@daemux/store-automator 0.10.80 → 0.10.82

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "App Store & Google Play automation for Flutter apps",
-    "version": "0.10.80"
+    "version": "0.10.82"
   },
   "plugins": [
     {
       "name": "store-automator",
       "source": "./plugins/store-automator",
       "description": "3 agents for app store publishing: reviewer, meta-creator, media-designer",
-      "version": "0.10.80",
+      "version": "0.10.82",
       "keywords": [
         "flutter",
         "app-store",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemux/store-automator",
-  "version": "0.10.80",
+  "version": "0.10.82",
   "description": "Full App Store & Google Play automation for Flutter apps with Claude Code agents",
   "type": "module",
   "bin": {

package/plugins/store-automator/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "store-automator",
-  "version": "0.10.80",
+  "version": "0.10.82",
   "description": "App Store & Google Play automation agents for Flutter app publishing",
   "author": {
     "name": "Daemux"

package/templates/scripts/ci/ios-native/profile_manager.py

@@ -29,6 +29,7 @@ from __future__ import annotations
 import base64
 import json
 import plistlib
+import re
 import subprocess
 from pathlib import Path
 
@@ -36,7 +37,14 @@ from asc_common import get_json, request
 
 
 PROFILE_PREFIX = "CI-"
-PROFILES_DIR = Path.home() / "Library/MobileDevice/Provisioning Profiles"
+
+# Xcode 16+ moved the canonical profile directory. Older Xcode releases used
+# ~/Library/MobileDevice/Provisioning Profiles/. We write to BOTH so the same
+# script works on macos-14 (Xcode 15) and macos-15 (Xcode 26).
+_PROFILE_DIRS = [
+    Path.home() / "Library/Developer/Xcode/UserData/Provisioning Profiles",
+    Path.home() / "Library/MobileDevice/Provisioning Profiles",
+]
 
 # Product types that must be signed with a provisioning profile. App
 # extensions share the common ``com.apple.product-type.app-extension`` prefix
@@ -125,55 +133,135 @@ def patch_project_signing(
 ) -> None:
     """Set manual signing + per-target profile name for every signable target.
 
-    Uses ``plutil -replace`` to mutate the pbxproj in place. Scope is limited
-    to native app + extension targets so SwiftPM / resource-bundle targets
-    (which reject PROVISIONING_PROFILE_SPECIFIER) are untouched.
+    The pbxproj stays in its original OpenStep format — Xcode is very
+    opinionated about that file and any conversion (to XML/JSON) risks
+    re-ordering keys or dropping comments. Instead, we edit the specific
+    ``XCBuildConfiguration`` blocks by their UUID and inject/replace the
+    handful of keys we care about. Targets outside ``targets`` (most
+    importantly SwiftPM / resource-bundle configs) are untouched.
     """
-    pbx = Path(project_path) / "project.pbxproj"
+    pbx_path = Path(project_path) / "project.pbxproj"
+    text = pbx_path.read_text(encoding="utf-8")
+
     for target in targets:
         profile_name = f"{PROFILE_PREFIX}{target['bundle_id']}"
         for cid in target["config_ids"]:
-            _set_build_setting(pbx, cid, "CODE_SIGN_STYLE", "Manual")
-            _set_build_setting(pbx, cid, "CODE_SIGN_IDENTITY", "Apple Distribution")
-            _set_build_setting(pbx, cid, "DEVELOPMENT_TEAM", team_id)
-            _set_build_setting(
-                pbx, cid, "PROVISIONING_PROFILE_SPECIFIER", profile_name
-            )
-            # Clear any legacy autogenerated PROVISIONING_PROFILE uuid that
-            # would otherwise override the specifier we just set.
-            _clear_build_setting(pbx, cid, "PROVISIONING_PROFILE")
+            text = _apply_signing_to_config(text, cid, team_id, profile_name)
         print(
             f"Patched {target['name']!r} -> {profile_name} "
             f"(configs={len(target['config_ids'])})"
         )
 
+    pbx_path.write_text(text, encoding="utf-8")
+    # Sanity check — plutil -lint rejects malformed output so CI fails
+    # fast before ``xcodebuild`` tries (and mangles) the file.
+    subprocess.check_call(["plutil", "-lint", str(pbx_path)])
 
-def _keypath(config_id: str, key: str) -> str:
-    return f"objects.{config_id}.buildSettings.{key}"
 
