Let a multi-selection be copied as plain lines as well as a list

Copying several notes only produced a numbered list, which is wrong for
pasting into a prompt that already has structure. The selection now
offers both forms, Shift+click selects a range, and a selection bar
makes it obvious that more than one note is selected. Esc clears the
selection before it hides the panel.

AGENTS.md

@@ -13,19 +13,28 @@ clicking an item copies it back to the clipboard.
   `NSStatusItem Preferred Position Prompt`). Left click toggles the panel,
   right click shows the menu (accessibility state, launch at login, open data
   folder, quit). Contains the single-instance guard and `LoginItem`
-  (`SMAppService`).
+  (`SMAppService`). Also sets `NSApp.mainMenu` with Hide Panel (Cmd+W) and Quit
+  (Cmd+Q) — an accessory app shows no menu bar, but the main menu still
+  services key equivalents, which is the only way to quit from the keyboard
+  while the panel has focus. `applicationShouldHandleReopen` shows the panel so
+  launching an already-running app does something. Supports `--sync-check` and
+  `--diag` (writes the status item's frame and permission state to
+  `/tmp/prompt-diag.txt`, then exits).
 - `Sources/Prompt/Store.swift` — `@MainActor` `ObservableObject` singleton.
   Data model: `Section` → `[PromptItem]`, item content is
   `.text(String)` or `.image(String)` (filename). Persists to
   `~/Library/Application Support/Prompt/store.json`; images are PNG files in
   `Images/` next to it, cached in an `NSCache`. Owns all mutations (add,
   toggle done, edit, delete, move, merge, clear done) and clipboard writes
-  (`copy`, `copyAsList`). Saves on every mutation.
+  (`copy`, `copyAsList` for numbered output, `copyAsLines` for plain newlines;
+  both text modes skip image items). Saves on every mutation.
 - `Sources/Prompt/PanelView.swift` — the panel UI. Header (section switcher,
   search, add photos, close), item list, composer. Composer `# Name` creates/
-  switches sections. Click = copy; Cmd+click = multi-select; right-click =
+  switches sections. Click = copy; Cmd+click toggles multi-select, Shift+click
-  context menu (Copy, Copy as List, Done, Edit, Open, Merge, Move To, Delete).
+  selects a range, and a selection bar offers Copy as List / Copy as Lines;
-  Drop target for images/files.
+  right-click = context menu (Copy, Copy as List, Copy as Lines, Done, Edit,
+  Open, Merge, Move To, Delete). Esc clears the selection before it hides the
+  panel. Drop target for images/files.
 - `Sources/Prompt/PanelController.swift` — owns the floating `NSPanel`
   (`.nonactivatingPanel`, `.floating`, right-edge docked, frame autosaved as
   `PromptPanel`), the Cmd+V image-paste monitor, and `EditWindowController`
@@ -40,8 +49,16 @@ clicking an item copies it back to the clipboard.
   a global queue); only the store append hops back to main.
 - `Sources/Prompt/SyncService.swift` — optional sync client. Holds the group
   code and server URL in `UserDefaults` (`sync.code`, `sync.serverURL`,
-  `sync.version`), pushes the whole store as JSON, and polls every 5s.
+  `sync.version`). The URL defaults to `SyncService.defaultServerURL`
+  (`https://prompt.tzgyn.dev`); nothing is sent anywhere until a code exists,
+  because polling only runs when one is set. Pushes the whole store as JSON and
+  polls every 5s.
 - `Server/main.go` — the Go sync backend (single file, `net/http` + `lib/pq`).
+  Also ships `Server/Dockerfile` (static binary on distroless) and
+  `Server/README.md` (self-hosting). Logs one line per request, creates its
+  schema on startup, shuts down gracefully on SIGTERM so a redeploy cannot cut
+  off a push, and supports `-healthcheck` (pings local `/healthz`) so the
+  shell-less image needs no curl for its Docker `HEALTHCHECK`.
 
 ## Sync protocol
 
@@ -53,6 +70,7 @@ payload as opaque `JSONB`; it never parses note contents.
 | --- | --- |
 | `POST /api/codes` | Generates a unique code and inserts an empty group |
 | `GET /api/sync/{code}` | `{"version":N,"updatedAt":…,"data":{…}\|null}`, 404 if unknown |
+| `GET /api/sync/{code}/version` | `{"version":N}` — the cheap poll |
 | `PUT /api/sync/{code}` | Upserts the payload, returns the incremented version |
 | `GET /healthz` | Liveness |
 
@@ -60,6 +78,9 @@ Client rules:
 
 - Payload = `{sections, activeSectionID, images}`, where `images` maps a
   filename to base64 PNG so photos travel with the notes.
+- Polling is two-step: `GET /version` every 5s (tiny) and the full payload only
+  when the version moved. Fetching the payload unconditionally would re-download
+  every base64 photo every 5 seconds.
 - Version counter is server-owned; the client stores the last version it saw
   in `sync.version` and only applies a remote payload when `remote.version >
   lastVersion`.
@@ -138,7 +159,8 @@ brew upgrade --cask prompt
 - **Never bind bare keys as `.keyboardShortcut` in the panel** (Space, Delete,
   plain Cmd+C). SwiftUI key equivalents are matched before text input and
   would steal characters from the composer TextField. Only Cmd-modified
-  shortcuts that TextFields don't use are bound (Cmd+F/K/N, Shift+Cmd+C).
+  shortcuts that TextFields don't use are bound (Cmd+F/K/N, Shift+Cmd+C,
+  Option+Cmd+C).
   This is why Copy has no in-panel shortcut: click-to-copy is the primary
   gesture, matching Copper's intent.
 - The panel is a `.nonactivatingPanel`; its `canBecomeKey` override is what
@@ -155,7 +177,10 @@ brew upgrade --cask prompt
   the main thread (the hotkey handler already dispatches to a global queue).
 - The double-Shift tap needs Accessibility; without it the event tap silently
   fails and only the Carbon fallbacks work. The panel banner and the status
-  menu both surface the permission state.
+  menu both surface the permission state, and `AppDelegate` shows a launch
+  alert when it is missing — otherwise a user who hides the panel is locked out
+  (no hotkey, no Dock icon) and reports it as "the app won't come back". Check
+  with `Prompt --diag` (`accessibility: false` is the tell).
 - `Info.plist` sets `NSAllowsArbitraryLoads` because the sync server URL is
   user-supplied and is often plain HTTP (LAN address, self-hosted box). ATS
   would otherwise block it with a confusing error.

README.md

@@ -8,8 +8,9 @@ to your work. Click anything to copy it back to your clipboard.
 - **Capture from anywhere** — select text in any app and tap **Left Shift twice**.
 - **Photos** — paste (Cmd+V), drag & drop, or add via the photo button.
 - **Sections** — type `# Name` in the composer; Cmd+K switches sections.
-- **Copy as List** — Cmd+click to multi-select, right-click → Copy as List
+- **Copy as List / Copy as Lines** — Cmd+click to multi-select (Shift+click for
-  (or Shift+Cmd+C) for a numbered list ready to paste into a chat.
+  a range), then copy the selection as a numbered list or as plain
+  newline-separated text, from the selection bar or the right-click menu.
 - **Merge Notes, Mark as Done, Edit, Move To** — right-click any item.
 - **Search** — Cmd+F searches across all sections.
 - **Sync (optional)** — generate an 8-digit code (`1234-5678`) on one Mac and
@@ -29,13 +30,16 @@ to your work. Click anything to copy it back to your clipboard.
 | Focus composer | Cmd+N |
 | Sync settings | Cmd+, |
 | Copy selection as numbered list | Shift+Cmd+C |
+| Copy selection as plain lines | Option+Cmd+C |
+| Clear selection | Esc |
 | Close panel | Esc |
 
 Double-Shift gestures require **Accessibility access** (Prompt reads the
-selection by simulating Cmd+C, then restores your clipboard untouched). The
+selection by simulating Cmd+C, then restores your clipboard untouched). Until
-Cmd+Shift fallbacks work without it. Bare keys like Space and Cmd+C are
+it is granted, use Cmd+Shift+Space and Cmd+Shift+C, or click the menu bar icon
-deliberately not bound inside the panel so they never conflict with typing in
+— and launching the app again always brings the panel back. Bare keys like
-the composer.
+Space and Cmd+C are deliberately not bound inside the panel so they never
+conflict with typing in the composer.
 
 ## Install
 
@@ -58,17 +62,24 @@ PROMPT_SYNC_DATABASE_URL="postgres://localhost:5432/prompt_sync?sslmode=disable"
   go run .          # listens on :8080
 ```
 
-Then in the panel: click the sync icon, set the server URL (e.g.
+Or build the Docker image (`docker build -t prompt-sync Server/`) and point it
-`http://192.168.1.10:8080` or an HTTPS host), and either **Generate Code** on
+at your own Postgres — see [Server/README.md](Server/README.md) for that and for
-the first Mac or paste the code into **Join** on the other.
+deploying to a host.
+
+Then in the panel: click the sync icon (or Cmd+,), confirm the server URL, and
+either **Generate Code** on the first Mac or paste the code into **Join** on the
+other.
 
 Notes:
 
-- Both Macs must be able to reach the server. A LAN address or a Tailscale
+- Sync defaults to `https://prompt.tzgyn.dev`; change it in the sync panel to
-  hostname works; `localhost` only works if the server runs on the same Mac.
+  point at your own server. Both Macs must be able to reach it — a LAN address
+  or a Tailscale hostname works, and `localhost` only works if the server runs
+  on the same Mac. See [Server/README.md](Server/README.md) to deploy it.
 - Joining a group that already has notes replaces what's on that Mac.
-- The app polls every 5 seconds and pushes 1.5s after a change; last write
+- The app polls every 5 seconds (a tiny version check) and pushes 1.5s after a
-  wins. Changes that came from the server are not echoed back.
+  change; last write wins, and changes that came from the server are not echoed
+  back.
 - Verify sync from a terminal with `Prompt --sync-check`.
 
 ## Build from source

Server/.dockerignore

@@ -0,0 +1,4 @@
+.git
+prompt-sync
+prompt-sync-*
+*.md

Server/Dockerfile

@@ -0,0 +1,27 @@
+# Build stage: the server is pure Go (lib/pq is pure Go), so CGO is off and the
+# result is a static binary that runs on a shell-less base image.
+FROM golang:1.26-alpine AS build
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY *.go ./
+
+ARG TARGETOS
+ARG TARGETARCH
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
+    go build -trimpath -ldflags="-s -w" -o /prompt-sync .
+
+# Runtime stage: distroless has no shell, so the binary does its own
+# healthcheck (see -healthcheck in main.go). Runs as non-root.
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=build /prompt-sync /prompt-sync
+
+ENV PROMPT_SYNC_ADDR=:8080
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD ["/prompt-sync", "-healthcheck"]
+
+ENTRYPOINT ["/prompt-sync"]

Server/README.md

@@ -0,0 +1,116 @@
+# Prompt sync server
+
+Small Go service that stores one JSON blob per sync group, keyed by an 8-digit
+code (`1234-5678`). There is no authentication: the code is the shared secret,
+so anyone who knows it can read and overwrite that group. It is meant to be
+self-hosted for personal use, not exposed as a public service.
+
+## Requirements
+
+- Postgres (any recent version; developed against 18)
+- A host both Macs can reach — a VPS, a home server, or a Tailscale node
+
+## Run it
+
+```bash
+createdb prompt_sync
+cd Server
+PROMPT_SYNC_DATABASE_URL="postgres://localhost:5432/prompt_sync?sslmode=disable" \
+  go run .            # or: go build -o prompt-sync . && ./prompt-sync
+```
+
+| Env var | Default |
+| --- | --- |
+| `PROMPT_SYNC_ADDR` | `:8080` |
+| `PROMPT_SYNC_DATABASE_URL` | `postgres://localhost:5432/prompt_sync?sslmode=disable` |
+
+The schema is created on startup. Every request is logged as
+`METHOD PATH STATUS DURATION`; SIGTERM/SIGINT shut down gracefully so an
+in-flight push is not cut off mid-write. If the database is not reachable yet
+it retries five times, 2s apart, before giving up.
+
+> **`sslmode` matters.** lib/pq defaults to `sslmode=require`, so a connection
+> string copied from a host that runs Postgres *without* TLS (Coolify's
+> internal Postgres, a plain `docker run postgres`, Homebrew) fails with
+> `pq: SSL is not enabled on the server`. Append `?sslmode=disable` in that
+> case — the server prints exactly that hint when it hits this.
+
+## Deploying with Coolify
+
+Use a Dockerfile application pointed at this repo with base directory `Server/`
+(so Coolify builds `Server/Dockerfile`), expose port `8080`, and set:
+
+| Variable | Value |
+| --- | --- |
+| `PROMPT_SYNC_DATABASE_URL` | your Postgres URL **plus `?sslmode=disable`** |
+| `PROMPT_SYNC_ADDR` | `:8080` (this is already the default) |
+
+Coolify detects the `HEALTHCHECK` in the Dockerfile and runs
+`prompt-sync -healthcheck` with its 5s start period, so the container only goes
+live once `/healthz` answers. It also logs a generic warning that a healthcheck
+needs `curl` or `wget` — that does not apply here, the binary does its own
+check, so there is no reason to add either to the image (it is distroless and
+has no shell).
+
+## Run with Docker
+
+The image is a static binary on `distroless` (non-root, no shell), so its
+`HEALTHCHECK` calls `prompt-sync -healthcheck`, which pings the local
+`/healthz` — no curl needed in the image. That is what `docker ps` reports as
+the container health.
+
+```bash
+docker build -t prompt-sync Server/
+docker run -d --name prompt-sync -p 8080:8080 \
+  -e PROMPT_SYNC_DATABASE_URL="postgres://user:pass@host:5432/prompt_sync?sslmode=disable" \
+  prompt-sync
+
+docker logs -f prompt-sync         # request log
+```
+
+Postgres stays outside the container; the server only needs a URL. If Postgres
+runs on the Docker host itself, `host` is `host.docker.internal` on macOS and
+Windows, or the host's LAN address on Linux (`--network host` also works).
+
+## Deploy to a host
+
+Build for the host's architecture and ship the image, or build it on the host
+itself (a `git clone` plus `docker build` is usually simplest):
+
+```bash
+# build on the Mac for a linux/arm64 host, then copy it over
+docker build --platform linux/arm64 -t prompt-sync Server/
+docker save prompt-sync | gzip > prompt-sync.tar.gz
+scp prompt-sync.tar.gz <host>:
+ssh <host> 'gunzip -c prompt-sync.tar.gz | docker load'
+
+ssh <host> 'docker run -d --name prompt-sync --restart unless-stopped \
+  -p 8080:8080 \
+  -e PROMPT_SYNC_DATABASE_URL="postgres://user:pass@db-host:5432/prompt_sync?sslmode=disable" \
+  prompt-sync'
+```
+
+Put it behind TLS if it is reachable from the internet — the code is the only
+secret, and it travels in the URL path. Both plain HTTP and HTTPS work from the
+app; an HTTP URL is often fine over a LAN or Tailscale.
+
+## Endpoints
+
+| Method | Path | Behaviour |
+| --- | --- | --- |
+| `POST` | `/api/codes` | Generates a unique code, inserts an empty group |
+| `GET` | `/api/sync/{code}` | `{"version":N,"updatedAt":…,"data":{…}\|null}`, 404 if unknown |
+| `GET` | `/api/sync/{code}/version` | `{"version":N}` — cheap poll used by the app |
+| `PUT` | `/api/sync/{code}` | Upserts the payload, returns the incremented version |
+| `GET` | `/healthz` | Liveness (200) |
+
+Payloads are opaque `JSONB`; the server never parses note contents. Bodies are
+capped at 50 MB, which is generous enough for base64 photos.
