[install] Use a Homebrew-installed bundle instead of building over it

A cask and these installers both want to own Tacet.app, and until now
each would build over the other: APP_DIR was hardcoded to ~/Applications
and the bundle was always rebuilt from the clone. A cask user would end
up with two copies, launchd pointed at the one brew does not manage.

Worse than untidy. Rebuilding over a cask's bundle re-signs a notarized
app with whatever identity is in the environment — usually none — which
invalidates the Accessibility and Microphone grants keyed to its
designated requirement, and leaves `brew uninstall` looking at something
it did not install.

Both installers now resolve APP_DIR as $TACET_APP_DIR, then a detected
cask install, then ~/Applications. In the cask case they skip the build
entirely and the client's uninstall removes only the plist. Machines
without the cask are unaffected: brew merely being present is not enough,
which is checked, since almost every Mac has it.

Solves: cask and installer both claiming the bundle
Tests: eleven cases over both scripts — resolution order including an
       explicit override beating a cask, and that the build skip and the
       uninstall removal are both guarded by the managed check

Author: drycode

install-client.sh

@@ -42,7 +42,27 @@ set -euo pipefail
 
 REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 APP_SRC="$REPO_DIR/swift/Packaging/Tacet.app"
-APP_DIR="$HOME/Applications"
+
+# Resolution order, most specific first:
+#   1. $TACET_APP_DIR          — explicit, always wins
+#   2. a Homebrew cask install — Homebrew owns that bundle; we point the agent
+#                                at it and never rebuild, overwrite, or remove it
+#   3. ~/Applications          — built from this clone, the from-source default
+#
+# Rebuilding over a brew-managed bundle would re-sign it (ad-hoc, with no
+# identity in the environment), which invalidates the Accessibility and
+# Microphone grants keyed to its designated requirement — the exact failure
+# this installer works hardest to avoid — and leaves `brew uninstall` looking
+# at something it did not install.
+APP_MANAGED=0
+if [[ -n "${TACET_APP_DIR:-}" ]]; then
+  APP_DIR="$TACET_APP_DIR"
+elif caskroom="$(brew --caskroom 2>/dev/null)" && [[ -n "$caskroom" && -d "$caskroom/tacet" ]]; then
+  APP_DIR="/Applications"
+  APP_MANAGED=1
+else
+  APP_DIR="$HOME/Applications"
+fi
 APP_DST="$APP_DIR/Tacet.app"
 
 TACET_CONFIG_DIR="$HOME/.config/tacet"
@@ -612,8 +632,16 @@ run_uninstall() {
     log "unloaded $AGENT_LABEL"
   fi
   rm -f "$AGENT_PLIST"
-  rm -rf "$APP_DST"
-  log "removed $APP_DST and $AGENT_PLIST"
+  if [[ "$APP_MANAGED" -eq 1 ]]; then
+    # Deleting a brew-managed bundle leaves Homebrew believing tacet is still
+    # installed, so `brew uninstall` then fails and `brew reinstall` is the
+    # only way back. Removing what we installed means the plist only.
+    log "removed $AGENT_PLIST"
+    log "left $APP_DST alone — Homebrew owns it: brew uninstall --cask tacet"
+  else
+    rm -rf "$APP_DST"
+    log "removed $APP_DST and $AGENT_PLIST"
+  fi
   # client.json is deliberately left in place: it holds the shared secret and
   # is what a reinstall (or the Hammerspoon client) would want back.
   log "left $CLIENT_CONFIG alone — delete it by hand if you meant to."
@@ -663,16 +691,25 @@ case "$MODE" in
   uninstall) run_uninstall; exit 0 ;;
 esac
 
-log "building the agent"
-(cd "$REPO_DIR/swift" && swift build -c release && bash Packaging/build-app.sh)
-
-log "installing to $APP_DST"
-mkdir -p "$APP_DIR"
-# Replaced wholesale rather than copied over: a stale file left inside the
-# bundle invalidates the signature, and the failure surfaces much later as an
-# unexplained TCC re-prompt.
-rm -rf "$APP_DST"
-cp -R "$APP_SRC" "$APP_DST"
+if [[ "$APP_MANAGED" -eq 1 ]]; then
+  # Homebrew already installed the bundle — see the note at APP_DIR.
+  log "using the Homebrew-installed bundle at $APP_DST (not rebuilding)"
+  if [[ ! -x "$APP_DST/Contents/MacOS/tacet" ]]; then
+    err "$APP_DST is missing its binary. Reinstall it: brew reinstall --cask tacet"
+    exit 1
+  fi
+else
+  log "building the agent"
+  (cd "$REPO_DIR/swift" && swift build -c release && bash Packaging/build-app.sh)
+
+  log "installing to $APP_DST"
+  mkdir -p "$APP_DIR"
+  # Replaced wholesale rather than copied over: a stale file left inside the
+  # bundle invalidates the signature, and the failure surfaces much later as an
+  # unexplained TCC re-prompt.
+  rm -rf "$APP_DST"
+  cp -R "$APP_SRC" "$APP_DST"
+fi
 
