@fastagent-sh/voicenote 0.22.1 → 1.0.0

package/README.md

@@ -1,395 +1,19 @@
-# voicenote
+# @fastagent-sh/voicenote
 
-Voice recordings → diarized transcripts → integrated semantic Markdown notes.
-
-CLI command: `vn`
-
-[中文文档 / Chinese documentation](README.zh-CN.md)
-
-Currently tuned for the PHILIPS VTR6500 voice recorder, but the workflow is generic: scan recordings under a mount point → transcribe with speaker diarization → the selected summary model performs cleanup and process reconstruction → produce smart notes.
-
-**Two ways to use it:**
-
-- 🖥️ **Desktop app (GUI)** — for non-terminal users, a self-contained `.app`, one-line install:
-  ```bash
-  curl -fsSL https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/install-app.sh | bash
-  ```
-  See [Desktop app](#desktop-app-gui-app) below.
-- ⌨️ **CLI (`vn`)** — for terminal users / developers, see "Install (CLI)" below.
-
-## Install (CLI)
-
-> The CLI installs from the npm package `@fastagent-sh/voicenote`. The install script / `bun add -g` below require the package to be **published to npm** (see "Development" at the end for the release flow).
-
-Recommended: the install script (macOS):
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/install.sh | bash
-```
-
-The install script does **no interactive configuration** by default: it installs/checks `ffmpeg`, Bun, Node/npm, pi, and `vn`, then writes an editable `config.json` template. After installation, open the config file and fill in your keys and name:
-
-```bash
-open ~/.config/voicenote/config.json
-# or open the directory
-vn open config
-```
-
-Advanced users can preseed the template with environment variables:
-
-```bash
-VOICENOTE_NAME="Jane Doe" \
-VOICENOTE_ALIAS="jane" \
-VOICENOTE_WORKSPACE="$HOME/Documents/meetings" \
-VOLCANO_ASR_KEY="..." \
-VOLCANO_TOS_BUCKET="..." \
-VOLCANO_TOS_ACCESS_KEY="..." \
-VOLCANO_TOS_SECRET_KEY="..." \
-bash <(curl -fsSL https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/install.sh)
-```
-
-The first install creates `~/.config/voicenote/config.json`. Once configured, run `vn doctor` to check it, and `vn install-launch-agent` if you want background monitoring.
-
-Manual install:
-
-```bash
-bun remove -g @kid7st/voicenote 2>/dev/null || true   # drop the pre-rebrand package if present (safe no-op otherwise)
-bun add -g @fastagent-sh/voicenote
-mkdir -p ~/.local/bin
-ln -sf ~/.bun/bin/vn ~/.local/bin/vn
-```
-
-An older `git+…#main` install is replaced in place by `bun add -g @fastagent-sh/voicenote`. The one exception is the **pre-rebrand `@kid7st/voicenote`** package: it ships the same `vn` bin, so the `bun remove -g` line above clears it first (the one-line `install.sh` does this automatically).
-
-### Windows (CLI)
-
-The CLI is cross-platform. Prerequisites: Bun, ffmpeg (provides `ffprobe.exe`), Node + pi.
