Replace osascript with native Swift helper for stable TCC permissions

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
   test:
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
@@ -18,6 +18,12 @@ jobs:
           go-version-file: go.mod
       - run: go test ./...
 
+  build-obkmacos:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: swiftc -O -o obkmacos swift/obkmacos.swift
+
   cross-compile:
     runs-on: ubuntu-latest
     strategy:
@@ -33,10 +39,6 @@ jobs:
             goarch: amd64
           - goos: darwin
             goarch: arm64
-          - goos: windows
-            goarch: amd64
-          - goos: windows
-            goarch: arm64
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5

.github/workflows/release.yml

@@ -8,7 +8,25 @@ permissions:
   contents: write
 
 jobs:
+  build-obkmacos:
+    strategy:
+      matrix:
+        include:
+          - arch: arm64
+            runner: macos-latest
+          - arch: amd64
+            runner: macos-13
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+      - run: swiftc -O -o obkmacos-darwin-${{ matrix.arch }} swift/obkmacos.swift
+      - uses: actions/upload-artifact@v4
+        with:
+          name: obkmacos-darwin-${{ matrix.arch }}
+          path: obkmacos-darwin-${{ matrix.arch }}
+
   release:
+    needs: build-obkmacos
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -22,3 +40,11 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: obkmacos-*
+          merge-multiple: true
+      - run: |
+          gh release upload "${{ github.ref_name }}" obkmacos-darwin-arm64 obkmacos-darwin-amd64
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -2,15 +2,8 @@ builds:
   - binary: obk
     env: [CGO_ENABLED=0]
     ldflags: -s -w -X github.com/priyanshujain/openbotkit/internal/cli.Version={{.Version}}
-    goos: [linux, darwin, windows]
+    goos: [linux, darwin]
     goarch: [amd64, arm64, riscv64]
     ignore:
       - goos: darwin
         goarch: riscv64
-      - goos: windows
-        goarch: riscv64
-
-archives:
-  - format_overrides:
-      - goos: windows
-        format: zip

Makefile

@@ -4,12 +4,19 @@ ALIAS = obk
 SKILLS_DIR = $(HOME)/.obk/skills
 ASSISTANT_SKILLS = assistant/.claude/skills
 
-.PHONY: build install uninstall update-local
+.PHONY: build build-obkmacos install uninstall update-local
 
 build:
 	go build -o $(BINARY) .
 
-install:
+build-obkmacos:
+ifeq ($(shell uname),Darwin)
+	@mkdir -p $(HOME)/.obk/bin
+	swiftc -O -o $(HOME)/.obk/bin/obkmacos swift/obkmacos.swift
+	@echo "Built obkmacos -> $(HOME)/.obk/bin/obkmacos"
+endif
+
+install: build-obkmacos
 	go install .
 	ln -sf $(GOBIN)/$(BINARY) $(GOBIN)/$(ALIAS)
 	mkdir -p $(SKILLS_DIR)

README.md

@@ -51,11 +51,22 @@ AI agents can now read your email, send messages, and browse the web on your beh
 
 ### 1. Install
 
+**macOS and Linux** (Windows is not supported):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/priyanshujain/openbotkit/master/install.sh | sh
+```
+
+<details>
+<summary>Alternative: build from source</summary>
+
+Requires [Go 1.25+](https://go.dev/dl/).
+
 ```bash
-# Build from source
 git clone https://github.com/priyanshujain/openbotkit.git
 cd openbotkit && make install
 ```
+</details>
 
