Merge branch 'beta'

Author: snomiao

bin/clx

@@ -3,11 +3,25 @@
 DIR="$(dirname "$(readlink -f "$0" 2>/dev/null || realpath "$0" 2>/dev/null || echo "$0")")/.."
 export DYLD_LIBRARY_PATH="${DIR}/rs/target/release:${DYLD_LIBRARY_PATH}"
 
-# If args are passed (agent, dino, --help, etc.), run directly — no watchdog.
-if [ $# -gt 0 ]; then
+# If args are passed (agent, dino, --help, -f, etc.), run directly — no watchdog.
+if [ $# -gt 0 ] && [ "$1" != "--watchdog" ]; then
     exec "${DIR}/clx" "$@"
 fi
 
+# Fork watchdog to background unless already running as watchdog.
+if [ "$1" != "--watchdog" ]; then
+    mkdir -p "${DIR}/tmp"
+    # Rotate watchdog log if it exceeds 5 MB so it can't grow unbounded
+    # (previously hit 56 MB / 583k lines from CGEventTap-disabled spam).
+    LOG="${DIR}/tmp/clx-watchdog.log"
+    if [ -f "$LOG" ] && [ "$(stat -f%z "$LOG" 2>/dev/null || stat -c%s "$LOG" 2>/dev/null || echo 0)" -gt 5242880 ]; then
+        mv -f "$LOG" "${LOG}.1"
+    fi
+    nohup "$0" --watchdog </dev/null >>"$LOG" 2>&1 &
+    echo "[CLX] started (pid $!)" >&2
+    exit 0
+fi
+
 # Daemon mode: watchdog with exponential backoff.
 # Starts at 10ms, doubles each crash, resets on clean run (>10s uptime).
 MAX_RESTARTS=20

rs/adapters/macos/src/brainstorm_overlay.rs

@@ -259,48 +259,108 @@ unsafe fn hide_window() {
     msg1(w, sel(b"orderOut:\0"), std::ptr::null_mut());
 }
 
-// ── Subprocess-based prompt input ────────────────────────────────────────────
-
-/// Show a prompt input dialog via a subprocess (`clx-prompt`).
-/// The subprocess has no CGEventTap, so keyboard input works normally.
-pub fn show_prompt_panel(title: &str, message: &str, prefill: &str) -> Option<String> {
-    use std::process::Command;
-
-    // Find the clx-prompt binary next to the main binary.
-    let prompt_bin = {
-        let exe = std::env::current_exe().unwrap_or_default();
-        let dir = exe.parent().unwrap_or(std::path::Path::new("."));
-        dir.join("clx-prompt")
-    };
+// ── Daemon-based prompt input (zero cold-start) ──────────────────────────────
 
-    // Fall back to looking in the cargo target directory.
-    let prompt_bin = if prompt_bin.exists() {
-        prompt_bin
-    } else {
-        // Try relative to CWD or in PATH.
-        std::path::PathBuf::from("clx-prompt")
-    };
+use std::io::{BufRead, BufReader, Write};
+use std::process::{Child, ChildStdin, ChildStdout, Stdio};
+use std::sync::OnceLock;
+
+struct PromptDaemon {
+    _child: Child,
+    stdin:  ChildStdin,
+    stdout: BufReader<ChildStdout>,
+}
+
+impl Drop for PromptDaemon {
+    fn drop(&mut self) {
+        // Kill the child explicitly so it doesn't outlive us as an orphan.
+        // Without this, repeated clx restarts (watchdog) leak clx-prompt
+        // processes (each ~74 MB) until the user reboots.
+        let _ = self._child.kill();
+        let _ = self._child.wait();
+    }
+}
 
