@hasna/recordings 0.3.1 → 0.3.8

package/src/native/Recordings/RecordingsTests/BarOnlyLaunchPlanTests.swift

@@ -0,0 +1,99 @@
+import Foundation
+import Testing
+@testable import RecordingsLib
+
+/// Regression coverage for the bar-only successor lane (task 4ee4ebbf-9a10-4181-8e43-9307d56e684b).
+///
+/// These lock the launch-plan control flow behind the terminated hasna/apps#269 lineage's P1
+/// classes:
+///
+/// - Cycle-1 P1: real launches of the installed bar never passed `--bar-only`, so the bar
+///   binary was behaviorally identical to the full app. Fixed by making bar builds bar-only by
+///   construction (`#if RECORDINGS_BAR_ONLY` compile-time default); the argument is now only a
+///   self-describing launch record.
+/// - Cycle-2 P1: the windowless branch keyed on `declaresMainWindow`, which excludes EVERY
+///   runtime smoke, so the FULL build's smoke failed deterministically. Fixed by splitting the
+///   conditions: `declaresWindow` (window creation may happen) excludes only the helper and bar
+///   launches, while `declaresMainWindow` (auto-open / reopen) additionally excludes runtime
+///   smoke so the smoke controls window creation deterministically.
+struct BarOnlyLaunchPlanTests {
+    @Test("a bare launch follows the build variant")
+    func bareLaunchFollowsBuildVariant() {
+        let plan = PermissionRequestLaunchPlan(arguments: [])
+        #if RECORDINGS_BAR_ONLY
+        #expect(plan.isBarOnly, "a bar build must be bar-only by construction on a bare launch")
+        #expect(!plan.declaresWindow)
+        #expect(!plan.declaresMainWindow)
+        #else
+        #expect(!plan.isBarOnly, "a full build must launch with the workspace window")
+        #expect(plan.declaresWindow)
+        #expect(plan.declaresMainWindow)
+        #endif
+        #expect(plan.declaresMenuBar)
+        #expect(plan.installsGlobalHandlers)
+    }
+
+    @Test("the explicit bar argument makes any launch bar-only on a full build")
+    func explicitBarArgument() {
+        #if !RECORDINGS_BAR_ONLY
+        let plan = PermissionRequestLaunchPlan(arguments: ["--bar-only"])
+        #expect(plan.isBarOnly)
+        #expect(!plan.declaresWindow)
+        #expect(!plan.declaresMainWindow)
+        // The menu bar is still declared: the bar keeps the record controls, live
+        // transcription, paste delivery, and settings surfaces.
+        #expect(plan.declaresMenuBar)
+        #endif
+    }
+
+    @Test("a full build's normal-mode runtime smoke keeps exercising the workspace window")
+    func fullBuildRuntimeSmokePlan() {
+        let plan = PermissionRequestLaunchPlan(arguments: [
+            "--runtime-smoke", "normal",
+            "--runtime-smoke-output", "/tmp/smoke.json",
+        ])
+        #if RECORDINGS_BAR_ONLY
+        // On a bar build even the smoke is bar-only: the windowless branch keys on the
+        // build variant, not on the smoke mode.
+        #expect(plan.isBarOnly)
+        #expect(!plan.declaresWindow)
+        #else
+        // The cycle-2 P1 regression: a full build's smoke must still be able to create
+        // the workspace window, or every full build's smoke fails deterministically.
+        #expect(!plan.isBarOnly)
+        #expect(plan.declaresWindow, "the full-build smoke must exercise the workspace window")
+        #endif
+        // declaresMainWindow excludes runtime smoke in BOTH variants so the smoke controls
+        // window creation deterministically (no init auto-open, no reopen handler).
+        #expect(!plan.declaresMainWindow)
+        #expect(plan.isRuntimeSmoke)
+        #expect(plan.declaresMenuBar, "the smoke must observe the live menu bar surface")
+    }
+
+    @Test("a bar plan keeps the menu bar and global handlers but never declares a window")
+    func barPlanKeepsMenuBarAndGlobalHandlers() {
+        let plan = PermissionRequestLaunchPlan(arguments: ["--bar-only"])
+        #expect(plan.installsGlobalHandlers)
+        #expect(plan.declaresMenuBar)
+        #expect(plan.isBarOnly)
+        #expect(!plan.declaresWindow)
+        #expect(!plan.declaresMainWindow)
+    }
+
+    @Test("declaresMainWindow excludes runtime smoke, helper, and bar launches")
+    func declaresMainWindowExcludesRuntimeSmoke() {
+        for arguments in [
+            ["--runtime-smoke", "normal"],
+            ["--runtime-smoke", "permission-helper"],
+            ["--request-permissions"],
+            ["--bar-only"],
+        ] {
+            let plan = PermissionRequestLaunchPlan(arguments: arguments)
+            #expect(!plan.declaresMainWindow)
+        }
+        let plain = PermissionRequestLaunchPlan(arguments: [])
+        #if !RECORDINGS_BAR_ONLY
+        #expect(plain.declaresMainWindow)
+        #endif
+    }
+}

package/src/native/Recordings/RecordingsTests/CLIRunnerTests.swift

@@ -8,7 +8,7 @@ struct CLIRunnerTests {
     func bundledCLIIsPreferred() throws {
         let root = FileManager.default.temporaryDirectory
             .appendingPathComponent("recordings-bundled-cli-\(UUID().uuidString)")
-        let app = root.appendingPathComponent("Recordings.app")
+        let app = root.appendingPathComponent("HasnaRecordings.app")
         let helper = app.appendingPathComponent("Contents/Helpers/recordings")
         let home = root.appendingPathComponent("home")
         let external = home.appendingPathComponent(".bun/bin/recordings")
@@ -34,7 +34,7 @@ struct CLIRunnerTests {
     func packagedAppDoesNotUseGlobalFallback() throws {
         let root = FileManager.default.temporaryDirectory
             .appendingPathComponent("recordings-missing-companion-\(UUID().uuidString)")
-        let app = root.appendingPathComponent("Recordings.app")
+        let app = root.appendingPathComponent("HasnaRecordings.app")
         let home = root.appendingPathComponent("home")
         let external = home.appendingPathComponent(".bun/bin/recordings")
         try FileManager.default.createDirectory(at: app, withIntermediateDirectories: true)

package/src/native/Recordings/RecordingsTests/RecordingStartGateTests.swift

@@ -6,7 +6,7 @@ struct RecordingStartGateTests {
     @Test("permission-only launch skips global handlers and terminates after handling")
     func permissionHelperLaunchPlan() {
         let plan = PermissionRequestLaunchPlan(arguments: [
-            "/Applications/Recordings.app/Contents/MacOS/Recordings",
+            "/Applications/HasnaRecordings.app/Contents/MacOS/Recordings",
             "--request-permissions",
             "--open-permission-settings",
         ])

package/src/native/Recordings/Updater/BootstrapPreflight/BootstrapPreflightMain.swift

@@ -51,7 +51,7 @@ enum RecordingsBootstrapPreflight {
         let manifest = try JSONDecoder().decode(ReleaseManifest.self, from: manifestData)
         try validateManifest(manifest, payload: payload)
 
-        let app = arguments.payloadRoot + "/Applications/Recordings.app"
+        let app = arguments.payloadRoot + "/Applications/HasnaRecordings.app"
         let client = app + "/" + RecordingsUpdateConstants.updateClientRelativePath
         let broker = arguments.payloadRoot + "/Library/PrivilegedHelperTools/com.hasna.recordings.updater"
         let artifactVerifier = arguments.payloadRoot

package/src/native/Recordings/Updater/Broker/ApplicationNamespace.swift

@@ -7,7 +7,7 @@ import RecordingsUpdateProtocol
 /// operation; first installs use exclusive rename semantics and can never replace a
 /// leaf created concurrently in `/Applications`.
 final class ApplicationNamespace {
-    private static let liveLeaf = "Recordings.app"
+    private static let liveLeaf = "HasnaRecordings.app"
     private static let previousLeaf = "previous.app"
     private static let failedCandidateLeaf = "failed-candidate.app"
 
@@ -22,7 +22,7 @@ final class ApplicationNamespace {
             .deletingLastPathComponent
         guard journal.applicationPath == RecordingsUpdateConstants.applicationPath,
               journal.candidateApplicationPath == expectedTransactionDirectory
-                + "/candidate/Recordings.app",
+                + "/candidate/HasnaRecordings.app",
               journal.previousApplicationPath == nil ||
                 journal.previousApplicationPath == expectedTransactionDirectory + "/previous.app"
         else {

package/src/native/Recordings/Updater/Broker/BrokerMain.swift

@@ -276,7 +276,7 @@ final class UpdateBrokerSession: NSObject, RecordingsUpdateXPCProtocol {
         guard mkdir(candidateRoot, 0o700) == 0 else {
             throw BrokerOperationError.candidateRejected
         }
-        let candidateApplication = candidateRoot + "/Recordings.app"
+        let candidateApplication = candidateRoot + "/HasnaRecordings.app"
         let verifierIDs = try verifierAccountIDs()
         try CanonicalTreeCopier.copyApplication(
             from: verifierOutput,

