Fix three privacy and supply-chain issues

[L65FREAD]

Three independent fixes, one per commit, so they can be reviewed or cherry-picked separately. The first one is the urgent one.

1. Transcripts were being written to a world-readable log, permanently

Install.swift pointed the LaunchAgent's StandardErrorPath at /tmp/parrot.err.log, and Parrot.swift logged the full text of every completed transcription to stderr. Anyone who ran parrot install --launch-at-login has a plaintext record of every sentence they have ever dictated, in a world-readable directory, with no rotation and no size cap. This is worth telling existing users about directly.

• Transcript line now records timing and length only (→ 0.42s · 63 chars)
• New --echo-transcripts restores the full text; its help says the text will appear in logs
• It is deliberately not forwarded into the LaunchAgent's ProgramArguments, so the daemon can never be configured to log transcript text
• Generated plist now points both StandardOutPath and StandardErrorPath at /dev/null
• New parrot install --log-file opts into ~/Library/Logs/parrot.log, created 0600 before launchctl bootstrap
• Plist also sets Umask 127 — launchd recreates a missing std-path file at 0644, so without it the 0600 silently degrades the first time the log is deleted
• parrot install now warns about pre-existing /tmp/parrot.{out,err}.log, naming each path and its size. Never deletes silently; parrot install --purge-legacy-logs does that, and works standalone
• parrot doctor gains a legacy-logs check
• --dump-wav had the same bug at smaller scale (raw mic audio to /tmp/parrot-last.wav); now ~/Library/Caches/parrot/last-capture.wav at 0600 in a 0700 directory

2. The event tap subscribed to far more than it needed

The tap requested keyDown and keyUp alongside flagsChanged, then discarded everything but flagsChanged one line later. It was .listenOnly and nothing was done with the events, but --debug-hotkey printed the keycode of every event it saw.

• eventsOfInterest is now flagsChanged only, with a comment so it doesn't get widened back
• Removed the now-unreachable guard type == .flagsChanged and the parameter that existed only to serve it
• Debug output prints the raw flags bitmask and no longer reads keyboardEventKeycode
• --debug-hotkey's help no longer promises "every keyboard event the tap sees"
• Related bug, same file: .tapDisabledByTimeout / .tapDisabledByUserInput were handled by doing nothing, so the daemon could silently stop responding to the hotkey. Both now re-enable the tap and log a line

One thing to weigh: Secure Input engages on password fields, which a dictation daemon sits beside constantly, and a bare re-enable won't stick while it's active. Rate-limiting was left out to keep the diff scoped — happy to add it if you'd prefer.

3. The installer verified nothing it downloaded

scripts/install.sh resolved the latest tag, downloaded, extracted and installed with no integrity check, even though release.yml has always uploaded a .sha256 that nothing ever fetched.

• Downloads ${ASSET}.sha256 and verifies with shasum -a 256 -c before extracting; prints the digest; fails closed on mismatch or a missing checksum, with no unverified fallback
• Inspects the archive with tar -tzf first, rejecting anything that isn't exactly the member parrot, or that has an absolute or .. path
• PARROT_VERSION pins an exact tag (piping to sh leaves no way to pass arguments)
• The blanket xattr -d com.apple.quarantine was a no-op — curl doesn't set that attribute; it's applied by apps opting into LSFileQuarantineEnabled. It now reports whether there was anything to remove
• Made POSIX-clean so the documented | sh is honest: dropped set -o pipefail, and the tag lookup no longer pipes curl into grep, where a failed download was masked by grep's exit status. Keeps the | sh one-liner valid, so gh-pages/index.html needs no change
• release.yml adds actions/attest-build-provenance with id-token / attestations write. Note permissions: replaces rather than merges, so contents: write is re-declared — without that the release upload would start failing with a 403

On the honest limit: a checksum published in the same release as the artifact does not make the install trustworthy. It proves the download wasn't corrupted; whoever can replace the tarball can replace the .sha256 beside it. The attestation is the part that actually helps.

Why provenance is advisory rather than fail-closed: gh attestation verify requires the user to be logged in even for a public repo, and returns the same exit code for "no attestation exists", "your token expired", and a genuine verification failure (cli/cli#9338). No release before this change has an attestation, and v0.0.5 can never retroactively get one — so failing closed would make parrot uninstallable today for everyone who has gh installed. The checksum is the check that blocks. PARROT_REQUIRE_ATTESTATION=1 makes provenance failures fatal too.

Two things that need you

• gh-pages must be updated together. scripts/install.sh and the copy served at digimata.github.io/parrot/install.sh are currently byte-identical (2ca5a0b6…a936ee). I can't push to gh-pages, so this PR only changes the copy on master.
• Commit 2 will likely conflict with Configurable hotkey, paste-based injection, overlay above full-screen #4 and Add a persistent, menu-configurable push-to-talk key #7, which both rewrite hotkey handling.

Verified / not verified

Tested: fresh install writes /dev/null for both path keys; --log-file produces -rw-------; doctor warns with a legacy log present and passes without one; --purge-legacy-logs exits 0 standalone (it previously hit the "specify exactly one of" guard and exited 64). Installer, against both a local server and the real v0.0.5 release: a tampered tarball, a missing .sha256, and an archive with an extra member each exit 1 with nothing installed; PARROT_VERSION=v0.0.5 installs that tag and its digest matches the published one. All three commits build independently with swift build -c release.

Not tested: the Fn press/release path with --debug-hotkey, which needs Accessibility granted and a physical keypress — the narrowing is verified by inspection instead (no keyDown/keyUp subscription and no keyboardEventKeycode read remain). And the attestation itself can't be exercised until a tag is built by the updated workflow.

One correction to how this is easy to describe: --debug-hotkey will still emit a line when you type a capital letter, because Shift is itself a flagsChanged event. What's gone is any keycode, and any output for plain character keys.

Nothing under UI/, Transcription/, or AudioCapture.swift's capture path was touched. No new dependencies.

Unrelated, spotted while working and left alone: README.md documents parrot --hotkey right-option, but no such flag exists on Run — possibly documented ahead of #4/#7.

---

Claude was used heavily for this work.

[FernandoGomes83]

Field report from running this PR in a fork, one real regression: the Umask key in the LaunchAgent plist applies to everything the daemon creates, not just the log. WhisperKit/HubApi model downloads create their cache directories under the daemon's umask, so with Umask = 127 every new directory is born 0600 — no execute bit — and the next write inside it fails with EACCES (NSCocoaErrorDomain 513 / NSPOSIXErrorDomain 13 from downloadBase). Symptom: any model download triggered from inside the daemon fails; downloads from a terminal work, which makes it look intermittent.

What we settled on: drop Umask entirely and rely on prepareLogFile pre-creating the log 0600 (every install rewrite re-tightens it). The one gap — launchd recreating a deleted log at 0644 — seemed acceptable since the log never holds transcript text by this PR's own design. An alternative if 0600 must be unconditional: have the daemon chmod its own log at startup instead of using umask.