-
-```powershell
-bun remove -g @kid7st/voicenote 2>$null   # drop the pre-rebrand package if present (safe no-op otherwise)
-bun add -g @fastagent-sh/voicenote
-# Windows has no /Volumes mount points; set the recorder drive explicitly
-'{"env":{"VOICENOTE_RECORD_DIR":"E:\\RECORD"}}' | vn config set
-```
-
-- Config: `%APPDATA%\voicenote\config.json`; logs/locks: `%LOCALAPPDATA%\voicenote\`
-- Background automation uses the **Windows Task Scheduler**: `vn install-launch-agent` to register / `vn status` to inspect / `vn uninstall-launch-agent` to remove (same command names as macOS; dispatched per platform internally)
-
-## Dependencies
-
-- **Bun >= 1.3 (required at runtime)** — the code uses `Bun.Glob` / `Bun.file`; plain Node cannot run it
-- Node / npm — only used to install the pi CLI (the notes backend)
-- ffmpeg / ffprobe (audio duration detection):
-
-```bash
-brew install ffmpeg
-```
-
-The install script only writes `vn` / Bun / Homebrew PATH entries to your shell config; app configuration lives in `~/.config/voicenote/config.json`. A manual setup needs at least:
-
-```json
-{
-  "VOICENOTE_WORKSPACE": "/Users/you/Documents/meetings",
-  "VOLCANO_ASR_KEY": "...",
-  "VOLCANO_ASR_RESOURCE_ID": "volc.seedasr.auc",
-  "VOLCANO_TOS_REGION": "cn-guangzhou",
-  "VOLCANO_TOS_ENDPOINT": "tos-s3-cn-guangzhou.volces.com",
-  "VOLCANO_TOS_BUCKET": "...",
-  "VOLCANO_TOS_ACCESS_KEY": "...",
-  "VOLCANO_TOS_SECRET_KEY": "...",
-  "VOLCANO_TOS_KEEP": "0",
-  "speakers": {
-    "self": { "name": "Your name", "aliases": ["nickname", "alias"] },
-    "known": []
-  }
-}
-```
-
-An empty or missing key means "use the built-in default" — those defaults live in `src/cli.ts` and nowhere else, so the installer and the GUI leave such fields blank.
-
-Optional settings:
-
-```json
-{
-  "VOICENOTE_DEVICE_VOLUME": "VTR6500",
-  "VOICENOTE_RECORD_DIR": "/Volumes/VTR6500/RECORD",
-  "VOICENOTE_MAX_AGE_HOURS": "48",
-  "VOICENOTE_PI_BIN": "pi",
-  "VOICENOTE_PI_MODEL": "openai-codex/gpt-5.6-sol",
-  "PI_CODING_AGENT_DIR": "$HOME/.config/voicenote/pi-agent",
-  "VOICENOTE_PI_THINKING": "high",
-  "VOICENOTE_PI_SUMMARY_TOOLS": "read,grep",
-  "VOICENOTE_CONTEXT_DIR": "/Users/you/vault"
-}
-```
-
-### Which model writes the notes
-
-`VOICENOTE_PI_MODEL` is passed straight to pi as `--model`. pi accepts
-`provider/id`, so one value pins both (`openai-codex/gpt-5.6-sol`). Leave it unset
-and pi's own configured default model is used.
-
-Credentials always belong to pi (`pi` → `/login <provider>`, or a provider API key
-in the environment); voicenote never picks a provider and never falls back to a
-second one. If pi fails, the transcript is kept and the summary can be retried
-with `vn run --latest`.
-
-### Credentials of their own
-
-`PI_CODING_AGENT_DIR` relocates pi's config directory, which is where it keeps
-`auth.json`. Point it at a voicenote-owned directory and `vn login` writes there,
-pi refreshes the tokens there, and an interactive pi session cannot clobber
-them — it rewrites its own `auth.json` wholesale on exit, which has silently
-dropped providers before:
-
-```bash
-echo '{"env":{"PI_CODING_AGENT_DIR":"$HOME/.config/voicenote/pi-agent"}}' | vn config set
-vn login   # signs in and stores credentials in that directory
-```
-
-`vn doctor` prints the path it will read (`pi.auth=...`).
-
-`DEEPSEEK_API_KEY` and `OPENAI_API_KEY` in the config are only forwarded to pi's
-environment for providers that read them.
-
-Transient failures (dropped socket, 5xx, 429) are retried on the same provider up
-to `VOICENOTE_PI_RETRIES` times (default 3). Quota and auth errors are not
-retried.
-
-## Usage
-
-```bash
-vn doctor                       # check environment and config
-vn run                          # default: Volcano ASR + pi notes
-vn run --mode transcript        # transcript only, skip semantic notes
-vn run --latest                 # process only the latest valid recording
-vn run --latest --force         # re-run the latest one
-vn run --pdf                    # additionally render a PDF after notes
-vn run --dry-run                # print the plan only
-vn run /path/to/audio.m4a       # process one file by path (skips the scan, ignores age/size/duration filters)
-vn list                         # list this month's notes
-vn list --month 2026-05         # specific month
-vn last                         # print the latest processing summary
-vn open                         # open the notes directory in Finder
-vn open config                  # open ~/.config/voicenote/
-vn open logs                    # open the logs directory
-vn open <slug>                  # open a note by filename fragment
-vn forget <id|filename>         # let a recording be processed again
-vn log                          # print today's log tail (--lines N / -f follow / --err include launchd.err / --date YYYY-MM-DD)
-vn errors                       # print recent ERROR logs
-vn login                        # sign in to ChatGPT for the notes backend (browser callback; `--device-code` for headless machines). No pi TUI needed
-vn upgrade                      # reinstall latest npm package
-vn install-launch-agent
-vn status
-vn uninstall-launch-agent
-```
-
-## Configuration file
-
-The install script writes an editable template:
-
-```text
-~/.config/voicenote/config.json     # workspace, Volcano ASR/TOS, summary backend, your name/aliases, etc.
-```
-
-`speakers` maps Speaker A/B/C back to real names; `known` lists known contacts:
-
-```json
-{
-  "speakers": {
-    "self": { "name": "Your name", "aliases": ["nickname", "alias"] },
-    "known": []
-  }
-}
-```
-
-Changes take effect on the next `vn run`. `~`, `$HOME`, and `${HOME}` are accepted at the start of path settings. Environment variables override the file for the current CLI process; background runs use `config.json`, not shell startup files.
-
-## Workflow
-
-1. Scan recordings under `/Volumes/VTR6500/RECORD/`
-2. Filter: ignore `._*`, small files (<100KB), short recordings (<60s), and already-processed recordings; if a previous run failed only at the summary stage and the transcript is saved, it is not considered done — processing resumes from there
-3. Copy the original audio into `${VOICENOTE_WORKSPACE}/_audio/YYYY-MM/`
-4. Transcribe with the Volcano Doubao large-model audio-file recognition API: upload local audio to TOS, submit the job, poll for results, and delete the TOS object by default when done
-5. Persist the raw transcript immediately after transcription (no lossy cleanup), so a later-stage failure never wastes the ASR spend
-6. The summary model (default: pi codex via ChatGPT Plus) reads the raw transcript directly, performing necessary cleanup, speaker restoration, and reconstruction of views/debates/consensus inside the notes-generation stage; if the summary fails, the next `vn run` / `vn run --latest` reuses the saved transcript and retries only the notes generation — no `vn forget` needed
-7. Write notes / metadata; the system makes no archiving decisions — files stay in the configured workspace
-
-A failing recording is retried on later runs, but at most **3 times** (whether it fails in transcription or in summarisation, and a run killed mid-job counts too). After that it is marked `Gave up` and left alone, so one broken file can't burn ASR/LLM budget on every scheduler tick. Use **Retry** on its GUI row to reset the budget, preserve saved outputs, and run it again; `vn forget <name>` is the CLI escape hatch that drops the record and re-queues it. Either path reuses a saved transcript instead of paying for ASR again. Both take the run lock, so retry after the active run finishes if the state file is busy.
-
-Records whose source file is no longer on the recorder are forgotten on the next scan (and the removal is logged), *unless* they already produced notes or a transcript — that history is kept. This is why swapping recorders, or deleting files from the device, no longer leaves permanent "failed" rows behind.
-
-## Output locations
-
-`VOICENOTE_WORKSPACE` defaults to `~/Documents/meetings`.
-
-- Notes entry point: `${VOICENOTE_WORKSPACE}/YYYY-MM/`
-- Original audio: `${VOICENOTE_WORKSPACE}/_audio/YYYY-MM/`
-- Full transcripts: `${VOICENOTE_WORKSPACE}/_transcripts/YYYY-MM/`
-- Metadata: `${VOICENOTE_WORKSPACE}/_metadata/YYYY-MM/`
-- State: `${VOICENOTE_WORKSPACE}/_state/jobs.json` — one record per recording, holding its `state` — where it is in its lifecycle (`queued`, `running`, `done`, `filtered`, `error`, or `gave_up` once retries are spent) — plus a `code` saying why (`summary_failed`, `transcribe_failed`, `interrupted`, `too_small`, …), its attempt count and its output paths. `vn run` writes lifecycle updates; only explicit retry/forget actions mutate it otherwise. `vn jobs` and passive GUI refreshes are pure reads, so what you see is what will run. A pre-0.18 `processed.json` is converted automatically on the first run and kept as `processed.json.v1.bak`.