package/src/native/Recordings/Updater/Broker/CanonicalTreeCopy.swift

@@ -22,7 +22,7 @@ enum CanonicalTreeCopier {
         }
         defer { Darwin.close(source) }
         let destinationRoot = URL(fileURLWithPath: rootCandidatePath).deletingLastPathComponent().path
-        guard URL(fileURLWithPath: rootCandidatePath).lastPathComponent == "Recordings.app" else {
+        guard URL(fileURLWithPath: rootCandidatePath).lastPathComponent == "HasnaRecordings.app" else {
             throw CanonicalCopyError.nonCanonicalRoot
         }
         let destination = Darwin.open(

package/src/native/Recordings/Updater/Broker/InstallJournal.swift

@@ -253,7 +253,7 @@ struct DurableInstallJournal {
         let leaf = URL(fileURLWithPath: transactionDirectory).lastPathComponent
         guard leaf.hasPrefix("transaction-") else { throw InstallJournalError.invalidJournal }
         let transactionID = String(leaf.dropFirst("transaction-".count))
-        let expectedCandidate = transactionDirectory + "/candidate/Recordings.app"
+        let expectedCandidate = transactionDirectory + "/candidate/HasnaRecordings.app"
         let activationPhases: Set<String> = [
             "prepared", "launch-barrier-pending", "launch-barrier-held",
             "swap-pending", "swapped", "previous-retaining",

package/src/native/Recordings/Updater/BrokerTests/ActivationRecoveryPolicyTests.swift

@@ -201,8 +201,8 @@ struct ActivationRecoveryPolicyTests {
             "Contents/Helpers/recordings": 493,
             "Contents/Helpers/recordings-update-client": 493
           },
-          "candidate_application_path": "/Library/Application Support/Hasna/Recordings/Updates/transaction-00000000-0000-0000-0000-000000000001/candidate/Recordings.app",
-          "application_path": "/Applications/Recordings.app"
+          "candidate_application_path": "/Library/Application Support/Hasna/Recordings/Updates/transaction-00000000-0000-0000-0000-000000000001/candidate/HasnaRecordings.app",
+          "application_path": "/Applications/HasnaRecordings.app"
         }
         """#.utf8)
         let journal = try JSONDecoder().decode(BrokerInstallJournal.self, from: legacyJSON)

package/src/native/Recordings/Updater/Protocol/UpdateProtocol.swift

@@ -7,7 +7,7 @@ public enum RecordingsUpdateConstants {
     public static let rootMaintenanceSupported = false
     public static let keyRotationSupported = false
     public static let machServiceName = "com.hasna.recordings.updater"
-    public static let applicationPath = "/Applications/Recordings.app"
+    public static let applicationPath = "/Applications/HasnaRecordings.app"
     public static let brokerExecutablePath = "/Library/PrivilegedHelperTools/com.hasna.recordings.updater"
     public static let stateRoot = "/Library/Application Support/Hasna/Recordings/Updates"
     public static let trustRoot = "/Library/Application Support/Hasna/Recordings/Trust"

package/src/native/Recordings/Updater/VerifierLauncher/RecordingsVerifierLauncher.c

@@ -729,7 +729,7 @@ int recordings_copy_canonical_application_tree(
         if (entry == NULL) break;
         if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) continue;
         visible_entries += 1;
-        if (strcmp(entry->d_name, "Recordings.app") != 0) only_application = false;
+        if (strcmp(entry->d_name, "HasnaRecordings.app") != 0) only_application = false;
     }
     int status = errno;
     closedir(directory);
@@ -739,7 +739,7 @@ int recordings_copy_canonical_application_tree(
     status = copy_directory_at(
         verifier_output_directory_descriptor,
         root_candidate_directory_descriptor,
-        "Recordings.app",
+        "HasnaRecordings.app",
         verifier_user_id,
         &budget
     );

package/src/native/Recordings/build.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Build, sign, notarize, and finalize a Recordings.app artifact.
+# Build, sign, notarize, and finalize a HasnaRecordings.app artifact.
 # Usage: ./build.sh [debug|local] | ./build.sh release <initial-bootstrap|app-update>
 
 set -euo pipefail
@@ -83,7 +83,7 @@ fi
 readonly RELEASE_SUBTYPE
 RELEASE_ARCHITECTURES=(arm64 x86_64)
 
-CODESIGN_IDENTITY="${RECORDINGS_CODESIGN_IDENTITY:-}"
+CODESIGN_IDENTITY="${RECORDINGS_CODESIGN_IDENTITY:-${HASNA_CODESIGN_IDENTITY:-}}"
 EXPECTED_TEAM_ID="${RECORDINGS_EXPECTED_TEAM_IDENTIFIER:-}"
 NOTARY_PROFILE="${RECORDINGS_NOTARY_KEYCHAIN_PROFILE:-}"
 INSTALLER_IDENTITY="${RECORDINGS_INSTALLER_CODESIGN_IDENTITY:-}"
@@ -96,6 +96,37 @@ COMPATIBLE_COHORT_MANIFEST="${RECORDINGS_RELEASE_COMPATIBLE_COHORT_MANIFEST:-}"
 LOCAL_APPROVED_TARGET="${RECORDINGS_LOCAL_APPROVED_TARGET:-}"
 LOCAL_APPROVED_TARGET_IDENTITY_KIND="${RECORDINGS_LOCAL_APPROVED_TARGET_IDENTITY_KIND:-}"
 LOCAL_APPROVED_TARGET_IDENTITY_SHA256="${RECORDINGS_LOCAL_APPROVED_TARGET_IDENTITY_SHA256:-}"
+VARIANT="${RECORDINGS_VARIANT:-full}"
+case "$VARIANT" in
+    full|bar) ;;
+    *)
+        echo "RECORDINGS_VARIANT must be full or bar; got: $VARIANT" >&2
+        exit 2
+        ;;
+esac
+if [ "$MODE" = "release" ] && [ "$VARIANT" = "bar" ]; then
+    # The bar variant is a deliberate product change (no workspace window, accessory
+    # launch); a release that carries it must be explicitly marked so a default release
+    # can never silently emit a bar artifact.
+    if [ "${RECORDINGS_RELEASE_BAR_VARIANT_MARKED:-0}" != "1" ]; then
+        echo "release-mode bar-variant builds require RECORDINGS_RELEASE_BAR_VARIANT_MARKED=1 to proceed explicitly." >&2
+        exit 2
+    fi
+fi
+readonly VARIANT
+VARIANT_SWIFT_FLAGS=()
+if [ "$VARIANT" = "bar" ]; then
+    VARIANT_SWIFT_FLAGS=(-Xswiftc -DRECORDINGS_BAR_ONLY)
+fi
+# Fleet naming rule (knowledge k_msxd5rz3_jfvl3i): every Hasna macOS app is
+# Hasna<Name>.app with 'Hasna' at the beginning. The bundle is named
+# HasnaRecordings.app for BOTH variants (full and bar); the 'bar' is a variant, never
+# a separate app name. Bundle identifier stays com.hasna.recordings so TCC keeps
+# keying on bundle id + signing identity, and the executable inside the bundle stays
+# "Recordings".
+APP_BUNDLE_NAME="HasnaRecordings.app"
+readonly APP_BUNDLE_NAME
+APP_BASENAME="${APP_BUNDLE_NAME%.app}"
 PLIST_BUDDY="$(select_executable "/usr/libexec/PlistBuddy" "${RECORDINGS_TEST_PLIST_BUDDY_EXECUTABLE:-${PLIST_BUDDY:-}}")"
 PLUTIL="$(select_executable "/usr/bin/plutil" "${RECORDINGS_TEST_PLUTIL_EXECUTABLE:-${PLUTIL:-}}")"
 BUN_EXECUTABLE="${BUN_EXECUTABLE:-}"
@@ -134,6 +165,48 @@ LIPO_EXECUTABLE="$(select_executable "/usr/bin/lipo" "${RECORDINGS_TEST_LIPO_EXE
 STAT_EXECUTABLE="$(select_executable "/usr/bin/stat" "${RECORDINGS_TEST_STAT_EXECUTABLE:-}")"
 TEST_GIT_EXECUTABLE="$(select_executable "" "${RECORDINGS_TEST_GIT_EXECUTABLE:-}")"
 TEST_SWIFT_EXECUTABLE="$(select_executable "" "${RECORDINGS_TEST_SWIFT_EXECUTABLE:-}")"
+SECURITY_EXECUTABLE="$(select_executable "/usr/bin/security" "${RECORDINGS_TEST_SECURITY_EXECUTABLE:-}")"
+
+# Developer ID signing identity support. The identity comes from RECORDINGS_CODESIGN_IDENTITY
+# (legacy) or HASNA_CODESIGN_IDENTITY (canonical name), and when neither is supplied the
+# keychain is consulted with `security find-identity -v -p codesigning` and the first
+# "Developer ID Application:" identity is used. Signing NEVER silently falls back to ad-hoc
+# when a Developer ID was requested: release builds always require one, and a local build
+# with RECORDINGS_SIGNING_REQUIRED=1 fails loudly when none exists.
+discover_developer_id_identity() {
+    local listing
+    listing="$("$SECURITY_EXECUTABLE" find-identity -v -p codesigning 2>/dev/null)" || return 0
+    printf '%s\n' "$listing" | "$AWK_EXECUTABLE" -F'"' '/Developer ID Application:/ { print $2; exit }'
+}
+
+derive_team_id() {
+    local identity="$1"
+    local team_id
+    team_id="$(printf '%s\n' "$identity" | "$SED_EXECUTABLE" -n 's/.*(\([A-Z0-9]\{10\}\))$/\1/p')"
+    if ! [[ "$team_id" =~ ^[A-Z0-9]{10}$ ]]; then
+        echo "Could not derive a 10-character Developer ID team from the signing identity: $identity" >&2
+        return 1
+    fi
+    printf '%s\n' "$team_id"
+}
+
+resolve_signing_identity() {
+    # Called when no explicit identity was supplied. Fails loudly when a Developer ID
+    # was requested but none can be found; the caller decides whether one was requested.
+    if [ "$HOST_PLATFORM" != "Darwin" ]; then
+        return 0
+    fi
+    local discovered
+    discovered="$(discover_developer_id_identity)"
+    if [ -z "$discovered" ]; then
+        echo "Developer ID signing was requested but no Developer ID Application identity found in the keychain; never silently ad-hoc when a Developer ID is requested." >&2
+        return 1
+    fi
+    CODESIGN_IDENTITY="$discovered"
+    if [ -z "$EXPECTED_TEAM_ID" ]; then
+        EXPECTED_TEAM_ID="$(derive_team_id "$CODESIGN_IDENTITY")" || return 1
+    fi
+}
 
