fix(env): stop shipping the development profile

A Vite define is text substitution, so passing an object emitted an
object literal where a string was expected; JSON.parse threw and the
catch silently loaded env.development.json. Every release therefore
ran its frontend with VITE_NIXMAC_SKIP_PERMISSIONS on, disabling the
permissions gate. Confirmed against a CI production bundle.

- one object-valued define, validated and coerced at build time, and
  no fallback: a bad profile fails the build, or throws at startup
- NIXMAC_ENV only selects a profile and no longer overwrites the
  selected file's own value; unknown selectors fail the build instead
  of falling through to development
- a prod profile refuses the skip-permissions and nix-installed
  bypasses whatever the profile asks for
- Rust resolves the environment through one path instead of three
- prerequisite steps are gated on onboarding being unfinished, so a
  missing permission after setup is a banner, not an internal error
- an inconclusive Full Disk Access probe no longer counts against the
  required-permission gate

Author: alex-sparus

.cursor/rules/native-env.mdc

@@ -8,7 +8,7 @@ alwaysApply: false
 
 **Do not use `process.env` or `import.meta.env` anywhere except `apps/native/src/lib/env.ts`.**
 
-All app code reads deployment settings through exports from that module (`settings`, `nixmacEnvironment`, `getProfileValue`, etc.).
+All app code reads deployment settings through exports from that module (`settings`, `nixmacEnvironment`, `nixmacVersion`, `isE2eProfile`).
 
 Benefits: single validation path, typed profile JSON, no scattered env reads, and build-time profile baking stays consistent with Rust (`build.rs`).
 

.github/workflows/build.yaml

@@ -87,7 +87,7 @@ jobs:
         working-directory: apps/native
         run: cargo test --manifest-path src-tauri/Cargo.toml
         env:
-          NIXMAC_ENV: production
+          NIXMAC_ENV: prod
   build:
     needs: rust-tests
     runs-on: [self-hosted, macOS]

apps/native/env.release.json

@@ -1,6 +1,6 @@
 {
   "$schema": "src-tauri/resources/schemas/env.schema.json",
-  "NIXMAC_ENV": "production",
+  "NIXMAC_ENV": "prod",
   "VITE_SERVER_URL": "https://nixmac.com",
   "VITE_POSTHOG_HOST": "https://us.i.posthog.com",
   "VITE_POSTHOG_KEY": "phc_qQ8JdjX8fo6Viodke6c4hm2Wb3ohKW3JuMUX3CjeyUcp",

apps/native/nixmac-profile.ts

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
+import { EnvProfileSchema, NIXMAC_ENVS } from "./src/lib/env-profile-schema";
 
 type NixmacProfileName = "development" | "release" | "e2e";
 
@@ -8,16 +9,26 @@ function readProfileJson(nativeAppDir: string, name: NixmacProfileName): Record<
   return JSON.parse(raw) as Record<string, unknown>;
 }
 
-/** Profile file selection — keep in sync with `apps/native/src-tauri/build.rs`. */
+/**
+ * Profile file selection — keep in sync with `apps/native/src-tauri/build.rs`.
+ *
+ * Unset means development. Any other value is a mistake in the build command,
+ * not a request for the default: falling through used to bake the development
+ * profile, permission checks disabled, into a build that looked like a release.
+ */
 function resolveNixmacProfile(): NixmacProfileName {
-  switch (process.env.NIXMAC_ENV ?? "development") {
+  const selector = process.env.NIXMAC_ENV ?? "development";
+  switch (selector) {
+    case "development":
+      return "development";
     case "prod":
-    case "production":
       return "release";
     case "e2e":
       return "e2e";
     default:
-      return "development";
+      throw new Error(
+        `NIXMAC_ENV must be unset or one of ${NIXMAC_ENVS.join(", ")}; got ${JSON.stringify(selector)}`,
+      );
   }
 }
 
@@ -65,6 +76,15 @@ const OVERRIDABLE_PREFIXES = [
   "NIX_INSTALLED_",
 ] as const;
 
