Release v1.4.0 - App Invasiveness Report & Real-time Monitoring

New Features:
- App Invasiveness Report: Analyze apps by persistence mechanisms and installation footprint
- Dual Scoring System: Separate persistence score (triggers, privileges, resilience) and junk score (bloat, orphans, spread)
- Grade System: Apps rated A through F for quick assessment
- Menu Bar Integration: Quick access to monitoring controls
- Real-time Monitoring: FSEvents-based persistence change detection with noise suppression
- Safe Containment Mode: Disable persistence items with network blocking

Improvements:
- On-demand size calculation for faster scans
- Sortable app lists (by score, size, persistence, name)
- Tabbed detail view with score breakdown
- Build script (build.sh) for easy compilation

Technical:
- InvasivenessScorer for comprehensive scoring
- AppInvasivenessAnalyzer for Library folder scanning
- PersistenceMonitor with DirectoryWatcher (FSEvents)
- NetworkBlocker with socketfilterfw/pfctl
- MonitorBaseline for change detection

Author: Pinperepette

.gitignore

@@ -0,0 +1,22 @@
+# Build
+.build/
+DerivedData/
+*.xcodeproj/xcuserdata/
+*.xcworkspace/xcuserdata/
+
+# macOS
+.DS_Store
+*.swp
+*~
+
+# Temporary files
+GenerateIcon.swift
+icona.png
+*.iconset/
+
+# App bundle (built separately)
+*.app/
+
+# Package manager
+.swiftpm/
+Packages/

MacPersistenceChecker/App/AppState.swift

@@ -2,6 +2,19 @@ import Foundation
 import SwiftUI
 import Combine
 
+// Debug helper
+extension String {
+    func appendToFile(_ path: String) throws {
+        if let handle = FileHandle(forWritingAtPath: path) {
+            handle.seekToEndOfFile()
+            handle.write(self.data(using: .utf8)!)
+            handle.closeFile()
+        } else {
+            try self.write(toFile: path, atomically: true, encoding: .utf8)
+        }
+    }
+}
+
 /// Global application state
 @MainActor
 final class AppState: ObservableObject {
@@ -65,6 +78,23 @@ final class AppState: ObservableObject {
     /// Item to show in focused graph view (nil = show full graph)
     @Published var focusedGraphItem: PersistenceItem? = nil
 
+    // MARK: - Graph Detail Window
+
+    /// Node to show in detail window
+    @Published var graphDetailNode: GraphNode? = nil
+
+    /// Edge to show in detail window
+    @Published var graphDetailEdge: GraphEdge? = nil
+
+    /// Source node for edge detail
+    @Published var graphDetailSourceNode: GraphNode? = nil
+
+    /// Target node for edge detail
+    @Published var graphDetailTargetNode: GraphNode? = nil
+
+    /// Persistence item for detailed view (linked from node)
+    @Published var graphDetailPersistenceItem: PersistenceItem? = nil
+
     // MARK: - Snapshots
 
     /// Available snapshots
@@ -73,14 +103,59 @@ final class AppState: ObservableObject {
     /// Current snapshot being viewed
     @Published var currentSnapshot: Snapshot? = nil
 
+    // MARK: - Monitoring State
+
+    /// Whether real-time monitoring is active
+    @Published var isMonitoring: Bool = false
+
+    /// Last detected change from monitor
+    @Published var lastMonitorChange: MonitorChange? = nil
+
+    /// Count of unacknowledged changes
+    @Published var unacknowledgedChangeCount: Int = 0
+
     // MARK: - Private
 
     private let scanner = ScannerOrchestrator()
     private var cancellables = Set<AnyCancellable>()
 
     private init() {
+        // Ensure database is initialized before we try to load from it
+        ensureDatabaseInitialized()
         setupBindings()
         loadSnapshots()
+        loadCachedScan()
+        // Note: Containment and Monitor are initialized lazily to avoid permission prompts on launch
+    }
+
+    /// Ensure database is initialized (idempotent)
+    private func ensureDatabaseInitialized() {
+        if DatabaseManager.shared.dbQueue == nil {
+            do {
+                try DatabaseManager.shared.initialize()
+                NSLog("[AppState] Database initialized")
+            } catch {
+                NSLog("[AppState] Failed to initialize database: %@", error.localizedDescription)
+            }
+        } else {
+            NSLog("[AppState] Database already initialized")
+        }
+    }
+
+    /// Load cached scan results from database
+    private func loadCachedScan() {
+        NSLog("[AppState] Loading cached scan...")
+        do {
+            if let cached = try DatabaseManager.shared.loadLastScan() {
+                items = cached.items
+                lastScanDate = cached.scanDate
+                NSLog("[AppState] Loaded %d items from cache", cached.items.count)
+            } else {
+                NSLog("[AppState] No cached scan found")
+            }
+        } catch {
+            NSLog("[AppState] Failed to load cached scan: %@", error.localizedDescription)
+        }
     }
 
     private func setupBindings() {
@@ -187,12 +262,29 @@ final class AppState: ObservableObject {
 
     /// Scan all categories
     func scanAll() async {
+        let debugFile = "/tmp/mpc_scan_debug.log"
+        try? "Scan started at \(Date())\n".write(toFile: debugFile, atomically: true, encoding: .utf8)
+
+        // Clear previous results to show we're starting fresh
+        items = []
+        selectedItem = nil
+
         let startTime = CFAbsoluteTimeGetCurrent()
         items = await scanner.scanAll()
         let elapsed = CFAbsoluteTimeGetCurrent() - startTime
-        print("⚡️ Scan completed in \(String(format: "%.2f", elapsed)) seconds - Found \(items.count) items")
         lastScanDate = Date()
 
+        try? "Scan completed: \(items.count) items in \(elapsed)s\n".appendToFile(debugFile)
+
+        // Save to cache for next app launch
+        do {
+            try? "Saving to cache...\n".appendToFile(debugFile)
+            try DatabaseManager.shared.saveLastScan(items: items, scanDate: lastScanDate!)
+            try? "Cache saved OK!\n".appendToFile(debugFile)
+        } catch {
+            try? "Cache save FAILED: \(error)\n".appendToFile(debugFile)
+        }
+
         // Create automatic snapshot if first scan
         if snapshots.isEmpty {
             await createSnapshot(trigger: .firstLaunch)
@@ -259,6 +351,71 @@ final class AppState: ObservableObject {
     var totalCount: Int {
         items.count
     }
+
+    // MARK: - Monitoring Methods
+
+    /// Whether monitor bindings have been setup
+    private var monitorBindingsSetup = false
+
+    /// Setup bindings to PersistenceMonitor (lazy - called on first monitoring access)
+    private func ensureMonitorBindings() {
+        guard !monitorBindingsSetup else { return }
+        monitorBindingsSetup = true
+
+        let monitor = PersistenceMonitor.shared
+
+        // Sync monitoring state
+        monitor.$state
+            .map { $0 == .running }
+            .receive(on: RunLoop.main)
+            .assign(to: &$isMonitoring)
+
+        // Sync last change
+        monitor.$lastChange
+            .receive(on: RunLoop.main)
+            .assign(to: &$lastMonitorChange)
+
+        // Sync unacknowledged count
+        monitor.$unacknowledgedCount
+            .receive(on: RunLoop.main)
+            .assign(to: &$unacknowledgedChangeCount)
+    }
+
+    /// Toggle real-time monitoring
+    func toggleMonitoring() async {
+        ensureMonitorBindings()
+        await PersistenceMonitor.shared.toggleMonitoring()
+    }
+
+    /// Start monitoring
+    func startMonitoring() async {
+        ensureMonitorBindings()
+        await PersistenceMonitor.shared.startMonitoring()
+    }
+
+    /// Stop monitoring
+    func stopMonitoring() {
+        ensureMonitorBindings()
+        PersistenceMonitor.shared.stopMonitoring()
+    }
+
+    /// Update monitoring baseline with current items
+    func updateMonitorBaseline() async throws {
+        ensureMonitorBindings()
+        try await PersistenceMonitor.shared.updateBaseline()
+    }
+
+    /// Acknowledge all pending changes
+    func acknowledgeAllChanges() {
+        ensureMonitorBindings()
+        PersistenceMonitor.shared.acknowledgeAllChanges()
+    }
+
+    /// Get change history
+    func getChangeHistory(limit: Int = 100) -> [ChangeHistoryEntry] {
+        ensureMonitorBindings()
+        return PersistenceMonitor.shared.getChangeHistory(limit: limit)
+    }
 }
 
