ruby_everywhere 0.3.0 → 0.5.0

data/support/mobile/ios/App/SceneDelegate.swift

@@ -1,3 +1,4 @@
+import AuthenticationServices
 import HotwireNative
 import UIKit
 import WebKit
@@ -43,6 +44,18 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
     /// until the first navigator/tab bar is built, then routed.
     private var pendingUniversalLinkURL: URL?
 
+    /// Third-party sign-in, run in the system browser (everywhere.yml `auth:`).
+    /// Held for the scene's lifetime — the session inside it must outlive the
+    /// call that started it.
+    private lazy var authFlow = AuthFlow { [weak self] in
+        self?.window ?? ASPresentationAnchor()
+    }
+
+    /// Set while the web view is spending a handoff token. The visit that
+    /// follows carries the Set-Cookie headers that sign the app in, so the
+    /// auth-gated tab bar can only be fetched once it has finished.
+    private var awaitingAuthHandoff = false
+
     func scene(_ scene: UIScene, willConnectTo session: UISceneSession, options connectionOptions: UIScene.ConnectionOptions) {
         guard let windowScene = scene as? UIWindowScene else { return }
 
@@ -75,6 +88,9 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
         NotificationCenter.default.addObserver(
             self, selector: #selector(handleNativeVisit(_:)),
             name: .everywhereNativeVisit, object: nil)
+        NotificationCenter.default.addObserver(
+            self, selector: #selector(handleAuthFlow(_:)),
+            name: .everywhereAuthFlow, object: nil)
 
         // Cookie hydration BEFORE the first visit: after a force-kill relaunch
         // (iOS kills the app when a Settings permission changes) the first
@@ -182,6 +198,10 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
     ///   3. refresh the auth-aware server config, which rebuilds the tab bar
     ///      back in if (and only if) the user is now signed in.
     private func resetApp(to target: URL) {
+        // A sign-in sheet still up is answering a question the app no longer
+        // has — the reset is re-rooting or re-authing underneath it.
+        authFlow.cancel()
+        awaitingAuthHandoff = false
         clearWebContentCache()
         rebuildRoot(entries: [], routeTo: target)
         loadedTabsFingerprint = "" // matches the empty tab set we just built
@@ -203,6 +223,75 @@ final class SceneDelegate: UIResponder, UIWindowSceneDelegate {
         activeNavigator.route(url)
     }
 
+    // MARK: Third-party sign-in
+
+    /// `{action: "authFlow", to: "/auth/github"}` from the gem's
+    /// /everywhere/auth/native page — the fallback for visits the proposal
+    /// handler never sees (a `data-turbo="false"` link, or OmniAuth 2's POST).
+    @objc private func handleAuthFlow(_ note: Notification) {
+        guard let to = note.userInfo?["to"] as? String, to.hasPrefix("/"), !to.hasPrefix("//") else { return }
+        startAuthFlow(to: to)
+    }
+
+    /// Open a provider sign-in in the system browser. Nothing is loaded in the
+    /// web view: the whole point is that this URL never touches it.
+    private func startAuthFlow(to: String) {
+        guard let scheme = config.authScheme,
+              let start = config.authStartURL(to: to, returnTo: currentPath)
+        else { return }
+
+        #if DEBUG
+        NSLog("authFlow: %@", start.absoluteString)
+        #endif
+
+        authFlow.start(url: start, scheme: scheme) { [weak self] result in
+            guard let self else { return }
+            switch result {
+            case .success(let token):
+                self.finishAuthFlow(token: token)
+            case .failure(.canceled):
+                break // they closed the sheet; they're still on the page they started from
+            case .failure(let error):
+                self.presentAuthFailure(error)
+            }
+        }
+    }
+
+    /// Spend the handoff token in the web view and rebuild around whatever it
+    /// signs the app in as. Deliberately the reset sequence, in order:
+    ///   1. drop cached web content — the pre-auth pages are all stale now,
+    ///   2. drop to a single navigator aimed at the handoff, which sets the
+    ///      session cookie in the WEB VIEW's jar (the browser's jar, where the
+    ///      flow actually happened, is unreachable from here) and redirects on
+    ///      to the app's post-sign-in page,
+    ///   3. once that request has finished — and only then, or the fetch races
+    ///      the cookie — re-read the auth-gated config, which brings the tab
+    ///      bar back for the user who just signed in.
+    private func finishAuthFlow(token: String) {
+        guard let handoff = config.authHandoffURL(token: token) else { return }
+
+        clearWebContentCache()
+        rebuildRoot(entries: [], routeTo: handoff)
+        loadedTabsFingerprint = "" // matches the empty tab set we just built
+        awaitingAuthHandoff = true
+    }
+
+    private func presentAuthFailure(_ error: AuthFlow.Failure) {
+        NSLog("authFlow failed: %@", String(describing: error))
+
+        let alert = UIAlertController(title: "Sign-in didn't finish",
+                                      message: "Something went wrong on the way back to the app. Please try again.",
+                                      preferredStyle: .alert)
+        alert.addAction(UIAlertAction(title: "OK", style: .default))
+        activeNavigator.activeNavigationController.present(alert, animated: true)
+    }
+
+    /// The path the user is currently on, for the flow to come back to when the
+    /// app's own sign-in doesn't name a destination.
+    private var currentPath: String? {
+        activeNavigator.currentVisitableURL.map { config.pathAndQuery(of: $0) }
+    }
+
     // MARK: Instance switching (multi-instance apps)
 