-- Index: `${VOICENOTE_WORKSPACE}/_index/notes.jsonl`
-
-## Automation
-
-The install script can set this up automatically. Manual setup:
-
-```bash
-vn install-launch-agent
-launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/sh.fastagent.voicenote.plist 2>/dev/null || true
-launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/sh.fastagent.voicenote.plist
-launchctl enable gui/$(id -u)/sh.fastagent.voicenote
-vn status
-```
-
-The LaunchAgent invokes `vn run` every 60 seconds. It skips safely when no recorder is plugged in; once the VTR6500 is connected, new recordings are processed automatically.
-
-> `config.json` changes are picked up by the background agent on its next run. The plist stores only a fixed PATH and executable paths: **after changing `VOICENOTE_PI_BIN`, re-run `vn install-launch-agent --load`** (`vn upgrade` does this automatically). Shell-only settings are deliberately not copied into the scheduler; persist them with `vn config set`. If pi or ASR is not configured, the agent skips before spending ASR.
-
-Logs:
-
-```text
-~/.local/state/voicenote/logs/launchd.out.log
-~/.local/state/voicenote/logs/launchd.err.log
-```
-
-## Development
-
-```bash
-git clone https://github.com/fastagent-sh/voicenote.git
-cd voicenote
-bun install
-bun run typecheck
-bun src/cli.ts doctor
-```
-
-Distribution: vn ships as **source** with no build step — it only runs on bun (shebang + `bun:ffi` + `engines.bun`), and bun runs TypeScript natively, so `bin` points straight at `src/cli.ts` and the npm tarball only contains `src/{cli,jobs,runLock,tos}.ts`. The install script / `vn upgrade` install from the published npm package (`bun add -g @fastagent-sh/voicenote`); a `git+https` install also works directly (the git tree carries the source; no build or install script needed).
-
-Routine release (tag triggers CI):
-
-```bash
-npm version patch
-git push --follow-tags
-```
-
-`package.json` is the CLI version source; `vn --version` reads it directly and CI rejects a mismatched `v*` tag.
-
-The workflow lives at `.github/workflows/release.yml`: CI explicitly runs typecheck, tests, and an entry-point smoke test, then `npm publish --ignore-scripts` (deterministic publishing, no lifecycle dependence). Publishing uses **npm trusted publishing (OIDC)**: no long-lived token (`id-token: write` + a Trusted Publisher configured on npmjs.com), with provenance attached automatically. A bare local `npm publish` is still guarded by `prepublishOnly` (typecheck + tests).
-
-> Both are already done for this package (Trusted Publisher configured, CI publishing since 0.18.0 with provenance), so a routine release needs nothing but the tag. Kept for forks: npm has no pending-publisher, so trusted publishing cannot publish a package's *very first* version — publish once manually with `npm login` + `npm publish --ignore-scripts`, then add a Trusted Publisher on the package settings page at npmjs.com (repo, workflow `release.yml`); CI takes over afterwards (the npm account needs 2FA).
-
-## Desktop app (GUI, `app/`)
-
-A self-contained macOS `.app` (Tauri v2) for **non-terminal users**: the target machine needs no pre-installed bun / pi / ffprobe / global `vn`.
-
-**Positioning**: the GUI is a status dashboard with quick access to output and manual Sync/Retry controls. The full pipeline still runs autonomously every 60s via the background LaunchAgent using the bundled CLI (it keeps running with the GUI closed).
-
-- First run: settings (identity / Volcano keys / proxy). The notes model comes from pi; ChatGPT users can sign in from the Status panel (`vn login`'s browser-callback flow).
-- After that: the main view shows agent activity and recent notes, opens outputs, and can retry failed recordings.
