browser-cookie-bridge 1.0.0 → 1.1.0

package/README.md

@@ -9,9 +9,10 @@
 <p>Brave, Chrome, Edge, Arc, Vivaldi, Opera, and Comet · browser-to-browser transfer · import into ChatGPT Codex.</p>
 
 <p>
-  <img src="https://img.shields.io/badge/macOS-13%2B-111111?logo=apple&logoColor=white" alt="macOS 13+" />
+  <img src="https://img.shields.io/badge/macOS-13.5%2B-111111?logo=apple&logoColor=white" alt="macOS 13.5+" />
   <img src="https://img.shields.io/badge/Swift-6-8E2735?logo=swift&logoColor=white" alt="Swift 6" />
   <img src="https://img.shields.io/badge/Node.js-22.5%2B-3C873A?logo=nodedotjs&logoColor=white" alt="Node.js 22.5+" />
+  <a href="https://www.npmjs.com/package/browser-cookie-bridge"><img src="https://img.shields.io/npm/v/browser-cookie-bridge?logo=npm&color=CB3837" alt="browser-cookie-bridge on npm" /></a>
   <img src="https://img.shields.io/badge/local--first-no%20cloud-C68B3C" alt="Local-first, no cloud" />
   <img src="https://img.shields.io/github/stars/apoorvdarshan/browser-cookie-bridge?logo=github&color=C68B3C" alt="GitHub stars" />
   <a href="https://www.producthunt.com/products/browser-cookie-bridge"><img src="https://img.shields.io/badge/Product%20Hunt-View%20launch-DA552F?logo=producthunt&logoColor=white" alt="Browser Cookie Bridge on Product Hunt" /></a>
@@ -20,6 +21,8 @@
 
 <p>
   <a href="#installation"><b>Install</b></a> ·
+  <a href="https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest">DMG</a> ·
+  <a href="https://www.npmjs.com/package/browser-cookie-bridge">npm</a> ·
   <a href="#how-it-works">How it works</a> ·
   <a href="#security--privacy">Security</a> ·
   <a href="CONTRIBUTING.md">Contribute</a> ·
@@ -28,7 +31,10 @@
   <a href="#support">Support</a>
 </p>
 
-<p><code>npm run build:app</code></p>
+<p>
+  <a href="https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-arm64.dmg"><b>Download for Apple silicon</b></a>
+  · <a href="https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-x64.dmg">Download for Intel</a>
+</p>
 
 <br />
 
@@ -38,7 +44,7 @@
 
 ---
 
-> **Status — local beta.** The native app and transfer engine work locally; the first public npm release has not been published yet. Importing into ChatGPT Codex is an intentionally unsupported direct integration and requires Codex to be completely closed.
+> **Version 1.1.0 adds self-contained DMG downloads.** Importing into ChatGPT Codex is an intentionally unsupported direct integration and requires Codex to be completely closed.
 
 ## Why Browser Cookie Bridge
 
@@ -54,7 +60,7 @@ Browser Cookie Bridge gives those local browser profiles a small, native control
 - 🕘 **Background automation** — sync when you sign in, at a fixed daily time, or whenever you choose.
 - ◉ **Native menu-bar app** — closing the window removes the Dock icon while the helper continues running.
 - 🧯 **Backup and rollback** — Codex's database is backed up, modified on a separate copy, integrity-checked, and restored if replacement fails.
-- ⬆️ **Built-in updates** — automatically checks npm release metadata and can install an update and relaunch the app.
+- ⬆️ **Built-in updates** — checks for GitHub releases, verifies the DMG checksum, installs in place, and relaunches the app.
 - 🔒 **Local-first** — no account, analytics, cloud service, cookie logs, or remote relay.
 