     /// `Everywhere.instance.set(url)`: persist the picked instance as the
@@ -444,6 +533,13 @@ extension SceneDelegate: NavigatorDelegate {
             resetApp(to: resetTarget(from: proposal.url))
             return .reject
         }
+        // A provider sign-in: hand it to the system browser instead of loading
+        // it here. Rejecting leaves the user on the page they tapped from, which
+        // is where they belong if they close the sheet.
+        if let target = config.authTarget(for: proposal.url) {
+            startAuthFlow(to: target)
+            return .reject
+        }
         // App-provided native screens: a path rule's `view_controller`
         // identifier resolves through the extension registry (everywhere.yml
         // native.ios.screens). Unknown identifiers fall through to the web.
@@ -460,6 +556,13 @@ extension SceneDelegate: NavigatorDelegate {
 
     func requestDidFinish(at url: URL) {
         dismissSplash()
+
+        // The handoff has landed, so its cookies are in the web view's jar:
+        // now the tab bar can be fetched as the signed-in user.
+        if awaitingAuthHandoff {
+            awaitingAuthHandoff = false
+            loadPathConfiguration(serverOnly: true)
+        }
     }
 
     func visitableDidFailRequest(_ visitable: any Visitable, error: HotwireNativeError, retryHandler: RetryBlock?) {

data/support/mobile/ios/App.xcodeproj/project.pbxproj

@@ -18,6 +18,7 @@
 		EBE000000000000000000060 /* StorageComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000059 /* StorageComponent.swift */; };
 		EBE000000000000000000068 /* MenuComponent.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000067 /* MenuComponent.swift */; };
 		EBE000000000000000000063 /* EverywhereHost.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000062 /* EverywhereHost.swift */; };
+		EBE000000000000000000070 /* AuthFlow.swift in Sources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000069 /* AuthFlow.swift */; };
 		EBE000000000000000000036 /* everywhere.json in Resources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000018 /* everywhere.json */; };
 		EBE000000000000000000037 /* path-configuration.json in Resources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000019 /* path-configuration.json */; };
 		EBE000000000000000000038 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = EBE000000000000000000020 /* Assets.xcassets */; };
@@ -45,6 +46,7 @@
 		EBE000000000000000000020 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
 		EBE000000000000000000021 /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/LaunchScreen.storyboard; sourceTree = "<group>"; };
 		EBE000000000000000000062 /* EverywhereHost.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = EverywhereHost.swift; sourceTree = "<group>"; };
+		EBE000000000000000000069 /* AuthFlow.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AuthFlow.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
@@ -89,6 +91,7 @@
 				EBE000000000000000000015 /* EverywhereConfig.swift */,
 				EBE000000000000000000016 /* ErrorViewController.swift */,
 				EBE000000000000000000062 /* EverywhereHost.swift */,
+				EBE000000000000000000069 /* AuthFlow.swift */,
 				EBE000000000000000000005 /* Bridge */,
 				EBE000000000000000000061 /* Extensions */,
 				EBE000000000000000000023 /* Resources */,
@@ -215,6 +218,7 @@
 				EBE000000000000000000060 /* StorageComponent.swift in Sources */,
 				EBE000000000000000000068 /* MenuComponent.swift in Sources */,
 				EBE000000000000000000063 /* EverywhereHost.swift in Sources */,
+				EBE000000000000000000070 /* AuthFlow.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};