-
-def _set_build_setting(
-    pbx_path: Path, config_id: str, key: str, value: str
-) -> None:
-    keypath = _keypath(config_id, key)
-    # -replace fails if the key doesn't exist, so try replace first then
-    # fall back to -insert for a fresh add.
-    rc = subprocess.run(
-        ["plutil", "-replace", keypath, "-string", value, str(pbx_path)],
-        capture_output=True,
-    ).returncode
-    if rc != 0:
-        subprocess.check_call(
-            ["plutil", "-insert", keypath, "-string", value, str(pbx_path)]
+def _apply_signing_to_config(
+    text: str, config_id: str, team_id: str, profile_name: str
+) -> str:
+    """Return ``text`` with the given XCBuildConfiguration's buildSettings
+    patched for manual signing. Raises ``SystemExit`` if the config block
+    can't be located (indicates a pbxproj format we don't understand).
+    """
+    start = text.find(f"\t\t{config_id} ")
+    if start < 0:
+        start = text.find(f"\t\t{config_id}\t")
+    if start < 0:
+        start = text.find(f"{config_id} = {{")
+    if start < 0:
+        raise SystemExit(
+            f"patch_project_signing: config {config_id} not found in pbxproj"
+        )
+    settings_key = "buildSettings = {"
+    s_idx = text.find(settings_key, start)
+    if s_idx < 0:
+        raise SystemExit(
+            f"patch_project_signing: buildSettings not found for {config_id}"
         )
+    # Find matching closing '};' for buildSettings — brace-balance forward.
+    depth = 0
+    i = s_idx + len(settings_key) - 1  # position at the opening '{'
+    end = -1
+    while i < len(text):
+        ch = text[i]
+        if ch == "{":
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth == 0:
+                end = i
+                break
+        i += 1
+    if end < 0:
+        raise SystemExit(
+            f"patch_project_signing: unbalanced buildSettings for {config_id}"
+        )
+    inner = text[s_idx + len(settings_key): end]
+    patched = _patch_inner_settings(inner, team_id, profile_name)
+    return text[: s_idx + len(settings_key)] + patched + text[end:]
 
 
-def _clear_build_setting(pbx_path: Path, config_id: str, key: str) -> None:
-    subprocess.run(
-        ["plutil", "-remove", _keypath(config_id, key), str(pbx_path)],
-        capture_output=True,
-        check=False,
-    )
+_SIGNING_KEYS = {
+    "CODE_SIGN_STYLE": "Manual",
+    "CODE_SIGN_IDENTITY": '"Apple Distribution"',
+}
+
+_STRIP_KEYS = ("PROVISIONING_PROFILE",)
+
+
+def _patch_inner_settings(
+    inner: str, team_id: str, profile_name: str
+) -> str:
+    """Rewrite build setting key/value lines inside one buildSettings block."""
+    # Always-set values
+    values = dict(_SIGNING_KEYS)
+    values["DEVELOPMENT_TEAM"] = team_id
+    values["PROVISIONING_PROFILE_SPECIFIER"] = f'"{profile_name}"'
+
+    lines = inner.splitlines(keepends=True)
+    emitted_keys: set[str] = set()
+    out: list[str] = []
+    # Each setting line looks like (whitespace-prefixed):
+    #   KEY = VALUE;
+    # We match leading indent, the key, `= `, the rest.
+    pattern = re.compile(r"^(\s*)([A-Z_][A-Z0-9_]*)\s*=\s*(.+);\s*$")
+
+    for line in lines:
+        m = pattern.match(line)
+        if not m:
+            out.append(line)
+            continue
+        indent, key, _old_value = m.group(1), m.group(2), m.group(3)
+        if key in _STRIP_KEYS:
+            # Drop these keys entirely.
+            continue
+        if key in values:
+            out.append(f"{indent}{key} = {values[key]};\n")
+            emitted_keys.add(key)
+            continue
+        out.append(line)
+
+    # Any key we wanted to set but didn't find — append just before close.
+    missing = [k for k in values if k not in emitted_keys]
+    if missing:
+        # Determine indent from the first KEY= line we can find, else use
+        # two tabs (the pbxproj default).
+        indent = "\t\t\t\t"
+        for line in lines:
+            m = pattern.match(line)
+            if m:
+                indent = m.group(1)
+                break
+        tail = out[-1] if out else ""
+        # Ensure we inject before the trailing whitespace on the last line.
+        new_lines = [f"{indent}{k} = {values[k]};\n" for k in missing]
+        if tail.strip() == "":
+            out = out[:-1] + new_lines + [tail]
+        else:
+            out = out + new_lines
+    return "".join(out)
 
 
 # --------------------------------------------------------------------------- #
@@ -261,15 +349,26 @@ def create_profile(
 
 
 def install_profile(profile_der: bytes) -> str:
-    PROFILES_DIR.mkdir(parents=True, exist_ok=True)
-    tmp_path = PROFILES_DIR / "tmp.mobileprovision"
+    primary = _PROFILE_DIRS[0]
+    primary.mkdir(parents=True, exist_ok=True)
+    tmp_path = primary / "tmp.mobileprovision"
     tmp_path.write_bytes(profile_der)
     decoded = subprocess.check_output(
         ["security", "cms", "-D", "-i", str(tmp_path)]
     )
-    uuid = plistlib.loads(decoded)["UUID"]
-    final_path = PROFILES_DIR / f"{uuid}.mobileprovision"
-    tmp_path.rename(final_path)
+    plist = plistlib.loads(decoded)
+    uuid = plist["UUID"]
+    team_ids = plist.get("TeamIdentifier") or []
+    profile_name = plist.get("Name") or "<unknown>"
+    final_name = f"{uuid}.mobileprovision"
+    for directory in _PROFILE_DIRS:
+        directory.mkdir(parents=True, exist_ok=True)
+        (directory / final_name).write_bytes(profile_der)
+    tmp_path.unlink(missing_ok=True)
+    print(
+        f"  profile {profile_name!r}: uuid={uuid} team={team_ids} "
+        f"dirs={[str(d) for d in _PROFILE_DIRS]}"
+    )
     return uuid