Prevent monitor status TCC prompts in Git-Same 3.2.0

.claude/CLAUDE.md

@@ -43,7 +43,9 @@ Git-Same is a Rust CLI + TUI + macOS Tauri app that discovers GitHub org/repo st
 
 **Commands:** `init`, `setup`, `sync`, `status`, `scan`, `workspace {list,default}`, `reset`, `monitor` (alias: `daemon`), `refresh`.
 
-**Why `monitor` is a CLI subcommand and not solely a Tauri-host responsibility:** the LaunchAgent invokes `gisa monitor --foreground`, non-cask installs (`cargo install`, the homebrew formula) ship only the binary, `--status` / `--stop` are the supported debugging surface, and a future Linux file-manager extension would talk to the same `gisa monitor` over the same Unix socket. The CLI handler is a thin shim (~140 lines); the loop itself lives in `git-same-core::monitor`.
+**Why `monitor` is a CLI subcommand and not solely a Tauri-host responsibility:** non-cask installs (`cargo install`, the homebrew formula) ship only the binary, `--status` / `--stop` are the supported debugging surface, and a future Linux file-manager extension would talk to the same `gisa monitor` over the same Unix socket. The CLI handler is a thin shim; the loop itself lives in `git-same-core::monitor`, and `monitor::Options::from_config` / `monitor::default_shutdown_signal` are shared with the app.
+
+**Why the LaunchAgent runs `Git-Same.app/Contents/MacOS/git-same-app monitor --foreground` and not the helper:** macOS TCC attributes a launchd-spawned process to its bundle only when the executable is the bundle's `CFBundleExecutable`. `Contents/Helpers/git-same` is a separate, path-based TCC identity, so a Full Disk Access grant for "Git-Same" never reaches a monitor started through it. `crates/git-same-app/src/monitor_mode.rs` runs the same core loop headlessly (no Tauri, no window, no Dock icon) when argv[1] is `monitor`. `monitor_binary_candidates()` in `commands.rs` prefers the bundled app executable, the app re-renders an installed agent that still points elsewhere on launch, and the cask renders the same path. Dev builds outside an `.app` fall back to the helper and keep a path-based identity.
 
 ### Engine modules (`crates/git-same-core/src/`)
 
@@ -112,7 +114,9 @@ Three non-obvious traps in `macos/GitSameBadges/`. Each one silently breaks badg
 
 3. **Google Drive's FinderSync poisons the badge-rendering pipeline.** When `com.google.drivefs.finderhelper.findersync` is enabled, peer FinderSync extensions render no badge image even after Finder calls `setBadgeIdentifier`. Confirmed in this environment: badges only began appearing after the user disabled Google Drive in System Settings → Login Items & Extensions. Other peers (Keka, Synology, Dropbox) coexist fine. There is no code fix; document the workaround and surface it in the in-app self-check if you can.
 
-`scan_roots` and `show_ambient`: defaults are `["~"]` / `false`. Never re-enable `show_ambient = true` with `~` in `scan_roots`: Finder refuses to call `requestBadgeIdentifier` on extensions whose `directoryURLs` contain the home folder (separate issue from the three above).
+4. **Full Disk Access is per executable, and the extension is not the process that needs it.** The appex does zero I/O outside its app-group container and has never triggered a TCC prompt. The monitor is what walks workspace roots, reads `/Volumes`, watches FSEvents, and writes `Icon\r`, so it is the process that needs FDA. `git-same-core::macos::full_disk_access::probe()` (opens the user TCC.db; success proves the grant, EPERM means denied, never prompts) is stamped into `status.json` as `full_disk_access` by the monitor and read by the app, whose `enable_finder_extension` command refuses to set the pluginkit election until the gate passes. macOS applies a new grant on process start: the app must be relaunched and the monitor restarted (the app does the latter automatically).
+
+`scan_roots` and `show_ambient`: defaults are `["~"]` / `false`. Never re-enable `show_ambient = true` with `~` in `scan_roots`: Finder refuses to call `requestBadgeIdentifier` on extensions whose `directoryURLs` contain the home folder (separate issue from the four above).
 
 ## Workspace folder branding (macOS)
 

.github/workflows/S1-Test-CI.yml

@@ -114,7 +114,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
 
       - name: Install Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 24
 
@@ -161,7 +161,7 @@ jobs:
           prefix-key: v1-rust-no-bin
 
       - name: Install cargo-tarpaulin
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@v2.87.8
         with:
           tool: cargo-tarpaulin
 
@@ -204,7 +204,7 @@ jobs:
 
           # Exactly 1 default [[bin]] in Cargo.toml. [[bin]] entries gated by
           # `required-features` (e.g. release-tools helpers gen-completions and
-          # gen-manpage) are excluded — they don't ship in normal builds.
+          # gen-manpage) are excluded: they don't ship in normal builds.
           read DEFAULT_COUNT CARGO_BIN <<<"$(awk '
             function flush() {
               if (in_bin && !has_req) {
@@ -305,10 +305,17 @@ jobs:
     permissions:
       contents: read
       checks: write
+    # audit-check builds cargo-audit from source with whatever toolchain cargo
+    # resolves. rust-toolchain.toml pins 1.93.1 for the crate itself, but
+    # cargo-audit's dependency graph now requires a newer rustc (kstring 2.0.4
+    # needs 1.96), so the audit job overrides the pin and uses current stable.
+    env:
+      RUSTUP_TOOLCHAIN: stable
     steps:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
       - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/S2-Release-GitHub.yml

@@ -65,7 +65,7 @@ jobs:
           prefix-key: v1-rust-no-bin
 
       - name: Install cargo-tarpaulin
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@v2.87.8
         with:
           tool: cargo-tarpaulin
 
@@ -423,7 +423,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
 
       - name: Install Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 24
 
@@ -502,7 +502,7 @@ jobs:
           find artifacts -type f -exec cp {} release-assets/ \;
 
       - name: Create/update release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: release-assets/*
         env: