fix: restart macOS input method after upgrades

Author: Leonardlsa

.github/release-notes/v5.0.8.md

@@ -0,0 +1,44 @@
+# VoCoType-linux v5.0.8
+
+VoCoType-linux v5.0.8 是 V5 稳定线的 macOS 输入法更新可靠性热修复版本。它修复了更新后旧 InputMethod 进程可能继续驻留、导致麦克风 TCC 身份与磁盘中新 bundle 不一致的问题。
+
+发布日期：2026-09-12。
+
+## 修复
+
+- **更新前先禁用旧输入源**：DMG 安装脚本在替换 `~/Library/Input Methods/VoCoType-linux.app` 前先禁用旧 VoCoType 输入源，再终止旧 InputMethod 和录音相关进程，避免 InputMethodKit 在文件复制过程中自动重新拉起旧进程。
+- **最终安装后强制建立新的进程边界**：新 bundle 完整复制、LaunchServices 注册和输入源安装完成后，再终止一次 InputMethod 并重新激活，确保最终常驻进程一定从最终安装、最终签名的 bundle 启动。
+- **Settings App 自动更新采用同样策略**：嵌入式 InputMethod 更新完成并激活后，也会做最终进程重启，DMG 安装与应用内更新行为保持一致。
+- **保留 v5.0.7 的录音启动 watchdog**：本次没有放宽或移除 CoreAudio 5 秒启动保护；现场验证表明当前问题不是 watchdog 阈值，而是更新后遗留的进程身份错位。
+
+## 真机证据
+
+受影响机器上，磁盘中的 `VoCoType-linux.app` 能通过 `codesign --verify --deep --strict`，但常驻 InputMethod 进程仍是前一天更新前启动的旧进程。真实 F9 录音时，TCC 日志出现：
+
+`IDENTITY_ATTRIBUTION: Failed to copy signing info ... -67034`
+
+这意味着负责麦克风访问的常驻 InputMethod 进程与当前磁盘 bundle 的签名身份无法正常对应。
+
+终止旧 InputMethod 并从当前已签名 bundle 重新激活后：
+
+- 新 InputMethod PID 启动；
+- 后续真实 F9 第一块音频分别约 145 ms / 144 ms 到达；
+- WAV 在松手后约 134–135 ms 完成；
+- 最终 ASR 正常完成并成功上屏；
+- 新 PID 的录音路径不再出现上述 `IDENTITY_ATTRIBUTION -67034`。
+
+验证结果：
+
+- macOS CTest：10/10 PASS；
+- native source contracts：PASS；
+- `packaging/macos/install.command` shell syntax：PASS。
+
+## 下载资产
+
+- macOS Apple Silicon：`VoCoType-linux-5.0.8-macOS-arm64.dmg`；
+- Debian / Ubuntu：Universal、IBus-only、Fcitx5-only；
+- Fedora / RHEL：Universal、IBus-only、Fcitx5-only；
+- Arch Linux：Universal、IBus-only、Fcitx5-only；
+- 所有安装资产统一提供 `SHA256SUMS`。
+
+**Full Changelog**: https://github.com/LeonardNJU/VocoType-linux/compare/v5.0.7...v5.0.8

CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.0.8] - 2026-09-12
+
+### Fixed
+
+- macOS upgrades now disable the old input source before replacing its bundle and force a final InputMethod process restart only after the new bundle is fully installed and registered. This prevents a stale in-memory input-method executable from remaining responsible for a newly signed on-disk bundle, which can make TCC microphone identity attribution fail intermittently even though the replacement bundle passes `codesign` verification.
+- The Settings App embedded-input-method updater now enforces the same final process boundary after activation, so both DMG installs and in-app upgrades converge on a fresh process loaded from the final installed bundle.
+
 ## [5.0.7] - 2026-09-11
 
 ### Fixed

VERSION

@@ -1 +1 @@
-5.0.7
+5.0.8

packaging/macos/install.command

@@ -15,6 +15,14 @@ if [[ ! -d "$SOURCE_INPUT" || ! -d "$SOURCE_SETTINGS" ]]; then
 fi
 
 mkdir -p "$HOME/Library/Input Methods" "$HOME/Applications"
+# Disable the old source before touching its bundle. InputMethodKit may
+# otherwise relaunch a killed input-method process while ditto is replacing
+# the app, leaving an old in-memory executable responsible for a newly signed
+# on-disk bundle. TCC then cannot reliably attribute microphone access.
+OLD_TOOL="$INPUT_DESTINATION/Contents/Resources/bin/vocotype-input-source-tool"
+if [[ -x "$OLD_TOOL" ]]; then
+  "$OLD_TOOL" --disable "$IDENTIFIER" >/dev/null 2>&1 || true
+fi
 pkill -f "$INPUT_DESTINATION/Contents/MacOS/VoCoTypeLinuxInputMethod" 2>/dev/null || true
 pkill -f "$SETTINGS_DESTINATION/Contents/MacOS/VoCoTypeLinuxSettings" 2>/dev/null || true
 for runtime in vocotype-audio-recorder vocotype-core vocotype-streaming-worker vocotype-offline-worker; do
@@ -40,6 +48,12 @@ fi
 