+/**
+ * Keys process env must never overwrite.
+ *
+ * `NIXMAC_ENV` picks which profile file to read; letting it also overwrite that
+ * file's own `NIXMAC_ENV` value made the two disagree — `NIXMAC_ENV=prod` stored
+ * "prod" where `env.release.json` said "production". A selector is not a setting.
+ */
+const NON_OVERRIDABLE_KEYS = new Set(["$schema", "NIXMAC_ENV"]);
+
 function isOverridableKey(key: string): boolean {
   return OVERRIDABLE_PREFIXES.some((prefix) => key.startsWith(prefix));
 }
@@ -80,7 +100,8 @@ function mergeProfileWithProcessEnv(
   const merged: Record<string, unknown> = { ...base };
 
   for (const [key, envValue] of Object.entries(process.env)) {
-    if (key === "$schema" || envValue === undefined || envValue.trim() === "") continue;
+    if (NON_OVERRIDABLE_KEYS.has(key) || envValue === undefined || envValue.trim() === "")
+      continue;
     if (!(key in merged) && !isOverridableKey(key)) continue;
     merged[key] = coerceEnvOverride(merged[key], envValue);
   }
@@ -101,11 +122,17 @@ function resolveMergedProfile(nativeAppDir: string): Record<string, unknown> {
   return mergeProfileWithProcessEnv(base, nativeAppDir);
 }
 
+/**
+ * Vite `define` entries that bake the selected profile into the bundle.
+ *
+ * A define is raw text substitution, so this emits a JavaScript object literal
+ * that `src/lib/env.ts` consumes directly: no string to parse, and therefore no
+ * parse for a bad profile to fall back from. Validating and coercing here means
+ * an invalid profile fails the build instead of the app.
+ */
 export function nixmacBuildDefines(nativeAppDir: string): Record<string, string> {
-  const profileName = resolveNixmacProfile();
-  const merged = resolveMergedProfile(nativeAppDir);
+  const profile = EnvProfileSchema.parse(resolveMergedProfile(nativeAppDir));
   return {
-    __NIXMAC_PROFILE__: JSON.stringify(profileName),
-    __NIXMAC_PROFILE_JSON__: JSON.stringify(merged),
+    __NIXMAC_PROFILE_DATA__: JSON.stringify(profile),
   };
 }

apps/native/src-tauri/build.rs

@@ -7,13 +7,21 @@ use std::path::Path;
 use std::process::Command;
 
 /// Embed `apps/native/env.{development,release,e2e}.json` selected by `NIXMAC_ENV`.
+///
+/// Accepted values must stay in sync with `apps/native/nixmac-profile.ts`.
+/// Unset means development; anything else stops the build. Falling through to
+/// the development profile is how a mistyped selector used to produce a build
+/// that looked like a release but carried the development profile.
 fn embed_build_profile() {
     let native_app_dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("..");
-    let profile = std::env::var("NIXMAC_ENV").unwrap_or_else(|_| "development".to_string());
-    let file = match profile.as_str() {
-        "prod" | "production" => "env.release.json",
+    let selector = std::env::var("NIXMAC_ENV").unwrap_or_else(|_| "development".to_string());
+    let file = match selector.as_str() {
+        "development" => "env.development.json",
+        "prod" => "env.release.json",
         "e2e" => "env.e2e.json",
-        _ => "env.development.json",
+        other => panic!(
+            "NIXMAC_ENV must be unset or one of development, prod, e2e; got {other:?}"
+        ),
     };
     let path = native_app_dir.join(file);
 