data/support/mobile/ios/README.md

@@ -19,7 +19,10 @@ this template, it overwrites **exactly** these files and nothing else:
 4. `App/Assets.xcassets/AppIcon.appiconset/AppIcon.png` — the app icon (1024×1024 opaque PNG)
 5. *(optionally)* `App/Assets.xcassets/AccentColor.colorset/Contents.json` and
    `App/Assets.xcassets/LaunchBackground.colorset/Contents.json` — brand colors
-6. *(optionally)* `App/App.entitlements` — the Associated Domains entitlement,
+6. *(optionally)* `App/Info.plist`'s `CFBundleURLTypes` — the sign-in callback
+   scheme, written **only** when `auth:` is set in `everywhere.yml` (alongside
+   the permission usage strings, which are stamped the same way)
+7. *(optionally)* `App/App.entitlements` — the Associated Domains entitlement,
    written **only** when `deep_linking:` is set in `everywhere.yml`. The matching
    `CODE_SIGN_ENTITLEMENTS` is added to the xcconfig in the same case, so the
    default build stays entitlement-free and the frozen template still compiles

data/support/{macos → release/macos}/notarize.sh

@@ -7,7 +7,7 @@
 # easiest way is to source your release env first:
 #
 #     source ~/Projects/atlastools.dev/atlas-workspaces/.env.release
-#     cli/support/macos/notarize.sh "example/dist/Example Notes.app"
+#     cli/support/release/macos/notarize.sh "example/dist/Example Notes.app"
 #
 # Required env vars (these match Tauri's names, so your existing .env works):
 #   APPLE_SIGNING_IDENTITY   e.g. "Developer ID Application: Your Name (TEAMID)"
@@ -33,7 +33,7 @@ APP="${1:?usage: notarize.sh /path/to/App.app}"
 # containing spaces/parens (e.g. APPLE_SIGNING_IDENTITY=Developer ID
 # Application: Name (TEAM)) that plain `source .env.release` cannot.
 #
-#   ENV_FILE=.env.release cli/support/macos/notarize.sh "App.app"
+#   ENV_FILE=.env.release cli/support/release/macos/notarize.sh "App.app"
 if [ -n "${ENV_FILE:-}" ]; then
   [ -f "$ENV_FILE" ] || { echo "ENV_FILE not found: $ENV_FILE" >&2; exit 1; }
   while IFS= read -r line || [ -n "$line" ]; do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_everywhere
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Andrea Fomera
@@ -76,6 +76,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - LICENSE.txt
+- README.md
 - bridge/LICENSE
 - bridge/README.md
 - bridge/everywhere/bridge.js
@@ -85,9 +86,17 @@ files:
 - exe/every
 - exe/rbe
 - lib/everywhere.rb
+- lib/everywhere/android_resources.rb
+- lib/everywhere/android_sdk.rb
+- lib/everywhere/asset_catalog.rb
+- lib/everywhere/auth_handoff.rb
+- lib/everywhere/auth_token.rb
 - lib/everywhere/blake2b.rb
 - lib/everywhere/boot.rb
+- lib/everywhere/builders/android.rb
+- lib/everywhere/builders/desktop.rb
 - lib/everywhere/builders/ios.rb
+- lib/everywhere/child_processes.rb
 - lib/everywhere/cli.rb
 - lib/everywhere/commands/build.rb
 - lib/everywhere/commands/clean.rb
@@ -106,16 +115,26 @@ files:
 - lib/everywhere/commands/shell_dir.rb
 - lib/everywhere/commands/updates_keygen.rb
 - lib/everywhere/config.rb
+- lib/everywhere/console.rb
 - lib/everywhere/database.rb
+- lib/everywhere/desktop_assets.rb
+- lib/everywhere/dock.rb
+- lib/everywhere/dock/footer.rb
+- lib/everywhere/dock/screen.rb
+- lib/everywhere/dock/state.rb
+- lib/everywhere/emulator.rb
 - lib/everywhere/engine.rb
+- lib/everywhere/fatal.rb
 - lib/everywhere/framework.rb
 - lib/everywhere/icon.rb
 - lib/everywhere/ignore.rb
+- lib/everywhere/line_pump.rb