 # Must run AFTER the copy (it hashes the installed bundle) and BEFORE the agent
 # restarts, so the agent's prompt lands on a cleared entry rather than a stale

install-server.sh

@@ -34,7 +34,27 @@ LABELS=(com.drycodeworks.tacet com.drycodeworks.tacet-whisper)
 # Where the running service lives. The clone is
 # a place to edit code; a daemon that runs out of it breaks when the checkout
 # moves and silently changes behaviour on `git pull`.
-APP_DIR="$HOME/Applications"
+#
+# Resolution order, most specific first:
+#   1. $TACET_APP_DIR          — explicit, always wins
+#   2. a Homebrew cask install — Homebrew owns that bundle; we point launchd
+#                                at it and never rebuild or overwrite it
+#   3. ~/Applications          — built from this clone, the from-source default
+#
+# The cask case is not a convenience. Rebuilding over a brew-managed bundle
+# would re-sign it (ad-hoc, without a signing identity in the environment),
+# which silently invalidates the TCC grants keyed to its designated
+# requirement and leaves `brew uninstall` looking at something it did not
+# install. Detect it and leave it alone.
+APP_MANAGED=0
+if [[ -n "${TACET_APP_DIR:-}" ]]; then
+  APP_DIR="$TACET_APP_DIR"
+elif caskroom="$(brew --caskroom 2>/dev/null)" && [[ -n "$caskroom" && -d "$caskroom/tacet" ]]; then
+  APP_DIR="/Applications"
+  APP_MANAGED=1
+else
+  APP_DIR="$HOME/Applications"
+fi
 APP_DST="$APP_DIR/Tacet.app"
 
 # Minimal TOML reader for the three scalars the plists need. Deliberately not a
@@ -404,20 +424,30 @@ fi
 # One signed bundle, two roles: `tacet serve` here, `tacet agent` on whatever Mac
 # you dictate from. install-client.sh installs the same artifact, so a
 # single-machine setup ends up with one copy that plays both parts.
-if ! command -v swift >/dev/null 2>&1; then
-  err "swift not found. Install the Xcode command line tools: xcode-select --install"
-  exit 1
-fi
+if [[ "$APP_MANAGED" -eq 1 ]]; then
+  # Homebrew already installed the bundle. Building here would overwrite a
+  # notarized bundle with a locally signed one — see the note at APP_DIR.
+  log "Using the Homebrew-installed bundle at ${APP_DST} (not rebuilding)."
+  if [[ ! -x "$APP_DST/Contents/MacOS/tacet" ]]; then
+    err "${APP_DST} is missing its binary. Reinstall it: brew reinstall --cask tacet"
+    exit 1
+  fi
+else
+  if ! command -v swift >/dev/null 2>&1; then
+    err "swift not found. Install the Xcode command line tools: xcode-select --install"
+    exit 1
+  fi
 
-log "Building the server..."
-(cd "$REPO_DIR/swift" && swift build -c release >/dev/null && bash Packaging/build-app.sh >/dev/null)
+  log "Building the server..."
+  (cd "$REPO_DIR/swift" && swift build -c release >/dev/null && bash Packaging/build-app.sh >/dev/null)
 
-log "Installing to ${APP_DST}..."
-mkdir -p "$APP_DIR"
-# Replaced wholesale: a stale file left inside the bundle invalidates the
-# signature, and that surfaces much later as an unexplained TCC re-prompt.
-rm -rf "$APP_DST"
-cp -R "$REPO_DIR/swift/Packaging/Tacet.app" "$APP_DST"
+  log "Installing to ${APP_DST}..."
+  mkdir -p "$APP_DIR"
+  # Replaced wholesale: a stale file left inside the bundle invalidates the
+  # signature, and that surfaces much later as an unexplained TCC re-prompt.
+  rm -rf "$APP_DST"
+  cp -R "$REPO_DIR/swift/Packaging/Tacet.app" "$APP_DST"
+fi
 
 # Prove it runs before a plist points launchd at it. A binary that cannot
 # start would otherwise surface as a restart loop with nothing in the log.

