Surface daemon registration and XPC errors instead of swallowing them

Adds LockInLog (Console + stderr) and routes register/unregister/ping
through it with the real domain+code. An enabled-but-unreachable daemon
now reports that its launchd job is out of sync rather than a vague
'not responding'. Also self-deregisters the daemon when its app bundle
is gone (checked at startup and hourly), so an orphaned root daemon
cleans itself up.

Author: HumbleBee14

App/DaemonClient.swift

@@ -29,9 +29,16 @@ final class DaemonClient: Sendable {
     func ping() async -> Bool {
         await withCheckedContinuation { cont in
             let c = connection()
-            let proxy = c.remoteObjectProxyWithErrorHandler { _ in cont.resume(returning: false) }
-                as? LockInDaemonProtocol
-            proxy?.getVersion { version in cont.resume(returning: version == LockInVersion.current) }
+            let proxy = c.remoteObjectProxyWithErrorHandler { err in
+                LockInLog.error("daemon ping connection failed (service unreachable)", err)
+                cont.resume(returning: false)
+            } as? LockInDaemonProtocol
+            proxy?.getVersion { version in
+                if version != LockInVersion.current {
+                    LockInLog.error("daemon ping: version mismatch app=\(LockInVersion.current) daemon=\(version)")
+                }
+                cont.resume(returning: version == LockInVersion.current)
+            }
         }
     }
 

App/InstallerService.swift

@@ -18,30 +18,44 @@ final class InstallerService: ObservableObject {
     }
 
     func unregisterAll() {
-        try? daemon.unregister()
-        try? agent.unregister()
+        do { try daemon.unregister() } catch { LockInLog.error("daemon.unregister failed", error) }
+        do { try agent.unregister() } catch { LockInLog.error("agent.unregister failed", error) }
         refreshStatus()
+        LockInLog.info("unregisterAll done — daemon=\(Self.describe(daemonStatus)) agent=\(Self.describe(agentStatus))")
     }
 
     // the agent registers cleanly only after the daemon is approved; called repeatedly by the poll
     func registerAgentIfDaemonReady() {
         refreshStatus()
         guard daemonStatus == .enabled else { return }
         if agentStatus == .notRegistered || agentStatus == .notFound {
-            try? agent.register()
+            do { try agent.register() } catch { LockInLog.error("agent.register failed", error) }
             refreshStatus()
         }
     }
 
     // required website-blocking helper; re-registers a stale enabled job that no longer answers
     func registerDaemon(alive: Bool) {
         refreshStatus()
+        LockInLog.info("registerDaemon(alive: \(alive)) — current status=\(Self.describe(daemonStatus))")
         if daemonStatus == .enabled && !alive {
-            try? daemon.unregister()
+            do { try daemon.unregister() }
+            catch { LockInLog.error("daemon.unregister (stale) failed", error); lastError = humanError(error); return }
             refreshStatus()
         }
-        if daemonStatus == .enabled { openLoginItems(); return }
-        do { try daemon.register() } catch { lastError = humanError(error) }
+        if daemonStatus == .enabled {
+            lastError = "macOS reports the service as installed but it isn’t running — its background record is out of sync. Restart your Mac to rebuild it."
+            LockInLog.error("daemon enabled but not alive — launchd job desynced from registration")
+            openLoginItems()
+            return
+        }
+        do {
+            try daemon.register()
+            LockInLog.info("daemon.register() succeeded — status now \(Self.describe(daemon.status))")
+        } catch {
+            LockInLog.error("daemon.register() failed", error)
+            lastError = humanError(error)
+        }
         refreshStatus()
     }
 
@@ -79,8 +93,8 @@ final class InstallerService: ObservableObject {
     private func humanError(_ error: Error) -> String {
         let ns = error as NSError
         if ns.domain == "SMAppServiceErrorDomain" && ns.code == 1 {
-            return "macOS blocked registration. A previous install may be stuck — reset background items in System Settings → Login Items and try again."
+            return "macOS blocked registration (a previous install is stuck). Restart your Mac, then open LockIn again. (\(ns.domain) \(ns.code))"
         }
-        return ns.localizedDescription
+        return "\(ns.localizedDescription) (\(ns.domain) \(ns.code))"
     }
 }

