fix(hotkey): MacHotkeyAdapter::shutdown stops CFRunLoop + tap [严重]

[appergb]

User description

Summary

`MacHotkeyAdapter` did not override `HotkeyAdapter::shutdown` — it inherited the empty default. The mac listener's `run_listen_loop` calls `CFRunLoopRun()` which never returns absent `CFRunLoopStop`. So every `HotkeyMonitor::drop` (which fires on every preference-driven monitor swap, e.g. user changes hotkey binding) leaked the listener thread + the underlying CGEventTap. Long-running sessions that cycle bindings would steadily accumulate background threads.

The Windows adapter already does this correctly via `PostThreadMessageW(WM_QUIT)`; this PR mirrors that pattern on macOS.

Change

• Add `CFRunLoopStop` FFI extern.
• New `MacShutdownHandles { tap, runloop }` shared via `Arc` between the listener thread (writes refs after `CGEventTapCreate` + `CFRunLoopGetCurrent`) and `MacHotkeyAdapter` (reads them in `shutdown`).
• `MacHotkeyAdapter::shutdown` — disables the tap first (so OS stops dispatching), then `CFRunLoopStop`. `take()` makes shutdown idempotent.
• `run_listen_loop` now does `Box::from_raw(context)` after `CFRunLoopRun` returns, so the listener thread releases the callback context before exiting.
• The TAP_DISABLED_BY_TIMEOUT re-enable path in `tap_callback` now reads through `ctx.handles.tap` (same lock that adapter shutdown takes from). Consistent ownership story.

Safety / threading

`CGEventTapEnable` and `CFRunLoopStop` are documented by Apple as safe to call from any thread. Captured as a `SAFETY` comment on the `unsafe Send/Sync impl for MacShutdownHandles`. Mutex held only across the FFI call (already a no-syscall fast path), so no nested-lock hazards.

Audit linkage

Audit ID 3.1.1 (CONFIRMED 严重). See `docs/audit-2026-05-10-validated.md` (local) for full validation context. 3.1.3 (JoinHandle storage) deferred to a separate supervisor PR — that fix is meaningless without a supervisor consuming the health signal.

Test plan

• `cargo test --lib` — all 31 hotkey/coordinator/types/commands tests pass.
• Test fixture `callback_context` updated to construct `MacShutdownHandles` (was constructing `tap` field directly on `CallbackContext`).
• `cargo check --lib` clean (warnings unrelated, pre-existing).
• CI build (mac + windows targets) — to be verified.
• Manual functional verification on macOS: swap hotkey binding 5+ times in Settings, watch `ps -M` / Activity Monitor for openless threads — count should stay flat (was: leaks one thread + one CGEventTap per swap). To be done after merge.

---

PR Type

Bug fix

---

Description

• MacHotkeyAdapter::shutdown stops CFRunLoop and tap

• Shares handles via Arc<MacShutdownHandles>

• Idempotent teardown using take() on lock

• Fixes thread/tap leak on monitor drop

---

Diagram Walkthrough

flowchart LR
    listener["listener thread: CFRunLoopRun"]
    handles["Arc<MacShutdownHandles>"]
    adapter["MacHotkeyAdapter::shutdown"]
    disable["CGEventTapEnable(tap, false)"]
    stop["CFRunLoopStop(runloop)"]
    exit["cleanup context"]
    listener -- "stores tap/runloop" --> handles
    handles -- "shared with" --> adapter
    adapter -- "1. disable tap" --> disable
    adapter -- "2. stop runloop" --> stop
    stop -- "unblocks" --> listener
    listener -- "exits" --> exit

Loading

File Walkthrough

	Relevant files
Bug fix	hotkey.rs Implement MacHotkeyAdapter::shutdown for proper cleanup    openless-all/app/src-tauri/src/hotkey.rs Add MacShutdownHandles with tap/runloop refs and Send/Sync impl Implement MacHotkeyAdapter::shutdown to disable tap and stop runloop Update run_listen_loop to share handles with adapter via StartupTx Add CFRunLoopStop FFI and adjust callback context to use handles +57/-8

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected