macOS autostart plist is built by string concatenation without XML escaping

[offbyonebit]

Severity: medium
Type: robustness
Location: clipsync/autostart.py — _macos_set() (~line 80)

Problem: The LaunchAgent plist is assembled by inserting argv strings directly into XML. If the Python executable path or any argument contains &, <, >, or quotes, the resulting plist is malformed and launchd will reject it, silently breaking “start on login.”

Suggested fix: Build the plist with plistlib (or at minimum XML-escape each inserted string) instead of string formatting.

---

_{Filed from a full-source audit of the repo (2026-07-29). Reported by the audit but not independently confirmed - verify the cited code before acting on it.}