@@ -25,11 +33,14 @@ fn embed_build_profile() {
         );
     }
 
-    let json = std::fs::read_to_string(&path).unwrap_or_else(|_| "{}".to_string());
-    let minified = serde_json::from_str::<serde_json::Value>(&json)
-        .ok()
-        .and_then(|value| serde_json::to_string(&value).ok())
-        .unwrap_or_else(|| "{}".to_string());
+    // An unreadable or malformed profile stops the build. Degrading to "{}"
+    // compiles an app whose every setting silently falls back to its default.
+    let json = std::fs::read_to_string(&path)
+        .unwrap_or_else(|error| panic!("cannot read {}: {error}", path.display()));
+    let value: serde_json::Value = serde_json::from_str(&json)
+        .unwrap_or_else(|error| panic!("cannot parse {}: {error}", path.display()));
+    let minified = serde_json::to_string(&value)
+        .unwrap_or_else(|error| panic!("cannot re-encode {}: {error}", path.display()));
     println!("cargo:rustc-env=NIXMAC_ENV_PROFILE_JSON={minified}");
 }
 

apps/native/src-tauri/src/env/config.rs

@@ -52,9 +52,12 @@ pub struct NixmacEnvSettings {
     )]
     pub sentry_dsn: String,
 
+    /// No `build_embed`: `NIXMAC_ENV` selects which profile to embed, so
+    /// embedding it as a value too let the selector overwrite the value it
+    /// selected. It resolves from the profile JSON instead. A process-env
+    /// override still wins here, as it does for every field in this struct.
     #[config(
         default = "prod",
-        build_embed = true,
         env_var = "NIXMAC_ENV",
         label = "Deployment environment"
     )]

apps/native/src-tauri/src/env/sources.rs

@@ -16,7 +16,6 @@ pub fn build_embed(name: &str) -> Option<String> {
         "SENTRY_DSN" => option_env!("SENTRY_DSN").map(str::to_string),
         "VITE_SERVER_URL" => option_env!("VITE_SERVER_URL").map(str::to_string),
         "SUBMITTED_FEEDBACK_DSN" => option_env!("SUBMITTED_FEEDBACK_DSN").map(str::to_string),
-        "NIXMAC_ENV" => option_env!("NIXMAC_ENV").map(str::to_string),
         "NIXMAC_VERSION" => option_env!("NIXMAC_VERSION").map(str::to_string),
         _ => None,
     };
@@ -25,8 +24,16 @@ pub fn build_embed(name: &str) -> Option<String> {
 }
 
 /// JSON profile from `apps/native/env.{development,release,e2e}.json`, embedded at compile time.
+///
+/// `None` only when nothing was embedded. A malformed embed panics rather than
+/// resolving to `None`, which would silently drop every profile value back to
+/// its field default.
 pub fn build_profile() -> Option<serde_json::Value> {
-    option_env!("NIXMAC_ENV_PROFILE_JSON").and_then(|raw| serde_json::from_str(raw).ok())
+    let raw = option_env!("NIXMAC_ENV_PROFILE_JSON")?;
+    Some(
+        serde_json::from_str(raw)
+            .expect("NIXMAC_ENV_PROFILE_JSON is minified by build.rs and must parse"),
+    )
 }
 
 #[cfg(test)]

apps/native/src-tauri/src/env_keys.rs

@@ -4,12 +4,10 @@
 
 #[allow(dead_code)]
 /// Environment variables embedded at build time via `build.rs` (`cargo:rustc-env`).
-pub const BUILD_EMBED_KEYS: &[&str] = &[
-    "SENTRY_DSN",
-    "VITE_SERVER_URL",
-    "SUBMITTED_FEEDBACK_DSN",
-    "NIXMAC_ENV",
-];
+/// `NIXMAC_ENV` is deliberately absent: it selects which profile to embed, so
+/// embedding it as a value too let the selector overwrite the selected file's
+/// own `NIXMAC_ENV`. The value comes from the embedded profile JSON instead.
+pub const BUILD_EMBED_KEYS: &[&str] = &["SENTRY_DSN", "VITE_SERVER_URL", "SUBMITTED_FEEDBACK_DSN"];
 
