fix(native): recover unattended sync helper setup

apps/native/src-tauri/src/evolve/nixmac_ignore.rs

@@ -96,19 +96,9 @@ impl NixmacIgnoreChecker {
             return false;
         }
 
-        let ignored = matcher
+        matcher
             .matched_path_or_any_parents(relative_path, is_dir)
-            .is_ignore();
-
-        // This diagnostic is very noisy so it's commented out by default, but it's useful
-        // for validating the ignore rules.
-        // log::debug!(
-        //     "nixmac ignore check: {} (dir={}) => {}",
-        //     relative_path.display(),
-        //     is_dir,
-        //     ignored
-        // );
-        ignored
+            .is_ignore()
     }
 }
 

apps/native/src-tauri/src/feedback.rs

@@ -390,6 +390,7 @@ pub fn gather_app_state(app: &AppHandle, feedback_type: &str) -> Value {
         "configDir": config_dir,
         "hostAttr": host_attr,
         "feedbackType": feedback_type,
+        "helperFailure": crate::system::helper_permission::last_failure_detail(),
         "evolution": evolution_state,
         "timestamp": Utc::now().to_rfc3339(),
     })
@@ -849,6 +850,7 @@ regex = "token=([A-Za-z0-9]+)"
         let mut metadata = empty_metadata();
         metadata.current_app_state_snapshot = Some(json!({
             "token": "token=abc123",
+            "helperFailure": "SMAppServiceErrorDomain 1: token=abc123",
             "nested": { "value": "token=xyz" }
         }));
         metadata.ai_provider_model_info = Some(types::FeedbackAiProviderModelInfo {
@@ -868,6 +870,9 @@ regex = "token=([A-Za-z0-9]+)"
         assert!(redacted_fields.contains(&"ai_provider_model_info"));
 
         let state = metadata.current_app_state_snapshot.unwrap();
+        let helper_failure = state["helperFailure"].as_str().unwrap();
+        assert!(helper_failure.contains("SMAppServiceErrorDomain 1"));
+        assert!(!helper_failure.contains("abc123"));
         assert!(
             state
                 .get("token")

apps/native/src-tauri/src/orpc/darwin.rs

@@ -8,7 +8,7 @@ use crate::privileged_helper::{
 };
 use crate::shared_types::{
     AppManagementCheckResult, BuildCheckResult, EtcClobberCheckResult, EvolveCancelResult,
-    OkResult, RebuildStatus, RollbackResult,
+    HelperPermissionPhase, OkResult, RebuildStatus, RollbackResult,
 };
 use crate::system::helper_permission;
 use orpc::*;
@@ -75,6 +75,7 @@ struct InstallSyncAgentInput {
 #[serde(rename_all = "camelCase")]
 struct HelperReport {
     at_this_build: bool,
+    phase: HelperPermissionPhase,
     detail: String,
 }
 
@@ -85,7 +86,8 @@ impl HelperReport {
                 report,
                 crate::privileged_helper::reconcile::Reconciled::AtThisBuild
             ),
-            detail: helper_permission::describe(report),
+            phase: helper_permission::phase(report),
+            detail: helper_permission::action_detail(report),
         }
     }
 }
@@ -233,6 +235,14 @@ async fn helper_grant(ctx: OrpcCtx, _input: ()) -> Result<HelperReport, ORPCErro
     Ok(HelperReport::of(&helper_permission::grant(&ctx.app)))
 }
 
+/// Retry the stored decision without recording a new one or opening System
+/// Settings. A stored Enable retries as an explicit Enable; a stored Disable
+/// retries the removal; an undecided user is handled exactly like an
+/// observation, including adoption of a registration that already exists.
+async fn helper_retry(ctx: OrpcCtx, _input: ()) -> Result<HelperReport, ORPCError> {
+    Ok(HelperReport::of(&helper_permission::retry(&ctx.app)))
+}
+
 /// The explicit Disable action: unregister the helper (deferring while an
 /// activation runs) and
 /// register nothing. No later automatic run overrides it.
@@ -318,6 +328,9 @@ pub fn routes() -> Router<OrpcCtx> {
         "helperGrant" => os::<OrpcCtx>()
             .output(orpc_specta::specta::<HelperReport>())
             .handler(helper_grant),
+        "helperRetry" => os::<OrpcCtx>()
+            .output(orpc_specta::specta::<HelperReport>())
+            .handler(helper_retry),
         "helperDisable" => os::<OrpcCtx>()
             .output(orpc_specta::specta::<HelperReport>())
             .handler(helper_disable),