Prompt for protected macOS channels

clients/apple/dotnet/README.md

@@ -2,7 +2,7 @@
 
 `VoiceCat.Mac` is the native AppKit C# port. It targets `net10.0-macos` and references the same `VoiceCat.Core` and `VoiceCat.Audio` assemblies used by the Windows client and managed CLI.
 
-The current checkpoint is a functional client: AppKit launch/menu lifecycle, saved server profiles, guest and account authentication, explicit TOFU approval (including changed-key warning), channel selection, user roster, channel text, voice subscription, managed microphone-stream lifecycle, default-device Core Audio capture/playback, disconnect reporting, native accessibility labels, sandbox/network/audio entitlements, and deterministic disposal. Profiles save the host, port, authentication mode, username or guest nickname; account passwords remain session-only and are never written to the profile JSON. Capture is converted to interleaved 48 kHz int16 PCM through `AVAudioConverter`; playback uses an `AVAudioSourceNode` and the shared bounded `PcmRing`, so its render callback does not allocate, lock, or block. It does not yet replace the Swift release. Protected-channel prompts, optional Keychain credentials, non-default device selection, moderation sheets, private messages, settings, ScreenCaptureKit sharing, VoiceOver verification, signing and notarization remain.
+The current checkpoint is a functional client: AppKit launch/menu lifecycle, saved server profiles, guest and account authentication, explicit TOFU approval (including changed-key warning), protected-channel password prompts, channel selection, user roster, channel text, voice subscription, managed microphone-stream lifecycle, default-device Core Audio capture/playback, disconnect reporting, native accessibility labels, sandbox/network/audio entitlements, and deterministic disposal. Profiles save the host, port, authentication mode, username or guest nickname; account passwords remain session-only and are never written to the profile JSON. Capture is converted to interleaved 48 kHz int16 PCM through `AVAudioConverter`; playback uses an `AVAudioSourceNode` and the shared bounded `PcmRing`, so its render callback does not allocate, lock, or block. It does not yet replace the Swift release. Optional Keychain credentials, non-default device selection, moderation sheets, private messages, settings, ScreenCaptureKit sharing, VoiceOver verification, signing and notarization remain.
 
 Build on Apple Silicon macOS 15.6+ with Xcode 26 and the .NET 10 macOS workload:
 

clients/apple/dotnet/VoiceCat.Mac/MainWindowController.cs

@@ -23,6 +23,7 @@ internal sealed class MainWindowController : NSWindowController
     private uint currentChannel = 1;
     private uint microphoneStreamId;
     private bool joinedVoice;
+    private bool changingChannel;
     private IAudioCapture? microphone;
     private IAudioPlayback? playback;
 
@@ -61,7 +62,11 @@ internal sealed class MainWindowController : NSWindowController
     private void RefreshState()
     {
         channels.RemoveAllItems();
-        foreach (var channel in client.Channels.OrderBy(c => c.Order).ThenBy(c => c.Name)) { channels.AddItem(channel.Name); channels.LastItem!.RepresentedObject = new NSString(channel.Id.ToString()); }
+        foreach (var channel in client.Channels.OrderBy(c => c.Order).ThenBy(c => c.Name))
+        {
+            channels.AddItem(channel.Name + (channel.PasswordProtected ? " [password]" : ""));
+            channels.LastItem!.RepresentedObject = new NSString(channel.Id.ToString());
+        }
         currentChannel = client.Users.FirstOrDefault(u => u.Id == selfId)?.ChannelId ?? currentChannel;
         int selectedIndex = client.Channels.ToList().FindIndex(c => c.Id == currentChannel); if (selectedIndex >= 0) channels.SelectItem(selectedIndex);
         users.Value = string.Join("\n", client.Users.Where(u => u.ChannelId == currentChannel).OrderBy(u => u.Nickname).Select(u => (u.Id == selfId ? "You — " : "") + u.Nickname));
@@ -69,16 +74,49 @@ internal sealed class MainWindowController : NSWindowController
     }
     private async void ChangeChannel(object? sender, EventArgs args)
     {
-        if (!uint.TryParse(channels.SelectedItem?.RepresentedObject?.ToString(), out uint id) || id == currentChannel) return;
+        if (changingChannel || !uint.TryParse(channels.SelectedItem?.RepresentedObject?.ToString(), out uint id) || id == currentChannel) return;
+        var channel = client.Channels.FirstOrDefault(item => item.Id == id);
+        if (channel is null) { RefreshState(); return; }
+        string? password = channel.PasswordProtected ? PromptForChannelPassword(channel.Name) : "";
+        if (password is null) { RefreshState(); return; }
+        bool resumeVoice = joinedVoice;
         try
         {
-            bool resumeVoice = joinedVoice;
+            changingChannel = true; channels.Enabled = false;
             if (resumeVoice) await LeaveVoice();
-            var result = (await client.RequestAsync(new() { JoinChannel = new() { ChannelId = id } })).JoinChannelResult;
-            if (!result.Ok) status.StringValue = result.Error;
+            var result = (await client.RequestAsync(new() { JoinChannel = new() { ChannelId = id, Password = password } })).JoinChannelResult;
+            if (result.Ok) currentChannel = id;
             if (resumeVoice) await JoinVoice();
+            RefreshState();
+            status.StringValue = result.Ok ? $"Joined {channel.Name}" : result.Error;
         }
-        catch (Exception exception) { status.StringValue = exception.Message; }
+        catch (Exception exception)
+        {
+            string message = exception.Message;
+            if (resumeVoice && !joinedVoice)
+            {
+                try { await JoinVoice(); }
+                catch (Exception restoreException) { message += " Voice could not be restored: " + restoreException.Message; }
+            }
+            RefreshState(); status.StringValue = message;
+        }
+        finally { changingChannel = false; channels.Enabled = true; }
+    }
+
+    private string? PromptForChannelPassword(string channelName)
+    {
+        var field = new NSSecureTextField(new CGRect(0, 0, 320, 26)) { PlaceholderString = "Channel password" };
+        ((INSAccessibility)field).AccessibilityLabel = $"Password for {channelName}";
+        var alert = new NSAlert
+        {
+            MessageText = $"Join {channelName}",
+            InformativeText = "Enter the channel password.",
+            AlertStyle = NSAlertStyle.Informational,
+            AccessoryView = field
+        };
+        alert.AddButton("Join"); alert.AddButton("Cancel");
+        if (alert.RunModal() != 1000) { field.StringValue = ""; return null; }
+        string value = field.StringValue; field.StringValue = ""; return value;
     }
     private void Send(object? sender, EventArgs args)
     {