 require_executable() {
     local label="$1"
@@ -253,6 +326,7 @@ require_executable "ID_EXECUTABLE" "$ID_EXECUTABLE"
 require_executable "STAT_EXECUTABLE" "$STAT_EXECUTABLE"
 if [ "$HOST_PLATFORM" = "Darwin" ]; then
     require_executable "LIPO_EXECUTABLE" "$LIPO_EXECUTABLE"
+    require_executable "SECURITY_EXECUTABLE" "$SECURITY_EXECUTABLE"
 fi
 require_bun_executable "$BUN_EXECUTABLE"
 if [ "$MODE" = "release" ]; then
@@ -545,11 +619,23 @@ run_codesign() {
 }
 
 run_swift() {
+    # VARIANT_SWIFT_FLAGS is empty for every full build (the default). A bare
+    # "${arr[@]}" on an EMPTY array under `set -u` aborts bash < 4.4 — macOS
+    # /bin/bash is 3.2.57 — with `unbound variable`, which killed every build the
+    # moment the flags existed. The ${arr[0]+"${arr[@]}"} guard is the script-wide
+    # idiom (see run_bun, run_xcrun, run_release_sensitive_tool); do not reintroduce
+    # a bare expansion here.
+    #
+    # The flags are arguments TO swift (after the executable), never before it:
+    # placed before the executable they would be consumed by /usr/bin/env as its
+    # own options and the build would die with `env: '-Xswiftc': No such file`.
     "$ENV_EXECUTABLE" -i \
         HOME="$BUILD_HOME" \
         PATH="$SANITIZED_PATH" \
         TMPDIR="$BUILD_WORK_DIR" \
-        "$SWIFT_EXECUTABLE" "$@"
+        "$SWIFT_EXECUTABLE" \
+        ${VARIANT_SWIFT_FLAGS[0]+"${VARIANT_SWIFT_FLAGS[@]}"} \
+        "$@"
 }
 
