DevVig · DevVig · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026
@@ -9,7 +9,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.3.8"
+version = "0.3.9"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/DevVig/microbridge"

@@ -39,6 +39,7 @@ Uninstall:
 
 ```sh
 microbridge-app uninstall
+brew services stop microbridge       # no-op unless headless mode was enabled
 brew uninstall microbridge
 # optional: brew untap DevVig/microbridge
 ```
@@ -58,7 +59,7 @@ Governance / why this path: [docs/governance.md](docs/governance.md).
 |---|---|
 | macOS (Homebrew) | Homebrew + **Xcode Command Line Tools** (`xcode-select --install`); Rust + Node pulled in as **build** deps (builds `.app` + daemon) |
 | From source | Rust stable, Node ≥ 20; macOS also needs Xcode CLT for the `.app` |
-| Hardware LEDs/keys | Codex Micro over USB; claim it from the popover, the menu-bar icon’s right-click menu, or **Settings → Device** (`MICROBRIDGE_HID_CLAIM=1` remains a developer override) |
+| Hardware LEDs/keys | Codex Micro over USB-C or Bluetooth; claim it from the popover, the menu-bar icon’s right-click menu, or **Settings → Device** (`MICROBRIDGE_HID_CLAIM=1` remains a developer override) |
 
 ## From source (developers)
 
@@ -197,9 +198,11 @@ headless operation:
 brew services restart microbridge
 ```
 
-**LEDs stay dark** — by default Microbridge only probes USB (Detected). Choose
+**LEDs stay dark** — by default Microbridge detects but does not control the
+USB/Bluetooth HID interface. Choose
 **Claim Codex Micro** in the popover or right-click menu. If the interface is
-busy, pause the other device owner and choose **Retry**. The advanced control
+busy, allow Microbridge under **System Settings → Privacy & Security → Input
+Monitoring**, pause the other device owner, and choose **Retry**. The advanced control
 also remains in **Settings → Device**. Developers can still set
 `MICROBRIDGE_HID_CLAIM=1` before starting the daemon. See
 [docs/device-hid.md](docs/device-hid.md).

@@ -61,7 +61,7 @@ function ingestLifecycle(id, state) {
           adapter: "claude-hook",
           protocol_version: 0,
           role: "ui",
-          adapter_version: "0.3.8",
+          adapter_version: "0.3.9",
           capabilities: {},
         },
         {

@@ -1,6 +1,6 @@
 {
   "name": "@microbridge/adapter-sdk",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Zero-dependency SDK for publishing AI agent session states to Microbridge",
   "main": "index.mjs",
   "type": "module",

@@ -1,7 +1,7 @@
 {
   "name": "microbridge-ui",
   "private": true,
-  "version": "0.3.8",
+  "version": "0.3.9",
   "type": "module",
   "scripts": {
     "dev": "vite",

@@ -1,6 +1,6 @@
 [package]
 name = "microbridge-ui"
-version = "0.3.8"
+version = "0.3.9"
 description = "Microbridge menu bar app (primary UI)"
 authors = ["Microbridge contributors"]
 edition = "2021"

@@ -1589,13 +1589,52 @@ fn trigger_update_check(app: &AppHandle) {
     let _ = app.emit("menu://check-updates", ());
 }
 
+#[cfg(target_os = "macos")]
+#[link(name = "IOKit", kind = "framework")]
+extern "C" {
+    fn IOHIDCheckAccess(request_type: i32) -> i32;
+    fn IOHIDRequestAccess(request_type: i32) -> bool;
+}
+
+/// Ask for the Input Monitoring grant that macOS requires before a process may
+/// receive reports from keyboard-class IOHID devices. The request originates
+/// from the signed main app so System Settings attributes it to Microbridge,
+/// not to the bundled daemon executable.
+#[tauri::command]
+fn request_input_monitoring_access() -> bool {
+    #[cfg(target_os = "macos")]
+    unsafe {
+        // IOHIDLib.h: ListenEvent = 1; Granted = 0; Denied = 1;
+        // Unknown = 2. A denied request will not show the consent prompt
+        // again, so take the user directly to the relevant System Settings
+        // pane on their next explicit Claim/Retry action.
+        match IOHIDCheckAccess(1) {
+            0 => true,
+            1 => {
+                let _ = std::process::Command::new("open")
+                    .arg("x-apple.systempreferences:com.apple.preference.security?Privacy_ListenEvent")
+                    .spawn();
+                false
+            }
+            _ => IOHIDRequestAccess(1),
+        }
+    }
+    #[cfg(not(target_os = "macos"))]
+    true
+}
+
 #[derive(Debug, PartialEq, Eq)]
 struct HardwareMenuPresentation {
     label: &'static str,
     enabled: bool,
     target_enabled: Option<bool>,
 }
 
+fn is_physical_micro(device_name: &str) -> bool {
+    device_name.starts_with("codex-micro-")
+        || device_name.starts_with("creator-micro-v2-")
+}
+
 fn hardware_menu_presentation_for(
     device_connected: bool,
     device_name: &str,
@@ -1608,7 +1647,7 @@ fn hardware_menu_presentation_for(
             target_enabled: Some(false),
         };
     }
-    if device_name.contains("usb") {
+    if is_physical_micro(device_name) {
         return HardwareMenuPresentation {
             label: if control_requested {
                 "Retry Codex Micro Claim"
@@ -1655,6 +1694,10 @@ async fn apply_hardware_menu_action(app: AppHandle) -> Result<(), String> {
         config
     };
 
+    if config.hardware_control_enabled {
+        let _ = request_input_monitoring_access();
+    }
+
