feat(profile): refuse writes while Elgato app is running + restart_app path fix

[jack-arturo]

Summary

Follow-up to #15. Closes a silent data-loss hole and fixes a pre-existing bug in the app-restart helper — both surfaced by the Phase 1 on-device smoke test.

• Data loss bug: the Elgato desktop app caches every profile in memory and rewrites the on-disk manifests from its snapshot on quit. Edits made via streamdeck_write_page while the app is running are silently wiped the next time it closes (observed live during Phase 1 testing). This PR makes `write_page` refuse to run while the app is up and exposes a single additive `auto_quit_app` opt-in field for callers that want the tool to quit it for them (AppleScript → killall fallback).
• restart_app -600 bug: `open -a "Stream Deck"` / `open -a "Elgato Stream Deck"` both fail with `LSOpenURLsWithCompletionHandler -600` on some macOS installs. Launching by explicit `/Applications/Elgato Stream Deck.app` path bypasses LaunchServices entirely. `STREAMDECK_APP_PATH` env var overrides the default for non-standard installs.
• Tool count unchanged (still 6 tools). The new behavior is a single `auto_quit_app: bool = false` field on the existing `streamdeck_write_page` tool — per Jack's "avoid tool bloat" direction.

Workflow (added to README)

1. `streamdeck_write_page(auto_quit_app: true, …)` — tool quits the app, writes, leaves app quit
2. Additional writes can follow without re-passing `auto_quit_app` (app stays quit)
3. `streamdeck_restart_app()` once done → device picks up the changes

Test plan

• `uv run pytest tests/` — 44 passed (5 new)
• `uv run ruff check .`
• `uv run ruff format --check .`
• Manual: reproduce the Phase 1 scenario end-to-end (app running → write fails with clear error → retry with auto_quit_app=true → write succeeds → restart_app shows the button on the deck)

Dependencies

Orthogonal to #15 — no merge-order requirement. Either can land first.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds safeguards to prevent Stream Deck profile writes from being silently lost while the Elgato desktop app is running, and fixes streamdeck_restart_app to relaunch via an explicit .app path (with an env-var override) to avoid macOS LaunchServices -600 failures.

Changes:

• Refuse write_page when the Stream Deck app is running unless callers opt in via auto_quit_app=True (and surface a dedicated error type).
• Add auto_quit_app to the MCP tool schema and server call path.
• Rework restart_app to open an explicit app bundle path with STREAMDECK_APP_PATH override; document the new workflow in the README; add tests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
profile_manager.py	Adds app-running detection/stop helpers, blocks writes while app is running, and changes app restart logic to launch by path.
profile_server.py	Extends streamdeck_write_page schema with auto_quit_app and returns a dedicated warning message for the new running-app error.
tests/test_profile_manager.py	Adds tests for the running-app refusal, auto-quit path, and explicit restart-app path behavior.
README.md	Documents the required quit → write → restart workflow and the STREAMDECK_APP_PATH override.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jack-arturo]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied all four review changes in commit 3bbc9e8 (with a follow-up in 1fce5e8):

1. Consistent stop_stream_deck_app() schema — early returns (non-darwin, not running) now always include graceful: [], forced: [], and reason.
2. Verify app actually stopped before writing — write_page() now checks both app_stop_report["stopped"] and a fresh is_stream_deck_app_running() call after stopping; raises StreamDeckAppRunningError with the report's reason if either indicates the app is still up.
3. Validate app path before stopping in restart_app() — path resolution and existence check now happen before stop_stream_deck_app(), so a misconfigured path raises without orphaning the user.
4. New test for stop-failure path — test_write_page_auto_quit_app_raises_when_stop_fails covers stopped=False; the existing happy-path test updated to use side_effect=[True, False] so the post-stop is_stream_deck_app_running() call returns False.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• releases.astral.sh
  • Triggering command: /home/REDACTED/.local/bin/uv uv venv .venv (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[jack-arturo]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in commit d3b831e. The conflict was in tests/test_profile_manager.py — main had added the sample_profiles_plus_xl fixture and encoder controller tests from #15 in the same region where this branch added the app-lifecycle tests. The merge keeps all tests from both branches (51 total, all passing).