 run_lipo() {
@@ -939,8 +1025,19 @@ BUILDER_IDENTITY_KIND="none"
 BUILDER_IDENTITY_SHA256="none"
 if [ "$MODE" = "release" ]; then
     if [ -z "$CODESIGN_IDENTITY" ] || [ "$CODESIGN_IDENTITY" = "-" ]; then
-        echo "Release builds require RECORDINGS_CODESIGN_IDENTITY for a Developer ID Application identity." >&2
-        exit 1
+        # No explicit identity: discover the Developer ID Application identity from the
+        # keychain. Release signing is never optional, so "requested but not found" fails
+        # loudly instead of degrading to an ad-hoc signature.
+        if [ "$HOST_PLATFORM" = "Darwin" ]; then
+            resolve_signing_identity || {
+                echo "Release builds require a Developer ID Application identity in RECORDINGS_CODESIGN_IDENTITY or HASNA_CODESIGN_IDENTITY." >&2
+                exit 1
+            }
+        fi
+        if [ -z "$CODESIGN_IDENTITY" ] || [ "$CODESIGN_IDENTITY" = "-" ]; then
+            echo "Release builds require RECORDINGS_CODESIGN_IDENTITY or HASNA_CODESIGN_IDENTITY for a Developer ID Application identity." >&2
+            exit 1
+        fi
     fi
     if [ -z "$EXPECTED_TEAM_ID" ]; then
         echo "Release builds require RECORDINGS_EXPECTED_TEAM_IDENTIFIER to pin the Developer ID team." >&2
@@ -1075,6 +1172,31 @@ elif [ "$MODE" = "local" ]; then
     # a release is notarization, the single-target binding, and the builder attestation
     # above, none of which are relaxed. With no identity supplied the old ad-hoc behaviour
     # is kept verbatim, because a Mac without the signing key must still be able to build.
+    if [ -z "$CODESIGN_IDENTITY" ] || [ "$CODESIGN_IDENTITY" = "-" ]; then
+        if [ "${RECORDINGS_SIGNING_REQUIRED:-0}" = "1" ]; then
+            # A Developer ID was explicitly requested for this local build: discover it
+            # from the keychain and fail loudly when none exists.
+            resolve_signing_identity || exit 1
+        elif [ "$HOST_PLATFORM" = "Darwin" ]; then
+            # The DEFAULT route is the keychain: `security find-identity` and use the
+            # Developer ID Application identity when one exists. That is the stable
+            # signing identity TCC grants key on — an ad-hoc signature has no identity
+            # to key on beyond a CDHash that changes on every rebuild, which orphans
+            # the Accessibility grant and breaks the Fn hold-to-talk path. A Mac
+            # without the signing key still builds ad-hoc (the old behaviour), but the
+            # fallback is LOUD, never silent, and RECORDINGS_SIGNING_REQUIRED=1 above
+            # turns it into a hard failure.
+            discovered_identity="$(discover_developer_id_identity)"
+            if [ -n "$discovered_identity" ]; then
+                CODESIGN_IDENTITY="$discovered_identity"
+                if [ -z "$EXPECTED_TEAM_ID" ]; then
+                    EXPECTED_TEAM_ID="$(derive_team_id "$CODESIGN_IDENTITY")" || exit 1
+                fi
+            else
+                echo "WARNING: no Developer ID Application identity found in the keychain; local build falls back to ad-hoc signing (set RECORDINGS_SIGNING_REQUIRED=1 to fail instead)." >&2
+            fi
+        fi
+    fi
     if [ -n "$CODESIGN_IDENTITY" ] && [ "$CODESIGN_IDENTITY" != "-" ]; then
         if [[ "$CODESIGN_IDENTITY" != "Developer ID Application:"* ]]; then
             echo "Local-station signing requires a Developer ID Application identity in RECORDINGS_CODESIGN_IDENTITY." >&2
@@ -1134,15 +1256,15 @@ fi
 
 generate_and_verify_native_fs_guard
 
-echo "Building Recordings.app ($MODE)..."
+echo "Building HasnaRecordings.app ($MODE)..."
 if [ "$MODE" = "release" ]; then
     OUTPUT_BUILD_DIR="$BUILD_ROOT/release-output"
 else
     OUTPUT_BUILD_DIR="$SCRIPT_DIR/.build/$BUILD_CONFIGURATION"
 fi
-OUTPUT_APP_DIR="$OUTPUT_BUILD_DIR/Recordings.app"
+OUTPUT_APP_DIR="$OUTPUT_BUILD_DIR/$APP_BUNDLE_NAME"
 SWIFT_PRODUCT_DIR="$SWIFT_SCRATCH_PATH/$BUILD_CONFIGURATION"
-APP_DIR="$BUILD_WORK_DIR/Recordings.app"
+APP_DIR="$BUILD_WORK_DIR/$APP_BUNDLE_NAME"
 CONTENTS="$APP_DIR/Contents"
 MACOS="$CONTENTS/MacOS"
 RESOURCES="$CONTENTS/Resources"
@@ -1300,6 +1422,16 @@ if [ "$MODE" = "release" ] && [ "$HOST_PLATFORM" = "Darwin" ]; then
     fi
 fi
 "$CP_EXECUTABLE" "$SOURCE_NATIVE_DIR/RecordingsLib/Info.plist" "$CONTENTS/Info.plist"
+# Bundle display name per the fleet naming rule (knowledge k_msxd5rz3_jfvl3i):
+# "Hasna Recordings" with 'Hasna' at the beginning, for both variants.
+"$PLIST_BUDDY" -c 'Set :CFBundleDisplayName Hasna Recordings' "$CONTENTS/Info.plist"
+if [ "$VARIANT" = "bar" ]; then
+    # The bar is an accessory app: LSUIElement keeps it out of the Dock and the app
+    # switcher, and the app's window-declaring control flow (RECORDINGS_BAR_ONLY)
+    # keeps the workspace window absent. The bundle identifier stays com.hasna.recordings
+    # so TCC grants continue to key on bundle id + signing identity.
+    "$PLIST_BUDDY" -c 'Add :LSUIElement bool true' "$CONTENTS/Info.plist"
+fi
 VERSION="$("$PLIST_BUDDY" -c 'Print :CFBundleShortVersionString' "$CONTENTS/Info.plist")"
 
