[iamnbutler]

Development builds had the release identity (dev.githubnext.desktop-tools) and ran from scattered build folders (12 copies under /tmp). macOS seems to ask again for its dated screen-capture approval ("bypass the system private window picker") per copy, so live runs stacked prompts. This follows Ace's approach (ace2 docs/desktop.md, UI testing).

• Identity: npm run dev-app builds Desktop Tools Dev.app with the bundle ID dev.githubnext.desktop-tools.dev, nested under the release ID as feat: ask once per agent before it controls the Mac, and keep agent input off Desktop Tools' own UI (#24) #120's self-target guard requires. The client is ….dev.desktop-client; sign now takes the client identifier from the bundle's Info.plist, so release signing is unchanged.
• Fixed path: ~/Library/Application Support/desktop-tools/dev/Desktop Tools Dev.app, shared by every checkout and worktree. A build stages a sibling folder, quits the running dev app, replaces the bundle in place and opens it with open (LaunchServices), not by exec'ing the binary. npm run dev-app -- --stop quits it.
• State: the app defaults to ~/.local/state/desktop-tools-dev when its bundle ID ends in .dev, so it can't relink the installed app's client even when opened from Finder. DESKTOP_TOOLS_STATE still overrides, and is passed through open --env. Approved agents (feat: ask once per agent before it controls the Mac, and keep agent input off Desktop Tools' own UI (#24) #120) live in that folder, so the dev app asks about each agent once, separately.
• Signing: one identity, from DESKTOP_TOOLS_CODESIGN_IDENTITY or the git config desktopTools.codesignIdentity, which all worktrees share. Ad-hoc signing is refused. On this Mac the config is set to the Developer ID SHA-1. The designated requirement stays identifier "dev.githubnext.desktop-tools.dev" and anchor apple generic and … across rebuilds.
• Docs: a Development app section in docs/build.md; docs/app.md and docs/live-checks.md point at it.

Verified

• npm test (70) and npm run check pass.
• npm run dev-app built, signed and installed the app, and opened it. desktop_apps (installed release tools) shows dev.githubnext.desktop-tools.dev running from the fixed path.
• An MCP client with DESKTOP_TOOLS_STATE=~/.local/state/desktop-tools-dev answered desktop_apps through it.
• A second npm run dev-app replaced the running app in place, and the client connected again.
• --stop quit it, a second --stop reported nothing running, and no staging folder was left.

For the user: this is a new identity, so macOS lists Desktop Tools Dev separately. It needs Accessibility, Screen Recording and Keyboard input granted once, plus one capture approval. Rebuilds keep them. Nothing in System Settings was clicked. The dev app is currently quit.