@davmash/bygone 0.8.3 → 0.8.5

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.8.5
+
+- Fixed Homebrew cask `bygone` CLI launch on Apple Silicon by routing through a bundle-aware launcher script inside the app
+- Documented the macOS **“app is damaged”** workaround for unsigned desktop downloads (README, releasing docs, PR Tour Guide skill)
+
+## 0.8.4
+
+- Clarified PR Tour Guide skill install commands for project scope and agent-specific global installs
+- Documented PromptScript-safe installation (`-y` without bare `-g`) to avoid spurious global-install failures from the skills CLI
+
 ## 0.8.3
 
 - Fixed tour anchor gutter markers so active and persistent anchors are visibly rendered by Monaco, including after switching files in stacked tours

package/README.md

@@ -119,10 +119,14 @@ Packaged macOS builds register `.bygone` with the desktop app, so Finder can ope
 
 Agents can validate anchors and structure with `bygone tour validate <file.bygone> --json`, compile a portable manifest with `bygone tour compile`, and retrieve the authoring contract with `bygone tour schema`. See [Generating change tours with an LLM](./docs/generating-change-tours.md).
 
-Install the agent skill (Cursor, Codex, Claude Code, and other supported agents):
+Install the agent skill:
 
 ```bash
-npx skills add davidmashburn/bygone -s pr-tour-guide -g -y
+# project scope (PromptScript-safe; committed with the repo if you run it here)
+npx skills add davidmashburn/bygone -s pr-tour-guide -y
+
+# global scope — name agents to avoid PromptScript global-install noise
+npx skills add davidmashburn/bygone -s pr-tour-guide -g -y -a cursor codex claude-code
 ```
 
 The skill includes Bygone install instructions for macOS Homebrew, npm, and source checkouts. It also ships inside the `@davmash/bygone` npm package under `skills/pr-tour-guide/`. Source: [`pr-tour-guide` skill](./skills/pr-tour-guide/SKILL.md).
@@ -133,6 +137,19 @@ Contributors should consult the internal [product surface overview](./docs/produ
 
 The desktop app also includes `Help -> Install Command Line Tools...` for non-npm installs. Homebrew cask installs can provide the `bygone` command automatically.
 
+### macOS says the app is damaged
+
+Downloads from GitHub or Homebrew are **unsigned** (no Apple Developer ID signature yet). macOS Gatekeeper then shows a misleading **“damaged”** dialog.
+
+**Workaround (unsigned desktop builds):**
+
+```bash
+xattr -cr /Applications/Bygone.app
+open /Applications/Bygone.app
+```
+
+Or right-click the app → **Open** once, or allow it under **System Settings → Privacy & Security**.
+
 ## Package For External Use
 
 This repo is set up for local/private packaging. A typical release flow is:

package/docs/generating-change-tours.md

@@ -7,7 +7,11 @@ For agents that support repository skills, use the agent-agnostic [`pr-tour-guid
 Install it with the skills CLI:
 
 ```sh
-npx skills add davidmashburn/bygone -s pr-tour-guide -g -y
+# project scope (works with PromptScript)
+npx skills add davidmashburn/bygone -s pr-tour-guide -y
+
+# global scope — pass -a so PromptScript is not included
+npx skills add davidmashburn/bygone -s pr-tour-guide -g -y -a cursor codex claude-code
 ```
 
 The skill documents how to install Bygone itself when the CLI is missing.

package/docs/releasing.md

@@ -190,6 +190,34 @@ That path must point at a local git checkout of the tap repo. The script writes:
 
 and then commits and pushes that tap repo.
 
+## macOS Unsigned Desktop Builds
+
+Published macOS desktop builds are currently **unsigned and not notarized**. After download, Gatekeeper often shows a misleading **“Bygone is damaged”** dialog.
+
+### End-user workaround
+
+```bash
+xattr -cr /Applications/Bygone.app
+open /Applications/Bygone.app
+```
+
+Or right-click the app → **Open** once, or allow it under **System Settings → Privacy & Security**.
+
+Document this for users in release notes when shipping desktop updates.
+
+### Future signing (not enabled)
+
+Signing helpers are shelved until Apple Developer Program membership is active. They are **not** wired into `release:publish` today.
+
+When ready to enable:
+
+- Config: `packaging/macos/electron-builder.signing.json`
+- Optional manual builds: `npm run package:desktop:mac:release`
+- Verification: `npm run release:verify-macos` or `node scripts/verify-macos-signing.mjs`
+- Re-enable checks in `scripts/release.mjs` (see git history)
+
+Credentials needed later: Developer ID Application cert (`CSC_NAME` / `CSC_LINK`) plus notarization (`APPLE_API_KEY` trio, or `APPLE_ID` + app-specific password + team ID).
+
 ## Recommended Release Flow
 
 ### Step 1. Confirm the version
@@ -223,7 +251,6 @@ This builds:
 - macOS desktop artifacts
 - Linux AppImage
 - Windows artifacts
-- Homebrew style validation, if `brew` is available
 
 If local packaging is partially unavailable, use the lower-level script:
 
@@ -312,6 +339,10 @@ node ./scripts/release.mjs --skip-dmg
 
 Then fix the local DMG toolchain before attempting a full publish.
 