 ## What it transfers
@@ -71,27 +77,23 @@ Some websites bind sessions to a specific device or browser and may ask you to s
 
 ## Requirements
 
-- **macOS 13 (Ventura)+**
-- **Node.js 22.5+**
-- **Xcode Command Line Tools** — install with `xcode-select --install`
+- **macOS 13.5+**
 - A supported Chromium browser, or ChatGPT Codex as the destination
 
+The DMG is self-contained. Node.js 22.5+ and Xcode Command Line Tools are required only for npm or source installation.
+
 ## Installation
 
-### From source
+### Download a DMG — recommended
 
-```bash
-git clone https://github.com/apoorvdarshan/browser-cookie-bridge.git
-cd browser-cookie-bridge
-npm test
-npm run build:app
-```
+- **[Apple silicon DMG](https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-arm64.dmg)** — M1, M2, M3, M4, and newer
+- **[Intel DMG](https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-x64.dmg)** — Intel-based Macs
 
-The final command compiles the native SwiftUI app, enables **Open at login**, **Sync at login**, and the **menu-bar helper**, then launches it. A first install uses `~/Applications/Browser Cookie Bridge.app` without requesting administrator access. If an existing `/Applications/Browser Cookie Bridge.app` is present, later builds and updates keep using that system Applications copy instead of creating a duplicate. Daily sync stays off until you enable it.
+Open the DMG, drag **Browser Cookie Bridge** onto **Applications**, then open it from Applications. The current public build is checksum-verified and ad-hoc signed but not Apple-notarized, so macOS may require **Control-click → Open** on first launch. It does not require Node.js, Xcode, Terminal, or an administrator password.
 
 ### Via npm
 
-The package will be installable after the first tagged release:
+Run the published package directly:
 
 ```bash
 npx browser-cookie-bridge install-app
@@ -99,6 +101,21 @@ npx browser-cookie-bridge install-app
 
 No administrator password is needed. The app is built from source on your Mac and installed in your user Applications folder unless an existing writable system Applications copy is being updated.
 
+Both installation methods use the same bundle identifier and the same settings under `~/Library/Application Support/BraveCodexCookieSync`. Installing the DMG after npm does not create a separate product identity: the system Applications copy becomes canonical, and a stale matching user Applications copy is moved to the Trash on launch. Future updates replace that same app in place.
+
+**[View `browser-cookie-bridge` on npm →](https://www.npmjs.com/package/browser-cookie-bridge)**
+
+### From source
+
+```bash
+git clone https://github.com/apoorvdarshan/browser-cookie-bridge.git
+cd browser-cookie-bridge
+npm test
+npm run build:app
+```
+
+The final command compiles the native SwiftUI app, enables **Open at login**, **Sync at login**, and the **menu-bar helper**, then launches it. A first install uses `~/Applications/Browser Cookie Bridge.app` without requesting administrator access. If an existing `/Applications/Browser Cookie Bridge.app` is present, later builds and updates keep using that system Applications copy instead of creating a duplicate. Daily sync stays off until you enable it.
+
 ## Setup
 
 ### Browser → ChatGPT Codex
@@ -135,7 +152,7 @@ Generated extensions live under `~/Library/Application Support/BraveCodexCookieS
 | **Sync at login** | Runs once whenever you sign in; on by default |
 | **Open at login** | Starts the background app after macOS login; on by default |
 | **Show in menu bar** | Keeps sync, status, updates, and support actions close at hand |
-| **Check for updates** | Finds a newer npm release and offers install + relaunch |
+| **Check for updates** | Finds a newer GitHub release, verifies its DMG, and offers install + relaunch |
 
 Automation always uses the source, destination, and data choices currently saved in the app. A scheduled Codex sync safely exits without making changes when Codex is open.
 
@@ -180,12 +197,12 @@ Found a vulnerability? Read [SECURITY.md](SECURITY.md) and report it privately.
 
 ## Releases
 
-Pushing a semantic version tag runs tests, validates that package and app versions match, publishes to npm, and creates a GitHub Release with the tarball attached.
+Pushing a semantic version tag runs tests, validates that package and app versions match, builds separate Apple-silicon and Intel DMGs, publishes to npm, and creates a GitHub Release with the tarball, DMGs, and SHA-256 files attached.
 