     // Preserve the daemon's normalized response as the source of truth.
     let next = state.bus.set_config(config.clone()).await?;
     config = next;
@@ -1684,6 +1727,10 @@ mod hardware_menu_tests {
             hardware_menu_presentation_for(false, "codex-micro-usb", true).label,
             "Retry Codex Micro Claim"
         );
+        assert_eq!(
+            hardware_menu_presentation_for(false, "codex-micro-bluetooth", false).label,
+            "Claim Codex Micro"
+        );
         assert_eq!(
             hardware_menu_presentation_for(true, "codex-micro-usb", false).label,
             "Release Codex Micro"
@@ -2244,6 +2291,7 @@ pub fn run() {
             quit_ui,
             update_channel,
             app_version,
+            request_input_monitoring_access,
             launch_at_login_status,
             set_launch_at_login,
             open_login_items_settings,

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Microbridge",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "identifier": "ai.microbridge.ui",
   "build": {
     "beforeDevCommand": "npm run dev",

@@ -8,6 +8,7 @@ import {
   subscribeSnapshot,
 } from "./lib/bus";
 import { promptLaunchAtLoginOnce } from "./lib/autostart";
+import { requestInputMonitoringAccess } from "./lib/hardwareControl";
 import { resolveAppearance } from "./lib/theme";
 import type { DaemonConfig, Snapshot } from "./lib/types";
 import { runAutomaticUpdateCheck, runUpdateCheck } from "./lib/updater";
@@ -116,6 +117,14 @@ export default function App() {
     }
   };
 
+  const applyHardwareControl = async (enabled: boolean) => {
+    if (enabled) await requestInputMonitoringAccess();
+    await applyConfig({
+      ...snapshot.config,
+      hardware_control_enabled: enabled,
+    });
+  };
+
   if (view === "hud") {
     return <Hud snapshot={snapshot} dark={dark} />;
   }
@@ -127,7 +136,19 @@ export default function App() {
         dark={dark}
         tab={tab}
         onTab={setTab}
-        onConfig={(c) => void applyConfig(c)}
+        onConfig={(c) => {
+          if (
+            c.hardware_control_enabled &&
+            !snapshot.config.hardware_control_enabled
+          ) {
+            void (async () => {
+              await requestInputMonitoringAccess();
+              await applyConfig(c);
+            })();
+          } else {
+            void applyConfig(c);
+          }
+        }}
         onClose={() => void closeSettings()}
         onAgentKey={(index, open) => void activateAgentKey(index, open)}
       />
@@ -145,12 +166,7 @@ export default function App() {
           pause_leds: !snapshot.config.pause_leds,
         })
       }
-      onHardwareControl={(enabled) =>
-        void applyConfig({
-          ...snapshot.config,
-          hardware_control_enabled: enabled,
-        })
-      }
+      onHardwareControl={(enabled) => void applyHardwareControl(enabled)}
       onQuit={() => void quitUi()}
       onAgentKey={(index, open) => void activateAgentKey(index, open)}
     />

@@ -1,6 +1,7 @@
 import type { Snapshot } from "../lib/types";
 import { agentKeyLedFrame } from "../lib/types";
 import type { ThemeTokens } from "../lib/theme";
+import { deviceTransportLabel, isPhysicalMicro } from "../lib/hardwareControl";
 
 /**
  * Miniature, read-only echo of the kbd-1.0 deck (MagicPath AgentKeyEcho).
@@ -111,7 +112,8 @@ export function DeviceEcho({
   const connected =
     snapshot.device_connected ||
     snapshot.device_name === "mock" ||
-    snapshot.device_name.includes("usb");
+    isPhysicalMicro(snapshot.device_name);
+  const transport = deviceTransportLabel(snapshot.device_name);
   return (
     <div className="flex flex-col items-center gap-1.5">
       <div
@@ -201,8 +203,8 @@ export function DeviceEcho({
       <span className="text-[10px] font-medium" style={{ color: t.textMuted }}>
         {snapshot.device_connected
           ? "Live on your deck · read-only"
-          : snapshot.device_name.includes("usb")
-            ? "USB detected · HID map pending"
+          : isPhysicalMicro(snapshot.device_name)
+            ? `${transport ?? "HID"} detected · hardware control available`
             : snapshot.device_name === "mock"
               ? "Simulator · read-only"
               : "Deck offline"}

@@ -1,5 +1,9 @@
 import { describe, expect, it } from "vitest";
-import { hardwareControlState } from "./hardwareControl";
+import {
+  deviceTransportLabel,
+  hardwareControlState,
+  isPhysicalMicro,
+} from "./hardwareControl";
 import type { Snapshot } from "./types";
 
 function snapshot(
@@ -53,6 +57,17 @@ describe("hardwareControlState", () => {
     expect(hardwareControlState(snapshot("codex-micro-usb", true, false))).toBe(
       "connected",
     );
+    expect(hardwareControlState(snapshot("codex-micro-bluetooth"))).toBe(
+      "available",
+    );
+  });
+
+  it("recognizes supported HID transports", () => {
+    expect(isPhysicalMicro("codex-micro-usb")).toBe(true);
+    expect(isPhysicalMicro("codex-micro-bluetooth")).toBe(true);
+    expect(deviceTransportLabel("codex-micro-bluetooth")).toBe("Bluetooth");
+    expect(deviceTransportLabel("unrelated-usb")).toBeNull();
+    expect(isPhysicalMicro("daemon-offline")).toBe(false);
   });
 
   it("does not offer hardware actions for non-device surfaces", () => {