-
-### What's bundled
-
-`bun build --compile` compiles the `vn` CLI (bun runtime + pi-ai included) into a single-file sidecar; pi cannot be compiled (it reads data files from disk at runtime), so the whole package ships alongside and runs with a bundled `bun`:
-
-| Component | Form | Purpose |
-|------|------|------|
-| `vn` (compiled) | externalBin | pipeline + ChatGPT sign-in |
-| `bun` | externalBin | runs pi |
-| `ffprobe` (native universal on macOS) | externalBin | audio duration (pi only needs ffprobe, not all of ffmpeg) |
-| `pi` + node_modules | resource | notes backend (ChatGPT, OpenAI API, or DeepSeek) |
-
-At runtime, Rust invokes the bundled `vn` directly and injects `VOICENOTE_PI_BIN`, `VOICENOTE_PI_CLI`, and `VOICENOTE_FFPROBE_BIN`; `vn` then runs `<bundled bun> <bundled pi/cli.js>` without a wrapper script. Release builds are **universal** (x86_64 + arm64; vn/bun/ffprobe each merged with `lipo`; pi is JS and needs none).
-
-### Build
-
-Prerequisites: Rust + cargo, bun, node/npm, Xcode CLT, and **pi installed globally on the build machine** (`npm i -g @earendil-works/pi-coding-agent`; the build script stages pi from there).
+Installs the **VoiceNote desktop app** on macOS:
 
 ```bash
-cd app
-bun install
-bun run tauri build
-# Output: src-tauri/target/release/bundle/macos/VoiceNote.app
-```
-
-**Windows** (build on Windows with Rust + MSVC C++ build tools; WebView2 is preinstalled on Win10/11, NSIS is downloaded by Tauri automatically):
-
-```powershell
-cd app
-bun install
-bun run tauri build --config src-tauri/tauri.windows.conf.json
-# Output: app\src-tauri\target\release\bundle\nsis\VoiceNote_<version>_x64-setup.exe
+npx @fastagent-sh/voicenote
 ```
 
-Windows uses `scripts/build-vn-sidecar.ps1` to stage `vn.exe` (`--windows-hide-console`, no console window) / `bun.exe` / `ffprobe.exe` + pi; `tauri.windows.conf.json` produces the NSIS installer (currentUser, no admin).
-
-`beforeBuildCommand` first runs `scripts/build-vn-sidecar.sh` to stage vn/bun/ffprobe/pi (`binaries/` and `resources/` are gitignored; pi/ffprobe copying is idempotent). For development use `bun run tauri dev` (dev mode runs `../src/cli.ts` directly, no bundling, no background agent install).
-
-### How users install (one line, recommended)
-
-> This is separate from the CLI `install.sh` above: the CLI script targets developers (installs bun/pi/vn); this one targets **non-technical users** (download .app → /Applications).
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/install-app.sh | bash
-```
-
-**Windows** (one line, no admin):
-
-```powershell
-irm https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/install-app.ps1 | iex
-```
-
-`install-app.ps1` downloads the NSIS installer from the GitHub Release (self-contained vn/bun/ffprobe/pi) → silent install into `%LOCALAPPDATA%` (no admin) → launches it.
-
-`install-app.sh` downloads the packaged `.app` from GitHub Releases → installs to `/Applications` → **removes the quarantine flag for the user** (Gatekeeper bypass for un-notarized builds) → opens it. The target machine needs no bun/pi/ffprobe/global vn (all bundled).
-
-**First launch**: the app lands on Settings. Fill in identity, your Volcano ASR/TOS keys, and proxy as needed. Notes are written by pi with pi's own provider and model; for ChatGPT, click "Sign in to ChatGPT" in the Status panel. Saving installs and loads the background LaunchAgent using the bundled CLI. Once credentials are configured, plug in the recorder for automatic transcription and notes.
-
-> The background agent label is `sh.fastagent.voicenote` (same as the CLI version; only one exists per machine). If the `.app` is moved, open it once to recalibrate the plist.
-
-**Upgrades**: since 0.1.9 the app has a built-in updater — open the app → "Settings → Software update" → "Check for updates"; when a new version appears, click "Download & install"; the app restarts automatically with config/notes preserved. For first installs, or upgrades from 0.1.8 and earlier (which had no updater), re-run the one-line install script above.
-
-> **Windows, from 0.1.11 or earlier**: those builds point their updater at the pre-rebrand repo, which still exists and stops at 0.1.11 — "Check for updates" therefore always reports "up to date". The bundle identifier changed in the same rebrand, so re-running the installer does *not* replace them; both copies stay installed under the same name. Uninstall the old VoiceNote (Settings → Apps) first, then run the one-line install. Config and notes are untouched by the uninstall.
