Fix macOS Accessibility trust across Preview rebuilds

[enaboapps]

Closes #508

What changed

• adds an idempotent machine-local development signing identity and signed macOS debug run command
• gives rebuilt Preview bundles a stable certificate-based designated requirement
• checks Accessibility silently at startup and on focus, requests permission asynchronously, and opens the exact Settings pane
• reports Ready only after trust verification and Enigo initialization succeed
• adds stale-row recovery guidance and keeps macOS CI unsigned
• moves pairing tokens created by the certificate-signed Preview to a new Keychain namespace, avoiding password prompts from legacy ad-hoc item ACLs while preserving those legacy secrets untouched

Validation

• npm run lint
• npm test (6 tests)
• npm run build
• cargo fmt --manifest-path src-tauri/Cargo.toml --check
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
• cargo test --manifest-path src-tauri/Cargo.toml (58 unit tests + config test)
• shell syntax checks and two idempotent signing setup runs
• successive signed debug builds produced different CDHashes with the same certificate requirement
• stale ad-hoc Accessibility row removed once; new certificate-based row enabled; TCC shows no renewed mismatch after a post-grant rebuild
• legacy pairing Keychain item remains untouched, the signed app no longer reads it at launch, and Android is prompted for one fresh pairing

Android-to-TextEdit typing, click, movement, modifier, and scrolling remain a manual device smoke test.

[enaboapps]

@greptileai please review the latest commit and provide a full score.

[greptile-apps]

Greptile Summary

The PR stabilizes macOS Accessibility authorization across Preview rebuilds by introducing a local development-signing workflow and revising permission verification. It also moves certificate-signed Preview pairing tokens into a new Keychain namespace.

• Adds idempotent local certificate setup, signed debug builds, signature verification, and explicitly unsigned macOS CI builds.
• Checks Accessibility at startup and after focus returns, opening the precise System Settings pane when access is requested.
• Reports input readiness only after Enigo initializes successfully.
• Removes pairing records whose tokens are unavailable in the new macOS Keychain namespace while leaving legacy secrets untouched.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
cross-platform/scripts/setup-macos-dev-signing.sh	Creates and reuses the machine-local code-signing identity used to keep the Preview bundle requirement stable.
cross-platform/scripts/run-macos-signed.sh	Builds the signed debug application, verifies its certificate-based designated requirement, and launches it.
cross-platform/src-tauri/src/macos.rs	Adds explicit Accessibility evaluation, input-adapter initialization, Settings navigation, and readiness transitions.
cross-platform/src-tauri/src/lib.rs	Rechecks required Accessibility access whenever the main macOS window regains focus.
cross-platform/src-tauri/src/state.rs	Restores only pairing records backed by tokens available in the active Keychain namespace and presents re-pairing guidance.
cross-platform/src-tauri/src/storage.rs	Assigns certificate-signed macOS Preview builds a separate pairing-token Keychain service.
cross-platform/src/App.tsx	Updates permission status and recovery controls to reflect the new macOS Accessibility workflow.
.github/workflows/cross-platform.yml	Keeps macOS CI bundles unsigned while retaining normal Windows bundle generation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Launch signed macOS Preview] --> B[Create Enigo without prompting]
    B -->|Success| C[Store input adapter]
    C --> D[Accessibility: Granted]
    B -->|Permission unavailable| E[Accessibility: Required]
    E --> F[User opens Accessibility Settings]
    F --> G[Request permission and open exact pane]
    G --> H[Window regains focus]
    H --> B

Loading

_{Reviews (3): Last reviewed commit: "Scope pairing keychain migration to macO..." | Re-trigger Greptile}

[enaboapps]

Local permission verification update:

• removed the stale ad-hoc Accessibility row once and enabled the newly registered certificate-based Preview entry
• TCC recorded the Accessibility delete/modify transition
• rebuilt and relaunched the signed Preview after granting access
• the rebuilt app has a new CDHash (4b25ae3a…) while retaining the same certificate requirement (identifier "com.enaboapps.switchify.pc.preview" and certificate root = H"7edac2db…")
• TCC reports no renewed Accessibility requirement mismatch after the post-grant rebuild

Android-to-TextEdit input smoke testing remains manual.

[enaboapps]

@greptileai please review the latest commit af4fadc and provide a full score.

[enaboapps]

@greptileai please review the latest commit f7d9e45 and provide a full score.