Merge SMAppService privileged helper (replaces sudoers)

Root helper daemon + XPC replaces the sudoers/first-run-admin-prompt model.
Security-reviewed; live-tested: happy path (register→approve→toggle sleep)
works and an unauthorized client is rejected by the helper's code-signing
requirement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: iamdadzilla

Package.swift

@@ -10,6 +10,10 @@ let package = Package(
             name: "Macsomnia",
             dependencies: ["MacsomniaCore"]
         ),
+        .executableTarget(
+            name: "MacsomniaHelper",
+            dependencies: ["MacsomniaCore"]
+        ),
         .testTarget(
             name: "MacsomniaCoreTests",
             dependencies: ["MacsomniaCore"]

README.md

@@ -15,12 +15,11 @@ closed and no external cooling can overheat the machine. Use the auto-off timer.
 1. Build the app: `./make-app.sh`, then move `Macsomnia.app` to `/Applications`.
 2. Open Macsomnia. On first launch it shows a one-time danger/liability warning
    you must accept. A `zzz` icon then appears in the menu bar.
-3. The first time you enable it, macOS asks you to authorize one-time
-   administrator permission (it installs a rule allowing password-free `pmset`).
-
-Prefer to set that up yourself instead of the in-app prompt? Run
-`./install-sudoers.sh` once before first use. Remove the permission any time
-with `sudo rm /etc/sudoers.d/macsomnia`.
+3. The first time you enable it, Macsomnia registers a small privileged helper
+   (an `SMAppService` daemon) that runs `pmset` as root. macOS may ask you to
+   allow Macsomnia's background item in **System Settings → General → Login
+   Items & Extensions** (under "Allow in the Background"). Approve it, then
+   enable again — after that it works without any further prompts.
 
 ## Use
 
@@ -33,5 +32,7 @@ with `sudo rm /etc/sudoers.d/macsomnia`.
 
 ## What it runs
 
-- Enable: `sudo pmset -b sleep 0 ; sudo pmset -b disablesleep 1`
-- Disable: `sudo pmset -b sleep 5 ; sudo pmset -b disablesleep 0`
+The privileged helper daemon runs these as root (reached over XPC):
+
+- Enable: `pmset -b sleep 0 ; pmset -b disablesleep 1`
+- Disable: `pmset -b sleep 5 ; pmset -b disablesleep 0`

Sources/Macsomnia/AppDelegate.swift

@@ -4,7 +4,7 @@ import UserNotifications
 import MacsomniaCore
 
 final class AppDelegate: NSObject, NSApplicationDelegate, ObservableObject {
-    let power: PowerControlling = RealPowerController()
+    let power: PowerControlling = XPCPowerController()
     lazy var appState = AppState(power: power)
     private let overlay = RedStripOverlay()
     private var monitor: StateMonitor!
@@ -110,7 +110,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, ObservableObject {
     // MARK: - User actions (from the menu)
 
     func enable(_ duration: MacsomniaDuration) {
-        if !power.hasPasswordlessAccess(), !ensurePrivilege() { return }
+        if !HelperManager.isEnabled, !ensureHelper() { return }
         do {
             try appState.enable(duration)
             tick = Date()
@@ -119,36 +119,47 @@ final class AppDelegate: NSObject, NSApplicationDelegate, ObservableObject {
         }
     }
 
-    /// First-run: ask permission, then install the sudoers rule via the native
-    /// admin dialog. Returns true only if password-free pmset now works.
-    private func ensurePrivilege() -> Bool {
+    /// First-run: register the privileged helper daemon via SMAppService. macOS
+    /// may require the user to approve Macsomnia's background item in System
+    /// Settings → Login Items before it becomes active. Returns true only once
+    /// the helper is enabled and ready to serve XPC requests.
+    private func ensureHelper() -> Bool {
+        switch HelperManager.status {
+        case .enabled:
+            return true
+        case .requiresApproval:
+            presentApprovalNeeded()
+            return false
+        default:
+            do {
+                try HelperManager.register()
+            } catch {
+                presentFailure(error)
+                return false
+            }
+            if HelperManager.isEnabled { return true }
+            presentApprovalNeeded()
+            return false
+        }
+    }
+
+    /// Directs the user to approve Macsomnia's background item so the helper can run.
+    private func presentApprovalNeeded() {
         let alert = NSAlert()
-        alert.messageText = "Macsomnia needs permission to control sleep"
+        alert.messageText = "Macsomnia needs you to allow its background item"
         alert.informativeText = """
-        To disable sleep, Macsomnia runs the system pmset tool, which requires \
-        administrator rights. macOS will ask you to authorize this once. It \
-        installs a rule allowing password-free pmset, which you can remove any \
-        time with:  sudo rm /etc/sudoers.d/macsomnia
+        To control sleep, Macsomnia installs a small privileged helper that runs \
+        the system pmset tool. macOS requires you to approve it once.
+
+        Open System Settings → General → Login Items & Extensions, then enable \
+        Macsomnia under "Allow in the Background". Then try again.
         """
-        alert.addButton(withTitle: "Grant Permission…")
+        alert.addButton(withTitle: "Open Login Items Settings")
         alert.addButton(withTitle: "Cancel")
         NSApp.activate(ignoringOtherApps: true)
-        guard alert.runModal() == .alertFirstButtonReturn else { return false }
-
-        do {
-            try PrivilegeProvisioner.installSudoersRule()
-        } catch PrivilegeProvisioner.ProvisionError.cancelled {
-            return false
-        } catch {
-            presentFailure(error)
-            return false
-        }
-
-        guard power.hasPasswordlessAccess() else {
-            presentFailure(PrivilegeProvisioner.ProvisionError.failed("permission was not granted"))
-            return false
+        if alert.runModal() == .alertFirstButtonReturn {
+            HelperManager.openLoginItemsSettings()
         }
-        return true
     }
 