-
-### Maintainers: packaging + release
-
-**Automatic (recommended)**: push an `app-v*` tag to trigger `.github/workflows/release-app.yml`:
-
-```bash
-git tag app-v0.1.0 && git push --tags
-```
-
-**One `app-v*` tag = one Release covering mac + Windows.** `release-app.yml` is a single workflow: mac (universal + ad-hoc deep signing) and Windows (NSIS) build in parallel, then the `release` job publishes. Each Release carries:
-
-- **First-install packages** `VoiceNote.zip` (mac) / `VoiceNote-setup.exe` (win) — fetched by `install-app.*` from `releases/latest/download/...`;
-- **Updater artifacts** `VoiceNote.app.tar.gz` + `latest.json` — used by the in-app Tauri updater (Settings → Software update).
-
-> The updater needs signing secrets `TAURI_SIGNING_PRIVATE_KEY` / `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` (generated with `tauri signer generate`; the public key goes in `tauri.conf.json`); the `preflight` job blocks the release while the pubkey is still a placeholder.
-
-> Use `app-v*` (distinct from the CLI's `v*` npm release tags). Artifacts are **universal** (x86_64 + arm64), working on both Intel and Apple Silicon.
-
-**Manual**:
-
-```bash
-cd app
-bash scripts/package.sh          # → app/release/VoiceNote-<version>.zip (~110MB)
-gh release create app-v0.1.0 app/release/VoiceNote-<version>.zip#VoiceNote.zip -t "VoiceNote 0.1.0" -n "Desktop app"
-```
-
-The asset name must be **`VoiceNote.zip`** (`install-app.sh` fetches `releases/latest/download/VoiceNote.zip`). For local testing bypass the Release with: `VOICENOTE_APP_URL=file:///path/to/VoiceNote.zip bash scripts/install-app.sh`.
-
-### Signing / notarization (no `xattr`, double-click to run)
-
-JIT entitlements are in place (`src-tauri/entitlements.plist`: `allow-jit` etc. for bun/vn; referenced from `tauri.conf.json`). `scripts/sign-macos.sh` performs inside-out deep signing (hardened runtime + entitlements):
-
-```bash
-# Internal ad-hoc (JIT verified to survive under hardened runtime)
-bash scripts/sign-macos.sh /Applications/VoiceNote.app
-
-# Official distribution (requires a Developer ID certificate, Apple Developer Program $99/yr)
-bash scripts/sign-macos.sh VoiceNote.app "Developer ID Application: NAME (TEAMID)"
-xcrun notarytool submit ... && xcrun stapler staple VoiceNote.app
-```
+It downloads the latest release from
+[GitHub](https://github.com/fastagent-sh/voicenote/releases), replaces any
+existing copy, and puts `VoiceNote.app` in `/Applications`. The app updates
+itself after that, so this command is only needed once (or to repair an
+install).
 
-## License
+Everything the app needs ships inside the bundle — no Node, no Bun, no
+separate transcription tooling.
 
-MIT
+Looking for the command line tool? That is
+[`@fastagent-sh/vn`](https://www.npmjs.com/package/@fastagent-sh/vn).

package/install.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// Installs the VoiceNote desktop app from its GitHub release.
+//
+// The app itself is a signed .app bundle, not something npm can hold; this
+// package exists so `npx @fastagent-sh/voicenote` is a one-line install (and
+// re-install, and repair) without hunting for a download page. Everything the
+// app needs is inside the bundle, so there is nothing else to set up.
+//
+// A file downloaded by this script is not quarantined the way a browser
+// download is, so the app opens on the first double-click — no right-click →
+// Open dance, even though the signature is self-signed.
+import { execFileSync } from 'node:child_process'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const REPO = 'fastagent-sh/voicenote'
+const APPS = '/Applications'
+
+function fail(message) {
+  console.error(`\nVoiceNote 安装失败：${message}\n`)
+  process.exit(1)
+}
+
+if (process.platform !== 'darwin') {
+  fail(`目前只有 macOS 版本（检测到 ${process.platform}）。`)
+}
+
+const release = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
+  headers: { accept: 'application/vnd.github+json' },
+}).then(r => r.ok ? r.json() : fail(`读取发布信息失败（HTTP ${r.status}）。`))
+
+// The zip is what ships the .app; the dmg is for people who download by hand.