+
+## Backups
+
+The whole state is one table, so `pg_dump prompt_sync` is a complete backup:
+
+```bash
+pg_dump prompt_sync | gzip > prompt_sync-$(date +%F).sql.gz
+```

Server/main.go

@@ -6,6 +6,7 @@
 //
 //	POST /api/codes           -> {"code":"1234-5678"}        (create group)
 //	GET  /api/sync/{code}     -> {"version":N,"data":{...}}  (404 if unknown)
+//	GET  /api/sync/{code}/version -> {"version":N}           (cheap poll)
 //	PUT  /api/sync/{code}     -> {"version":N+1}             (upsert payload)
 //	GET  /healthz             -> 200
 //
@@ -16,6 +17,7 @@
 package main
 
 import (
+	"context"
 	"crypto/rand"
 	"database/sql"
 	"encoding/json"
@@ -23,7 +25,10 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"os/signal"
 	"regexp"
+	"strings"
+	"syscall"
 	"time"
 
 	_ "github.com/lib/pq"
@@ -44,6 +49,13 @@ type Server struct {
 }
 
 func main() {
+	// -healthcheck pings the local /healthz and exits non-zero on failure. It
+	// exists so the container image can run on a shell-less base (distroless),
+	// where there is no wget or curl for a HEALTHCHECK to use.
+	if len(os.Args) > 1 && os.Args[1] == "-healthcheck" {
+		os.Exit(healthcheck())
+	}
+
 	dsn := os.Getenv("PROMPT_SYNC_DATABASE_URL")
 	if dsn == "" {
 		dsn = "postgres://localhost:5432/prompt_sync?sslmode=disable"
@@ -53,14 +65,11 @@ func main() {
 		addr = ":8080"
 	}
 
-	db, err := sql.Open("postgres", dsn)
+	db, err := openDatabase(dsn)
 	if err != nil {
-		log.Fatalf("open database: %v", err)
+		log.Fatalf("connect to database: %v%s", err, hintFor(err))
 	}
 	defer db.Close()
-	if err := db.Ping(); err != nil {
-		log.Fatalf("connect to database: %v", err)
-	}
 	if _, err := db.Exec(schema); err != nil {
 		log.Fatalf("ensure schema: %v", err)
 	}
@@ -69,13 +78,112 @@ func main() {
 	mux := http.NewServeMux()
 	mux.HandleFunc("POST /api/codes", s.createCode)
 	mux.HandleFunc("GET /api/sync/{code}", s.getSync)
+	mux.HandleFunc("GET /api/sync/{code}/version", s.getVersion)
 	mux.HandleFunc("PUT /api/sync/{code}", s.putSync)
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	})
 
+	server := &http.Server{
+		Addr:              addr,
+		Handler:           withLogging(mux),
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+
+	// Shut down cleanly so a redeploy (systemd restart, container stop) never
+	// cuts off an in-flight push and leaves a client thinking it failed.
+	stop := make(chan os.Signal, 1)
+	signal.Notify(stop, os.Interrupt, syscall.SIGTERM)
+	go func() {
+		<-stop
+		log.Println("shutting down")
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		_ = server.Shutdown(ctx)
+	}()
+
 	log.Printf("prompt-sync listening on %s", addr)
-	log.Fatal(http.ListenAndServe(addr, mux))
+	if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		log.Fatalf("serve: %v", err)
+	}
+}
+
+// openDatabase connects, retrying briefly so a deploy is not marked unhealthy
+// just because Postgres was still starting up.
+func openDatabase(dsn string) (*sql.DB, error) {
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		return nil, err
+	}
+	var lastErr error
+	for attempt := 1; attempt <= 5; attempt++ {
+		if lastErr = db.Ping(); lastErr == nil {
+			return db, nil
+		}
+		if attempt < 5 {
+			log.Printf("database not ready (attempt %d/5): %v", attempt, lastErr)
+			time.Sleep(2 * time.Second)
+		}
+	}
+	db.Close()
+	return nil, lastErr
+}
+
+// hintFor turns the most common connection failure into something actionable.
+// lib/pq defaults to sslmode=require, so any DSN copied from a host that runs
+// Postgres without TLS (Coolify's internal Postgres, docker-compose, Homebrew)
+// fails with a bare "SSL is not enabled on the server".
+func hintFor(err error) string {
+	if !strings.Contains(err.Error(), "SSL is not enabled") {
+		return ""
+	}
+	return "\n\nhint: lib/pq defaults to sslmode=require, but that Postgres has TLS off." +
+		"\n      Append ?sslmode=disable to PROMPT_SYNC_DATABASE_URL" +
+		"\n      (e.g. postgres://user:pass@host:5432/prompt_sync?sslmode=disable)."
+}
+
+// healthcheck returns 0 when the local /healthz answers 200.