 ```bash
 npm run release:check
-git tag v1.0.0
-git push origin v1.0.0
+git tag vX.Y.Z
+git push origin vX.Y.Z
 ```
 
 A normal branch push does not publish anything.
@@ -199,6 +216,8 @@ Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for local setu
 If Browser Cookie Bridge is useful to you:
 
 - ⭐ **Star** the repository
+- ⬇️ **[Download the latest DMG](https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest)**
+- 📦 **[Install from npm](https://www.npmjs.com/package/browser-cookie-bridge)**
 - 🐛 **[Report a bug](https://github.com/apoorvdarshan/browser-cookie-bridge/issues/new?template=bug_report.yml)** — never include cookie values or tokens
 - ☕ **[Support on Ko-fi](https://ko-fi.com/apoorvdarshan)**
 - 𝕏 **Follow [@apoorvdarshan](https://x.com/apoorvdarshan)**

package/extension-template/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Browser Cookie Bridge",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Transfers selected browser data locally between supported browsers and into ChatGPT Codex.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5o6lDkXzU/23Jm2QRk4mfuxNnr3VlEIjRHcZr93Gdo7PI7asHJQhigaMGT6UOz0lkaTn1F+TGIPlsJo9GNBSsxbCfxWoBSXcFQFrPolY5LEfKaMtZQQ6eb4UAnp+bbUwb1den4On0piWU47Yzl6i0Jcdg4EG5H1kCSF/6nJsbKgF7OTaR/3drULu40yRvflzSXRhly3UDO7c5mgHJsaMwVV+VILsxbcPOoRINjuo3zDC737HFs67dpf38xF3tjSVL0HURAWKKobMvfABiDfVEm5O0Lvf+57d1Ib12QLT2qtVXNDy3iYwX+w2S0wH2vIMsfvoFPlRdmeqft70kZOqXwIDAQAB",
   "permissions": ["alarms", "cookies", "history"],

package/macos-app/Info.plist

@@ -10,9 +10,9 @@
   <key>CFBundleInfoDictionaryVersion</key><string>6.0</string>
   <key>CFBundleName</key><string>Browser Cookie Bridge</string>
   <key>CFBundlePackageType</key><string>APPL</string>
-  <key>CFBundleShortVersionString</key><string>1.0.0</string>
-  <key>CFBundleVersion</key><string>24</string>
-  <key>LSMinimumSystemVersion</key><string>13.0</string>
+  <key>CFBundleShortVersionString</key><string>1.1.0</string>
+  <key>CFBundleVersion</key><string>25</string>
+  <key>LSMinimumSystemVersion</key><string>13.5</string>
   <key>NSHighResolutionCapable</key><true/>
 </dict>
 </plist>

package/macos-app/Sources/BraveCodexSyncApp/BraveCodexSyncApp.swift

@@ -3,6 +3,8 @@ import SwiftUI
 
 private enum ProjectLinks {
   static let repository = URL(string: "https://github.com/apoorvdarshan/browser-cookie-bridge")!
+  static let downloads = URL(string: "https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest")!
+  static let npm = URL(string: "https://www.npmjs.com/package/browser-cookie-bridge")!
   static let issues = URL(string: "https://github.com/apoorvdarshan/browser-cookie-bridge/issues/new?template=bug_report.yml")!
   static let license = URL(string: "https://github.com/apoorvdarshan/browser-cookie-bridge/blob/main/LICENSE")!
   static let koFi = URL(string: "https://ko-fi.com/apoorvdarshan")!
@@ -168,6 +170,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSWindowDelegate {
   private func addProjectLinks(to menu: NSMenu) {
     menu.addItem(.separator())
     addLink("Open-source repository", url: ProjectLinks.repository, to: menu)
+    addLink("Download latest DMG", url: ProjectLinks.downloads, to: menu)
+    addLink("View on npm", url: ProjectLinks.npm, to: menu)
     addLink("Report a bug…", url: ProjectLinks.issues, to: menu)
     addLink("MIT license", url: ProjectLinks.license, to: menu)
     menu.addItem(.separator())
@@ -503,6 +507,10 @@ struct PreferencesPanel: View {
         SectionLabel(title: "Project & support", detail: "Open source", separated: true)
         ProjectLinkRow(icon: "chevron.left.forwardslash.chevron.right", title: "Open-source repository", detail: "View the code on GitHub", url: ProjectLinks.repository)
         RowDivider()
+        ProjectLinkRow(icon: "arrow.down.circle", title: "Download latest DMG", detail: "Apple silicon and Intel builds", url: ProjectLinks.downloads)
+        RowDivider()
+        ProjectLinkRow(icon: "shippingbox", title: "View on npm", detail: "Install the latest public release", url: ProjectLinks.npm)
+        RowDivider()
         ProjectLinkRow(icon: "ladybug", title: "Report a bug", detail: "Open a GitHub issue", url: ProjectLinks.issues)
         RowDivider()
         ProjectLinkRow(icon: "doc.text", title: "MIT license", detail: "Read the open-source license", url: ProjectLinks.license)

package/macos-app/Sources/BraveCodexSyncApp/SyncModel.swift

@@ -116,6 +116,7 @@ final class SyncModel: ObservableObject {
   }
 
   init() {
+    bootstrapBundledRuntimeIfNeeded()
     let calendar = Calendar.current
     scheduleTime = calendar.date(bySettingHour: 9, minute: 0, second: 0, of: Date()) ?? Date()
     updateCodexRunningStatus()
@@ -130,6 +131,51 @@ final class SyncModel: ObservableObject {
     }
   }
 
+  private func bootstrapBundledRuntimeIfNeeded() {
+    guard let resources = Bundle.main.resourceURL else { return }
+    let bundledRuntime = resources.appending(path: "runtime")
+    let bundledNode = bundledRuntime.appending(path: "node/bin/node")
+    let bundledCLI = bundledRuntime.appending(path: "bin/brave-codex-cookie-sync.js")
+    guard FileManager.default.isExecutableFile(atPath: bundledNode.path),
+          FileManager.default.fileExists(atPath: bundledCLI.path) else { return }
+
+    if Bundle.main.bundlePath.hasPrefix("/Volumes/") {
+      state = .warning
+      primaryStatus = "Move the app to Applications"
+      secondaryStatus = "Drag Browser Cookie Bridge onto Applications in the DMG window, then open it there"
+      return
+    }
+
+    let process = Process()
+    let output = Pipe()
+    process.executableURL = bundledNode
+    process.arguments = [
+      bundledCLI.path,
+      "bootstrap-bundled",
+      "--app-path", Bundle.main.bundlePath,
+    ]
+    process.standardOutput = output
+    process.standardError = output
+
+    do {
+      try process.run()
+      process.waitUntilExit()
+      guard process.terminationStatus != 0 else { return }
+      let data = output.fileHandleForReading.readDataToEndOfFile()
+      let message = String(decoding: data, as: UTF8.self)
+        .split(separator: "\n")
+        .map(String.init)
+        .last(where: { !$0.isEmpty })
+      state = .error
+      primaryStatus = "Could not prepare the local runtime"
+      secondaryStatus = message ?? "Move the app to Applications and reopen it"
+    } catch {
+      state = .error
+      primaryStatus = "Could not prepare the local runtime"
+      secondaryStatus = error.localizedDescription
+    }
+  }
+
   func refresh() {
     dailyEnabled = FileManager.default.fileExists(atPath: launchAgent.path)
     loginSyncEnabled = FileManager.default.fileExists(atPath: loginSyncAgent.path)
@@ -204,11 +250,12 @@ final class SyncModel: ObservableObject {
 
   func checkForUpdates(showAlert: Bool = false) {
     guard !isCheckingForUpdates, !isInstallingUpdate else { return }
-    guard let url = URL(string: "https://registry.npmjs.org/browser-cookie-bridge/latest") else { return }
+    guard let url = URL(string: "https://api.github.com/repos/apoorvdarshan/browser-cookie-bridge/releases/latest") else { return }
     isCheckingForUpdates = true
     postUpdateState()
     var request = URLRequest(url: url, cachePolicy: .reloadIgnoringLocalCacheData, timeoutInterval: 15)
     request.setValue("Browser-Cookie-Bridge/\(currentVersion)", forHTTPHeaderField: "User-Agent")
+    request.setValue("application/vnd.github+json", forHTTPHeaderField: "Accept")
     URLSession.shared.dataTask(with: request) { [weak self] data, response, error in
       Task { @MainActor in
         guard let self else { return }
@@ -575,6 +622,16 @@ final class SyncModel: ObservableObject {
 