 ### 2. Set up your sources
 
@@ -154,10 +165,17 @@ All data lives under `~/.obk/` (override with `OBK_CONFIG_DIR`):
     └── data.db             # Audit log
 ```
 
+## Platform Support
+
+| Platform | Status |
+|----------|--------|
+| **macOS** (Apple Silicon & Intel) | Fully supported — all features including Apple Contacts, Notes, iMessage |
+| **Linux** (amd64 & arm64) | Supported — server deployment, all features except Apple-native integrations |
+| **Windows** | Not supported |
+
 ## Prerequisites
 
-- macOS (primary target; Linux supported for server deployment)
-- Go 1.25+
+- macOS or Linux
 - Gmail: API credentials from [Google Cloud Console](https://console.cloud.google.com/apis/credentials)
 - WhatsApp: Phone with WhatsApp to scan QR code
 - Telegram: Bot token from [@BotFather](https://t.me/botfather) (for approval flow)

daemon/contacts.go

@@ -3,6 +3,7 @@ package daemon
 import (
 	"context"
 	"log/slog"
+	"runtime"
 	"time"
 
 	"github.com/priyanshujain/openbotkit/config"
@@ -18,6 +19,8 @@ func runContactsSync(ctx context.Context, cfg *config.Config) <-chan error {
 	go func() {
 		defer close(errCh)
 
+		migrateContactsLinking()
+
 		if err := config.EnsureSourceDir("contacts"); err != nil {
 			slog.Error("contacts: failed to create dir", "error", err)
 			errCh <- err
@@ -38,7 +41,7 @@ func runContactsSync(ctx context.Context, cfg *config.Config) <-chan error {
 		sourceDBs := openSourceDBs(cfg)
 		defer closeSourceDBs(sourceDBs)
 
-		if len(sourceDBs) == 0 {
+		if len(sourceDBs) == 0 && !config.IsSourceLinked("applecontacts") {
 			slog.Info("contacts: no linked sources, skipping sync")
 			return
 		}
@@ -62,8 +65,21 @@ func runContactsSync(ctx context.Context, cfg *config.Config) <-chan error {
 	return errCh
 }
 
+func linkedSources(sourceDBs map[string]*store.DB) []string {
+	sources := make([]string, 0, len(sourceDBs)+1)
+	for name := range sourceDBs {
+		sources = append(sources, name)
+	}
+	if config.IsSourceLinked("applecontacts") {
+		sources = append(sources, "applecontacts")
+	}
+	return sources
+}
+
 func syncContacts(db *store.DB, sourceDBs map[string]*store.DB) {
-	result, err := contactsrc.Sync(db, sourceDBs, contactsrc.SyncOptions{})
+	result, err := contactsrc.Sync(db, sourceDBs, contactsrc.SyncOptions{
+		Sources: linkedSources(sourceDBs),
+	})
 	if err != nil {
 		slog.Error("contacts: sync error", "error", err)
 		return
@@ -102,3 +118,16 @@ func closeSourceDBs(dbs map[string]*store.DB) {
 		db.Close()
 	}
 }
+
+func migrateContactsLinking() {
+	if runtime.GOOS != "darwin" {
+		return
+	}
+	if config.IsSourceLinked("contacts") && !config.IsSourceLinked("applecontacts") {
+		if err := config.LinkSource("applecontacts"); err != nil {
+			slog.Warn("contacts: failed to migrate contacts->applecontacts linking", "error", err)
+		} else {
+			slog.Info("contacts: migrated contacts->applecontacts linking")
+		}
+	}
+}

daemon/contacts_test.go

@@ -2,10 +2,13 @@ package daemon
 
 import (
 	"context"
+	"runtime"
+	"sort"
 	"testing"
 	"time"
 
 	"github.com/priyanshujain/openbotkit/config"
+	"github.com/priyanshujain/openbotkit/store"
 )
 
 func TestRunContactsSync_StartAndStop(t *testing.T) {
@@ -34,6 +37,114 @@ func TestRunContactsSync_StartAndStop(t *testing.T) {
 	}
 }
 
+func TestLinkedSources_OnlyDBSources(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("OBK_CONFIG_DIR", tmpDir)
+
+	sourceDBs := map[string]*store.DB{
+		"whatsapp": nil,
+		"gmail":    nil,
+	}
+	got := linkedSources(sourceDBs)
+	sort.Strings(got)
+	want := []string{"gmail", "whatsapp"}
+	if len(got) != len(want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("got %v, want %v", got, want)
+		}
+	}
+}
+
+func TestLinkedSources_IncludesAppleContactsWhenLinked(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("OBK_CONFIG_DIR", tmpDir)
+
+	if err := config.LinkSource("applecontacts"); err != nil {
+		t.Fatal(err)
+	}
+	sourceDBs := map[string]*store.DB{
+		"whatsapp": nil,
+	}
+	got := linkedSources(sourceDBs)
+	sort.Strings(got)
+	want := []string{"applecontacts", "whatsapp"}
+	if len(got) != len(want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("got %v, want %v", got, want)
+		}
+	}
+}
+
+func TestLinkedSources_ExcludesAppleContactsWhenNotLinked(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("OBK_CONFIG_DIR", tmpDir)
+
+	sourceDBs := map[string]*store.DB{}
+	got := linkedSources(sourceDBs)
+	if len(got) != 0 {
+		t.Fatalf("expected empty sources, got %v", got)
+	}
+}
+
+func TestMigrateContactsLinking(t *testing.T) {
+	if runtime.GOOS != "darwin" {
+		t.Skip("migrateContactsLinking only runs on macOS")
+	}
+	tmpDir := t.TempDir()
+	t.Setenv("OBK_CONFIG_DIR", tmpDir)
+
+	// Link "contacts" (the old incorrect name)
+	if err := config.LinkSource("contacts"); err != nil {
+		t.Fatal(err)
+	}
+
+	migrateContactsLinking()
+
+	if !config.IsSourceLinked("applecontacts") {
+		t.Error("expected applecontacts to be linked after migration")
+	}
+}
+
+func TestMigrateContactsLinking_NoOp(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("OBK_CONFIG_DIR", tmpDir)
+
+	// Neither "contacts" nor "applecontacts" linked
+	migrateContactsLinking()
+
+	if config.IsSourceLinked("applecontacts") {
+		t.Error("expected applecontacts to remain unlinked")
+	}
+}
+
+func TestMigrateContactsLinking_AlreadyMigrated(t *testing.T) {
+	if runtime.GOOS != "darwin" {
+		t.Skip("migrateContactsLinking only runs on macOS")
+	}
+	tmpDir := t.TempDir()
+	t.Setenv("OBK_CONFIG_DIR", tmpDir)
+
+	// Both linked — should not error
+	if err := config.LinkSource("contacts"); err != nil {
+		t.Fatal(err)
+	}
+	if err := config.LinkSource("applecontacts"); err != nil {
+		t.Fatal(err)
+	}
+
+	migrateContactsLinking()
+
+	if !config.IsSourceLinked("applecontacts") {
+		t.Error("expected applecontacts to remain linked")
+	}
+}
+
 func TestRunContactsSync_NoLinkedSources(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("OBK_CONFIG_DIR", tmpDir)