+func healthcheck() int {
+	addr := os.Getenv("PROMPT_SYNC_ADDR")
+	if addr == "" {
+		addr = ":8080"
+	}
+	if strings.HasPrefix(addr, ":") {
+		addr = "127.0.0.1" + addr
+	}
+	client := &http.Client{Timeout: 3 * time.Second}
+	response, err := client.Get("http://" + addr + "/healthz")
+	if err != nil {
+		log.Printf("healthcheck: %v", err)
+		return 1
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		log.Printf("healthcheck: unexpected status %d", response.StatusCode)
+		return 1
+	}
+	return 0
+}
+
+// withLogging keeps a one-line trail of method, path, status and duration so a
+// self-hosted deployment can be debugged from journalctl or docker logs.
+func withLogging(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		started := time.Now()
+		recorder := &statusRecorder{ResponseWriter: w, status: http.StatusOK}
+		next.ServeHTTP(recorder, r)
+		log.Printf("%s %s %d %s", r.Method, r.URL.Path, recorder.status, time.Since(started).Round(time.Millisecond))
+	})
+}
+
+type statusRecorder struct {
+	http.ResponseWriter
+	status int
+}
+
+func (r *statusRecorder) WriteHeader(status int) {
+	r.status = status
+	r.ResponseWriter.WriteHeader(status)
 }
 
 // createCode generates a unique 8-digit code, formats it as 1234-5678, and
@@ -136,6 +244,27 @@ func (s *Server) getSync(w http.ResponseWriter, r *http.Request) {
 		version, updatedAt.UTC().Format(time.RFC3339), data)
 }
 
+// getVersion is the cheap poll: clients ask for the version every few seconds
+// and only download the payload (which can carry base64 images) when it moved.
+func (s *Server) getVersion(w http.ResponseWriter, r *http.Request) {
+	code := r.PathValue("code")
+	if !codePattern.MatchString(code) {
+		writeError(w, http.StatusBadRequest, "code must look like 1234-5678")
+		return
+	}
+	var version int64
+	err := s.db.QueryRow(`SELECT version FROM sync_groups WHERE code = $1`, code).Scan(&version)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "unknown code")
+		return
+	}
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "database error")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]int64{"version": version})
+}
+
 func (s *Server) putSync(w http.ResponseWriter, r *http.Request) {
 	code := r.PathValue("code")
 	if !codePattern.MatchString(code) {

Sources/Prompt/App.swift

@@ -27,6 +27,18 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
             return
         }
 
+        // --diag reports where the status item landed. On a notched Mac a
+        // brand-new item can be placed under the notch and be unclickable,
+        // which locks the user out once the panel is hidden.
+        if CommandLine.arguments.contains("--diag") {
+            setupStatusItem()
+            DispatchQueue.main.asyncAfter(deadline: .now() + 1.0) {
+                self.writeDiagnostics()
+                NSApp.terminate(nil)
+            }
+            return
+        }
+
         // Single instance: stale copies keep their hotkeys alive after an
         // update and eat the events meant for the new instance.
         let myPid = ProcessInfo.processInfo.processIdentifier
@@ -47,6 +59,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         HotkeyManager.shared.start()
 
         setupStatusItem()
+        setupMainMenu()
+        promptForAccessibilityIfNeeded()
 
         // Show the panel on launch so the app is discoverable (it has no Dock
         // icon and the menu bar icon can be hard to spot on a full bar).
@@ -56,6 +70,94 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         }
     }
 
+    /// Without Accessibility the Shift-Shift gestures fail silently, so the
+    /// panel can be hidden with no obvious way back. Say so on launch and
+    /// point at the shortcut that works without the permission.
+    private func promptForAccessibilityIfNeeded() {
+        guard !AXIsProcessTrusted() else { return }
+        let alert = NSAlert()
+        alert.messageText = "Prompt needs Accessibility access"
+        alert.informativeText = """
+        Capturing with Shift-Shift (and showing the panel with right Shift twice) \
+        only works with Accessibility access.
+
+        Until it is granted, use Cmd+Shift+Space to show or hide the panel and \
+        Cmd+Shift+C to capture, or click the menu bar icon.
+        """
+        alert.addButton(withTitle: "Open Settings")
+        alert.addButton(withTitle: "Later")
+        if alert.runModal() == .alertFirstButtonReturn {
+            let options = [kAXTrustedCheckOptionPrompt.takeUnretainedValue(): true] as CFDictionary
+            _ = AXIsProcessTrustedWithOptions(options)
+        }
+    }
+
+    /// A launched-again app must reveal itself. Without this, `open` (or
+    /// clicking it in Finder/Spotlight) hits the running instance, which does
+    /// nothing, so the app looks like it never started.
+    @MainActor
+    func applicationShouldHandleReopen(_ sender: NSApplication, hasVisibleWindows flag: Bool) -> Bool {
+        PanelController.shared.show()
+        return true
+    }
+
+    @MainActor
+    func applicationShouldTerminate(_ sender: NSApplication) -> NSApplication.TerminateReply {
+        // Stop the poll timer, any queued push, the event tap and the Carbon
+        // hotkeys so termination cannot be held up by a live callback.
+        SyncService.shared.stop()
+        HotkeyManager.shared.stop()
+        return .terminateNow
+    }
+
+    /// Accessory apps have no visible menu bar, but the main menu still
+    /// services key equivalents — this is what makes Cmd+Q and Cmd+W work
+    /// while the panel has focus.
