@davmash/bygone 0.8.4 → 0.8.5

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 0.8.5
+
+- Fixed Homebrew cask `bygone` CLI launch on Apple Silicon by routing through a bundle-aware launcher script inside the app
+- Documented the macOS **“app is damaged”** workaround for unsigned desktop downloads (README, releasing docs, PR Tour Guide skill)
+
 ## 0.8.4
 
 - Clarified PR Tour Guide skill install commands for project scope and agent-specific global installs

package/README.md

@@ -137,6 +137,19 @@ Contributors should consult the internal [product surface overview](./docs/produ
 
 The desktop app also includes `Help -> Install Command Line Tools...` for non-npm installs. Homebrew cask installs can provide the `bygone` command automatically.
 
+### macOS says the app is damaged
+
+Downloads from GitHub or Homebrew are **unsigned** (no Apple Developer ID signature yet). macOS Gatekeeper then shows a misleading **“damaged”** dialog.
+
+**Workaround (unsigned desktop builds):**
+
+```bash
+xattr -cr /Applications/Bygone.app
+open /Applications/Bygone.app
+```
+
+Or right-click the app → **Open** once, or allow it under **System Settings → Privacy & Security**.
+
 ## Package For External Use
 
 This repo is set up for local/private packaging. A typical release flow is:

package/docs/releasing.md

@@ -190,6 +190,34 @@ That path must point at a local git checkout of the tap repo. The script writes:
 
 and then commits and pushes that tap repo.
 
+## macOS Unsigned Desktop Builds
+
+Published macOS desktop builds are currently **unsigned and not notarized**. After download, Gatekeeper often shows a misleading **“Bygone is damaged”** dialog.
+
+### End-user workaround
+
+```bash
+xattr -cr /Applications/Bygone.app
+open /Applications/Bygone.app
+```
+
+Or right-click the app → **Open** once, or allow it under **System Settings → Privacy & Security**.
+
+Document this for users in release notes when shipping desktop updates.
+
+### Future signing (not enabled)
+
+Signing helpers are shelved until Apple Developer Program membership is active. They are **not** wired into `release:publish` today.
+
+When ready to enable:
+
+- Config: `packaging/macos/electron-builder.signing.json`
+- Optional manual builds: `npm run package:desktop:mac:release`
+- Verification: `npm run release:verify-macos` or `node scripts/verify-macos-signing.mjs`
+- Re-enable checks in `scripts/release.mjs` (see git history)
+
+Credentials needed later: Developer ID Application cert (`CSC_NAME` / `CSC_LINK`) plus notarization (`APPLE_API_KEY` trio, or `APPLE_ID` + app-specific password + team ID).
+
 ## Recommended Release Flow
 
 ### Step 1. Confirm the version
@@ -223,7 +251,6 @@ This builds:
 - macOS desktop artifacts
 - Linux AppImage
 - Windows artifacts
-- Homebrew style validation, if `brew` is available
 
 If local packaging is partially unavailable, use the lower-level script:
 
@@ -312,6 +339,10 @@ node ./scripts/release.mjs --skip-dmg
 
 Then fix the local DMG toolchain before attempting a full publish.
 
+### macOS says the app is damaged after install
+
+This is expected for unsigned desktop builds. See [macOS Unsigned Desktop Builds](#macos-unsigned-desktop-builds).
+
 ### Windows packaging fails locally
 
 Use:

package/out/standalone-main.js

@@ -8798,7 +8798,7 @@ var require_package = __commonJS({
       displayName: "Bygone",
       desktopName: "com.davidmashburn.bygone.desktop",
       description: "See how change happened. Visual diff and file history for VS Code.",
-      version: "0.8.4",
+      version: "0.8.5",
       author: "David Mashburn",
       license: "MIT",
       private: false,
@@ -8991,7 +8991,9 @@ var require_package = __commonJS({
         "web:start": "npm run compile && node ./scripts/web-server.mjs",
         "package:desktop": "npm run package:desktop:mac",
         "package:desktop:mac": "npm run compile && electron-builder --mac dmg --publish never",
+        "package:desktop:mac:release": "npm run compile && electron-builder --mac dmg --publish never --config packaging/macos/electron-builder.signing.json",
         "package:desktop:mac:zip": "npm run compile && electron-builder --mac zip --publish never",
+        "package:desktop:mac:zip:release": "npm run compile && electron-builder --mac zip --publish never --config packaging/macos/electron-builder.signing.json",
         "package:desktop:linux": "npm run compile && electron-builder --linux AppImage --publish never",
         "package:desktop:win": "npm run compile && electron-builder --win --publish never",
         "package:desktop:all": "npm run compile && electron-builder --mac --win --linux AppImage --publish never",
@@ -9007,6 +9009,7 @@ var require_package = __commonJS({
         "release:check": "npm run security:audit && npm test && npm run bundle:check && npm run lint && npm run package:vsix && npm run package:npm && npm run package:npm:dry-run",
         "release:build": "node ./scripts/release.mjs",
         "release:publish": "node ./scripts/release.mjs --publish",
+        "release:verify-macos": "node ./scripts/verify-macos-signing.mjs --require-notarized",
         lint: "eslint . --max-warnings=0",
         "lint:fix": "eslint . --fix",
         watch: "tsc -watch -p ./",
@@ -9036,6 +9039,10 @@ var require_package = __commonJS({
           {
             from: "completions",
             to: "completions"
+          },
+          {
+            from: "packaging/homebrew/bygone-launcher.sh",
+            to: "bygone-launcher.sh"
           }
         ],
         extraMetadata: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davmash/bygone",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "See how change happened. Visual diff and file history.",
   "author": "David Mashburn",
   "license": "MIT",

package/skills/pr-tour-guide/SKILL.md

@@ -66,6 +66,13 @@ npm install -g @davmash/bygone
 
 **macOS without Homebrew:** download the DMG from [GitHub Releases](https://github.com/davidmashburn/bygone/releases), then choose **Help → Install Command Line Tools…** in the app.
 
+If macOS reports the app is **damaged**, the build is likely unsigned. Clear quarantine and open once:
+
+```sh
+xattr -cr /Applications/Bygone.app
+open /Applications/Bygone.app
+```
+
 **From a Bygone source checkout:**
 
 ```sh