 /// Application environment variable names.
 #[allow(dead_code)]

apps/native/src-tauri/src/main.rs

@@ -502,12 +502,9 @@ fn run_gui_mode(
         std::sync::Mutex<Option<tracing_appender::non_blocking::WorkerGuard>>,
     >,
 ) {
-    // Prefer compile-time embedded vars (set by build.rs via `cargo:rustc-env`),
-    // fall back to runtime environment variables.
-    let nixmac_env = option_env!("NIXMAC_ENV")
-        .map(|s| s.to_string())
-        .or_else(|| std::env::var("NIXMAC_ENV").ok())
-        .unwrap_or_else(|| "prod".to_string());
+    // One resolution path for the deployment profile; `crate::env` owns the
+    // precedence so this log line cannot disagree with what telemetry reports.
+    let nixmac_env = crate::env::nixmac_env();
 
     let nixmac_version = option_env!("NIXMAC_VERSION")
         .map(|s| s.to_string())

apps/native/src-tauri/src/system/permissions.rs

@@ -238,28 +238,46 @@ fn check_folder_access(path: &PathBuf) -> PermissionStatus {
     }
 }
 
-/// Check if we have Full Disk Access.
+/// Shown on the Full Disk Access row when every probe path was missing.
+///
+/// The probe reads files a granted process can read and a denied one cannot.
+/// If none of them exist there is nothing to read, so it proves neither state —
+/// say so, rather than implying we checked and found the access missing. The
+/// other inconclusive path, a Mac with no home directory, has its own message.
+const FULL_DISK_ACCESS_INCONCLUSIVE: &str = "Could not determine Full Disk Access: none of the files this check probes exist on this Mac. If a rebuild fails with a permissions error, add nixmac under System Settings → Privacy & Security → Full Disk Access.";
+
+/// Check if we have Full Disk Access, with an explanation when inconclusive.
 ///
 /// Probes several TCC-gated paths. A successful read on any one is proof of
 /// FDA. A PermissionDenied on any one is proof of the opposite — even if the
 /// user has nixmac listed and toggled on in System Settings, a stale TCC
 /// entry (e.g. codesign requirement mismatch after an update-in-place) can
 /// leave the grant silently inactive, and reads will fail with
-/// PermissionDenied. Only if every probe path is missing (NotFound) do we
-/// fall back to Pending.
-fn check_full_disk_access() -> PermissionStatus {
+/// PermissionDenied. If every probe path is missing (NotFound) the probe has
+/// established nothing, which is `Unknown` rather than `Pending` — the latter
+/// reads as "not granted yet", which is a claim this probe cannot make.
+///
+/// `Unknown` still fails the onboarding gate on its own; what keeps an
+/// unverifiable result from holding the gate shut is the caller dropping the
+/// row's `required` flag (see the `full-disk` arm of `check_all_permissions`).
+fn check_full_disk_access() -> (PermissionStatus, Option<String>) {
     if vite_skip_permissions_enabled() {
         debug!("VITE_NIXMAC_SKIP_PERMISSIONS is set, assuming Full Disk Access granted");
-        return PermissionStatus::Granted;
+        return (PermissionStatus::Granted, None);
     }
     if e2e_skip_permissions_enabled() {
         debug!("E2E permission skip enabled, assuming Full Disk Access granted");
-        return PermissionStatus::Granted;
+        return (PermissionStatus::Granted, None);
     }
 
     let home = match dirs::home_dir() {
         Some(h) => h,
-        None => return PermissionStatus::Unknown,
+        None => {
+            return (
+                PermissionStatus::Unknown,
+                Some("Could not determine Full Disk Access: this Mac reported no home directory, so the check could not run. If a rebuild fails with a permissions error, add nixmac under System Settings → Privacy & Security → Full Disk Access.".to_string()),
+            );
+        }
     };
 
