Upload diagnostic.sh

diagnostic.sh

@@ -1,190 +1,601 @@
 #!/bin/bash
-# BSKL AIColorMatch Diagnostic Script
-# Collects system info and logs for troubleshooting
-
-OUTPUT_DIR="$HOME/Desktop/BSKL_Diagnostic_$(date +%Y%m%d_%H%M%S)"
-mkdir -p "$OUTPUT_DIR"
-
-echo "=== BSKL AIColorMatch Diagnostic Tool ===" | tee "$OUTPUT_DIR/diagnostic.txt"
-echo "Date: $(date)" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-
-# 1. macOS Version
-echo "=== macOS Version ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-sw_vers | tee -a "$OUTPUT_DIR/diagnostic.txt"
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-
-# 2. Mac Architecture
-echo "=== Mac Architecture ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-uname -m | tee -a "$OUTPUT_DIR/diagnostic.txt"
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-
-# 3. Render Engine Version
-echo "=== Render Engine Version ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-RE_VERSION_FILE="/Library/Application Support/BSKL/Render Engine/Python 3.10/version.txt"
-if [ -f "$RE_VERSION_FILE" ]; then
-    echo "Version: $(cat "$RE_VERSION_FILE")" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+#
+# After Effects Plugin Diagnostic Tool
+# Checks dependencies, code signing, quarantine, and plugin structure
+#
+# Usage: bash check_plugin.sh /path/to/Plugin.plugin
+#
+
+# Don't exit on error - we want to continue checking even if some commands fail
+set +e
+
+# Output file on Desktop
+REPORT_TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+OUTPUT_FILE="$HOME/Desktop/plugin_diagnostic_$REPORT_TIMESTAMP.txt"
+
+# Function to output to both console and file
+log() {
+    echo -e "$1"
+    # Strip color codes for file output
+    echo -e "$1" | sed 's/\x1b\[[0-9;]*m//g' >> "$OUTPUT_FILE"
+}
+
+# Initialize output file
+echo "# After Effects Plugin Diagnostic Report" > "$OUTPUT_FILE"
+echo "# Generated: $(date)" >> "$OUTPUT_FILE"
+echo "" >> "$OUTPUT_FILE"
+
+# Colors (for console only)
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Icons
+PASS="✅"
+FAIL="❌"
+WARN="⚠️"
+INFO="ℹ️"
+
+print_header() {
+    log ""
+    log "${BLUE}═══════════════════════════════════════════════════════════${NC}"
+    log "${BLUE}  $1${NC}"
+    log "${BLUE}═══════════════════════════════════════════════════════════${NC}"
+}
+
+print_section() {
+    log ""
+    log "${YELLOW}── $1 ──${NC}"
+}
+
+# Default plugin path for AIColorMatch
+DEFAULT_PLUGIN="/Library/Application Support/Adobe/Common/Plug-ins/7.0/MediaCore/BSKL/AIColorMatch.plugin"
+MEDIACORE_PATH="/Library/Application Support/Adobe/Common/Plug-ins/7.0/MediaCore"
+
+# Check arguments - use default if not provided
+if [ -z "$1" ]; then
+    if [ -d "$DEFAULT_PLUGIN" ]; then
+        PLUGIN_PATH="$DEFAULT_PLUGIN"
+        echo "Using default plugin path: $PLUGIN_PATH"
+    else
+        echo -e "${RED}Usage: bash check_plugin.sh /path/to/Plugin.plugin${NC}"
+        echo ""
+        echo "Default plugin not found at:"
+        echo "  $DEFAULT_PLUGIN"
+        echo ""
+        echo "Please specify plugin path manually."