 private struct PackageRelease: Decodable {
   let version: String
+
+  private enum CodingKeys: String, CodingKey {
+    case tagName = "tag_name"
+  }
+
+  init(from decoder: Decoder) throws {
+    let values = try decoder.container(keyedBy: CodingKeys.self)
+    let tag = try values.decode(String.self, forKey: .tagName)
+    version = tag.hasPrefix("v") ? String(tag.dropFirst()) : tag
+  }
 }
 
 private struct UpdateResult: Decodable {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-cookie-bridge",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Private local cookie and session transfer for macOS",
   "type": "module",
   "bin": {
@@ -8,9 +8,10 @@
   },
   "scripts": {
     "test": "node --test test/*.test.js",
-    "check": "node --check bin/brave-codex-cookie-sync.js && node --check src/app-installer.js && node --check src/broker.js && node --check src/chromium-reader.js && node --check src/cli.js && node --check src/codex-direct-import.js && node --check src/config.js && node --check src/paths.js && node --check src/scheduler.js && node --check src/updater.js && node --check extension-template/background.js && node --check web/server.js && node --check web/script.js",
+    "check": "node --check bin/brave-codex-cookie-sync.js && node --check src/app-installer.js && node --check src/broker.js && node --check src/chromium-reader.js && node --check src/cli.js && node --check src/codex-direct-import.js && node --check src/config.js && node --check src/paths.js && node --check src/scheduler.js && node --check src/updater.js && node --check scripts/build-dmg.js && node --check extension-template/background.js && node --check web/server.js && node --check web/script.js",
     "release:check": "node scripts/check-release-version.js",
     "build:app": "node bin/brave-codex-cookie-sync.js install-app --no-open",
+    "build:dmg": "node scripts/build-dmg.js",
     "web": "node web/server.js",
     "web:deploy": "wrangler deploy --config web/wrangler.jsonc"
   },
@@ -22,7 +23,7 @@
     "type": "git",
     "url": "git+https://github.com/apoorvdarshan/browser-cookie-bridge.git"
   },
-  "homepage": "https://github.com/apoorvdarshan/browser-cookie-bridge#readme",
+  "homepage": "https://cookiebridge.apoorvdarshan.com/",
   "bugs": {
     "url": "https://github.com/apoorvdarshan/browser-cookie-bridge/issues"
   },
@@ -30,6 +31,16 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
+  "keywords": [
+    "browser",
+    "cookies",
+    "sessions",
+    "macos",
+    "chromium",
+    "brave",
+    "codex"
+  ],
+  "funding": "https://ko-fi.com/apoorvdarshan",
   "files": [
     "bin",
     "src",

package/src/cli.js

@@ -19,6 +19,9 @@ import {
   installedExtensionDir,
   launchAgentPath,
   loginSyncLaunchAgentPath,
+  systemInstalledAppPath,
+  userInstalledAppPath,
+  APP_ID,
   SOURCE_BROWSERS,
   TARGET_BROWSERS,
 } from "./paths.js";
@@ -39,6 +42,7 @@ Local cookie and session transfer between Chromium browsers and into ChatGPT Cod
 Commands:
   setup [--hour 9] [--minute 0] [--no-schedule]
   install-app [--no-open]
+  bootstrap-bundled --app-path /Applications/Browser Cookie Bridge.app
   preferences --source brave --target codex --cookies on --history off --menu-bar on --auto-check-updates on
   sync [--timeout 300]
   doctor
@@ -59,6 +63,8 @@ export async function main(argv) {
       return sync(args);
     case "install-app":
       return installDesktopApp(args);
+    case "bootstrap-bundled":
+      return bootstrapBundledApp(args);
     case "preferences":
       return preferences(args);
     case "install-update":
@@ -97,9 +103,9 @@ function installUpdate(args) {
   console.log(`Update worker started: ${result.workerPID}`);
 }
 
-function performUpdateWorker(args) {
+async function performUpdateWorker(args) {