     // (path, is_dir). Ordered by how reliably the path exists on a typical
@@ -286,7 +304,7 @@ fn check_full_disk_access() -> PermissionStatus {
         match result {
             Ok(_) => {
                 debug!("Full Disk Access granted (probe succeeded: {:?})", path);
-                return PermissionStatus::Granted;
+                return (PermissionStatus::Granted, None);
             }
             Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => {
                 debug!("Full Disk Access denied (probe blocked: {:?})", path);
@@ -297,10 +315,13 @@ fn check_full_disk_access() -> PermissionStatus {
     }
 
     if saw_denied {
-        PermissionStatus::Denied
+        (PermissionStatus::Denied, None)
     } else {
         debug!("Full Disk Access check inconclusive — no probe path existed");
-        PermissionStatus::Pending
+        (
+            PermissionStatus::Unknown,
+            Some(FULL_DISK_ACCESS_INCONCLUSIVE.to_string()),
+        )
     }
 }
 
@@ -345,7 +366,24 @@ pub fn check_all_permissions() -> PermissionsState {
             "desktop" => check_desktop_access(),
             "documents" => check_documents_access(),
             "admin" => check_admin_privileges(),
-            "full-disk" => check_full_disk_access(),
+            "full-disk" => {
+                let (status, detail) = check_full_disk_access();
+                // Keep the default "how to grant it" text unless the probe has
+                // something more accurate to say.
+                if let Some(detail) = detail {
+                    perm.instructions = Some(detail);
+                }
+                // A probe that could not decide must not keep the gate shut —
+                // the same reasoning that makes app-management Recommended
+                // rather than Required (see `app_management_permission`), except
+                // discovered at runtime. Requiring access we cannot verify shows
+                // a permissions banner to users who may well have granted it.
+                // Only this row relaxes: every other `Unknown` still blocks.
+                if status == PermissionStatus::Unknown {
+                    perm.required = false;
+                }
+                status
+            }
             "app-management" => check_app_management(),
             "privileged-helper" => {
                 let (status, detail) = check_privileged_helper();
@@ -356,7 +394,10 @@ pub fn check_all_permissions() -> PermissionsState {
                 }
                 status
             }
-            _ => PermissionStatus::Unknown,
+            other => {
+                debug_assert!(false, "no probe for permission id {other:?}");
+                PermissionStatus::Unknown
+            }
         };
 
         // If this permission is required and not granted, mark all_required_granted as false
@@ -501,17 +542,18 @@ pub fn request_permission(permission_id: &str) -> Result<Permission> {
                 .spawn();
 
             // Re-check the status
+            let (status, detail) = check_full_disk_access();
             Ok(Permission {
                 id: "full-disk".to_string(),
                 name: "Full Disk Access".to_string(),
                 description: "Required for darwin-rebuild to apply system changes".to_string(),
                 required: true,
                 can_request_programmatically: false,
-                status: check_full_disk_access(),
-                instructions: Some(
+                status,
+                instructions: Some(detail.unwrap_or_else(|| {
                     "First make sure nixmac is in your Applications folder (not running from the install disk image). Then go to System Settings → Privacy & Security → Full Disk Access and add nixmac to the list."
-                        .to_string(),
-                ),
+                        .to_string()
+                })),
             })
         }
         "app-management" => {
@@ -805,6 +847,24 @@ mod tests {
         );
     }
 
+    #[test]
+    fn inconclusive_full_disk_access_is_unknown_and_explains_itself() {
+        // Only meaningful when the probe is actually inconclusive; on a Mac
+        // with Safari or Mail the probe reaches a verdict and this is skipped.
+        // Either inconclusive path must explain itself — which one ran depends
+        // on the machine, so assert the property rather than the wording.
+        let (status, detail) = check_full_disk_access();
+        if status == PermissionStatus::Unknown {
+            let detail = detail.expect("an inconclusive probe must explain itself");
+            assert!(detail.starts_with("Could not determine Full Disk Access:"));
+        } else {
+            assert!(matches!(
+                status,
+                PermissionStatus::Granted | PermissionStatus::Denied
+            ));
+        }
+    }
+
     #[test]
     fn app_management_is_not_inferred_from_full_disk_access() {
         assert_eq!(check_app_management(), PermissionStatus::Pending);