swiftc linker-signs only the inner binary, leaving the bundle unsigned
and its codesign identifier as "launcher" rather than the bundle id. More
importantly it leaves the app ad-hoc signed, and macOS pins an ad-hoc
app's Accessibility grant to its exact cdhash instead of to a designated
requirement. Every build mints a new cdhash, so each rebuild-and-replace
silently revoked the permission while the app stayed listed and ticked
under Privacy & Security — and every release did the same to everyone who
updated. That was the root cause of the window tags never appearing.
- build.sh signs the bundle with its real identifier, honours
SHANNONCOAT_SIGN_IDENTITY, and fails outright rather than falling back
to ad-hoc when an identity was asked for explicitly.
- The identity is read from a gitignored .env, so it doesn't have to be
retyped every build. Parsed rather than sourced, so a stray command in
the file can't execute as a side effect of building, and so an existing
environment variable still wins. .env.example carries the full one-time
setup.
- release.yml imports the certificate into a throwaway keychain, builds,
verifies, and deletes the keychain on if: always(). It stays inert
until the three secrets exist, and fails the release rather than
shipping ad-hoc.
- Guards the empty-password case explicitly: macOS cannot import an
OpenSSL-produced PKCS#12 with an empty password, and reports it as "MAC
verification failed (wrong password?)", which sends you hunting for a
wrong password rather than a missing one. Nothing local catches this,
since the login keychain imports the PEM pair and needs no password.
- Ignores *.p12 and *.pem as a backstop; the certificate belongs outside
the working tree entirely.
Verified end-to-end: two from-scratch builds produce byte-identical
designated requirements where ad-hoc differs every time, and six
rebuild-reinstall cycles under a real certificate kept the Accessibility
grant with no System Settings interaction.
This buys permission persistence, not Gatekeeper approval — a
self-signed certificate isn't notarized, so downloads still need
System Settings -> Privacy & Security -> Open Anyway.
Every profile launches the same Claude Desktop binary with the same icon
and title, so with two or more open there was no way to tell which window
belonged to which profile at a glance. WindowOverlay pins a small tag —
profile name, in that profile's own dot colour — to each running managed
profile's window, tracked live via AXObserver notifications rather than
polling. Only a persistent process can hold a watcher like that, which is
exactly the gap the old one-shot CLI could never close.
Shown for every running managed profile, not just when two or more are
up: the tag is an identity marker, not merely a disambiguator. Never
shown on "default", which isn't a shannoncoat profile at all.
Positioned top-right, since top-left is where a window's close/minimize/
zoom controls live. Draggable in case that still obstructs something in a
particular layout, on a .nonactivatingPanel so dragging it doesn't steal
focus from the window underneath, with the offset persisted.
Attachment retries for ~3s rather than requiring the target's first
window to already exist: a cold Electron launch can take a second or more
between the process starting — which is what triggers the update, via
NSWorkspace's launch notification — and its first window existing. Losing
that race previously meant the tag silently never appeared at all.
Also ignores CHECKPOINT.md, a local session-handoff note.
Replaces the original shannoncoat.sh entirely with in-process Swift. The
script stopped earning its keep once the rest went native, and being a
persistent process rather than a one-shot CLI is what later makes live
window tracking possible at all.
- ProfileStore: JSON config at ~/.shannoncoat/<name>.json (was hand-rolled
YAML), with ~ expansion, paths relative to the config dir, and
name/dir-collision validation in one place.
- ProcessInspector: sysctl(KERN_PROC_ALL/KERN_PROCARGS2) enumeration
instead of shelling out to pgrep.
- ClaudeControl: launch via Process, focus via direct Accessibility calls
(unhide, un-minimize, poll-for-window, AXRaise) instead of AppleScript,
and a quit that respects Claude's own termination handling rather than
unconditionally SIGKILLing after a flat 5s timeout.
- LiveState: NSWorkspace notification-driven state with no polling timer,
so the menu bar reflects reality within about a second — including
changes made outside the app entirely.
- ManageWindow: one non-modal window replacing what would otherwise be a
string of separate popup alerts, with inline add/remove and directory
pickers.
- LaunchAtLogin / UpdateChecker: SMAppService login-item toggle, and a
minimal VERSION-file update check that alerts on a manual check and
posts a quiet notification on the automatic one.
Also drops the standalone CLI in favour of GUI-only, and adds a
placeholder app icon drawn from vector shapes rather than composited on
top of Claude's own icon assets.
Claude Desktop is located at runtime rather than assumed: a path the user
picked previously, then /Applications, then a per-user ~/Applications
install, each accepted only if it actually contains the executable. If
none match, launching a profile asks the user to locate it once and
remembers the answer — a launch that silently does nothing gives them no
way to work out what's wrong.
Claude Opus 5andbdeshi