tests/test_app_dir_resolution.py

@@ -0,0 +1,111 @@
+"""Where the installers put the bundle, and when they refuse to touch it.
+
+A Homebrew cask and these installers both want to own Tacet.app. Left alone,
+each install would build over the other's copy: the cask's bundle is notarized,
+and a rebuild here re-signs it with whatever identity is in the environment —
+usually none. That silently invalidates the Accessibility and Microphone grants
+keyed to its designated requirement, and leaves `brew uninstall` looking at
+something it did not install.
+
+So the installers detect a cask install and step aside. These tests pin the
+resolution order and, more importantly, the refusals.
+"""
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent
+SERVER = ROOT / "install-server.sh"
+CLIENT = ROOT / "install-client.sh"
+
+
+@pytest.fixture
+def resolve(tmp_path):
+    """Source an installer and report the resolved APP_DIR / APP_MANAGED."""
+
+    def run(script: Path, *, caskroom_has_tacet: bool | None, **env: str):
+        bin_dir = tmp_path / "bin"
+        bin_dir.mkdir(exist_ok=True)
+
+        # caskroom_has_tacet=None means "no brew at all on this machine".
+        if caskroom_has_tacet is not None:
+            caskroom = tmp_path / "Caskroom"
+            caskroom.mkdir(exist_ok=True)
+            if caskroom_has_tacet:
+                (caskroom / "tacet").mkdir(exist_ok=True)
+            brew = bin_dir / "brew"
+            brew.write_text(
+                "#!/bin/bash\n"
+                f"[[ \"$1\" == '--caskroom' ]] && echo '{caskroom}' && exit 0\n"
+                "exit 1\n"
+            )
+            brew.chmod(0o755)
+
+        program = f"source {script}\nprintf '%s\\n%s\\n' \"$APP_DIR\" \"$APP_MANAGED\"\n"
+        r = subprocess.run(
+            ["bash", "-c", program],
+            capture_output=True,
+            text=True,
+            env={"PATH": f"{bin_dir}:/usr/bin:/bin", "HOME": str(tmp_path), **env},
+        )
+        assert r.returncode == 0, r.stderr
+        app_dir, managed = r.stdout.strip().splitlines()[-2:]
+        return app_dir, managed == "1"
+
+    return run
+
+
+@pytest.mark.parametrize("script", [SERVER, CLIENT], ids=lambda p: p.name)
+class TestResolutionOrder:
+    def test_without_brew_it_builds_into_home(self, resolve, script, tmp_path):
+        app_dir, managed = resolve(script, caskroom_has_tacet=None)
+        assert app_dir == f"{tmp_path}/Applications"
+        assert not managed, "a from-source install owns its bundle"
+
+    def test_brew_without_the_cask_is_not_a_cask_install(self, resolve, script, tmp_path):
+        # Almost every Mac has brew. Its mere presence must not redirect the
+        # install to /Applications.
+        app_dir, managed = resolve(script, caskroom_has_tacet=False)
+        assert app_dir == f"{tmp_path}/Applications"
+        assert not managed
+
+    def test_a_cask_install_is_detected_and_marked_managed(self, resolve, script):
+        app_dir, managed = resolve(script, caskroom_has_tacet=True)
+        assert app_dir == "/Applications"
+        assert managed, "a brew-owned bundle must never be rebuilt over"
+
+    def test_an_explicit_override_beats_a_cask_install(self, resolve, script):
+        # Someone who names a directory means it, even with a cask present.
+        app_dir, managed = resolve(script, caskroom_has_tacet=True,
+                                   TACET_APP_DIR="/opt/custom")
+        assert app_dir == "/opt/custom"
+        assert not managed
+
+
+class TestManagedBundleIsLeftAlone:
+    """The refusals, checked at source level.
+
+    Running the real install paths would need a signed bundle, a working swift
+    toolchain and a live launchd — so these assert the guards exist and are
+    attached to the managed case, which is what the whole mechanism is for.
+    """
+
+    @pytest.mark.parametrize("script", [SERVER, CLIENT], ids=lambda p: p.name)
+    def test_the_build_is_skipped_when_homebrew_owns_the_bundle(self, script):
+        code = script.read_text()
+        assert 'if [[ "$APP_MANAGED" -eq 1 ]]; then' in code
+        # The copy-over-the-bundle line must sit inside the else branch.
+        build_idx = code.index('if [[ "$APP_MANAGED" -eq 1 ]]; then')
+        assert code.index("swift build -c release", build_idx) > build_idx
+
+    def test_uninstall_does_not_delete_a_brew_owned_bundle(self):
+        # rm -rf on a cask's bundle leaves Homebrew believing tacet is still
+        # installed: `brew uninstall` then fails and only `brew reinstall`
+        # recovers. The client is the one with an uninstall path.
+        code = CLIENT.read_text()
+        uninstall = code[code.index("run_uninstall()"):]
+        guard = uninstall.index('"$APP_MANAGED" -eq 1')
+        removal = uninstall.index('rm -rf "$APP_DST"')
+        assert guard < removal, "the removal must be guarded by the managed check"