+        exit 1
+    fi
 else
-    echo "❌ Render Engine not found" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    PLUGIN_PATH="$1"
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 4. AIM Server Process Status
-echo "=== AIM Server Process ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-AIM_PROCESS=$(ps aux | grep -i "AI MACHINE Server" | grep -v grep)
-if [ -n "$AIM_PROCESS" ]; then
-    echo "✅ AIM Server is running" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-    echo "$AIM_PROCESS" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-else
-    echo "❌ AIM Server is NOT running" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+# Validate plugin exists
+if [ ! -d "$PLUGIN_PATH" ]; then
+    log "${FAIL} Plugin not found: $PLUGIN_PATH"
+    exit 1
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 5. Check Server Port (7007 is default)
-echo "=== Server Port (7007) ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-PORT_CHECK=$(lsof -i :7007 2>/dev/null | head -5)
-if [ -n "$PORT_CHECK" ]; then
-    echo "✅ Port 7007 is in use:" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-    echo "$PORT_CHECK" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+# Get plugin name
+PLUGIN_NAME=$(basename "$PLUGIN_PATH" .plugin)
+
+print_header "After Effects Plugin Diagnostic Report"
+log ""
+log "Plugin: ${GREEN}$PLUGIN_NAME${NC}"
+log "Path: $PLUGIN_PATH"
+log "Date: $(date)"
+log "macOS: $(sw_vers -productVersion) ($(sw_vers -buildVersion))"
+log "Machine: $(uname -m)"
+
+# ─────────────────────────────────────────────────────────────
+# 0. ALL PLUGINS IN MEDIACORE
+# ─────────────────────────────────────────────────────���───────
+print_section "All Plugins in MediaCore"
+
+if [ -d "$MEDIACORE_PATH" ]; then
+    log "${BLUE}Scanning: $MEDIACORE_PATH${NC}"
+    log ""
+
+    # Find all .plugin bundles
+    PLUGIN_COUNT=0
+    while IFS= read -r plugin_bundle; do
+        PLUGIN_COUNT=$((PLUGIN_COUNT + 1))
+        plugin_name=$(basename "$plugin_bundle" .plugin)
+        plugin_modified=$(stat -f "%Sm" -t "%Y-%m-%d %H:%M" "$plugin_bundle" 2>/dev/null || echo "unknown")
+        plugin_size=$(du -sh "$plugin_bundle" 2>/dev/null | cut -f1 || echo "?")
+
+        # Check if binary exists
+        binary_path="$plugin_bundle/Contents/MacOS/$plugin_name"
+        if [ -f "$binary_path" ]; then
+            arch=$(lipo -archs "$binary_path" 2>/dev/null || echo "?")
+            log "$PASS $plugin_name"
+            log "      Modified: $plugin_modified | Size: $plugin_size | Arch: $arch"
+        else
+            log "$WARN $plugin_name (binary missing)"
+            log "      Modified: $plugin_modified | Size: $plugin_size"
+        fi
+    done < <(find "$MEDIACORE_PATH" -maxdepth 2 -name "*.plugin" -type d 2>/dev/null | sort)
+
+    log ""
+    log "Total plugins found: $PLUGIN_COUNT"
 else
-    echo "❌ Port 7007 is not in use (server not running?)" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log "$WARN MediaCore directory not found: $MEDIACORE_PATH"
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 6. AIM Server Lock File
-echo "=== AIM Server Lock File ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-LOCK_FILE="$HOME/.AI MACHINE Server.lock"
-if [ -f "$LOCK_FILE" ]; then
-    echo "Lock file exists: $LOCK_FILE" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+# ─────────────────────────────────────────────────────────────
+# 1. PLUGIN STRUCTURE
+# ─────────────────────────────────────────────────────────────
+print_section "Plugin Structure"
+
+BINARY_PATH="$PLUGIN_PATH/Contents/MacOS/$PLUGIN_NAME"
+PLIST_PATH="$PLUGIN_PATH/Contents/Info.plist"
+RSRC_PATH="$PLUGIN_PATH/Contents/Resources/$PLUGIN_NAME.rsrc"
+
+if [ -f "$BINARY_PATH" ]; then
+    log "$PASS Binary: $BINARY_PATH"
+    BINARY_SIZE=$(du -h "$BINARY_PATH" | cut -f1)