+    private func setupMainMenu() {
+        let mainMenu = NSMenu()
+        let appMenuItem = NSMenuItem()
+        mainMenu.addItem(appMenuItem)
+
+        let appMenu = NSMenu()
+        appMenuItem.submenu = appMenu
+
+        let hide = NSMenuItem(title: "Hide Panel", action: #selector(hidePanel), keyEquivalent: "w")
+        hide.target = self
+        appMenu.addItem(hide)
+
+        appMenu.addItem(.separator())
+
+        let quit = NSMenuItem(title: "Quit Prompt", action: #selector(quit), keyEquivalent: "q")
+        quit.target = self
+        appMenu.addItem(quit)
+
+        NSApp.mainMenu = mainMenu
+    }
+
+    @MainActor @objc private func hidePanel() {
+        PanelController.shared.hide()
+    }
+
+    @MainActor
+    private func writeDiagnostics() {
+        var lines = ["Prompt diagnostics", "accessibility: \(AXIsProcessTrusted())"]
+        if let window = statusItem?.button?.window {
+            lines.append("status item frame: \(window.frame)")
+            if let screen = window.screen ?? NSScreen.main {
+                lines.append("screen: \(screen.frame) visible: \(screen.visibleFrame)")
+                lines.append("notch inset: \(screen.safeAreaInsets)")
+                let underNotch = window.frame.maxX > screen.frame.maxX - screen.safeAreaInsets.right
+                lines.append("under the notch: \(underNotch)")
+            }
+        } else {
+            lines.append("status item has no window (not in the menu bar)")
+        }
+        lines.append("preferred position: \(UserDefaults.standard.object(forKey: "NSStatusItem Preferred Position Prompt") ?? "unset")")
+        try? lines.joined(separator: "\n").write(
+            to: URL(fileURLWithPath: "/tmp/prompt-diag.txt"), atomically: true, encoding: .utf8
+        )
+    }
+
     private func setupStatusItem() {
         let item = NSStatusBar.system.statusItem(withLength: NSStatusItem.squareLength)
         item.autosaveName = "Prompt"

Sources/Prompt/HotkeyManager.swift

@@ -34,6 +34,22 @@ final class HotkeyManager {
         registerFallbackHotkeys()
     }
 
+    func stop() {
+        if let tap = eventTap {
+            CGEvent.tapEnable(tap: tap, enable: false)
+            CFMachPortInvalidate(tap)
+        }
+        if let source = runLoopSource {
+            CFRunLoopRemoveSource(CFRunLoopGetMain(), source, .commonModes)
+        }
+        for ref in hotKeyRefs {
+            if let ref { UnregisterEventHotKey(ref) }
+        }
+        hotKeyRefs.removeAll()
+        eventTap = nil
+        runLoopSource = nil
+    }
+
     // MARK: - Double-Shift event tap
 
     private func startEventTap() {

Sources/Prompt/PanelController.swift

@@ -31,12 +31,14 @@ final class PanelController: NSObject {
         }
         NSApp.activate(ignoringOtherApps: true)
         panel.makeKeyAndOrderFront(nil)
+        NSLog("Prompt: panel shown")
         NotificationCenter.default.post(name: .promptPanelDidShow, object: nil)
     }
 
     func hide() {
         panel?.orderOut(nil)
         NSApp.deactivate()
+        NSLog("Prompt: panel hidden (app keeps running for the Shift-Shift hotkeys)")
     }
 
     private func makePanel() -> KeyablePanel {

Sources/Prompt/PanelView.swift

@@ -13,6 +13,7 @@ struct PanelView: View {
     @State private var showSync = false
     @State private var joinCode = ""
     @State private var selection = Set<UUID>()
+    @State private var lastSelectedID: UUID?
     @State private var copiedID: UUID?
     @State private var accessibilityGranted = AXIsProcessTrusted()
 
@@ -31,6 +32,9 @@ struct PanelView: View {
             Divider()
             content
             Divider()
+            if !selection.isEmpty {
+                selectionBar
+            }
             composerField
         }
         .frame(minWidth: 300)
@@ -76,7 +80,8 @@ struct PanelView: View {
             Button { addPhotos() } label: { Image(systemName: "photo.on.rectangle.angled") }
                 .buttonStyle(.plain).foregroundStyle(.secondary).help("Add photos")
             Button { PanelController.shared.hide() } label: { Image(systemName: "xmark") }
-                .buttonStyle(.plain).foregroundStyle(.secondary).help("Close (Esc)")
+                .buttonStyle(.plain).foregroundStyle(.secondary)
+                .help("Hide the panel (Cmd+W) — Prompt keeps running so Shift-Shift capture still works. Quit from the menu bar icon or Cmd+Q.")
         }
         .padding(.horizontal, 12)
         .padding(.vertical, 10)
@@ -86,8 +91,13 @@ struct PanelView: View {
         HStack(spacing: 8) {
             Image(systemName: "exclamationmark.triangle.fill")
                 .foregroundStyle(.yellow)
+            VStack(alignment: .leading, spacing: 2) {
                 Text("Shift-tap capture needs Accessibility access.")
                     .font(.caption)
+                Text("Meanwhile: Cmd+Shift+Space toggles this panel.")