 - lib/everywhere/log_filter.rb
 - lib/everywhere/minisign.rb
 - lib/everywhere/mobile_config_endpoint.rb
 - lib/everywhere/mobile_configs_controller.rb
 - lib/everywhere/native_helper.rb
+- lib/everywhere/omniauth.rb
 - lib/everywhere/paths.rb
 - lib/everywhere/platform/client.rb
 - lib/everywhere/platform/credentials.rb
@@ -123,16 +142,87 @@ files:
 - lib/everywhere/png.rb
 - lib/everywhere/raster.rb
 - lib/everywhere/receipt.rb
+- lib/everywhere/relay.rb
 - lib/everywhere/s3.rb
 - lib/everywhere/shellout.rb
 - lib/everywhere/simulator.rb
+- lib/everywhere/task_pool.rb
 - lib/everywhere/ui.rb
 - lib/everywhere/update_manifest.rb
 - lib/everywhere/version.rb
 - lib/ruby_everywhere.rb
-- support/github/build.yml
-- support/macos/entitlements.plist
-- support/macos/notarize.sh
+- support/desktop/README.md
+- support/desktop/splash/index.html
+- support/desktop/src-tauri/Cargo.lock
+- support/desktop/src-tauri/Cargo.toml
+- support/desktop/src-tauri/build.rs
+- support/desktop/src-tauri/capabilities/default.json
+- support/desktop/src-tauri/gen/schemas/acl-manifests.json
+- support/desktop/src-tauri/gen/schemas/capabilities.json
+- support/desktop/src-tauri/gen/schemas/desktop-schema.json
+- support/desktop/src-tauri/gen/schemas/macOS-schema.json
+- support/desktop/src-tauri/icons/icon.png
+- support/desktop/src-tauri/src/extension_host.rs
+- support/desktop/src-tauri/src/extensions/mod.rs
+- support/desktop/src-tauri/src/main.rs
+- support/desktop/src-tauri/src/updater.rs
+- support/desktop/src-tauri/tauri.conf.json
+- support/mobile/android/README.md
+- support/mobile/android/app/build.gradle.kts
+- support/mobile/android/app/everywhere.properties
+- support/mobile/android/app/native-packages.gradle.kts
+- support/mobile/android/app/proguard-rules.pro
+- support/mobile/android/app/src/debug/res/xml/network_security_config.xml
+- support/mobile/android/app/src/main/AndroidManifest.xml
+- support/mobile/android/app/src/main/assets/everywhere.json
+- support/mobile/android/app/src/main/assets/fonts/MaterialIcons-Regular.codepoints
+- support/mobile/android/app/src/main/assets/fonts/MaterialIcons-Regular.ttf
+- support/mobile/android/app/src/main/assets/json/path-configuration.json
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/AuthFlow.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/EverywhereApplication.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/EverywhereConfig.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/EverywhereEvents.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/EverywhereHost.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/IconFont.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/MainActivity.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/MainTabs.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/WebBottomSheetFragment.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/WebFragment.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/BiometricsComponent.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/HapticsComponent.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/MenuComponent.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/NotificationComponent.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/PermissionsComponent.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/StorageComponent.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/WebControlChannel.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/extensions/EverywhereExtensions.kt
