cicy-desktop 2.1.148 → 2.1.149

package/.github/workflows/mac-app-release.yml

@@ -188,9 +188,12 @@ jobs:
           for ARCH in x64 arm64; do
             WANT="$([ "$ARCH" = x64 ] && echo x86_64 || echo arm64)"
             APP=""
-            for d in $(find dist -maxdepth 2 -type d -name "*.app"); do
-              if lipo -archs "$d/Contents/MacOS/"* 2>/dev/null | grep -qw "$WANT"; then APP="$d"; break; fi
-            done
+            # NUL-delimited: the .app dir name has a space ("CiCy Desktop.app"), so a
+            # `for d in $(find …)` word-splits the path and breaks. read -d '' is safe.
+            while IFS= read -r -d '' d; do
+              bin="$(find "$d/Contents/MacOS" -maxdepth 1 -type f | head -1)"
+              if lipo -archs "$bin" 2>/dev/null | grep -qw "$WANT"; then APP="$d"; break; fi
+            done < <(find dist -maxdepth 2 -type d -name "*.app" -print0)
             [ -n "$APP" ] || { echo "::warning::no $ARCH .app found, skipping"; continue; }
             echo "app installer $ARCH ← $APP"
             B="appbundle-$ARCH"; rm -rf "$B"; mkdir -p "$B"
@@ -200,4 +203,16 @@ jobs:
             tar -czf "$OUT" -C "$B" .
             gh release upload "${{ steps.meta.outputs.tag }}" "$OUT" --repo "$GITHUB_REPOSITORY" --clobber
             echo "uploaded $OUT ($(du -h "$OUT" | cut -f1))"
+
+            # Native .pkg installer (right-click Open once; the postinstall ad-hoc-signs
+            # + de-quarantines the installed app so it opens with no Apple cert).
+            ROOT="pkgroot-$ARCH"; rm -rf "$ROOT"; mkdir -p "$ROOT/Applications"
+            cp -R "$APP" "$ROOT/Applications/CiCy Desktop.app"
+            SCR="pkgscripts-$ARCH"; rm -rf "$SCR"; mkdir -p "$SCR"
+            cp scripts/mac-allinone/postinstall "$SCR/postinstall"; chmod +x "$SCR/postinstall"
+            PKG="cicy-desktop-$VER-$ARCH.pkg"
+            pkgbuild --root "$ROOT" --scripts "$SCR" --identifier com.cicy.desktop \
+              --version "$VER" --install-location / "$PKG"
+            gh release upload "${{ steps.meta.outputs.tag }}" "$PKG" --repo "$GITHUB_REPOSITORY" --clobber
+            echo "uploaded $PKG ($(du -h "$PKG" | cut -f1))"
           done

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cicy-desktop",
-  "version": "2.1.148",
+  "version": "2.1.149",
   "description": "CiCy - AI-powered operating system browser",
   "main": "src/main.js",
   "bin": {

package/scripts/mac-allinone/postinstall

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Runs as root right after the .pkg lays down /Applications/CiCy Desktop.app.
+# The app is unsigned-but-ad-hoc (no Apple cert). pkg-installed files normally
+# aren't quarantined, but strip any quarantine + re-ad-hoc-sign to be safe so the
+# app opens without "已损坏 / unidentified developer". Best-effort — never fail install.
+APP="/Applications/CiCy Desktop.app"
+[ -d "$APP" ] || exit 0
+/usr/bin/xattr -dr com.apple.quarantine "$APP" 2>/dev/null || true
+/usr/bin/xattr -cr "$APP" 2>/dev/null || true
+/usr/bin/codesign --force --deep --sign - "$APP" 2>/dev/null || true
+exit 0