+    log "   Size: $BINARY_SIZE"
 else
-    echo "No lock file found" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log "$FAIL Binary NOT FOUND: $BINARY_PATH"
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 7. AIM Settings
-echo "=== AIM Settings ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-SETTINGS_FILE="$HOME/.aim/settings.json"
-if [ -f "$SETTINGS_FILE" ]; then
-    echo "Settings file:" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-    cat "$SETTINGS_FILE" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-    cp "$SETTINGS_FILE" "$OUTPUT_DIR/"
+if [ -f "$PLIST_PATH" ]; then
+    log "$PASS Info.plist: exists"
 else
-    echo "No settings file found at $SETTINGS_FILE" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log "$FAIL Info.plist NOT FOUND"
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 8. AIM Server Files
-echo "=== AIM Server Files ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-AIM_SERVER_DIR="/Library/Application Support/BSKL/AI MACHINE/Server"
-if [ -d "$AIM_SERVER_DIR" ]; then
-    ls -la "$AIM_SERVER_DIR"/*.so 2>/dev/null | tee -a "$OUTPUT_DIR/diagnostic.txt"
-else
-    echo "❌ AIM Server directory not found" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-
-# 9. AI MACHINE Plugins
-echo "=== AI MACHINE Plugins ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-PLUGINS_DIR="/Library/Application Support/BSKL/AI MACHINE/Plugins"
-if [ -d "$PLUGINS_DIR" ]; then
-    for plugin_dir in "$PLUGINS_DIR"/*/; do
-        if [ -d "$plugin_dir" ]; then
-            plugin_name=$(basename "$plugin_dir")
-            echo "Plugin: $plugin_name" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-            # List .so files with sizes
-            for so_file in "$plugin_dir"*.so; do
-                if [ -f "$so_file" ]; then
-                    size=$(ls -lh "$so_file" | awk '{print $5}')
-                    arch=$(file "$so_file" | grep -o "arm64\|x86_64" | head -1)
-                    echo "  $(basename "$so_file") ($size, $arch)" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-                fi
-            done
-        fi
-    done
+if [ -f "$RSRC_PATH" ]; then
+    log "$PASS Resource file: $PLUGIN_NAME.rsrc"
 else
-    echo "❌ AI MACHINE Plugins directory not found" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-
-# 10. Adobe BSKL Plugins (with version info from plist)
-echo "=== Adobe BSKL Plugins ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-ADOBE_PLUGINS_DIR="/Library/Application Support/Adobe/Common/Plug-ins/7.0/MediaCore/BSKL"
-if [ -d "$ADOBE_PLUGINS_DIR" ]; then
-    for plugin in "$ADOBE_PLUGINS_DIR"/*.plugin; do
-        if [ -d "$plugin" ]; then
-            plugin_name=$(basename "$plugin" .plugin)
-            plist="$plugin/Contents/Info.plist"
-            if [ -f "$plist" ]; then
-                version=$(defaults read "$plist" CFBundleShortVersionString 2>/dev/null || echo "n/a")
-                build=$(defaults read "$plist" CFBundleVersion 2>/dev/null || echo "n/a")
-                sdk=$(defaults read "$plist" DTPlatformVersion 2>/dev/null || echo "n/a")
-                xcode=$(defaults read "$plist" DTXcode 2>/dev/null || echo "n/a")
-                echo "Plugin: $plugin_name" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-                echo "  Version: $version (build: $build)" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-                echo "  SDK: macOS $sdk, Xcode: $xcode" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log "$WARN Resource file not found (may be embedded)"
+fi
+
+# ─────────────────────────────────────────────────────────────
+# 2. ARCHITECTURE
+# ─────────────────────────────────────────────────────────────
+print_section "Architecture"
+
+if [ -f "$BINARY_PATH" ]; then
