fix: Accessibility never prompted in onboarding + hotkey dead until restart

Two real bugs behind 'Right ⌘ shows no HUD':

1. Onboarding never asked for Accessibility. The AX prompt was wired
   (_act_grant_accessibility) but nothing fired it — enabling Whisper requested
   only Microphone. So users reached the 'hold Right ⌘' demo without the
   permission that makes Right ⌘ work. Now enable_whisper also requests AX, and
   the Whisper step gates the read-aloud demo behind an 'Enable Accessibility'
   step when it's missing.

2. Granting Accessibility mid-session didn't help — _start_hotkey checks trust
   only at launch, and a global event monitor created while untrusted stays deaf
   even after the grant (it must be re-created). The 10s watch loop now re-arms
   the hotkey once trust flips true, so the HUD starts working without an app
   restart.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019GTBZjBGurqsHUHsjaU1gA

Author: sodiumsun

heard/daemon.py

@@ -945,6 +945,14 @@ def _start_hotkey(self, prompt_for_accessibility: bool = False) -> None:
         # daemon-spawn path passes prompt_for_accessibility=False so the
         # system dialog doesn't fire alongside the onboarding card.
         trusted = accessibility.ensure_trusted(prompt=prompt_for_accessibility)
+        # Remember whether we armed the hotkey WHILE trusted. A global event
+        # monitor created before Accessibility is granted receives no key events,
+        # and granting it later does NOT wake the existing monitor — it must be
+        # RE-created. The watch loop (_start_voice_service_watch) reads this and
+        # re-arms once trust flips true, so PTT starts working without an app
+        # restart. (Before this, granting Accessibility mid-session left the HUD
+        # dead until relaunch.)
+        self._hotkey_trusted = trusted
         if not trusted:
             print(
                 "heard: Accessibility permission pending — hotkeys will start "
@@ -1026,6 +1034,19 @@ def _watch() -> None:
                         _log("voice_service_gate_changed", want=want, trying=trying)
                         self.cfg = cfg          # adopt the config we decided on
                         self._sync_voice_service()
+                    # Accessibility granted AFTER launch: the hotkey monitor was
+                    # armed while untrusted (deaf) and needs re-creating. Re-arm
+                    # once trust flips true so the Right ⌘ HUD starts without a
+                    # restart. Only when we know we armed untrusted, and only if
+                    # the hotkey is enabled, so we don't thrash.
+                    if (
+                        getattr(self, "_hotkey_trusted", True) is False
+                        and cfg.get("hotkey_enabled", True)
+                        and accessibility.is_trusted()
+                    ):
+                        _log("accessibility_granted_rearming_hotkey")
+                        self.cfg = cfg
+                        self._start_hotkey()
                 except Exception as e:
                     _log("voice_service_watch_error", err=str(e))
 

heard/home_window.py

@@ -875,6 +875,19 @@ def _act_enable_whisper(self, body):
                 # voice-mode radio, which sets both.
                 config.set_value("push_to_talk", True)
                 _reload_daemon()
+                # PTT needs TWO permissions: Microphone (below) AND Accessibility
+                # (the global Right ⌘ monitor can't see the key without it). The
+                # AX prompt was wired (_act_grant_accessibility) but nothing ever
+                # fired it during onboarding, so users enabled Whisper, got the
+                # "hold Right ⌘" demo, and no HUD ever appeared. Fire it here so
+                # enabling Whisper asks for both. The daemon's watch re-arms the
+                # hotkey once the grant lands (no restart needed).
+                try:
+                    from heard import accessibility
+
+                    accessibility.ensure_trusted(prompt=True)
+                except Exception as e:
+                    _log_bridge_error("enable_whisper_ax", e)
                 # CRITICAL: the serve is a subprocess with no UI, so it can't
                 # show the mic TCC prompt — macOS silently KILLS it the moment it
                 # opens the mic (a native crash, no traceback → the serve

heard/onboarding.html

@@ -683,7 +683,12 @@ <h1 class="hero" style="font-size:56px">Choose your voice.</h1>
       <div class="eyebrow">Heard Whisper</div>
       <h1 class="hero" style="font-size:44px">Speak, don’t type.</h1>
       ${on
-        ? `<p class="lede" style="max-width:500px;margin-top:12px">Whisper’s on. Read the line below to try it.</p>${test}`
+        ? (S.axGranted
+            ? `<p class="lede" style="max-width:500px;margin-top:12px">Whisper’s on. Read the line below to try it.</p>${test}`
+            : `<p class="lede" style="max-width:500px;margin-top:12px">Whisper’s on — one last permission.</p>
+               <div style="max-width:500px;margin-top:12px;font:400 14px/1.6 var(--sans);color:var(--ink-2)">Heard needs <strong>Accessibility</strong> access to catch the <span class="kbd">Right ⌘</span> key anywhere you type. Without it, push-to-talk can’t work.</div>
+               <div class="row" style="margin-top:16px"><button class="btn btn-primary" onclick="bridge('grant_accessibility')">Enable Accessibility</button></div>
+               <p style="margin-top:12px;font:400 12px var(--sans);color:var(--ink-3)">Toggle <strong>Heard</strong> on in System Settings → Privacy & Security → Accessibility. This screen updates once it’s granted.</p>`)
         : `<p class="lede" style="max-width:500px;margin-top:12px">Heard’s voice-to-text. Two ways to dictate to your agents instead of typing:</p>
            <div style="max-width:540px;margin-top:18px;display:flex;flex-direction:column;gap:12px">${rows}</div>
            <p style="margin-top:20px;font:400 13px var(--sans);color:var(--ink-2)">Press below to enable Heard Whisper.</p>`}