck · format:check · lint — all clean.

Tests execute the generated bootstrap against a stub Electron module rather than regex-matching its source. Six mutations were used to check the suite can actually go red: inverting the opt-in gate, renaming a marker field, dropping the log redirection, moving the payload to Resources/app, collapsing the forwarded option shapes, and misreporting a failed launch as a normal exit — all six are caught.

On not testing the grant by hand

The TCC grant itself was not exercised, and does not need to be for this PR. In TCC terms this branch differs from main by one string: main (i.e. #1920) already signs ad hoc and already takes codesign's default cdhash designated requirement. An earlier revision of this PR deviated by pinning -r=identifier; that is now reverted, so the requirement matches main and the only remaining change is the per-worktree suffix on the identifier — strictly more isolation.

Whether an ad-hoc-signed bundle can hold a grant at all is therefore a premise of #1920, already on main, neither introduced nor worsened by this PR. The parts this PR does change were verified by experiment rather than by argument: an impostor claiming the identifier is rejected, a rebuild leaves the cdhash unchanged, strict verification passes, and the helper bundles keep com.github.Electron.helper — which main's --deep --identifier had been overwriting.

Known limitation

dev-env.json outlives the session, so a Dock launch long after npm run dev stopped points at a Vite URL that is no longer served and the window stays blank; if another worktree has since taken that port, it loads that renderer instead, which looks like it worked. Deleting the file on exit would break "Quit & Reopen", the capability this design exists to keep; a proper fix belongs in main-window.ts's load-failure path and is out of scope. Documented in the README.