Phase 2: Transparent traffic capture via pf redirect

.github/workflows/build.yml

@@ -27,10 +27,32 @@ jobs:
           name: native-bridge
           path: native/build/libAgentTapBridge.dylib
 
+  build-helper:
+    name: Build Privileged Helper
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build universal helper
+        run: cd native && make build-helper
+
+      - name: Verify helper architectures
+        run: |
+          lipo -info native/build/com.geiserx.agenttap.helper
+          file native/build/com.geiserx.agenttap.helper
+
+      - name: Upload helper artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: privileged-helper
+          path: |
+            native/build/com.geiserx.agenttap.helper
+            native/Helper/Launchd.plist
+
   build-app:
     name: Build ElectroBun App
     runs-on: macos-14
-    needs: build-native
+    needs: [build-native, build-helper]
     steps:
       - uses: actions/checkout@v4
 
@@ -48,12 +70,35 @@ jobs:
           name: native-bridge
           path: native/build/
 
+      - name: Download privileged helper
+        uses: actions/download-artifact@v4
+        with:
+          name: privileged-helper
+          path: native/
+
       - name: Build app
         run: bun run build
 
+      - name: Embed helper in app bundle
+        run: |
+          APP_DIR=$(find build/ -name "*.app" -maxdepth 2 | head -1)
+          if [ -n "$APP_DIR" ]; then
+            mkdir -p "$APP_DIR/Contents/MacOS"
+            mkdir -p "$APP_DIR/Contents/Library/LaunchDaemons"
+            cp native/build/com.geiserx.agenttap.helper "$APP_DIR/Contents/MacOS/"
+            cp native/Helper/Launchd.plist "$APP_DIR/Contents/Library/LaunchDaemons/com.geiserx.agenttap.helper.plist"
+            echo "Helper embedded in: $APP_DIR"
+          else
+            echo "Warning: No .app bundle found in build/"
+          fi
+
+      - name: List build output
+        if: always()
+        run: ls -la build/ 2>/dev/null || echo "build/ not found"; ls -la .build/ 2>/dev/null || echo ".build/ not found"
+
       - name: Upload app artifact
         uses: actions/upload-artifact@v4
         with:
           name: agenttap-macos
-          path: .build/
+          path: build/
           if-no-files-found: error