+### macOS says the app is damaged after install
+
+This is expected for unsigned desktop builds. See [macOS Unsigned Desktop Builds](#macos-unsigned-desktop-builds).
+
 ### Windows packaging fails locally
 
 Use:

package/out/standalone-main.js

@@ -8798,7 +8798,7 @@ var require_package = __commonJS({
       displayName: "Bygone",
       desktopName: "com.davidmashburn.bygone.desktop",
       description: "See how change happened. Visual diff and file history for VS Code.",
-      version: "0.8.3",
+      version: "0.8.5",
       author: "David Mashburn",
       license: "MIT",
       private: false,
@@ -8991,7 +8991,9 @@ var require_package = __commonJS({
         "web:start": "npm run compile && node ./scripts/web-server.mjs",
         "package:desktop": "npm run package:desktop:mac",
         "package:desktop:mac": "npm run compile && electron-builder --mac dmg --publish never",
+        "package:desktop:mac:release": "npm run compile && electron-builder --mac dmg --publish never --config packaging/macos/electron-builder.signing.json",
         "package:desktop:mac:zip": "npm run compile && electron-builder --mac zip --publish never",
+        "package:desktop:mac:zip:release": "npm run compile && electron-builder --mac zip --publish never --config packaging/macos/electron-builder.signing.json",
         "package:desktop:linux": "npm run compile && electron-builder --linux AppImage --publish never",
         "package:desktop:win": "npm run compile && electron-builder --win --publish never",
         "package:desktop:all": "npm run compile && electron-builder --mac --win --linux AppImage --publish never",
@@ -9007,6 +9009,7 @@ var require_package = __commonJS({
         "release:check": "npm run security:audit && npm test && npm run bundle:check && npm run lint && npm run package:vsix && npm run package:npm && npm run package:npm:dry-run",
         "release:build": "node ./scripts/release.mjs",
         "release:publish": "node ./scripts/release.mjs --publish",
+        "release:verify-macos": "node ./scripts/verify-macos-signing.mjs --require-notarized",
         lint: "eslint . --max-warnings=0",
         "lint:fix": "eslint . --fix",
         watch: "tsc -watch -p ./",
@@ -9036,6 +9039,10 @@ var require_package = __commonJS({
           {
             from: "completions",
             to: "completions"
+          },
+          {
+            from: "packaging/homebrew/bygone-launcher.sh",
+            to: "bygone-launcher.sh"
           }
         ],
         extraMetadata: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davmash/bygone",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "See how change happened. Visual diff and file history.",
   "author": "David Mashburn",
   "license": "MIT",

package/skills/pr-tour-guide/SKILL.md

@@ -9,10 +9,28 @@ Use Bygone as the deterministic evidence and rendering layer. Treat the language
 
 ## Install this skill
 
-For Cursor, Codex, Claude Code, and other agents supported by the skills CLI:
+Install with the [skills CLI](https://skills.sh). Prefer **project** scope (default) or name agents explicitly on **global** installs — bare `-g` fans out to every detected host, and PromptScript only supports project-level skills, which produces a spurious failure line.
+
+**This repo / PromptScript / team-shared (project scope):**
+
+```sh
+npx skills add davidmashburn/bygone -s pr-tour-guide -y
+```
+
+Installs to `.agents/skills/pr-tour-guide` (or your agent's project skills directory).
+
+**Global, all projects (pick your agents):**
 
 ```sh
-npx skills add davidmashburn/bygone -s pr-tour-guide -g -y
+npx skills add davidmashburn/bygone -s pr-tour-guide -g -y -a cursor codex claude-code
+```
+
+Add or remove agent names for the tools you use. Omit `-a` only if you accept PromptScript possibly printing `does not support global skill installation` even when other agents succeeded.
+
+**PromptScript only:**
+
+```sh
+npx skills add davidmashburn/bygone -s pr-tour-guide -y -a promptscript
 ```
 
 List without installing:
@@ -24,7 +42,7 @@ npx skills add davidmashburn/bygone --list
 From a Bygone source checkout, install the local copy instead:
 
 ```sh
-npx skills add ./skills/pr-tour-guide -g -y
+npx skills add ./skills/pr-tour-guide -y
 ```
 
 ## Install Bygone
@@ -48,6 +66,13 @@ npm install -g @davmash/bygone
 
 **macOS without Homebrew:** download the DMG from [GitHub Releases](https://github.com/davidmashburn/bygone/releases), then choose **Help → Install Command Line Tools…** in the app.
 
+If macOS reports the app is **damaged**, the build is likely unsigned. Clear quarantine and open once:
+
+```sh
+xattr -cr /Applications/Bygone.app
+open /Applications/Bygone.app
+```
+
 **From a Bygone source checkout:**
 
 ```sh