   assertMacOS();
-  const result = performUpdate({
+  const result = await performUpdate({
     version: stringFlag(args, "--version", ""),
     appPath: stringFlag(args, "--app-path", ""),
     appPID: integerFlag(args, "--app-pid", 0, 2, Number.MAX_SAFE_INTEGER),
@@ -150,6 +156,67 @@ function installDesktopApp(args) {
     : "The app is available in your user Applications folder and Spotlight.");
 }
 
+function bootstrapBundledApp(args) {
+  assertMacOS();
+  const appPath = path.resolve(stringFlag(args, "--app-path", ""));
+  if (!appPath.endsWith(".app") || !fs.existsSync(appPath)) {
+    throw new Error("--app-path must point to the running Browser Cookie Bridge app");
+  }
+
+  const firstInstall = !fs.existsSync(configPath());
+  const runtime = installRuntime();
+  const existing = firstInstall ? null : readConfig();
+  const config = installConfig({
+    hour: existing?.schedule?.hour ?? 9,
+    minute: existing?.schedule?.minute ?? 0,
+    nodePath: process.execPath,
+  });
+
+  if (config.ui.openAtLogin) {
+    installAppLogin({ appPath, bootstrapNow: false });
+  } else {
+    removeAppLogin();
+  }
+
+  const bundledCLI = path.join(runtime, "bin", "brave-codex-cookie-sync.js");
+  if (firstInstall || fs.existsSync(loginSyncLaunchAgentPath())) {
+    installLoginSync({
+      cliPath: bundledCLI,
+      nodePath: process.execPath,
+    });
+  }
+  if (fs.existsSync(launchAgentPath())) {
+    installSchedule({
+      hour: config.schedule.hour,
+      minute: config.schedule.minute,
+      cliPath: bundledCLI,
+      nodePath: process.execPath,
+    });
+  }
+
+  archiveDuplicateUserApp(appPath);
+
+  console.log(`Bundled runtime ready: ${runtime}`);
+}
+
+function archiveDuplicateUserApp(currentAppPath) {
+  if (path.resolve(currentAppPath) !== path.resolve(systemInstalledAppPath())) return;
+  const duplicate = userInstalledAppPath();
+  if (!fs.existsSync(duplicate)) return;
+  const infoPath = path.join(duplicate, "Contents", "Info.plist");
+  const info = fs.existsSync(infoPath) ? fs.readFileSync(infoPath, "utf8") : "";
+  if (!info.includes(`<string>${APP_ID}</string>`)) return;
+
+  const trash = path.join(os.homedir(), ".Trash");
+  fs.mkdirSync(trash, { recursive: true, mode: 0o700 });
+  let archived = path.join(trash, "Browser Cookie Bridge previous installation.app");
+  for (let suffix = 2; fs.existsSync(archived); suffix += 1) {
+    archived = path.join(trash, `Browser Cookie Bridge previous installation ${suffix}.app`);
+  }
+  fs.renameSync(duplicate, archived);
+  console.log(`Archived duplicate app: ${archived}`);
+}
+
 function setup(args) {
   assertMacOS();
   const hour = integerFlag(args, "--hour", 9, 0, 23);

package/src/config.js

@@ -22,7 +22,7 @@ export function readConfig(home) {
   return config;
 }
 
-export function installConfig({ home, hour = 9, minute = 0 }) {
+export function installConfig({ home, hour = 9, minute = 0, nodePath = process.execPath }) {
   const target = configPath(home);
   const support = path.dirname(target);
   fs.mkdirSync(support, { recursive: true, mode: 0o700 });
@@ -38,7 +38,7 @@ export function installConfig({ home, hour = 9, minute = 0 }) {
     version: 1,
     token: existing.token || crypto.randomBytes(32).toString("base64url"),
     port: existing.port || DEFAULT_PORT,
-    nodePath: process.execPath,
+    nodePath,
     sourceBrowser,
     targetBrowser: configuredTarget === sourceBrowser ? "codex" : configuredTarget,
     imports: {
@@ -87,8 +87,7 @@ export function updatePreferences({ home, cookies, history, sourceBrowser, targe
   return config;
 }
 
-export function installRuntime(home) {
-  const source = projectRoot();
+export function installRuntime(home, source = projectRoot()) {
   const target = path.join(path.dirname(configPath(home)), "runtime");