 compute_release_publication_identity() {
@@ -1313,6 +1445,7 @@ compute_release_publication_identity() {
         --component "release_sequence=$RELEASE_SEQUENCE"
         --component "key_epoch=$KEY_EPOCH"
         --component "expires_at_utc=$ENVELOPE_EXPIRES_AT_UTC"
+        --component "variant=$VARIANT"
     )
     identity_arguments+=(--component "envelope_public_key_sha256=$ENVELOPE_PUBLIC_KEY_SHA256")
     if [ "$RELEASE_SUBTYPE" = "initial-bootstrap" ]; then
@@ -1331,7 +1464,7 @@ compute_release_publication_identity() {
 
 reserve_release_output() {
     local release_set_basename reserved_output
-    release_set_basename="Recordings-${VERSION}-macos-${RELEASE_SUBTYPE}"
+    release_set_basename="${APP_BASENAME}-${VERSION}-macos-${RELEASE_SUBTYPE}"
     compute_release_publication_identity
     RELEASE_OUTPUT_ROOT="$OUTPUT_BUILD_DIR"
     RELEASE_FINAL_DIR="$RELEASE_OUTPUT_ROOT/${release_set_basename}.release"
@@ -1398,7 +1531,7 @@ reserve_release_output() {
     RELEASE_STAGING_DIR="$($MKTEMP_EXECUTABLE -d "$RELEASE_OUTPUT_ROOT/.${release_set_basename}.staging.XXXXXX")"
     "$CHMOD_EXECUTABLE" 0700 "$RELEASE_STAGING_DIR"
     OUTPUT_BUILD_DIR="$RELEASE_STAGING_DIR"
-    OUTPUT_APP_DIR="$OUTPUT_BUILD_DIR/Recordings.app"
+    OUTPUT_APP_DIR="$OUTPUT_BUILD_DIR/$APP_BUNDLE_NAME"
 }
 
 if [ "$MODE" = "release" ]; then
@@ -1533,8 +1666,6 @@ run_signed_helper_contract() {
         HOME="$contract_home"
         PATH="/usr/bin:/bin:/usr/sbin:/sbin"
         TMPDIR="$contract_home"
-        HASNA_RECORDINGS_CLIENT_STORE="sqlite"
-        RECORDINGS_CLIENT_STORE="sqlite"
         HASNA_RECORDINGS_DB_PATH="$contract_home/recordings.db"
         RECORDINGS_AUDIO_DIR="$contract_home/audio"
     )
@@ -1586,6 +1717,7 @@ if [ "$MODE" != "debug" ]; then
         --team-id "$EXPECTED_TEAM_ID" \
         --package-root "$PACKAGE_ROOT" \
         --artifact-policy "$ARTIFACT_POLICY" \
+        --variant "$VARIANT" \
         --approved-target "$APPROVED_TARGET" \
         --approved-target-identity-kind "$APPROVED_TARGET_IDENTITY_KIND" \
         --approved-target-identity-sha256 "$APPROVED_TARGET_IDENTITY_SHA256" \
@@ -1643,7 +1775,7 @@ run_codesign --verify --deep --strict --verbose=2 "$APP_DIR"
     TMPDIR="$BUILD_WORK_DIR" \
     SSH_CONNECTION="${SSH_CONNECTION:-}" \
     ${SMOKE_TEST_ENVIRONMENT[0]+"${SMOKE_TEST_ENVIRONMENT[@]}"} \
-    "$BASH_EXECUTABLE" "$SMOKE_SCRIPT" "$APP_DIR" "$BUN_EXECUTABLE"
+    "$BASH_EXECUTABLE" "$SMOKE_SCRIPT" "$APP_DIR" "$BUN_EXECUTABLE" --variant "$VARIANT"
 
 publish_app_output() {
     local source_tree_digest
@@ -1807,7 +1939,7 @@ publish_complete_release_set() {
     RELEASE_DIRECTORY_PUBLISHED=1
     RELEASE_STAGING_DIR=""
     OUTPUT_BUILD_DIR="$RELEASE_FINAL_DIR"
-    OUTPUT_APP_DIR="$OUTPUT_BUILD_DIR/Recordings.app"
+    OUTPUT_APP_DIR="$OUTPUT_BUILD_DIR/$APP_BUNDLE_NAME"
     run_bun "$SOURCE_PACKAGE_ROOT/scripts/macos_artifact.ts" complete-release-publication \
         --destination "$RELEASE_FINAL_DIR" \
         --reservation "$RELEASE_RESERVATION" \
@@ -1833,7 +1965,7 @@ if [ "$MODE" = "debug" ]; then
 fi
 
