macOS Notification Watcher POC

Status

POC implementation is built but not yet authorized to read Notification Center. Resume after granting Full Disk Access.

Artifacts

Project: ~/notification-poc
Binary: ~/notification-poc/notification-poc
Source: ~/notification-poc/Sources/NotificationPOC/main.swift
Log: ~/notification-poc/notifications.jsonl
State: ~/notification-poc/state.json
LaunchAgent: ~/Library/LaunchAgents/com.adolforeyna.notification-poc.plist
README: ~/notification-poc/README.md

Behavior

The watcher monitors ~/Library/Group Containers/group.com.apple.usernoted/db2/db, primarily via db-wal filesystem events with a two-second fallback scan. It copies db, db-wal, and db-shm to a temporary directory before read-only SQLite access, baselines existing records on first successful run, and logs only later notifications as JSONL. It does not modify, dismiss, forward, or send notifications.

Verification so far

Swift release build passed.
plutil -lint passed for the LaunchAgent.
Runtime reached the expected TCC boundary: macOS returned permission denied for the database.
Persistent LaunchAgent bootstrap was not run because Hermes blocks registering persistent jobs from inside the gateway process.

Resume steps

In System Settings → Privacy & Security → Full Disk Access, add/enable ~/notification-poc/notification-poc.
Run the binary manually and verify it prints Watching and creates/updates notifications.jsonl.
Generate a harmless test notification and confirm one JSONL record.
Install from a separate shell with: launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.adolforeyna.notification-poc.plist.
Verify with launchctl print gui/$(id -u)/com.adolforeyna.notification-poc and inspect watcher stderr/stdout logs.

1.8 KiB Raw Permalink Blame History