+    ARCHS=$(lipo -archs "$BINARY_PATH" 2>/dev/null || echo "unknown")
+
+    if [[ "$ARCHS" == *"arm64"* ]] && [[ "$ARCHS" == *"x86_64"* ]]; then
+        log "$PASS Universal Binary: $ARCHS"
+    elif [[ "$ARCHS" == *"arm64"* ]]; then
+        log "$WARN ARM64 only (no Intel support)"
+    elif [[ "$ARCHS" == *"x86_64"* ]]; then
+        log "$WARN Intel only (no Apple Silicon native)"
+    else
+        log "$FAIL Unknown architecture: $ARCHS"
+    fi
+
+    # Current machine
+    MACHINE_ARCH=$(uname -m)
+    log "$INFO Current machine: $MACHINE_ARCH"
+fi
+
+# ─────────────────────────────────────────────────────────────
+# 3. DEPENDENCIES
+# ─────────────────────────────────────────────────────────────
+print_section "Dependencies"
+
+if [ -f "$BINARY_PATH" ]; then
+    MISSING_DEPS=0
+
+    # Get unique dependencies (otool shows both archs for universal binary)
+    while IFS= read -r line; do
+        # Skip empty lines and the binary path itself
+        [[ -z "$line" ]] && continue
+        [[ "$line" == *"$BINARY_PATH"* ]] && continue
+
+        # Extract library path
+        LIB_PATH=$(echo "$line" | sed 's/^[[:space:]]*//' | cut -d' ' -f1)
+
+        # Skip if empty
+        [[ -z "$LIB_PATH" ]] && continue
+
+        # Categorize
+        # Note: Since macOS Big Sur, /usr/lib libraries are in shared cache
+        # and don't exist as physical files, but they still work
+        if [[ "$LIB_PATH" == /usr/lib/* ]]; then
+            log "$PASS System: $(basename "$LIB_PATH") (shared cache)"
+        elif [[ "$LIB_PATH" == /System/Library/* ]]; then
+            if [ -d "${LIB_PATH%/*}" ] || [ -f "$LIB_PATH" ]; then
+                log "$PASS Framework: $(echo "$LIB_PATH" | grep -o '[^/]*\.framework')"
             else
-                echo "Plugin: $plugin_name (no plist)" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+                log "$FAIL MISSING: $LIB_PATH"
+                MISSING_DEPS=$((MISSING_DEPS + 1))
             fi
+        elif [[ "$LIB_PATH" == @rpath/* ]] || [[ "$LIB_PATH" == @loader_path/* ]] || [[ "$LIB_PATH" == @executable_path/* ]]; then
+            log "$WARN Relative: $LIB_PATH"
+        elif [ -f "$LIB_PATH" ]; then
+            log "$PASS External: $LIB_PATH"
+        else
+            log "$FAIL MISSING: $LIB_PATH"
+            MISSING_DEPS=$((MISSING_DEPS + 1))
         fi
+    done < <(otool -L "$BINARY_PATH" 2>/dev/null | sort -u)
+
+    if [ $MISSING_DEPS -gt 0 ]; then
+        log ""
+        log "${RED}$FAIL Found $MISSING_DEPS missing dependencies!${NC}"
+    else
+        log ""
+        log "${GREEN}$PASS All dependencies found${NC}"
+    fi
+fi
+
+# ─────────────────────────────────────────────────────────────
+# 4. CODE SIGNING & NOTARIZATION
+# ─────────────────────────────────────────────────────────────
+print_section "Code Signing & Notarization"
+
+CODESIGN_OUTPUT=$(codesign -dv --verbose=4 "$PLUGIN_PATH" 2>&1)
+SIGNING_ISSUE=0
+
+# Check signing status
+if echo "$CODESIGN_OUTPUT" | grep -q "Authority="; then
+    # Extract all authorities (certificate chain)
+    log "${BLUE}Certificate Chain:${NC}"
+    echo "$CODESIGN_OUTPUT" | grep "Authority=" | while read -r line; do
+        CERT=$(echo "$line" | cut -d= -f2)
+        log "   $CERT"
     done
+
+    # Team ID
+    TEAM_ID=$(echo "$CODESIGN_OUTPUT" | grep "TeamIdentifier=" | cut -d= -f2)
+    if [ -n "$TEAM_ID" ] && [ "$TEAM_ID" != "not set" ]; then
+        log "$PASS Team ID: $TEAM_ID"
+    else
+        log "$WARN Team ID not set"
+    fi
+
+    # Timestamp
+    SIGN_TIMESTAMP=$(echo "$CODESIGN_OUTPUT" | grep "Timestamp=" | cut -d= -f2)
+    if [ -n "$SIGN_TIMESTAMP" ]; then
+        log "$PASS Signed on: $SIGN_TIMESTAMP"
+    else
+        log "$WARN No timestamp (signature may expire with certificate)"
+    fi
+
+    # Runtime version (hardened runtime)
