[Jish2]

The work Mac's VM–Mac bridge currently needs a manually started helper and stops when its SSH transport disconnects. Enable fleet.vmMacBridge for work so a Home Manager login agent opens the approval helper in Terminal at graphical login, reconnects to the existing devspace SSH alias, and fetches the latest upstream helper before each start or reconnect.

Every command retains Mac-local approval through notification actions or full review in the terminal. The local lock prevents a second helper from starting; Ctrl-C stops it. Requests keep their async polling, approval expiry, and separate execution timeout.

The module builds pinned terminal-notifier 3.1.0, then Home Manager installs and signs the dedicated app in ~/Applications before starting the login agent. Its bundle ID matches the existing bridge app, giving it its own macOS notification settings. Notification permission and Alerts/Banners remain one-time macOS choices.

The launcher tracks jgoon/vm-mac-bridge's main branch in an app-owned checkout on the Mac. Bridge updates take effect on startup/reconnect without a Nix rebuild; a running helper picks them up on its next restart or reconnect. The terminal reports the revision it starts. Git operations have a 60-second timeout, preserve local edits, and retry failed updates without starting stale cached code.

Runtime Git access uses the Mac user's existing Enterprise GitHub authentication. Nix builds need the local launcher and public notifier source. The VM's compatible transport script and the Mac's working devspace SSH alias remain prerequisites. Usage, migration, and update behavior are documented in .config/nix.

Project decisions, deployment state, and live bridge validation are recorded in the project handoff.

Validation:

• All 18 source-update/startup/app-installation tests pass. Temporary local Git repositories cover initial clone, new commits, rewritten main history, failed fetches, partial-clone cleanup, and preserving local edits. Startup and app-installation tests cover duplicate startup, reconnect/stop behavior, and preserving the previous app on signing or registration failure.
• The checks.x86_64-linux.vm-mac-bridge Nix build passes.
• The full work Mac system derivation evaluates successfully; configuration checks confirm the agent is enabled on work and absent on personal/mini.
• The pinned notifier source downloads and passes its fixed SHA-256 hash check.
• Live manual Mac helper checks pass: immediate async submission, polling timeouts without cancellation, approval delayed beyond two minutes, a 10-second expiry without execution, and blocking submission returning Darwin. These checks do not validate the Nix login agent or runtime update.

Draft pending a native macOS build and validation of Enterprise GitHub access, Terminal startup, codesigning, and notification approval. No machine configuration has been applied. After validation/merge, stop the old manual helper and apply on the work Mac with make here from ~/.config/nix.

[github-actions]

Claude review: skipped (draft). It will run once the PR is marked ready for review.