 TOOL="$INPUT_DESTINATION/Contents/Resources/bin/vocotype-input-source-tool"
 "$TOOL" --install "$INPUT_DESTINATION" "$IDENTIFIER"
+# Establish a process boundary after the final bundle bytes are installed and
+# registered. Even if macOS launched the input method during registration,
+# the surviving process must come from the final signed bundle on disk.
+pkill -f "$INPUT_DESTINATION/Contents/MacOS/VoCoTypeLinuxInputMethod" 2>/dev/null || true
+sleep 0.2
+"$TOOL" --activate "$IDENTIFIER"
 open "$SETTINGS_DESTINATION" --args --settings-page 1 2>/dev/null || true
 
 cat <<'MESSAGE'

scripts/test/contracts.sh

@@ -239,6 +239,23 @@ rg -Fq 'prewarm_offline_asr(socket, config, asr_lease)' src/integrations/macos/V
   fail "macOS does not prewarm final ASR at recording start"
 rg -Fq 'wait_for_asr_prepare(asr_lease' src/integrations/macos/VocoTypeInputController.mm || \
   fail "macOS final ASR does not wait for recording-time preparation"
+mac_install=packaging/macos/install.command
+rg -Fq '"$OLD_TOOL" --disable "$IDENTIFIER"' "$mac_install" || \
+  fail "macOS installer does not disable the old input source before replacement"
+mac_copy_line=$(grep -nF 'ditto "$SOURCE_INPUT" "$INPUT_DESTINATION"' "$mac_install" | head -1 | cut -d: -f1)
+mac_final_kill_line=$(grep -nF 'pkill -f "$INPUT_DESTINATION/Contents/MacOS/VoCoTypeLinuxInputMethod"' "$mac_install" | tail -1 | cut -d: -f1)
+mac_final_activate_line=$(grep -nF '"$TOOL" --activate "$IDENTIFIER"' "$mac_install" | tail -1 | cut -d: -f1)
+if [[ -z "$mac_copy_line" || -z "$mac_final_kill_line" || -z "$mac_final_activate_line" ]] || \
+   (( mac_final_kill_line <= mac_copy_line || mac_final_activate_line <= mac_final_kill_line )); then
+  fail "macOS installer does not force a fresh InputMethod process after the final bundle is installed"
+fi
+for token in \
+  'Contents/MacOS/VoCoTypeLinuxInputMethod' \
+  '(void)run_task(@"/usr/bin/pkill", @[ @"-f", inputExecutable ], nil);' \
+  '输入法组件已安装，但最终进程重启失败'; do
+  rg -Fq "$token" src/integrations/macos/VocoTypeRuntime.mm || \
+    fail "macOS in-app upgrade does not enforce a final InputMethod process restart: $token"
+done
 for service in scripts/install/common/install-native-user.sh \
                packaging/common/systemd/vocotype-fcitx5-backend.service; do
   rg -Fq 'Restart=always' "$service" || \

src/integrations/macos/VocoTypeRuntime.mm

@@ -237,6 +237,29 @@ BOOL VocoTypeEnsureEmbeddedInputMethod(NSString **errorMessage) {
           toolOutput.length > 0 ? toolOutput : @"未知错误"];
     return NO;
   }
+
+  // TIS/InputMethodKit may start the input-method process as soon as the
+  // source is registered. Force one process boundary after the final bundle
+  // is fully in place so the process responsible for microphone access is
+  // guaranteed to match the final on-disk code signature. A stale process
+  // from an earlier bundle can make TCC identity attribution fail even though
+  // codesign verification of the replacement bundle succeeds.
+  NSString *inputExecutable = [destination stringByAppendingPathComponent:
+      @"Contents/MacOS/VoCoTypeLinuxInputMethod"];
+  (void)run_task(@"/usr/bin/pkill", @[ @"-f", inputExecutable ], nil);
+  [NSThread sleepForTimeInterval:0.2];
+  activated = run_task(
+      tool,
+      @[ @"--activate",
+         @"io.github.LeonardNJU.VoCoTypeLinux.InputMethod" ],
+      &toolOutput);
+  if (!activated) {
+    if (errorMessage)
+      *errorMessage = [NSString stringWithFormat:
+          @"输入法组件已安装，但最终进程重启失败。\n\n%@",
+          toolOutput.length > 0 ? toolOutput : @"未知错误"];
+    return NO;
+  }
   return YES;
 }