-    eprintln!("[CLX] launching prompt subprocess: {:?}", prompt_bin);
-
-    let output = Command::new(&prompt_bin)
-        .arg(title)
-        .arg(message)
-        .arg(prefill)
-        .output();
-
-    match output {
-        Ok(out) => {
-            if out.status.success() {
-                let text = String::from_utf8_lossy(&out.stdout).into_owned();
-                if text.is_empty() { None } else { Some(text) }
-            } else {
-                eprintln!("[CLX] prompt cancelled (exit code {:?})", out.status.code());
-                None
+static DAEMON: OnceLock<Mutex<PromptDaemon>> = OnceLock::new();
+
+fn prompt_bin_path() -> std::path::PathBuf {
+    let exe = std::env::current_exe().unwrap_or_default();
+    let dir = exe.parent().unwrap_or(std::path::Path::new("."));
+    // Check same dir as binary, then bin/ subdir (where build.sh deploys it).
+    for candidate in [dir.join("clx-prompt"), dir.join("bin").join("clx-prompt")] {
+        if candidate.exists() {
+            // Verify it's the Tauri build, not an old AppKit binary.
+            if let Ok(bytes) = std::fs::read(&candidate) {
+                if bytes.windows(5).any(|w| w == b"tauri") {
+                    return candidate;
+                }
+                eprintln!("[CLX] skipping non-Tauri clx-prompt at {:?}", candidate);
             }
         }
-        Err(e) => {
-            eprintln!("[CLX] failed to launch clx-prompt: {}", e);
+    }
+    std::path::PathBuf::from("clx-prompt")
+}
+
+/// Pre-spawn the clx-prompt daemon so the window is warm before first use.
+/// Call this at CLX startup. Safe to call multiple times.
+pub fn spawn_prompt_daemon() {
+    DAEMON.get_or_init(|| {
+        let bin = prompt_bin_path();
+        eprintln!("[CLX] spawning clx-prompt daemon: {:?}", bin);
+        let mut child = std::process::Command::new(&bin)
+            .arg("--daemon")
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::inherit())
+            .spawn()
+            .expect("failed to spawn clx-prompt --daemon");
+
+        let stdin  = child.stdin.take().expect("no stdin");
+        let stdout = BufReader::new(child.stdout.take().expect("no stdout"));
+
+        let mut daemon = PromptDaemon { _child: child, stdin, stdout };
+
+        // Wait for {"type":"ready"} line before returning.
+        let mut line = String::new();
+        let _ = daemon.stdout.read_line(&mut line);
+        eprintln!("[CLX] clx-prompt daemon ready: {}", line.trim());
+
+        Mutex::new(daemon)
+    });
+}
+
+/// Show the prompt dialog. Blocks until user submits or cancels.
+/// Returns the prompt text (with optional "[KEEP]\n" prefix), or None if cancelled.
+pub fn show_prompt_panel(title: &str, context: &str, last_prompt: &str) -> Option<String> {
+    // Ensure daemon is running (lazy fallback if spawn_prompt_daemon wasn't called at startup).
+    spawn_prompt_daemon();
+
+    let daemon_lock = DAEMON.get()?;
+    let mut d = daemon_lock.lock().ok()?;
+
+    // Send show command.
+    let cmd = serde_json::json!({
+        "cmd": "show",
+        "title": title,
+        "context": context,
+        "last_prompt": last_prompt,
+    });
+    writeln!(d.stdin, "{cmd}").ok()?;
+    d.stdin.flush().ok()?;
+
+    // Block until we get a result line.
+    let mut line = String::new();
+    d.stdout.read_line(&mut line).ok()?;
+    let msg: serde_json::Value = serde_json::from_str(line.trim()).ok()?;
+
+    match msg["type"].as_str()? {
+        "submit" => {
+            let text = msg["text"].as_str()?.to_string();
+            let keep = msg["keep"].as_bool().unwrap_or(false);
+            Some(if keep { format!("[KEEP]\n{text}") } else { text })
+        }
+        _ => {
+            eprintln!("[CLX] prompt cancelled");
             None
         }
     }

rs/adapters/macos/src/hook.rs

@@ -99,7 +99,25 @@ unsafe extern "C" fn raw_callback(
     if etype_raw == TAP_DISABLED_BY_TIMEOUT || etype_raw == TAP_DISABLED_BY_USER {
         let tap = TAP_REF.load(Ordering::Relaxed);
         if !tap.is_null() {
-            eprintln!("[CLX] CGEventTap was disabled (secure input?) - releasing all keys + re-enabling");
+            // Rate-limit logging: only log first event in a burst, and at most
+            // once per 5s. The previous version spammed 583k lines into the
+            // watchdog log over a few days.
+            use std::sync::atomic::AtomicU64;
+            use std::time::{SystemTime, UNIX_EPOCH};
+            static LAST_LOG_SEC: AtomicU64 = AtomicU64::new(0);
+            static DISABLE_COUNT: AtomicU64 = AtomicU64::new(0);
+            let now = SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
+            let last = LAST_LOG_SEC.load(Ordering::Relaxed);
+            let n = DISABLE_COUNT.fetch_add(1, Ordering::Relaxed) + 1;
+            if now.saturating_sub(last) >= 5 {
+                LAST_LOG_SEC.store(now, Ordering::Relaxed);
+                let cause = if etype_raw == TAP_DISABLED_BY_TIMEOUT {
+                    "timeout (handler too slow → key drops/lag)"
+                } else {
+                    "user (secure input field)"
+                };
+                eprintln!("[CLX] CGEventTap disabled — {} (total disables: {}) — re-enabling", cause, n);
+            }
             // Emergency stop: release all held keys and stop all modules.
             // Without this, AccModel keeps running (tabs/mouse) because we
             // never received the key-up events while the tap was disabled.

rs/adapters/macos/src/main.rs

@@ -130,6 +130,13 @@ fn main() {
                 "pgrep -f '/clx\\b|/capslockx\\b' | grep -v {} | xargs kill -9 2>/dev/null", my_pid
             )])
             .status();
+
+        // Reap any orphan clx-prompt daemons from previous (crashed) sessions.
+        // The Tauri prompt helper is ~74 MB each — without this, repeated
+        // crashes leak ten or more orphan processes.
+        let _ = std::process::Command::new("sh")
+            .args(["-c", "pkill -9 -f 'clx-prompt --daemon' 2>/dev/null"])
+            .status();
     }
 
     // Tee stderr to /tmp/clx-debug.log (truncated on each start) so the log