+- support/mobile/android/app/src/main/res/color/bottom_navigation_active_indicator.xml
+- support/mobile/android/app/src/main/res/color/bottom_navigation_item.xml
+- support/mobile/android/app/src/main/res/drawable/ic_launcher_foreground.xml
+- support/mobile/android/app/src/main/res/drawable/ic_tab_placeholder.xml
+- support/mobile/android/app/src/main/res/layout/activity_main.xml
+- support/mobile/android/app/src/main/res/layout/bridge_menu_sheet.xml
+- support/mobile/android/app/src/main/res/layout/bridge_menu_sheet_item.xml
+- support/mobile/android/app/src/main/res/layout/tab_more_sheet.xml
+- support/mobile/android/app/src/main/res/layout/tab_more_sheet_item.xml
+- support/mobile/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
+- support/mobile/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml
+- support/mobile/android/app/src/main/res/values-night/colors.xml
+- support/mobile/android/app/src/main/res/values-night/themes.xml
+- support/mobile/android/app/src/main/res/values/colors.xml
+- support/mobile/android/app/src/main/res/values/ic_launcher_background.xml
+- support/mobile/android/app/src/main/res/values/strings.xml
+- support/mobile/android/app/src/main/res/values/styles.xml
+- support/mobile/android/app/src/main/res/values/themes.xml
+- support/mobile/android/app/src/main/res/xml/network_security_config.xml
+- support/mobile/android/app/src/stamped/AndroidManifest.xml
+- support/mobile/android/build.gradle.kts
+- support/mobile/android/gradle.properties
+- support/mobile/android/gradle/wrapper/gradle-wrapper.jar
+- support/mobile/android/gradle/wrapper/gradle-wrapper.properties
+- support/mobile/android/gradlew
+- support/mobile/android/gradlew.bat
+- support/mobile/android/settings.gradle.kts
 - support/mobile/ios/App.xcodeproj/project.pbxproj
 - support/mobile/ios/App.xcodeproj/project.xcworkspace/contents.xcworkspacedata
 - support/mobile/ios/App.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -144,6 +234,7 @@ files:
 - support/mobile/ios/App/Assets.xcassets/AppIcon.appiconset/Contents.json
 - support/mobile/ios/App/Assets.xcassets/Contents.json
 - support/mobile/ios/App/Assets.xcassets/LaunchBackground.colorset/Contents.json
+- support/mobile/ios/App/AuthFlow.swift
 - support/mobile/ios/App/Base.lproj/LaunchScreen.storyboard
 - support/mobile/ios/App/Bridge/BiometricsComponent.swift
 - support/mobile/ios/App/Bridge/HapticsComponent.swift
@@ -162,19 +253,8 @@ files:
 - support/mobile/ios/NativeExtensions/Package.swift
 - support/mobile/ios/NativeExtensions/Sources/NativeExtensions/Exports.swift
 - support/mobile/ios/README.md
-- support/shell/splash/index.html
-- support/shell/src-tauri/Cargo.lock
-- support/shell/src-tauri/Cargo.toml
-- support/shell/src-tauri/build.rs
-- support/shell/src-tauri/capabilities/default.json
-- support/shell/src-tauri/gen/schemas/acl-manifests.json
-- support/shell/src-tauri/gen/schemas/capabilities.json
-- support/shell/src-tauri/gen/schemas/desktop-schema.json
-- support/shell/src-tauri/gen/schemas/macOS-schema.json
-- support/shell/src-tauri/icons/icon.png
-- support/shell/src-tauri/src/main.rs
-- support/shell/src-tauri/src/updater.rs
-- support/shell/src-tauri/tauri.conf.json
+- support/release/macos/entitlements.plist
+- support/release/macos/notarize.sh
 homepage: https://rubyeverywhere.com
 licenses:
 - MIT