+                    .font(.caption2)
+                    .foregroundStyle(.secondary)
+            }
             Spacer()
             Button("Grant…") {
                 let options = [kAXTrustedCheckOptionPrompt.takeUnretainedValue(): true] as CFDictionary
@@ -217,6 +227,7 @@ struct PanelView: View {
             }
         }
         .buttonStyle(.plain)
+        .help("Click to copy · Cmd+click to select several · Shift+click for a range · right-click for more")
         .contextMenu { contextMenu(for: item) }
     }
 
@@ -256,7 +267,11 @@ struct PanelView: View {
             Button("Copy") { copy(item) }
             Button("Copy as List") {
                 store.copyAsList(ids: effectiveIDs(for: item))
-                flashCopied(item)
+                flashCopied(item.id)
+            }
+            Button("Copy as Lines") {
+                store.copyAsLines(ids: effectiveIDs(for: item))
+                flashCopied(item.id)
             }
             Divider()
             Button(item.done ? "Mark as Not Done" : "Mark as Done") { store.toggleDone(item.id) }
@@ -273,7 +288,7 @@ struct PanelView: View {
             if selection.count > 1, selection.contains(item.id) {
                 Button("Merge Notes") {
                     store.merge(ids: selection)
-                    selection.removeAll()
+                    clearSelection()
                 }
             }
             Menu("Move To") {
@@ -450,6 +465,49 @@ struct PanelView: View {
         }
     }
 
+    // MARK: - Selection
+
+    private var selectionBar: some View {
+        HStack(spacing: 12) {
+            Text("\(selection.count) selected")
+                .font(.caption)
+                .foregroundStyle(.secondary)
+            Spacer()
+            Button("Copy as List") { copySelection(asList: true) }
+                .font(.caption)
+                .buttonStyle(.plain)
+                .foregroundStyle(Color.accentColor)
+            Button("Copy as Lines") { copySelection(asList: false) }
+                .font(.caption)
+                .buttonStyle(.plain)
+                .foregroundStyle(Color.accentColor)
+            Button { clearSelection() } label: {
+                Image(systemName: "xmark.circle.fill")
+            }
+            .buttonStyle(.plain)
+            .foregroundStyle(.tertiary)
+            .help("Clear selection (Esc)")
+        }
+        .padding(.horizontal, 12)
+        .padding(.vertical, 6)
+        .background(Color.accentColor.opacity(0.12))
+    }
+
+    private func copySelection(asList: Bool) {
+        guard !selection.isEmpty else { return }
+        if asList {
+            store.copyAsList(ids: selection)
+        } else {
+            store.copyAsLines(ids: selection)
+        }
+        if let id = selection.first { flashCopied(id) }
+    }
+
+    private func clearSelection() {
+        selection.removeAll()
+        lastSelectedID = nil
+    }
+
     // MARK: - Composer
 
     private var composerField: some View {
@@ -458,7 +516,15 @@ struct PanelView: View {
                 .textFieldStyle(.plain)
                 .focused($focusedField, equals: .composer)
                 .onSubmit(submit)
-                .onExitCommand { PanelController.shared.hide() }
+                .onExitCommand {
+                    // Esc clears a selection first, and only hides the panel
+                    // once there is nothing selected.
+                    if selection.isEmpty {
+                        PanelController.shared.hide()
+                    } else {
+                        clearSelection()
+                    }
+                }
             if !composer.isEmpty {
                 Button(action: submit) { Image(systemName: "arrow.up.circle.fill") }
                     .buttonStyle(.plain)
@@ -500,11 +566,13 @@ struct PanelView: View {
             }
             .keyboardShortcut(",", modifiers: .command)
             Button("") {
-                guard !selection.isEmpty else { return }
+                copySelection(asList: true)
-                store.copyAsList(ids: selection)
-                if let id = selection.first { flashCopied(PromptItem(id: id, content: .text(""))) }
             }
             .keyboardShortcut("c", modifiers: [.command, .shift])
+            Button("") {
+                copySelection(asList: false)
+            }
+            .keyboardShortcut("c", modifiers: [.command, .option])
         }
         .opacity(0)
         .frame(width: 0, height: 0)
@@ -514,26 +582,40 @@ struct PanelView: View {
     // MARK: - Actions
 
     private func handleClick(_ item: PromptItem) {
-        if NSApp.currentEvent?.modifierFlags.contains(.command) == true {
+        let modifiers = NSApp.currentEvent?.modifierFlags ?? []
+        if modifiers.contains(.command) {
             if selection.contains(item.id) {
                 selection.remove(item.id)
             } else {
                 selection.insert(item.id)
             }
+            lastSelectedID = item.id
+            return
+        }
+        if modifiers.contains(.shift), let anchor = lastSelectedID, anchor != item.id {
+            selectRange(from: anchor, to: item.id)
             return
         }
         copy(item)
     }
 
-    private func copy(_ item: PromptItem) {
+    private func selectRange(from anchor: UUID, to target: UUID) {
-        store.copy(item)
+        let ids = displayedItems.map(\.item.id)
-        flashCopied(item)
+        guard let start = ids.firstIndex(of: anchor), let end = ids.firstIndex(of: target) else { return }
+        let range = start <= end ? start...end : end...start
+        selection = Set(ids[range])
+        lastSelectedID = target
     }
 
-    private func flashCopied(_ item: PromptItem) {
+    private func copy(_ item: PromptItem) {
-        withAnimation { copiedID = item.id }
+        store.copy(item)
+        flashCopied(item.id)
+    }
+
+    private func flashCopied(_ id: UUID) {
+        withAnimation { copiedID = id }
         DispatchQueue.main.asyncAfter(deadline: .now() + 1.2) {
-            if copiedID == item.id {
+            if copiedID == id {
                 withAnimation { copiedID = nil }
             }
         }

Sources/Prompt/Store.swift

@@ -269,18 +269,34 @@ final class Store: ObservableObject {
     }
 
     func copyAsList(ids: Set<UUID>) {
-        let items = sections.flatMap(\.items)
+        let texts = selectedTexts(ids: ids)
+        guard !texts.isEmpty else { return }
+        let list = texts.enumerated().map { "\($0.offset + 1). \($0.element)" }.joined(separator: "\n")
+        writeToPasteboard(list)
+    }
+
+    /// Same selection as `copyAsList`, but joined with plain newlines so it
+    /// drops into a prompt without numbering.
