bgclick-rev

# Background-Click Reverse Engineering Use this skill only for research on a user-provided macOS `.app`. If IDA Pro or IDA MCP is unavailable, stop early and explain the blocker. Do not modify Uni-CLI source code from this skill; write research artifacts and reproduction code only after the binary evidence is gathered. ## Outputs Create a research bundle under `<workspace>/research/`: - `SHARED-CONTEXT.md` with target paths, bundle IDs, signing status, IDA MCP instance mapping, and priors to verify. - `findings/<phase-or-question>.md` for call-site maps and open questions. - `sub_<addr>-<label>.md` for every decompiled function used as evidence. - `frame-map.md` for Swift async task-frame offsets. - `FINAL-REPORT.md` with behavior spec, evidence table, reproduction diff, and VM test plan. If asked to build a reproduction, add: - `Sources/<Module>/BackgroundClicker.swift` - `EchoApp/main.swift` - `impl-research.md` with empirical VM runs. ## Priors To Verify Treat these as hypotheses until confirmed in the target binary: - Events are posted with `CGEvent.postToPid(_:)`. - The synthetic event starts as `NSEvent.mouseEvent(...)`, then uses `event.cgEvent`. - Explicit integer fields are `3` button, `7` subtype value `3`, `91` window under pointer, and `92` window that can handle the event. - Screen location is set, read back, translated by the target window origin, and written with `CGEventSetWindowLocation` resolved by `dlsym`. - Background targets receive `CGEventFlags...