Fix attempt

Author: unsecretised

assets/entitlements.plist

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Required for global key monitoring -->
+    <key>com.apple.security.temporary-exception.accessibility</key>
+    <true/>
+
+    <!-- If using App Sandbox (Mac App Store) -->
+    <key>com.apple.security.app-sandbox</key>
+    <false/>
+
+    <!-- Input monitoring - needed for global key events -->
+    <key>com.apple.security.device.input-monitoring</key>
+    <true/>
+</dict>
+</plist>

scripts/sign-macos.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env -S bash -e
 
+ENTITLEMENTS_PATH="assets/macos/entitlements.plist"
+
 APP_BUNDLE_PATH="${APP_BUNDLE_PATH:?APP_BUNDLE_PATH not set}"
 
 # 1. Create a temporary keychain and import certificate
@@ -29,6 +31,7 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: \
 
 # 2. Sign app bundle
 codesign --deep --force --options runtime --timestamp \
+  --entitlements $ENTITLEMENTS_PATH \
   --sign "$MACOS_CERTIFICATE_NAME" \
   "$APP_BUNDLE_PATH"