+    RUNTIME=$(echo "$CODESIGN_OUTPUT" | grep "Runtime Version=" | cut -d= -f2)
+    if [ -n "$RUNTIME" ]; then
+        log "$PASS Hardened Runtime: $RUNTIME"
+    else
+        log "$WARN Hardened runtime not enabled"
+    fi
+
+    # Notarization check
+    if echo "$CODESIGN_OUTPUT" | grep -q "Notarization Ticket"; then
+        log "$PASS Notarization ticket stapled"
+    else
+        log "$WARN Notarization ticket NOT stapled"
+        SIGNING_ISSUE=1
+    fi
+
+elif echo "$CODESIGN_OUTPUT" | grep -q "adhoc"; then
+    log "$WARN Ad-hoc signed (development only)"
+    SIGNING_ISSUE=1
+else
+    log "$FAIL NOT SIGNED"
+    SIGNING_ISSUE=1
+fi
+
+# Verify signature integrity
+log ""
+log "${BLUE}Signature Verification:${NC}"
+VERIFY_OUTPUT=$(codesign --verify --deep --strict "$PLUGIN_PATH" 2>&1)
+if [ $? -eq 0 ]; then
+    log "$PASS Signature integrity: valid"
+else
+    log "$FAIL Signature integrity: INVALID"
+    log "   $VERIFY_OUTPUT"
+    SIGNING_ISSUE=1
+fi
+
+# Gatekeeper assessment (spctl)
+log ""
+log "${BLUE}Gatekeeper Assessment:${NC}"
+SPCTL_OUTPUT=$(spctl --assess --type execute -v "$PLUGIN_PATH" 2>&1)
+SPCTL_EXIT=$?
+if [ $SPCTL_EXIT -eq 0 ]; then
+    log "$PASS Gatekeeper: accepted"
+elif echo "$SPCTL_OUTPUT" | grep -q "rejected"; then
+    # Check the reason
+    if echo "$SPCTL_OUTPUT" | grep -q "notarized"; then
+        log "$WARN Gatekeeper: requires notarization"
+    elif echo "$SPCTL_OUTPUT" | grep -q "not.*app"; then
+        log "$PASS Gatekeeper: valid code (not an app bundle)"
+    else
+        log "$FAIL Gatekeeper: rejected"
+        log "   $SPCTL_OUTPUT"
+    fi
 else
-    echo "❌ Adobe BSKL plugins directory not found" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log "$INFO Gatekeeper: $SPCTL_OUTPUT"
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 11. NumPy Architecture
-echo "=== NumPy Architecture ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-NUMPY_FILE="/Library/Application Support/BSKL/Render Engine/Python 3.10/lib/python3.10/site-packages/numpy/core/_multiarray_umath.cpython-310-darwin.so"
-if [ -f "$NUMPY_FILE" ]; then
-    arch=$(file "$NUMPY_FILE" | grep -o "arm64\|x86_64" | head -1)
-    echo "NumPy architecture: $arch" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+# Check if notarization can be verified online
+log ""
+log "${BLUE}Notarization Status (online check):${NC}"
+STAPLER_OUTPUT=$(xcrun stapler validate "$PLUGIN_PATH" 2>&1)
+if echo "$STAPLER_OUTPUT" | grep -q "valid"; then
+    log "$PASS Notarization: verified"
+elif echo "$STAPLER_OUTPUT" | grep -q "not valid"; then
+    log "$FAIL Notarization: NOT valid or not notarized"
+    SIGNING_ISSUE=1
+else
+    log "$INFO $STAPLER_OUTPUT"
+fi
+
+# ─────────────────────────────────────────────────────────────
+# 5. QUARANTINE
+# ─────────────────────────────────────────────────────────────
+print_section "Quarantine Status"
+
+QUARANTINE=$(xattr -p com.apple.quarantine "$PLUGIN_PATH" 2>/dev/null || echo "")
+
+if [ -n "$QUARANTINE" ]; then
+    log "$WARN Quarantine flag is SET"
+    log "   Value: $QUARANTINE"
+    log ""
+    log "${YELLOW}To remove quarantine, run:${NC}"
+    log "   xattr -cr \"$PLUGIN_PATH\""
 else
-    echo "❌ NumPy not found" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log "$PASS No quarantine flag"
+fi
+
+# ─────────────────────────────────────────────────────────────
+# 6. INFO.PLIST CHECK
+# ─────────────────────────────────────────────────────────────
+print_section "Info.plist Analysis"
+
+if [ -f "$PLIST_PATH" ]; then
+    # CFBundleIdentifier
+    BUNDLE_ID=$(/usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" "$PLIST_PATH" 2>/dev/null || echo "")
+    if [ -n "$BUNDLE_ID" ] && [ "$BUNDLE_ID" != "" ]; then
+        log "$PASS CFBundleIdentifier: $BUNDLE_ID"
+    else
+        log "$FAIL CFBundleIdentifier is EMPTY!"