     func disable() {
@@ -209,9 +220,9 @@ final class AppDelegate: NSObject, NSApplicationDelegate, ObservableObject {
         alert.informativeText = """
         \(error)
 
-        Try enabling again and authorize the permission prompt. If it keeps \
-        failing, you can grant access manually by running install-sudoers.sh \
-        from the Macsomnia source.
+        Try enabling again. If it keeps failing, make sure Macsomnia's background \
+        item is allowed in System Settings → General → Login Items & Extensions \
+        (under "Allow in the Background").
         """
         alert.alertStyle = .warning
         alert.runModal()

Sources/Macsomnia/HelperManager.swift

@@ -0,0 +1,11 @@
+import Foundation
+import ServiceManagement
+import MacsomniaCore
+
+enum HelperManager {
+    static var service: SMAppService { SMAppService.daemon(plistName: MacsomniaHelperInfo.daemonPlistName) }
+    static var status: SMAppService.Status { service.status }
+    static var isEnabled: Bool { status == .enabled }
+    static func register() throws { try service.register() }
+    static func openLoginItemsSettings() { SMAppService.openSystemSettingsLoginItems() }
+}

Sources/Macsomnia/PrivilegeProvisioner.swift

@@ -0,0 +1,54 @@
+import Foundation
+import MacsomniaCore
+
+/// `PowerControlling` backed by the privileged helper daemon over XPC. The
+/// protocol is synchronous, so each call bridges the async XPC reply with a
+/// semaphore — bounded by a timeout so a stalled/unreachable helper throws
+/// instead of hanging the calling (main) thread forever.
+final class XPCPowerController: PowerControlling {
+    /// Generous ceiling; a real round-trip + pmset exec is sub-millisecond.
+    private static let callTimeout: DispatchTimeInterval = .seconds(10)
+
+    func enable() throws { try setSleepDisabled(true) }
+    func disable() throws { try setSleepDisabled(false) }
+
+    func readSleepDisabled() throws -> Bool {
+        let conn = makeConnection(); defer { conn.invalidate() }
+        var value = false, found = false, connErr: Error?
+        let sem = DispatchSemaphore(value: 0)
+        guard let proxy = conn.remoteObjectProxyWithErrorHandler({ connErr = $0; sem.signal() })
+            as? MacsomniaHelperProtocol else {
+            throw PmsetError(code: -1, message: "helper unavailable")
+        }
+        proxy.readSleepDisabled { f, v in found = f; value = v; sem.signal() }
+        if sem.wait(timeout: .now() + Self.callTimeout) == .timedOut {
+            throw PmsetError(code: -1, message: "helper timed out")
+        }
+        if let connErr { throw connErr }
+        guard found else { throw PmsetError(code: -1, message: "SleepDisabled not found") }
+        return value
+    }
+
+    private func setSleepDisabled(_ disabled: Bool) throws {
+        let conn = makeConnection(); defer { conn.invalidate() }
+        var failure: String?, connErr: Error?
+        let sem = DispatchSemaphore(value: 0)
+        guard let proxy = conn.remoteObjectProxyWithErrorHandler({ connErr = $0; sem.signal() })
+            as? MacsomniaHelperProtocol else {
+            throw PmsetError(code: -1, message: "helper unavailable")
+        }
+        proxy.setSleepDisabled(disabled) { ok, msg in if !ok { failure = msg ?? "unknown" }; sem.signal() }
+        if sem.wait(timeout: .now() + Self.callTimeout) == .timedOut {
+            throw PmsetError(code: -1, message: "helper timed out")
+        }
+        if let connErr { throw connErr }
+        if let failure { throw PmsetError(code: -1, message: failure) }
+    }
+
+    private func makeConnection() -> NSXPCConnection {
+        let c = NSXPCConnection(machServiceName: MacsomniaHelperInfo.machServiceName, options: .privileged)
+        c.remoteObjectInterface = NSXPCInterface(with: MacsomniaHelperProtocol.self)
+        c.resume()
+        return c
+    }
+}

Sources/Macsomnia/XPCPowerController.swift

@@ -0,0 +1,13 @@
+import Foundation
+
+@objc public protocol MacsomniaHelperProtocol {
+    /// Set disablesleep (and the -b sleep timer). reply: (ok, errorMessage?)
+    func setSleepDisabled(_ disabled: Bool, reply: @escaping (Bool, String?) -> Void)
+    /// Read SleepDisabled. reply: (found, value)
+    func readSleepDisabled(reply: @escaping (Bool, Bool) -> Void)
+}
+
+public enum MacsomniaHelperInfo {
+    public static let machServiceName = "net.jperry.Macsomnia.helper"
+    public static let daemonPlistName = "net.jperry.Macsomnia.helper.plist"
+}

Sources/MacsomniaCore/HelperProtocol.swift

@@ -4,75 +4,14 @@ public protocol PowerControlling {
     func enable() throws           // sleep 0 ; disablesleep 1
     func disable() throws          // sleep 5 ; disablesleep 0
     func readSleepDisabled() throws -> Bool
-    /// True when `pmset` can be run as root without a password (the sudoers rule
-    /// is installed). Used to decide whether to trigger first-run provisioning.
-    func hasPasswordlessAccess() -> Bool
 }
 
 public struct PmsetError: Error, CustomStringConvertible {
     public let code: Int32
     public let message: String
-    public var description: String { "pmset failed (\(code)): \(message)" }
-}
-
-/// Runs the real `pmset` binary. Writes require root (via the sudoers rule
-/// installed by install-sudoers.sh); reads do not.
-public final class RealPowerController: PowerControlling {
-    public init() {}
-
-    public func enable() throws {
-        try runSudo(["-b", "sleep", "0"])
-        try runSudo(["-b", "disablesleep", "1"])
-    }
-
-    public func disable() throws {
-        try runSudo(["-b", "sleep", "5"])
-        try runSudo(["-b", "disablesleep", "0"])
-    }
-
-    public func readSleepDisabled() throws -> Bool {
-        let output = try capture("/usr/bin/pmset", ["-g"])
-        guard let value = SleepStateParser.sleepDisabled(fromPmsetOutput: output) else {
-            throw PmsetError(code: -1, message: "SleepDisabled not found in pmset -g")
-        }
-        return value
-    }
-
-    public func hasPasswordlessAccess() -> Bool {
-        // Grep the user's sudo rules for an actual NOPASSWD pmset grant. This
-        // reflects the installed rule regardless of sudo's credential-cache
-        // state — a plain `sudo -n pmset` would also succeed on a cached
-        // timestamp (e.g. the user ran sudo recently), giving a false positive
-        // and skipping first-run provisioning.
-        guard let listing = try? capture("/usr/bin/sudo", ["-n", "-l"]) else { return false }
-        return listing.range(of: "NOPASSWD:[^\n]*pmset", options: .regularExpression) != nil
-    }
-
-    // MARK: - Process helpers
-
-    private func runSudo(_ pmsetArgs: [String]) throws {
-        _ = try capture("/usr/bin/sudo", ["-n", "/usr/bin/pmset"] + pmsetArgs)
-    }
-
-    @discardableResult
-    private func capture(_ launchPath: String, _ args: [String]) throws -> String {
-        let process = Process()
-        process.executableURL = URL(fileURLWithPath: launchPath)
-        process.arguments = args
-        let stdout = Pipe()
-        let stderr = Pipe()
-        process.standardOutput = stdout
-        process.standardError = stderr
-        try process.run()
-        // Drain both pipes to EOF before waiting, so a child that writes more
-        // than the OS pipe buffer can't block and deadlock waitUntilExit().
-        let outData = stdout.fileHandleForReading.readDataToEndOfFile()
-        let errData = stderr.fileHandleForReading.readDataToEndOfFile()
-        process.waitUntilExit()
-        guard process.terminationStatus == 0 else {
-            let message = String(data: errData, encoding: .utf8) ?? "unknown error"
-            throw PmsetError(code: process.terminationStatus, message: message)
-        }
-        return String(data: outData, encoding: .utf8) ?? ""
+    public init(code: Int32, message: String) {
+        self.code = code
+        self.message = message
     }
+    public var description: String { "pmset failed (\(code)): \(message)" }
 }