+    func copyAsLines(ids: Set<UUID>) {
+        let texts = selectedTexts(ids: ids)
+        guard !texts.isEmpty else { return }
+        writeToPasteboard(texts.joined(separator: "\n"))
+    }
+
+    private func selectedTexts(ids: Set<UUID>) -> [String] {
+        sections.flatMap(\.items)
             .filter { ids.contains($0.id) }
             .sorted { $0.createdAt < $1.createdAt }
-        let texts = items.compactMap { item -> String? in
+            .compactMap { item in
                 if case .text(let text) = item.content { return text }
                 return nil
             }
-        guard !texts.isEmpty else { return }
+    }
-        let list = texts.enumerated().map { "\($0.offset + 1). \($0.element)" }.joined(separator: "\n")
+
+    private func writeToPasteboard(_ string: String) {
         let pasteboard = NSPasteboard.general
         pasteboard.clearContents()
-        pasteboard.setString(list, forType: .string)
+        pasteboard.setString(string, forType: .string)
     }
 
     // MARK: - Images

Sources/Prompt/SyncService.swift

@@ -39,6 +39,9 @@ final class SyncService: ObservableObject {
     private static let urlKey = "sync.serverURL"
     private static let versionKey = "sync.version"
 
+    /// Where sync points unless the user overrides it in the sync panel.
+    static let defaultServerURL = "https://prompt.tzgyn.dev"
+
     private var lastVersion: Int64 {
         get { Int64(defaults.integer(forKey: Self.versionKey)) }
         set { defaults.set(newValue, forKey: Self.versionKey) }
@@ -54,7 +57,7 @@ final class SyncService: ObservableObject {
 
     private init() {
         code = defaults.string(forKey: Self.codeKey)
-        serverURL = defaults.string(forKey: Self.urlKey) ?? "http://localhost:8080"
+        serverURL = defaults.string(forKey: Self.urlKey) ?? Self.defaultServerURL
     }
 
     func start() {
@@ -64,6 +67,14 @@ final class SyncService: ObservableObject {
         restartPolling()
     }
 
+    func stop() {
+        pollTimer?.invalidate()
+        pollTimer = nil
+        pushWork?.cancel()
+        pushWork = nil
+        Store.shared.onDidChange = nil
+    }
+
     // MARK: - Group membership
 
     func generateCode() {
@@ -181,22 +192,34 @@ final class SyncService: ObservableObject {
     }
 
     private func poll() {
-        guard !isSyncing, let code, let url = endpoint("/api/sync/\(code)") else { return }
+        guard !isSyncing, let code, let versionURL = endpoint("/api/sync/\(code)/version") else { return }
         Task {
             do {
-                let (data, response) = try await URLSession.shared.data(from: url)
+                // Cheap poll first: the full payload can be megabytes of
-                if (response as? HTTPURLResponse)?.statusCode == 404 {
+                // base64 images, so only download it when the version moved.
+                let (versionData, versionResponse) = try await URLSession.shared.data(from: versionURL)
+                if (versionResponse as? HTTPURLResponse)?.statusCode == 404 {
                     lastError = "Sync group no longer exists on the server"
                     return
                 }
-                guard let http = response as? HTTPURLResponse, http.statusCode == 200 else {
+                guard let versionHTTP = versionResponse as? HTTPURLResponse, versionHTTP.statusCode == 200 else {
-                    syncLog("poll HTTP \((response as? HTTPURLResponse)?.statusCode ?? -1)")
+                    syncLog("poll HTTP \((versionResponse as? HTTPURLResponse)?.statusCode ?? -1)")
                     return
                 }
+                let remoteVersion = try JSONDecoder().decode([String: Int64].self, from: versionData)["version"] ?? 0
+                guard remoteVersion > lastVersion else {
+                    lastError = nil
+                    return
+                }
+                syncLog("poll remote v\(remoteVersion) local v\(lastVersion) — fetching payload")
+                guard let payloadURL = endpoint("/api/sync/\(code)") else { return }
+                let (data, response) = try await URLSession.shared.data(from: payloadURL)
+                guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return }
                 let remote = try JSONDecoder().decode(SyncGetResponse.self, from: data)
-                syncLog("poll remote v\(remote.version) local v\(lastVersion)")
+                if let payload = remote.data {
-                if remote.version > lastVersion, let payload = remote.data {
                     apply(payload, version: remote.version)
+                } else {
+                    lastVersion = remote.version
                 }
                 lastError = nil
             } catch {