+        log "   ${YELLOW}This may cause loading issues on some systems${NC}"
+    fi
+
+    # CFBundleExecutable
+    BUNDLE_EXEC=$(/usr/libexec/PlistBuddy -c "Print :CFBundleExecutable" "$PLIST_PATH" 2>/dev/null || echo "")
+    if [ "$BUNDLE_EXEC" = "$PLUGIN_NAME" ]; then
+        log "$PASS CFBundleExecutable: $BUNDLE_EXEC"
+    else
+        log "$WARN CFBundleExecutable: $BUNDLE_EXEC (expected: $PLUGIN_NAME)"
+    fi
+
+    # LSMinimumSystemVersion
+    MIN_VERSION=$(/usr/libexec/PlistBuddy -c "Print :LSMinimumSystemVersion" "$PLIST_PATH" 2>/dev/null || echo "not set")
+    log "$INFO Minimum macOS: $MIN_VERSION"
+
+    # Current macOS version
+    CURRENT_MACOS=$(sw_vers -productVersion)
+    log "$INFO Current macOS: $CURRENT_MACOS"
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 12. Test Server Connection
-echo "=== Server Connection Test ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-CURL_RESULT=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 3 http://127.0.0.1:7007/ 2>/dev/null)
-if [ "$CURL_RESULT" = "200" ] || [ "$CURL_RESULT" = "404" ] || [ "$CURL_RESULT" = "422" ]; then
-    echo "✅ Server responding (HTTP $CURL_RESULT)" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+# ─────────────────────────────────────────────────────────────
+# 7. ENTRY POINT CHECK (via nm)
+# ─────────────────────────────────────────────────────────────
+print_section "Entry Point"
+
+if [ -f "$BINARY_PATH" ]; then
+    if nm "$BINARY_PATH" 2>/dev/null | grep -q "_EffectMain"; then
+        log "$PASS EffectMain symbol exported"
+    elif nm "$BINARY_PATH" 2>/dev/null | grep -q "_main"; then
+        log "$WARN Found _main but not _EffectMain"
+    else
+        log "$FAIL No EffectMain symbol found!"
+    fi
+fi
+
+# ─────────────────────────────────────────────────────────────
+# 8. FILE PERMISSIONS & OWNERSHIP
+# ─────────────────────────────────────────────────────────────
+print_section "File Permissions & Ownership"
+
+PERM_ISSUES=0
+CURRENT_USER=$(whoami)
+
+log "${BLUE}Expected: owner=root or current user, readable by all${NC}"
+log ""
+
+# Check each file and directory
+while IFS= read -r item; do
+    # Get permissions, owner, group
+    STAT_OUTPUT=$(stat -f "%Sp %Su %Sg" "$item" 2>/dev/null)
+    PERMS=$(echo "$STAT_OUTPUT" | cut -d' ' -f1)
+    OWNER=$(echo "$STAT_OUTPUT" | cut -d' ' -f2)
+    GROUP=$(echo "$STAT_OUTPUT" | cut -d' ' -f3)
+
+    # Get relative path for display
+    REL_PATH="${item#$PLUGIN_PATH}"
+    [ -z "$REL_PATH" ] && REL_PATH="/"
+
+    # Check if it's a directory or file
+    if [ -d "$item" ]; then
+        ITEM_TYPE="d"
+        # Directories should be readable and executable (r-x) by all
+        if [[ "$PERMS" != d*r?x*r?x*r?x* ]] && [[ "$PERMS" != d*r?x*r?x* ]]; then
+            # Check if at least owner can read/execute
+            if [[ "$PERMS" == d*r?x* ]]; then
+                # Owner can access, check if current user is owner
+                if [ "$OWNER" != "$CURRENT_USER" ] && [ "$OWNER" != "root" ]; then
+                    log "$WARN $REL_PATH"
+                    log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
+                    log "      ${YELLOW}May not be accessible to After Effects${NC}"
+                    PERM_ISSUES=$((PERM_ISSUES + 1))
+                fi
+            else
+                log "$FAIL $REL_PATH"
