Make the app the product, not the CLI

[TerrifiedBug]

yap shipped as a CLI that happened to draw a menu bar. Onboarding was yap setup, the login item was yap install, a missing grant printed into a log file nobody reads, and the .app existed only so the build could be notarized. This turns that around.

What changes

• CLI is run and bench. setup, install, start, stop, doctor, record, models are gone, with every run flag the Settings window already covers. Doctor.swift becomes Permissions.swift; Setup/Install/Agent collapse into LaunchAgent.swift; Daemon moves out of Yap.swift into its own file. supportsSessions goes — every registered model can do sessions.
• The status item goes up before the model loads. A first run is visible for the minutes it spends downloading instead of invisible, and a press during that says press ignored — model not loaded rather than recording into nothing.
• Onboarding lives in the menu. Rows for Accessibility, the microphone, a hijacked Fn key, and a tap that failed to register. The daemon no longer exits when Accessibility is missing: it raises the prompt once, watches com.apple.accessibility.api, re-checks on every menu open, and starts the tap the moment the grant lands — no relaunch.
• Settings gains a General pane: launch at login, updates, logs.
• The hotkey is recorded, not picked. Any modifier held alone (now including the left-hand ones), or a chord like cmd+shift+space, or a lone function key. A chord tap is a .defaultTap that swallows the keystroke; a held modifier stays byte-identical to today's listen-only flagsChanged tap. The spellings are the ones already in people's config files.
• The transcript pill gains Delete — to the Trash, with Undo, no confirmation. And the pill now answers exactly once, whichever button is clicked.
• yap can update itself from GitHub Releases, when asked: SHA-256, then a signature check against the team the running code is signed by, then Update to x.y.z · Restart in the menu, disabled while a recording or press is live.

Nothing runs while idle

There is no update schedule. An earlier revision had a 30 s work item and a repeating daily Timer, which is exactly what AGENTS.md forbids — it permits one piece of background work and that is meeting detection. Both are gone, along with the updates.automatic key and its toggle. Check Now in Settings → General is the only thing that reaches the network after the model is on disk.

Measured on the installed daemon sitting idle: 0.0% CPU. Every remaining timer in the tree belongs to something happening — the menu's elapsed counter while a session records, the pill's auto-dismiss while a pill is up, the session stall check, the config watcher's debounce, the dictation suppression tail — plus MeetingDetector, the permitted one.

No new processes

The updater unpacks in process. ZipArchive reads the central directory and inflates with the Compression framework; extraction forks nothing. Two things make that safe for bytes that have not been signature-checked yet:

• entry names are resolved and checked for containment, so ../../bin/something is refused;
• symlink entries are refused outright, because the containment check is lexical — a link entry creating staging/link -> /elsewhere would let every later link/… entry pass a text comparison while the write followed the link out of staging. A yap release contains no symlinks (measured: zero, in both bundle and artifact).

AppleDouble sidecars are dropped; build-release.sh already runs xattr -cr before signing, and a bundle extracted without them verifies.

Sources spawns a process in three places, all inherited from main: osascript for notifications, /bin/sh for the on_stop hook, launchctl. The update path spawns none.

Latency

Press acknowledgement is the one change. The pill used to be drawn after capture.start() returned; it is now drawn before. M4, p50 of 10 synthesized Fn presses, from beginDictation entry:

	p50	min	max
pill on screen (after)	1.9 ms	1.5	6.7
capture.start() returned (what it was before)	69.7 ms	63.2	134.4

Transcription untouched, and measured to confirm it: bench --audio <5 s clip> --iterations 7 on parakeet-tdt-ctc-110m gives 39 ms p50 — exactly the AGENTS.md baseline for that clip length.

Registering the update observer costs 6.5–17 ms cold (SecCodeCopySelf + SecCodeCopySigningInformation), so it happens after warm-up rather than on the launch path — but outside the do/catch, because a build whose model will not load is the one a user most wants to replace.

Upgrade path

yap 0.2's login item runs yap run --skip-doctor, an argument 0.3 does not take. Reproduced on a real machine before fixing: last exit code = 64: EX_USAGE, state = spawn scheduled — KeepAlive respawning a job that can never start.

The cask postflight rewrites ProgramArguments with plutil, then bootout + bootstrap rather than kickstart -k, because launchd reads a plist when the job is bootstrapped and not again. Verified against the reproduced loop: the job comes back up and the plist is byte-identical to a clean install. LaunchAgent.refreshIfStale() covers the DMG path — drag the new app in, launch it, login item corrected.

Known gap: someone on 0.2 with launch-at-login who upgrades by dragging a DMG and reboots without ever launching the app gets the loop, until they launch yap once or delete the plist. Homebrew — the documented install — is covered.

Verified

Against the installed app on macOS 26 unless noted. 47 tests, swift build -c release --arch arm64 clean.

• Launch order — menu bar item up immediately, loading model… → idle · hold Fn to dictate.
• Fn row — set 🌐 to Show Emoji & Symbols → row appears with that text and the state line reads needs setup; set it back → row gone, live, no restart.
• Missing Accessibility — ad-hoc-signed copy under a different bundle id: prompt raised once, process stays up, Grant Accessibility… row present, no relaunch loop.
• Microphone — reset then Deny → Grant Microphone… row; reset then Allow → row gone.
• Chord binding — cmd+shift+space hot-reloaded, menu reads idle · hold ⌘⇧Space to dictate, a synthesized chord drives a full dictation cycle, and a tail-appended tap sees 0 Space key-downs downstream against 1 with Fn bound. That is the swallow, measured.
• Recorder capture — right ⌥ commits on release as rightOption, left Shift distinct from right, F5 alone accepted with the implicit Fn bit stripped, bare a refused with needs a modifier and nothing written, Escape cancels, ⌃Escape binds, ⌘⇧Space commits on key-down. Real NSEvents built from CGEvents, so the sided modifier bits are genuine.
• A 0.2-spelled config — "hotkey": "rightOption" hot-reloads to idle · hold Right ⌥ to dictate, file untouched.
• Delete — recorded a session, clicked Delete on the pill → folder in the Trash, Deleted · <name> pill with Undo → folder restored with all six files. Three real clicks inside the 160 ms fade produce exactly one ⌫ trashed and no error.
• Updater — local feed with a signed 9.9.9 build: our extractor's output is a byte-identical tree to ditto -x -k of the same archive, reports valid on disk and satisfies its Designated Requirement, passes the updater's own SecStaticCodeCheckValidity, and installs — /Applications/yap.app came up 9.9.9, signature valid, no quarantine xattr, staging cleared. Menu item disabled while recording, enabled after. Corrupted .sha256 → checksum mismatch, nothing staged. Ad-hoc-signed payload → signature mismatch, nothing staged.

Not verified: three click targets inside the Settings window — the recorder field's click-to-arm gesture, the launch-at-login switch, and Show Logs in Finder. Synthetic CGEvent clicks reach AppKit chrome (they close the window) but never reach SwiftUI content in an accessory app that never becomes frontmost; AXFocused stays false even after a title-bar click. Everything behind those three gestures is covered another way: the recorder's capture rules by unit test, LaunchAgent.install() by refreshIfStale on a real upgrade, and both panes visually. They need one human minute.