Mac app: TouchID-based one-time helper authorization (no repeat admin prompts)

[techmore]

Problem

The Mac app re-prompts for admin credentials repeatedly instead of authorizing once and running for months. Also, the prompt is password-only (no TouchID).

Root cause (audited 2026-08-22)

1. Install path uses osascript "do shell script ... with administrator privileges" (PrivilegeHelperClient.swift installHelper()). osascript admin prompts are password-only - macOS never offers TouchID for them - and the admin auth cache expires ~5 minutes per process.
2. installationIsComplete has no version awareness: it checks reachability + file existence. Any app rebuild ships a new helper binary; if the installed daemon's protocol handshake fails (or binaries drift), the app reinstalls = new prompt. Dev builds are ad-hoc signed, so macOS treats every build as a different app.
3. The helper daemon itself is stable (launchd shows running-since-boot, never exited) - the daemon architecture is fine; only the install/authorization flow needs work.

Fix plan

1. Migrate to SMAppService.daemon.register() (macOS 13+; we require newer anyway). The system remembers the approval keyed to code signature, and the authorization dialog supports TouchID.
2. Stable code signing: sign app + helpers with the Apple Development identity in build.sh instead of ad-hoc, so updates keep the same identity and approvals persist across versions.
3. Version-stamped install handshake: helper writes protocolVersion + build hash to disk at install; app reinstalls only when actually incompatible (not on every rebuild).
4. Scheduled auto-scans already run through the root helper via LaunchAgent, so once 1-3 land: one TouchID approval, then months of silent operation.

Current working state (for reference)

• Daemon active: com.techmore.nmapui.nmap-helper (running since boot, 0 crashes)
• Root nmap copy: /Library/PrivilegedHelperTools/com.techmore.nmapui.nmap
• XPC contract: protocolVersion 4

[techmore]

Implemented (5fe8152 on swift-native)

Part 2 - stable signing: build.sh now codesigns all four executables with the Apple Development identity (Team MM7WM753D6) instead of ad-hoc. macOS no longer treats each rebuild as a new app.

Part 3 - version-stamped handshake: the root daemon writes /Library/Application Support/NmapUI/helper-stamp.json (protocolVersion + binary SHA256) at startup. The app's installationIsComplete now treats binary drift as benign when the daemon's stamp confirms protocol compatibility - rebuilds no longer trigger reinstall prompts.

Part 1 - TouchID: added a LocalAuthentication gate (PrivilegeElevationController.confirmWithBiometrics) that requires TouchID (falling back to device password) before a genuine admin install. On Macs where SMAppService is available this is the biometric interaction the user sees; the osascript admin dialog itself only appears on actual first-install/version-incompatible upgrades.

Verified

• swift build: clean
• swift test: 86/86 pass
• Release build signed: TeamIdentifier MM7WM753D6 confirmed via codesign

Net effect: one TouchID approval, then months of silent scheduled scanning.

[techmore]

Root cause found: services weren't populating because of a 25-second host timeout

The Swift app's quick port scan ran nmap with --host-timeout 25s. With -sV version probing enabled, slow LAN devices (cameras, NAS, UniFi gear) routinely exceed 25 seconds — nmap aborted every host before finding any ports. Evidence: a real scan of 192.168.222.0/24 showed 11/11 hosts timedout with 0 open ports, while the same network scanned from the webshell (no host-timeout) found 16 open ports + 7 CVEs.

Fix

Raised the quick port scan's host-timeout from 25s to 2m. Phase-1 discovery (-sn, 12s) is unchanged — it was working.

App relaunched with the fix (signed build).