+                log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
+                log "      ${RED}Directory not readable/executable${NC}"
+                PERM_ISSUES=$((PERM_ISSUES + 1))
+            fi
+        fi
+    else
+        ITEM_TYPE="f"
+        # Files should be readable by all, executable if binary
+        FILENAME=$(basename "$item")
+
+        # Check if file is readable
+        if [[ "$PERMS" != -*r* ]]; then
+            log "$FAIL $REL_PATH"
+            log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
+            log "      ${RED}File not readable${NC}"
+            PERM_ISSUES=$((PERM_ISSUES + 1))
+        fi
+
+        # Binary should be executable
+        if [ "$item" = "$BINARY_PATH" ]; then
+            if [[ "$PERMS" != -*x* ]]; then
+                log "$FAIL $REL_PATH"
+                log "      Perms: $PERMS  Owner: $OWNER:$GROUP"
+                log "      ${RED}Binary not executable${NC}"
+                PERM_ISSUES=$((PERM_ISSUES + 1))
+            fi
+        fi
+    fi
+
+    # Check for unusual owners (not root, not current user, not wheel/admin)
+    if [ "$OWNER" != "root" ] && [ "$OWNER" != "$CURRENT_USER" ] && [ "$OWNER" != "wheel" ]; then
+        # Only warn if we haven't already flagged this item
+        if [ $PERM_ISSUES -eq 0 ] || ! echo "$item" | grep -q "flagged"; then
+            log "$INFO $REL_PATH"
+            log "      Owner: $OWNER:$GROUP (unusual)"
+        fi
+    fi
+
+done < <(find "$PLUGIN_PATH" -print 2>/dev/null)
+
+# Summary of permissions
+log ""
+if [ $PERM_ISSUES -eq 0 ]; then
+    log "${GREEN}$PASS All permissions look correct${NC}"
 else
-    echo "❌ Server not responding (HTTP $CURL_RESULT)" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log "${RED}$FAIL Found $PERM_ISSUES permission issue(s)${NC}"
+    log ""
+    log "${YELLOW}To fix permissions, run:${NC}"
+    log "   sudo chmod -R a+rX \"$PLUGIN_PATH\""
+    log "   sudo chmod a+x \"$BINARY_PATH\""
 fi
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
 
-# 13. Collect Logs
-echo "=== Collecting Logs ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+# Show ownership summary
+log ""
+log "${BLUE}Ownership Summary:${NC}"
+# Get unique owners
+OWNERS=$(find "$PLUGIN_PATH" -print0 2>/dev/null | xargs -0 stat -f "%Su" | sort -u)
+for owner in $OWNERS; do
+    COUNT=$(find "$PLUGIN_PATH" -user "$owner" 2>/dev/null | wc -l | tr -d ' ')
+    log "   $owner: $COUNT items"
+done
+
+# ─────────────────────────────────────────────────────────────
+# 9. EXTENDED ATTRIBUTES
+# ─────────────────────────────────────────────────────────────
+print_section "Extended Attributes"
 
-# BSKL logs directory
-BSKL_LOGS="/Library/Application Support/BSKL/Logs"
-if [ -d "$BSKL_LOGS" ]; then
-    echo "Found logs:" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-    ls -la "$BSKL_LOGS"/*.log 2>/dev/null | tee -a "$OUTPUT_DIR/diagnostic.txt"
-    cp "$BSKL_LOGS"/*.log "$OUTPUT_DIR/" 2>/dev/null
-    echo "✅ Copied BSKL logs" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+# Check for any extended attributes on all files
+XATTR_FILES=0
+log "${BLUE}Checking for extended attributes on all files...${NC}"
+log ""
+
+while IFS= read -r item; do
+    XATTRS=$(xattr "$item" 2>/dev/null)
+    if [ -n "$XATTRS" ]; then
+        REL_PATH="${item#$PLUGIN_PATH}"