.github/workflows/release.yml

@@ -0,0 +1,207 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release (e.g., 0.2.0)'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Build and Release
+    runs-on: macos-14
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.12"
+
+      - name: Determine version
+        id: version
+        run: |
+          if [ -n "${{ github.event.inputs.version }}" ]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/v}"
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Building version: $VERSION"
+
+      - name: Sync version from tag
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          echo "Syncing all version references to $VERSION"
+
+          # electrobun.config.ts
+          sed -i '' "s/version: \".*\"/version: \"$VERSION\"/" electrobun.config.ts
+
+          # package.json
+          sed -i '' "s/\"version\": \".*\"/\"version\": \"$VERSION\"/" package.json
+
+          # src/bun/index.ts startup log
+          sed -i '' "s/Starting v[0-9.]*\.\.\./Starting v$VERSION.../" src/bun/index.ts
+
+          echo "Versions synced:"
+          grep -n 'version' electrobun.config.ts | head -1
+          grep -n '"version"' package.json | head -1
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build Swift FFI bridge (universal)
+        run: cd native && make universal
+
+      - name: Build privileged helper (universal)
+        run: cd native && make build-helper
+
+      - name: Build ElectroBun app
+        run: bun run build
+
+      - name: Embed helper in app bundle
+        run: |
+          APP_DIR=$(find build/ -name "*.app" -maxdepth 2 | head -1)
+          if [ -z "$APP_DIR" ]; then
+            echo "Error: No .app bundle found"
+            exit 1
+          fi
+          mkdir -p "$APP_DIR/Contents/MacOS"
+          mkdir -p "$APP_DIR/Contents/Library/LaunchDaemons"
+          cp native/build/com.geiserx.agenttap.helper "$APP_DIR/Contents/MacOS/"
+          cp native/Helper/Launchd.plist "$APP_DIR/Contents/Library/LaunchDaemons/com.geiserx.agenttap.helper.plist"
+          echo "Helper embedded in: $APP_DIR"
+
+      - name: Rename app for release
+        id: app
+        run: |
+          APP_DIR=$(find build/ -name "*.app" -maxdepth 2 | head -1)
+          PARENT=$(dirname "$APP_DIR")
+          RELEASE_APP="$PARENT/AgentTap.app"
+          if [ "$APP_DIR" != "$RELEASE_APP" ]; then
+            mv "$APP_DIR" "$RELEASE_APP"
+          fi
+          echo "app_dir=$RELEASE_APP" >> $GITHUB_OUTPUT
+
+      - name: Ad-hoc codesign
+        run: codesign --force --deep --sign - "${{ steps.app.outputs.app_dir }}"
+
+      - name: Create DMG
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          mkdir -p dist
+          DMG_DIR=$(mktemp -d)
+          cp -R "${{ steps.app.outputs.app_dir }}" "$DMG_DIR/"
+          ln -s /Applications "$DMG_DIR/Applications"
+          hdiutil create -volname "AgentTap" -srcfolder "$DMG_DIR" -ov -format UDZO "dist/AgentTap-${VERSION}.dmg"
+          rm -rf "$DMG_DIR"
+          echo "DMG created: dist/AgentTap-${VERSION}.dmg"
+
+      - name: Calculate SHA256
+        id: sha
+        run: |
+          SHA256=$(shasum -a 256 dist/AgentTap-${{ steps.version.outputs.version }}.dmg | awk '{print $1}')
+          echo "sha256=$SHA256" >> $GITHUB_OUTPUT
+          echo "SHA256: $SHA256"
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          VERSION="v${{ steps.version.outputs.version }}"
+          PREV_TAG=$(git tag -l "v*" --sort=-version:refname | sed -n '2p')
+
+          if [ -z "$PREV_TAG" ]; then
+            PREV_TAG=$(git rev-list --max-parents=0 HEAD)
+          fi
+
+          {
+            echo "## What's Changed"
+            echo ""
+
+            FEATURES=$(git log $PREV_TAG..HEAD --pretty=format:"- %s" --grep="^feat" 2>/dev/null || true)
+            if [ -n "$FEATURES" ]; then
+              echo "### Features"
+              echo "$FEATURES" | head -20
+              echo ""
+            fi
+
+            FIXES=$(git log $PREV_TAG..HEAD --pretty=format:"- %s" --grep="^fix" 2>/dev/null || true)
+            if [ -n "$FIXES" ]; then
+              echo "### Bug Fixes"
+              echo "$FIXES" | head -20
+              echo ""
+            fi
+
+            OTHERS=$(git log $PREV_TAG..HEAD --pretty=format:"- %s" --invert-grep --grep="^feat" --invert-grep --grep="^fix" 2>/dev/null | head -10 || true)
+            if [ -n "$OTHERS" ]; then
+              echo "### Other Changes"
+              echo "$OTHERS"
+              echo ""
+            fi
+
+            echo "---"
+            echo ""
+            echo "## Installation"
+            echo ""
+            echo "### Homebrew (recommended)"
+            echo '```bash'
+            echo "brew tap geiserx/agenttap"
+            echo "brew install --cask agenttap"
+            echo '```'
+            echo ""
+            echo "### Manual Download"
+            echo "Download \`AgentTap-${{ steps.version.outputs.version }}.dmg\` from the assets below."
+            echo ""
+            echo "---"
+            echo ""
+            echo "**SHA256:** \`${{ steps.sha.outputs.sha256 }}\`"
+            echo ""
+            echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/$PREV_TAG...$VERSION"
+          } > changelog.md
+
+          cat changelog.md
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ steps.version.outputs.version }}
+          name: "AgentTap v${{ steps.version.outputs.version }}"
+          body_path: changelog.md
+          draft: false
+          prerelease: false
+          files: |
+            dist/AgentTap-${{ steps.version.outputs.version }}.dmg
+
+      - name: Update Homebrew Cask
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          SHA256="${{ steps.sha.outputs.sha256 }}"
+
+          git clone "https://x-access-token:${{ secrets.HOMEBREW_TAP_TOKEN }}@github.com/GeiserX/homebrew-agenttap.git" homebrew-tap
+          cd homebrew-tap
+
+          sed -i '' "s/version \".*\"/version \"$VERSION\"/" Casks/agenttap.rb 2>/dev/null || \
+          sed -i "s/version \".*\"/version \"$VERSION\"/" Casks/agenttap.rb
+
+          sed -i '' "s/sha256 .*/sha256 \"$SHA256\"/" Casks/agenttap.rb 2>/dev/null || \
+          sed -i "s/sha256 .*/sha256 \"$SHA256\"/" Casks/agenttap.rb
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Casks/agenttap.rb
+          git diff --staged --quiet || git commit -m "Update agenttap to v$VERSION"
+          git push
+
+          echo "Homebrew cask updated to v$VERSION"

.gitignore

@@ -1,7 +1,9 @@
 # Build
 .build/
+build/
 node_modules/
 dist/
+Casks/
 
 # macOS
 .DS_Store