   if (path.resolve(source) === path.resolve(target)) return target;
 
@@ -100,12 +99,14 @@ export function installRuntime(home) {
   const appSource = path.join(source, "macos-app");
   const appTarget = path.join(target, "macos-app");
   fs.rmSync(appTarget, { recursive: true, force: true });
-  fs.mkdirSync(appTarget, { recursive: true, mode: 0o700 });
-  for (const name of ["Sources", "Resources"]) {
-    fs.cpSync(path.join(appSource, name), path.join(appTarget, name), { recursive: true, force: true });
-  }
-  for (const name of ["Package.swift", "Info.plist"]) {
-    fs.copyFileSync(path.join(appSource, name), path.join(appTarget, name));
+  if (fs.existsSync(appSource)) {
+    fs.mkdirSync(appTarget, { recursive: true, mode: 0o700 });
+    for (const name of ["Sources", "Resources"]) {
+      fs.cpSync(path.join(appSource, name), path.join(appTarget, name), { recursive: true, force: true });
+    }
+    for (const name of ["Package.swift", "Info.plist"]) {
+      fs.copyFileSync(path.join(appSource, name), path.join(appTarget, name));
+    }
   }
   for (const name of ["package.json", "README.md", "LICENSE"]) {
     fs.copyFileSync(path.join(source, name), path.join(target, name));

package/src/updater.js

@@ -2,10 +2,12 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import { Readable } from "node:stream";
+import { finished } from "node:stream/promises";
 import { fileURLToPath } from "node:url";
 import {
   appSupportDir,
-  installedAppPath,
   systemInstalledAppPath,
   userInstalledAppPath,
 } from "./paths.js";
@@ -35,33 +37,28 @@ export function startDetachedUpdate({ version, appPath, appPID, home = os.homedi
   return { workerPID: child.pid, logPath };
 }
 
-export function performUpdate({ version, appPath, appPID, home = os.homedir() }) {
+export async function performUpdate({ version, appPath, appPID, home = os.homedir() }) {
   const destination = validateUpdateRequest({ version, appPath, appPID, home });
-  const resultPath = path.join(appSupportDir(home), "update-result.json");
-  const currentUserApp = installedAppPath(home);
+  const support = appSupportDir(home);
+  const resultPath = path.join(support, "update-result.json");
+  let mounted = null;
   try {
     waitForProcessToExit(appPID, 30_000);
-    const npxPath = findNpx();
-    const result = spawnSync(npxPath, [
-      "--yes",
-      `browser-cookie-bridge@${version}`,
-      "install-app",
-      "--no-open",
-    ], {
-      encoding: "utf8",
-      maxBuffer: 32 * 1024 * 1024,
-      env: { ...process.env, npm_config_yes: "true" },
-    });
-    if (result.status !== 0) {
-      throw new Error(result.stderr.trim() || result.stdout.trim() || `npx exited with status ${result.status}`);
-    }
-    if (!fs.existsSync(currentUserApp)) throw new Error("The downloaded app was not installed");
-    if (destination !== currentUserApp) replaceAppContents(currentUserApp, destination);
+    const release = await downloadReleaseDMG({ version, architecture: process.arch, support });
+    mounted = mountReleaseDMG(release.dmgPath, support);
+    const sourceApp = path.join(mounted.mountPoint, "Browser Cookie Bridge.app");
+    if (!fs.existsSync(sourceApp)) throw new Error("The downloaded DMG does not contain Browser Cookie Bridge.app");
+    replaceAppContents(sourceApp, destination);
     installAppLogin({ appPath: destination, bootstrapNow: false });
     writeUpdateResult(resultPath, { status: "success", version });
+    unmountReleaseDMG(mounted);
+    mounted = null;
+    fs.rmSync(release.dmgPath, { force: true });
+    fs.rmSync(release.checksumPath, { force: true });
     relaunch(destination);
     return { destination, version };
   } catch (error) {
+    if (mounted) unmountReleaseDMG(mounted);
     writeUpdateResult(resultPath, { status: "failed", version, message: error.message });