+        [ -z "$REL_PATH" ] && REL_PATH="/"
+
+        log "$WARN $REL_PATH"
+        echo "$XATTRS" | while read -r attr; do
+            if [ -n "$attr" ]; then
+                log "      $attr"
+            fi
+        done
+        XATTR_FILES=$((XATTR_FILES + 1))
+    fi
+done < <(find "$PLUGIN_PATH" -print 2>/dev/null)
+
+if [ $XATTR_FILES -eq 0 ]; then
+    log "${GREEN}$PASS No extended attributes found${NC}"
 else
-    echo "❌ BSKL logs directory not found" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+    log ""
+    log "${YELLOW}Found extended attributes on $XATTR_FILES file(s)${NC}"
+    log "${YELLOW}To remove all extended attributes, run:${NC}"
+    log "   xattr -cr \"$PLUGIN_PATH\""
+fi
+
+# ─────────────────────────────────────────────────────────────
+# SUMMARY
+# ─────────────────────────────────────────────────────────────
+print_header "Summary"
+
+ISSUES=0
+
+# Check for common issues
+if [ -z "$BUNDLE_ID" ] || [ "$BUNDLE_ID" = "" ]; then
+    log "$FAIL Empty CFBundleIdentifier - may cause 'entry point' errors"
+    ISSUES=$((ISSUES + 1))
+fi
+
+if [ -n "$QUARANTINE" ]; then
+    log "$WARN Quarantine flag set - may block plugin loading"
+    ISSUES=$((ISSUES + 1))
 fi
 
-# 14. Create ZIP archive
-echo "" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-echo "=== Creating ZIP Archive ===" | tee -a "$OUTPUT_DIR/diagnostic.txt"
+if [ $MISSING_DEPS -gt 0 ]; then
+    log "$FAIL Missing dependencies detected"
+    ISSUES=$((ISSUES + 1))
+fi
 
-ZIP_FILE="$HOME/Desktop/BSKL_Diagnostic_$(date +%Y%m%d_%H%M%S).zip"
-cd "$HOME/Desktop"
-zip -r "$ZIP_FILE" "$(basename $OUTPUT_DIR)" > /dev/null 2>&1
+if [ $SIGNING_ISSUE -gt 0 ]; then
+    log "$WARN Code signing or notarization issues detected"
+    ISSUES=$((ISSUES + 1))
+fi
 
-if [ -f "$ZIP_FILE" ]; then
-    # Cleanup temp folder
-    rm -rf "$OUTPUT_DIR"
+if [ $PERM_ISSUES -gt 0 ]; then
+    log "$FAIL Permission issues detected"
+    ISSUES=$((ISSUES + 1))
+fi
 
-    echo ""
-    echo "=========================================="
-    echo "✅ Done! Please send this file to support:"
-    echo "$ZIP_FILE"
-    echo "=========================================="
+if [ $ISSUES -eq 0 ]; then
+    log "${GREEN}$PASS No issues detected${NC}"
 else
-    echo "❌ Failed to create ZIP archive" | tee -a "$OUTPUT_DIR/diagnostic.txt"
-    echo "Diagnostic folder: $OUTPUT_DIR"
+    log ""
+    log "${YELLOW}Found $ISSUES potential issue(s)${NC}"
+    log ""
+    log "${BLUE}Quick fixes:${NC}"
+    if [ -n "$QUARANTINE" ]; then
+        log "  Remove quarantine:  xattr -cr \"$PLUGIN_PATH\""
+    fi
+    if [ $PERM_ISSUES -gt 0 ]; then
+        log "  Fix permissions:    sudo chmod -R a+rX \"$PLUGIN_PATH\""
+    fi
 fi
+
+# ─────────────────────────────────────────────────────────────
+# OUTPUT FILE INFO
+# ────────────────────────���────────────────────────────────────
+log ""
+log "═══════════════════════════════════════════════════════════"
+log ""
+log "${GREEN}📄 Report saved to:${NC}"
+log "   $OUTPUT_FILE"
+log ""
+log "${YELLOW}Please send this file to support for analysis.${NC}"
+log ""
+
+# Also print to console without colors for clarity
+echo ""
+echo "════════════════════════════════════════════════════════════"
+echo ""
+echo "📄 Report saved to Desktop:"
+echo "   $OUTPUT_FILE"
+echo ""
+echo "👉 Please send this file to BSKL support for analysis."
+echo ""