+const wanted = process.arch === 'arm64' ? 'arm64' : 'x64'
+const asset = (release.assets ?? []).find(a => a.name.endsWith('-mac.zip') && a.name.includes(wanted))
+if (!asset) fail(`这个版本没有 ${wanted} 的 macOS 包（${release.tag_name}）。`)
+
+console.log(`下载 VoiceNote ${release.tag_name.replace(/^app-v/, '')}（${(asset.size / 1e6).toFixed(0)} MB）…`)
+const work = await mkdtemp(join(tmpdir(), 'voicenote-install-'))
+const zipPath = join(work, asset.name)
+try {
+  const download = await fetch(asset.browser_download_url)
+  if (!download.ok) fail(`下载失败（HTTP ${download.status}）。`)
+  await writeFile(zipPath, Buffer.from(await download.arrayBuffer()))
+
+  const target = join(APPS, 'VoiceNote.app')
+  if (existsSync(target)) {
+    console.log('替换已安装的版本…')
+    // Quit it first: replacing a running bundle leaves the old process alive
+    // with files that no longer exist.
+    try { execFileSync('osascript', ['-e', 'tell application "VoiceNote" to quit'], { stdio: 'ignore' }) } catch { /* not running */ }
+    await rm(target, { recursive: true, force: true })
+  }
+  execFileSync('ditto', ['-x', '-k', zipPath, APPS], { stdio: 'inherit' })
+  if (!existsSync(target)) fail('解压后没有找到 VoiceNote.app。')
+
+  console.log(`\n✓ 已安装到 ${target}`)
+  console.log('  打开方式：访达 → 应用程序 → VoiceNote，或执行 open -a VoiceNote')
+  console.log('  应用会自己检查更新，之后不需要再跑这个命令。\n')
+} catch (error) {
+  if (error?.code === 'EACCES' || /Permission denied/i.test(String(error?.message))) {
+    fail(`没有写入 ${APPS} 的权限。用 sudo 重试：sudo npx @fastagent-sh/voicenote`)
+  }
+  fail(String(error?.message ?? error))
+} finally {
+  await rm(work, { recursive: true, force: true })
+}

package/package.json

@@ -1,58 +1,25 @@
 {
   "name": "@fastagent-sh/voicenote",
-  "version": "0.22.1",
-  "description": "Voice recordings → diarized transcripts → integrated semantic Markdown notes. Currently optimized for the PHILIPS VTR6500 recorder, but the workflow is generic.",
+  "version": "1.0.0",
+  "description": "Installs the VoiceNote desktop app (macOS). The command line tool is @fastagent-sh/vn.",
   "type": "module",
   "license": "MIT",
   "author": "fastagent-sh",
   "homepage": "https://github.com/fastagent-sh/voicenote",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/fastagent-sh/voicenote.git"
+    "url": "git+https://github.com/fastagent-sh/voicenote.git",
+    "directory": "installer"
   },
-  "bugs": {
-    "url": "https://github.com/fastagent-sh/voicenote/issues"
-  },
-  "keywords": [
-    "voice",
-    "voicenote",
-    "transcription",
-    "diarization",
-    "meeting-notes",
-    "philips",
-    "cli",
-    "bun"
-  ],
+  "keywords": ["voicenote", "installer", "macos", "transcription", "meeting-notes"],
   "bin": {
-    "vn": "src/cli.ts"
-  },
-  "files": [
-    "src/cli.ts",
-    "src/jobs.ts",
-    "src/runLock.ts",
-    "src/tos.ts",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "dev": "bun src/cli.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "bun test",
-    "doctor": "bun src/cli.ts doctor",
-    "prepublishOnly": "bun run typecheck && bun test ./src"
+    "voicenote": "install.mjs"
   },
+  "files": ["install.mjs", "README.md"],
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "@earendil-works/pi-ai": "^0.79.3",
-    "cac": "latest"
-  },
-  "devDependencies": {
-    "@types/bun": "latest",
-    "typescript": "latest"
-  },
   "engines": {
-    "bun": ">=1.3.0"
+    "node": ">=20"
   }
 }

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 fastagent-sh
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.