mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 10:27:33 +00:00
Jinwoo Hong
0d7a48df9b
* feat(daemon): capture macOS's verdict when a terminal host is refused a folder On a confirmed app/host divergence in Documents, Desktop or Downloads, read macOS's own record once per host incarnation and folder class: tccd decisions and kernel sandbox denies for the host pid, host signature checks, host age and origin, earlier good reads, time since wake signals, Full Disk Access, fork-fallback reason, and the class root's dataless, iCloud and volume state (read before the app-side opendir). Telemetry is enum-only in a new daemon_pty_cwd_denial_capture event; raw filtered lines go to a capped local file under userData logs. Every subprocess is bounded and failures are swallowed off the spawn path. * fix(daemon): keep the wake clock Electron-free and avoid casts in the log parser * fix(daemon): tighten denial capture attribution and bounds Snapshot good-read and wake context at the denial, bound the class-root realpath, keep earlier captures when one entry is over the cap, require the app or host in requirement failures, let an explicit pid outrank a shared copy path, and report a capped log read as truncated. * fix(daemon): collect Info requirement checks and claim captures before probing Ask log show for Info records in a 30 s window ending at the denial, claim a helper/class capture before the folder probes and release it when the app is refused too, and report a requirement failure tied only to the shared app identifier as uncorrelated instead of blaming this helper. * fix(daemon): keep folder-denial capture in telemetry labels only Drop the local diagnostics file and stop retaining raw log lines: the parser reads them in memory to derive enums and keeps nothing. * fix(daemon): skip the folder-denial capture when telemetry is off Gate the folder probes and the log/codesign capture on the telemetry client's consent check so opted-out users never have their log read or checks run. * fix(daemon): recheck telemetry consent at every capture stage Run every capture subprocess through a consent-checked runner (now a required probe argument), ask again before and after the identity probe and after the remaining probes, and free the claim when an opt-out stops a capture so a later opt-in can still capture. * fix(daemon): recheck consent after the access reader's lazy import The Full Disk Access reader started after its import resolved without asking again, and its catch swallowed the opt-out; ask after the import and let the opt-out end the capture so its claim is freed. * fix(daemon): report a helper's denial over a later allowed result Overlapping tccd requests can resolve out of order; when any result for the denied folder class is a denial, report it.