v0.10.6: Hook fail-open + launchd plist hardening

🛡️ Hook Fail-Open

The PreToolUse / PermissionRequest hook now fails open instead of denying:

• Server unreachable (Connection refused) → exit 0, stderr warning, agent falls back to native terminal permission prompt
• No request_id from server → fail-open
• 120s poll timeout → fail-open (an unanswered Feishu card is not the same as an explicit deny)
• Hook script itself crashes (ImportError / unexpected exception) → top-level try/except BaseException → fail-open

Motto: "Hook broken = same UX as no WalkCode installed", never "Coding Agent stuck".

🚀 launchd plist hardening (docs)

README / README_EN now recommend walkcode serve (foreground uvicorn) instead of walkcode start (daemonizer) in launchd plists. The previous template silently broke KeepAlive: walkcode start forks a daemon and the parent exits, so launchd thinks the job finished and stops tracking. With serve launchd watches the real PID and restarts on crash.

Recommended additions to both plists (Claude + Codex instances):

• KeepAlive { SuccessfulExit=false, Crashed=true } — clean launchctl unload does not trigger respawn; crashes do.
• ThrottleInterval=10, ExitTimeOut=15
• ProcessType=Background
• StandardOutPath / StandardErrorPath → ~/.walkcode/launchd.{out,err}.log
• WALKCODE_ENV_FILE as an absolute path (launchd does not load direnv/shell rc)
• HOME, WorkingDirectory explicit

Also documented: once launchd owns the service, do not run walkcode start manually — both would fight for the same port.

Upgrade

walkcode upgrade

Then, for existing launchd-managed instances, pick up the new server code with:

launchctl kickstart -k gui/$(id -u)/com.alpha.walkcode
launchctl kickstart -k gui/$(id -u)/com.alpha.walkcode-codex

(Only strictly needed if your plist was already using serve. If you're migrating from walkcode start, follow the new plist template in the README.)