fix: renew official Accessibility access after uninstall

[singkia]

Summary

Restoring the official ChatGPT bundle can leave Accessibility tied to the removed ad-hoc signature. Default uninstall now reopens the verified official app, checks the target process, preserves valid access, and guides renewal only when access is denied. The CLI automatically checks completion for two minutes and distinguishes restored files from unfinished permission setup.

Safety Review

• Applies only to the default /Applications/ChatGPT.app; explicit --app and --clone targets do not start the handoff.
• Existing dry-run and confirmation boundaries remain. The printed plan includes the permission handoff.
• Holds the target lock, verifies the official signature before launch and again before reset, and uses the target PID/audit-token probe rather than the CLI's permission.
• Unknown identities and missing startup windows cannot trigger reset. A denied registration is reset only for Accessibility and com.openai.codex; same-ID copies share that registration boundary.
• System Settings performs authorization. No TCC database edits or silent grants; failed or unfinished renewal never rolls back successful file restoration.

Tests

• Failing repro commits precede implementation: seven original regressions plus three handoff/recovery regressions.
• cargo test --workspace --release — passed on macOS.
• cargo clippy --workspace --all-targets --locked -- -D warnings — passed.
• Live default install/uninstall: valid official authorization survives restoration without renewal.
• Live denied-after-restoration renewal: patched host granted → uninstall → verified official app denied → targeted reset → real Finder file drag → automatic CLI success and official target granted. No password dialog was observed in this run.
• Earlier timeout trial correctly reported unfinished permission setup while retaining the restored official bundle.

Safety-related changes

Default uninstall now reopens the restored app and, only after a confirmed denial, clears its invalid Accessibility registration and opens System Settings/Finder. macOS may require user authentication. The CLI does not handle credentials or alter official session databases.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T06:49:53.731110Z	aad7ab2	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[singkia]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: aad7ab2230

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".