data/support/github/build.yml

@@ -1,85 +0,0 @@
-# RubyEverywhere Platform — reusable build workflow.
-#
-# Lives in the RunnerDispatch build repo (private, RubyEverywhere-owned). The
-# Platform triggers it via workflow_dispatch (see app/models/runner_dispatch.rb);
-# it runs one artifact on an ephemeral, single-use macOS runner and reports back
-# through the Runner API. No customer source lives in this repo — it arrives as
-# the snapshot the runner downloads.
-#
-# The heavy part is provisioning the toolchain (rbe-tebako fork + deps + Xcode
-# shims). Cache it aggressively; a warm runner builds in minutes.
-
-name: RubyEverywhere Platform Build
-
-on:
-  workflow_dispatch:
-    inputs:
-      artifact_id:
-        description: Artifact public id (art_…)
-        required: true
-      runner_token:
-        description: Per-artifact runner token
-        required: true
-      callback_base_url:
-        description: Platform base URL the runner reports back to
-        required: true
-
-# One in-flight job per artifact.
-concurrency:
-  group: build-${{ inputs.artifact_id }}
-  cancel-in-progress: false
-
-jobs:
-  build:
-    # macOS/iOS → macos; Android → ubuntu; Windows → windows (routed by the
-    # dispatcher today only macOS is live).
-    runs-on: macos-14 # Apple Silicon
-    timeout-minutes: 45
-
-    steps:
-      - name: Set up Ruby (to run the every CLI itself)
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.4"
-
-      - name: Provision the RubyEverywhere toolchain
-        run: |
-          set -euo pipefail
-          # The signing engine needs the rbe-tebako fork + build deps. This is the
-          # slow step — restore it from cache in a real setup (actions/cache on
-          # ~/.tebako, ~/.tebako-shims, brew).
-          brew install bison
-          gem install ruby_everywhere        # provides `every`
-          # gem install rbe-tebako           # the fork (or build from source)
-          # bin/setup-xcode-shims             # Xcode 26 CXX shim, rbconfig patch
-          every doctor || true                # surfaces any missing toolchain bits
-
-      - name: Install Apple intermediate certificates
-        run: |
-          set -euo pipefail
-          # The delivered .p12 holds only the leaf; codesign needs the Developer
-          # ID intermediate to build a complete chain (a clean runner has none).
-          for cert in DeveloperIDG2CA AppleWWDRCAG3; do
-            curl -fsSL "https://www.apple.com/certificateauthority/$cert.cer" -o "$RUNNER_TEMP/$cert.cer"
-            sudo security import "$RUNNER_TEMP/$cert.cer" -k /Library/Keychains/System.keychain || true
-          done
-
-      - name: Provision the generic Tauri shell
-        run: |
-          set -euo pipefail
-          # The shell (src-tauri) is generic — same for every app. Pull the
-          # pinned prebuilt shell for this platform.
-          echo "SHELL_DIR=$RUNNER_TEMP/shell/src-tauri" >> "$GITHUB_ENV"
-          # gh release download --repo rubyeverywhere/shell --pattern 'src-tauri-*' ...
-          # OR: git clone --depth 1 https://github.com/rubyeverywhere/shell "$RUNNER_TEMP/shell"
-
-      - name: Run the build
-        run: |
-          every platform runner \
-            --artifact "${{ inputs.artifact_id }}" \
-            --token "${{ inputs.runner_token }}" \
-            --url "${{ inputs.callback_base_url }}" \
-            --shell-dir "$SHELL_DIR"
-        # Signing credentials are pulled JIT from the Platform into a throwaway
-        # keychain by the runner itself — they are never GitHub secrets, and the
-        # ephemeral runner is destroyed after this job.

data/support/shell/src-tauri/gen/schemas/capabilities.json

@@ -1 +0,0 @@
-{"default":{"identifier":"default","description":"Main window IPC: local app origins (the packaged Rails app serves on 127.0.0.1)","remote":{"urls":["http://127.0.0.1:*","http://localhost:*"]},"local":true,"windows":["main"],"permissions":["core:default","core:window:allow-set-title","notification:default","dialog:default","clipboard-manager:allow-read-text","clipboard-manager:allow-write-text"]}}