 // MARK: - Sort Order

MacPersistenceChecker/App/MacPersistenceCheckerApp.swift

@@ -2,16 +2,26 @@ import SwiftUI
 
 @main
 struct MacPersistenceCheckerApp: App {
-    @StateObject private var appState = AppState.shared
-    @StateObject private var fdaChecker = FullDiskAccessChecker.shared
-
-    init() {
-        // Initialize database
+    // IMPORTANT: Database must be initialized before AppState.shared is accessed
+    // This static initializer runs before @StateObject property initializers
+    private static let _initializeDatabase: Void = {
         do {
             try DatabaseManager.shared.initialize()
+            print("[App] Database initialized successfully")
         } catch {
-            print("Failed to initialize database: \(error)")
+            print("[App] Failed to initialize database: \(error)")
         }
+    }()
+
+    @StateObject private var appState = AppState.shared
+    @StateObject private var fdaChecker = FullDiskAccessChecker.shared
+    @StateObject private var monitor = PersistenceMonitor.shared
+
+    init() {
+        // Ensure database initialization runs (static property is lazy)
+        _ = Self._initializeDatabase
+        // Note: Monitor is NOT auto-started here
+        // User must explicitly enable monitoring in Settings → Monitoring
     }
 
     var body: some Scene {
@@ -41,10 +51,41 @@ struct MacPersistenceCheckerApp: App {
         .windowStyle(.automatic)
         .defaultSize(width: 1000, height: 700)
 
+        // Graph Detail Window (opens on double-click)
+        Window("Graph Detail", id: "graph-detail-window") {
+            GraphDetailWindowView()
+                .environmentObject(appState)
+        }
+        .windowStyle(.automatic)
+        .defaultSize(width: 900, height: 650)
+
+        // App Invasiveness Report Window
+        Window("App Invasiveness Report", id: "invasiveness-window") {
+            AppInvasivenessView()
+                .environmentObject(appState)
+        }
+        .windowStyle(.automatic)
+        .defaultSize(width: 1000, height: 700)
+
         Settings {
             SettingsView()
                 .environmentObject(appState)
         }
+
+        // Menu Bar Extra for quick monitoring control
+        MenuBarExtra {
+            MenuBarView(monitor: monitor, appState: appState)
+        } label: {
+            HStack(spacing: 4) {
+                Image(systemName: monitor.isMonitoring ? "shield.checkered" : "shield")
+                    .symbolRenderingMode(.hierarchical)
+                if monitor.unacknowledgedCount > 0 {
+                    Text("\(monitor.unacknowledgedCount)")
+                        .font(.caption2)
+                }
+            }
+        }
+        .menuBarExtraStyle(.window)
     }
 }
 
@@ -82,12 +123,17 @@ struct SettingsView: View {
                     Label("Extended Scanners", systemImage: "plus.circle")
                 }
 
+            MonitoringSettingsView()
+                .tabItem {
+                    Label("Monitoring", systemImage: "eye")
+                }
+
             AboutView()
                 .tabItem {
                     Label("About", systemImage: "info.circle")
                 }
         }
-        .frame(width: 550, height: 500)
+        .frame(width: 550, height: 600)
     }
 }
 
@@ -268,7 +314,7 @@ struct AboutView: View {
                 .font(.title)
                 .fontWeight(.bold)
 
-            Text("Version 1.3.0")
+            Text("Version 1.4.0")
                 .foregroundColor(.secondary)
 
             Text("A comprehensive tool for monitoring macOS persistence mechanisms.")