     if (fs.existsSync(destination)) relaunch(destination);
     throw error;
@@ -104,13 +101,78 @@ export function validateUpdateRequest({ version, appPath, appPID, home = os.home
   return resolved;
 }
 
-function findNpx() {
-  const sibling = path.join(path.dirname(process.execPath), "npx");
-  if (fs.existsSync(sibling)) return sibling;
-  const result = spawnSync("/usr/bin/which", ["npx"], { encoding: "utf8" });
-  const discovered = result.status === 0 ? result.stdout.trim() : "";
-  if (!discovered || !fs.existsSync(discovered)) throw new Error("npx was not found beside the configured Node.js runtime");
-  return discovered;
+export function releaseAssetName(version, architecture = process.arch) {
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version ?? "")) throw new Error("Invalid update version");
+  if (!["arm64", "x64"].includes(architecture)) throw new Error(`Unsupported macOS architecture: ${architecture}`);
+  return `Browser-Cookie-Bridge-${architecture}.dmg`;
+}
+
+export function parseChecksum(text, expectedFilename) {
+  const match = text.trim().match(/^([a-f0-9]{64})\s+\*?(.+)$/i);
+  if (!match || match[2] !== expectedFilename) throw new Error("Invalid release checksum file");
+  return match[1].toLowerCase();
+}
+
+async function downloadReleaseDMG({ version, architecture, support }) {
+  const updates = path.join(support, "updates");
+  fs.mkdirSync(updates, { recursive: true, mode: 0o700 });
+  const filename = releaseAssetName(version, architecture);
+  const base = `https://github.com/apoorvdarshan/browser-cookie-bridge/releases/download/v${version}`;
+  const dmgPath = path.join(updates, filename);
+  const checksumPath = `${dmgPath}.sha256`;
+  await downloadFile(`${base}/${filename}`, dmgPath);
+  await downloadFile(`${base}/${filename}.sha256`, checksumPath);
+  const expected = parseChecksum(fs.readFileSync(checksumPath, "utf8"), filename);
+  const actual = await fileSHA256(dmgPath);
+  if (actual !== expected) throw new Error("The downloaded update failed its SHA-256 verification");
+  return { dmgPath, checksumPath };
+}
+
+async function downloadFile(url, target) {
+  const response = await fetch(url, {
+    headers: { "User-Agent": "Browser-Cookie-Bridge-Updater" },
+    redirect: "follow",
+  });
+  if (!response.ok || !response.body) throw new Error(`Could not download update (${response.status})`);
+  const temporary = `${target}.${process.pid}.tmp`;
+  const output = fs.createWriteStream(temporary, { mode: 0o600 });
+  try {
+    await finished(Readable.fromWeb(response.body).pipe(output));
+    fs.renameSync(temporary, target);
+  } catch (error) {
+    fs.rmSync(temporary, { force: true });
+    throw error;
+  }
+}
+
+async function fileSHA256(target) {
+  const hash = crypto.createHash("sha256");
+  const input = fs.createReadStream(target);
+  input.on("data", (chunk) => hash.update(chunk));
+  await finished(input);
+  return hash.digest("hex");
+}
+
+function mountReleaseDMG(dmgPath, support) {
+  const mountPoint = path.join(support, "updates", `mounted-${process.pid}`);
+  fs.rmSync(mountPoint, { recursive: true, force: true });
+  fs.mkdirSync(mountPoint, { recursive: true, mode: 0o700 });
+  const result = spawnSync("/usr/bin/hdiutil", [
+    "attach", dmgPath,
+    "-mountpoint", mountPoint,
+    "-nobrowse",
+    "-readonly",
+  ], { encoding: "utf8" });
+  if (result.status !== 0) {
+    fs.rmSync(mountPoint, { recursive: true, force: true });
+    throw new Error(result.stderr.trim() || "The update DMG could not be mounted");
+  }
+  return { mountPoint };
+}
+
+function unmountReleaseDMG({ mountPoint }) {
+  spawnSync("/usr/bin/hdiutil", ["detach", mountPoint, "-force"], { stdio: "ignore" });
+  fs.rmSync(mountPoint, { recursive: true, force: true });
 }
 
 function waitForProcessToExit(pid, timeoutMilliseconds) {