App/Models/InstallGate.swift

@@ -51,9 +51,12 @@ final class InstallGate: ObservableObject {
                 installer.lastError = "Website blocking isn’t approved yet. Tap Approve above, then allow it in System Settings."
                 return
             }
-            guard await pingWithRetry() else {
-                installer.lastError = "Approved, but the blocker isn’t responding yet. Wait a moment and tap Continue again."
-                return
+            if await pingWithRetry() == false {
+                installer.registerDaemon(alive: false)
+                guard await pingWithRetry() else {
+                    installer.lastError = "Couldn’t start the background service. Quit LockIn and reopen it; if it persists, restart your Mac."
+                    return
+                }
             }
             showingInstall = false
             if let action = pendingAction {

Daemon/main.swift

@@ -1,4 +1,5 @@
 import Foundation
+import ServiceManagement
 import LockInDaemonCore
 
 @MainActor
@@ -8,11 +9,16 @@ final class DaemonRuntime {
     private var powerNotifier: PowerNotifier?
     private var timer: Timer?
 
+    // .../LockIn.app/Contents/MacOS/lockind -> .../LockIn.app
+    private let appBundlePath = URL(fileURLWithPath: CommandLine.arguments[0])
+        .deletingLastPathComponent().deletingLastPathComponent().deletingLastPathComponent().path
+
     init() {
         listener = DaemonListener(controller: controller)
     }
 
     func start() {
+        selfCleanIfOrphaned()
         listener.start()
         evaluate()
         powerNotifier = PowerNotifier(onWake: { [weak self] in
@@ -27,8 +33,19 @@ final class DaemonRuntime {
         timer = t
     }
 
+    private var ticksSinceOrphanCheck = 0
+
     private func evaluate() {
         controller.applyDecisionIfNeeded(timeResolved: controller.timeIsResolved())
+        ticksSinceOrphanCheck += 1
+        if ticksSinceOrphanCheck >= 720 { ticksSinceOrphanCheck = 0; selfCleanIfOrphaned() }
+    }
+
+    private func selfCleanIfOrphaned() {
+        guard controller.isOrphaned(appBundlePath: appBundlePath) else { return }
+        _ = controller.prepareUninstall()
+        try? SMAppService.daemon(plistName: "lockind.plist").unregister()
+        exit(0)
     }
 }
 

DaemonCore/Lock/BlockController.swift

@@ -193,14 +193,19 @@ public final class BlockController {
     }
 
     // root-side cleanup for uninstall: reset hosts, clear snapshots + root config. Refused while locked.
-    func prepareUninstall() -> Bool {
+    public func prepareUninstall() -> Bool {
         if isLockHeld() { return false }
         let ok = blocker.resetToSystemDefault()
         try? snapshotStore.clear()
         try? configStore.save(ScheduleConfig(rules: []))
         return ok
     }
 
+    // invariant: self-clean only when the app bundle is gone AND no lock is held — never tears down a live lock
+    public func isOrphaned(appBundlePath: String) -> Bool {
+        !FileManager.default.fileExists(atPath: appBundlePath) && !isLockHeld()
+    }
+
     // invariant: corroborate the snapshot set against live pf/hosts so deleting active.plist can't unlock teardown
     private func isLockHeld() -> Bool {
         if !snapshotStore.load().isEmpty { return true }

Shared/LockInLog.swift

@@ -0,0 +1,20 @@
+import Foundation
+import os
+
+enum LockInLog {
+    private static let log = Logger(subsystem: "com.humblebee.lockin", category: "lockin")
+
+    static func info(_ message: String) {
+        log.info("\(message, privacy: .public)")
+        FileHandle.standardError.write(Data("[LockIn] \(message)\n".utf8))
+    }
+
+    static func error(_ message: String, _ error: Error? = nil) {
+        let detail = error.map { e -> String in
+            let ns = e as NSError
+            return " — \(ns.domain) \(ns.code): \(ns.localizedDescription)"
+        } ?? ""
+        log.error("\(message, privacy: .public)\(detail, privacy: .public)")
+        FileHandle.standardError.write(Data("[LockIn] ERROR \(message)\(detail)\n".utf8))
+    }
+}