 if [ "$MODE" = "local" ]; then
-    ARTIFACT_BASENAME="Recordings-${VERSION}-macos-${APPROVED_TARGET}-local-only"
+    ARTIFACT_BASENAME="${APP_BASENAME}-${VERSION}-macos-${APPROVED_TARGET}-local-only"
     FINAL_ARCHIVE="$OUTPUT_BUILD_DIR/${ARTIFACT_BASENAME}.zip"
     FINAL_MANIFEST="$OUTPUT_BUILD_DIR/${ARTIFACT_BASENAME}.manifest.json"
     "$RM_EXECUTABLE" -f "$FINAL_ARCHIVE" "$FINAL_MANIFEST"
@@ -1846,6 +1978,7 @@ if [ "$MODE" = "local" ]; then
         --archive "$FINAL_ARCHIVE" \
         --manifest "$FINAL_MANIFEST" \
         --package-root "$PACKAGE_ROOT" \
+        --variant "$VARIANT" \
         --approved-target "$APPROVED_TARGET" \
         --approved-target-identity-kind "$APPROVED_TARGET_IDENTITY_KIND" \
         --approved-target-identity-sha256 "$APPROVED_TARGET_IDENTITY_SHA256" \
@@ -1859,8 +1992,8 @@ if [ "$MODE" = "local" ]; then
 fi
 
 verify_signed_code "$HELPERS/recordings" "Companion CLI"
-verify_signed_code "$APP_DIR" "Recordings.app"
-ARTIFACT_BASENAME="Recordings-${VERSION}-macos-${RELEASE_SUBTYPE}"
+verify_signed_code "$APP_DIR" "HasnaRecordings.app"
+ARTIFACT_BASENAME="${APP_BASENAME}-${VERSION}-macos-${RELEASE_SUBTYPE}"
 NOTARY_ARCHIVE="$OUTPUT_BUILD_DIR/${ARTIFACT_BASENAME}-notarization.zip"
 FINAL_ARCHIVE="$OUTPUT_BUILD_DIR/${ARTIFACT_BASENAME}.zip"
 FINAL_MANIFEST="$OUTPUT_BUILD_DIR/${ARTIFACT_BASENAME}.manifest.json"
@@ -1911,7 +2044,7 @@ run_xcrun stapler validate "$APP_DIR"
 run_release_sensitive_tool "$SPCTL_EXECUTABLE" --assess --type execute --verbose=2 "$APP_DIR"
 run_release_sensitive_tool "$SYSPOLICY_CHECK_EXECUTABLE" distribution "$APP_DIR"
 verify_signed_code "$HELPERS/recordings" "Companion CLI"
-verify_signed_code "$APP_DIR" "Recordings.app"
+verify_signed_code "$APP_DIR" "HasnaRecordings.app"
 run_codesign --verify --deep --strict --verbose=2 "$APP_DIR"
 
 run_release_sensitive_tool "$DITTO_EXECUTABLE" -c -k --sequesterRsrc --keepParent "$APP_DIR" "$FINAL_ARCHIVE"
@@ -1923,6 +2056,7 @@ run_bun "$SOURCE_PACKAGE_ROOT/scripts/macos_artifact.ts" finalize \
     --manifest "$FINAL_MANIFEST" \
     --package-root "$PACKAGE_ROOT" \
     --team-id "$EXPECTED_TEAM_ID" \
+    --variant "$VARIANT" \
     --notary-log "$NOTARY_LOG" \
     --notary-submission-id "$NOTARY_ID" \
     --submitted-archive-sha256 "$NOTARY_ARCHIVE_SHA256"

package/dist/lib/retired-deployment-modes.d.ts

@@ -1,24 +0,0 @@
-export declare const RETIRED_DEPLOYMENT_MODES: readonly ["local", "self_hosted", "cloud", "remote", "hybrid"];
-export type RetiredDeploymentMode = (typeof RETIRED_DEPLOYMENT_MODES)[number];
-/** Fold case, surrounding space, and the `self-hosted`/`self_hosted` spelling split. */
-export declare function normalizeModeToken(value: string): string;
-/** The retired mode this value names, or null if it names something else. */
-export declare function asRetiredDeploymentMode(value: string): RetiredDeploymentMode | null;
-export interface RetiredModeReplacement {
-    /** The variable the caller should set instead. */
-    envKey: string;
-    /** Value that replaces `local` — the on-this-box arm. */
-    onBox: string;
-    /** Value that replaces `self_hosted` / `cloud` / `remote` / `hybrid`. */
-    offBox: string;
-}
-/**
- * The error a retired mode word must produce.
- *
- * It names three things a bare "unknown value" error does not: the variable that
- * carried the retired word, the variable to set instead, and the exact value —
- * because the operator reading this cannot be assumed to know the collapse
- * happened.
- */
-export declare function retiredDeploymentModeError(rawValue: string, sourceEnvKey: string, replacement: RetiredModeReplacement): Error;
-//# sourceMappingURL=retired-deployment-modes.d.ts.map

package/dist/lib/retired-deployment-modes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"retired-deployment-modes.d.ts","sourceRoot":"","sources":["../../src/lib/retired-deployment-modes.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,wBAAwB,gEAM3B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAKnF;AAED,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,sBAAsB,GAClC,KAAK,CASP"}