tactus 0.32.2__tar.gz → 0.33.0__tar.gz

{tactus-0.32.2 → tactus-0.33.0}/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 <!-- version list -->
 
+## v0.33.0 (2026-01-18)
+
+### Documentation
+
+- Add installation instructions for unsigned macOS builds
+  ([`bb34f44`](https://github.com/AnthusAI/Tactus/commit/bb34f44b389b0154801d79a9d23255068328945d))
+
+### Features
+
+- Improve unsigned app distribution based on research
+  ([`34bc90e`](https://github.com/AnthusAI/Tactus/commit/34bc90ed6e25f4e58a4fefccbbc3c4220869dd3b))
+
+
 ## v0.32.2 (2026-01-17)
 
 ### Bug Fixes

{tactus-0.32.2 → tactus-0.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tactus
-Version: 0.32.2
+Version: 0.33.0
 Summary: Tactus: Lua-based DSL for agentic workflows
 Project-URL: Homepage, https://github.com/AnthusAI/Tactus
 Project-URL: Documentation, https://github.com/AnthusAI/Tactus/tree/main/docs

{tactus-0.32.2 → tactus-0.33.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "tactus"
-version = "0.32.2"
+version = "0.33.0"
 description = "Tactus: Lua-based DSL for agentic workflows"
 readme = "README.md"
 requires-python = ">=3.11"

{tactus-0.32.2 → tactus-0.33.0}/tactus/__init__.py

@@ -5,7 +5,7 @@ Tactus provides a declarative workflow engine for AI agents with pluggable
 backends for storage, HITL, and chat recording.
 """
 
-__version__ = "0.32.2"
+__version__ = "0.33.0"
 
 # Core exports
 from tactus.core.runtime import TactusRuntime

tactus-0.33.0/tactus-desktop/DISTRIBUTION.md

@@ -0,0 +1,205 @@
+# Distribution Notes for Unsigned Electron Apps
+
+## Current Working Solution (v0.32.2+)
+
+The GitHub Actions build **DOES work** - users just need to remove quarantine attributes:
+
+```bash
+# Required steps for macOS users:
+xattr -cr ~/Downloads/Tactus*.dmg
+open ~/Downloads/Tactus*.dmg
+xattr -cr "/Applications/Tactus IDE.app"
+```
+
+**Verified working:** v0.32.2 DMG launches successfully after removing quarantine.
+
+## The Problem
+
+When users download the DMG from GitHub Releases:
+1. GitHub adds `com.apple.provenance` attribute to downloaded files
+2. macOS Gatekeeper sees the app isn't code-signed
+3. macOS blocks the app with "damaged" error message
+4. Even right-clicking and selecting "Open" doesn't work for unsigned DMGs from the internet
+
+## Why Local Builds Work
+
+Local builds don't have quarantine attributes because they weren't downloaded from the internet. That's why testing locally always worked but CI builds appeared broken.
+
+## Alternative Distribution Methods (RESEARCHED)
+
+### 1. **Homebrew Cask - BEST SOLUTION**
+**Most popular method for unsigned Electron apps. Homebrew handles quarantine automatically.**
+
+Used by: VSCodium, Motrix, MarkText, Kap, FreeTube, PicGo, YesPlayMusic, and many others.
+
+**Advantages:**
+- ✅ No manual quarantine removal needed
+- ✅ Automatic updates through Homebrew
+- ✅ Trusted by developer community
+- ✅ No code signing required
+- ✅ Users already familiar with `brew install`
+
+**How to Submit:**
+1. Create a Cask formula in homebrew/homebrew-cask repository
+2. Formula references the DMG from GitHub Releases
+3. Homebrew team reviews and merges
+4. Users install with: `brew install --cask tactus-ide`
+
+**Example Apps Successfully Using This:**
+- VSCodium (VSCode fork): https://github.com/VSCodium/vscodium
+- Motrix (download manager): https://github.com/agalwood/Motrix
+- MarkText (markdown editor): https://github.com/marktext/marktext
+
+### 2. **Provide Both DMG and ZIP**
+Research shows successful apps offer both formats:
+- **DMG**: More professional, better UX, drag-to-install
+- **ZIP**: Simpler, some users report fewer issues
+- Both still trigger quarantine, but choice is good UX
+
+**Examples:**
+- draw.io desktop offers both
+- VSCodium provides both formats
+
+### 2. **Self-Hosted Downloads with Instructions**
+Host the DMG on your own server with clear installation instructions:
+- Removes GitHub's automatic quarantine flags
+- More control over download experience
+- Can show installation instructions before download
+
+### 3. **Real-World Examples of Unsigned Distribution**
+
+**massCode** (most transparent example):
+- Repository: https://github.com/massCodeIO/massCode
+- Explicitly ships unsigned starting v3.8.0 (dev couldn't afford Apple cert)
+- Documents three workarounds in README
+- Discussion: https://github.com/massCodeIO/massCode/discussions/413
+
+**YouTube Music (th-ch/youtube-music)**:
+- electron-builder config uses `identity: null` to explicitly disable signing
+- Ships DMG for both x64 and arm64
+- Config: https://github.com/th-ch/youtube-music/blob/master/electron-builder.yml
+
+**MarkText**:
+- Repository: https://github.com/marktext/marktext
+- Multiple issues (#3889, #3004, #2983) document user workarounds
+- Users share solution: `xattr -dr com.apple.quarantine /Applications/MarkText.app/`
+
+### 4. **Notarization Service Alternatives**
+Some third-party services offer notarization for a fee (cheaper than $99/year):
+- Research if any legitimate services exist
+- Would provide proper macOS integration
+- Probably not worth it for MVP
+
+### 5. **Homebrew Cask Distribution**
+Distribute via Homebrew:
+```bash
+brew install --cask tactus-ide
+```
+- Homebrew handles installation and quarantine removal
+- Users familiar with dev tools already use Homebrew
+- Requires maintaining a Cask formula
+
+### 6. **electron-builder Auto-Update**
+Built-in update mechanism that bypasses Gatekeeper:
+- After first install (with xattr), updates work seamlessly
+- electron-updater package handles this
+- Requires hosting update server
+
+## Research TODO
+
+- [ ] Test ZIP distribution vs DMG (does it actually help?)
+- [ ] Test ad-hoc code signing (does it reduce errors?)
+- [ ] Research how other unsigned Electron apps distribute (VSCode forks, etc.)
+- [ ] Look into Homebrew Cask as primary distribution method
+- [ ] Check if electron-builder has any built-in solutions
+- [ ] Research user experience: how do other indie Electron apps handle this?
+
+## Key Insight from Debugging
+
+**The app itself is perfectly fine.** The binaries are identical between local and CI builds. The only issue is macOS quarantine attributes added during download from GitHub. This is a distribution problem, not a build problem.
+
+## Projects to Study
+
+Look at how these unsigned/indie Electron apps handle distribution:
+- Obsidian (before they got signing)
+- Various open-source Electron apps on GitHub
+- Community forks of popular apps
+- Apps distributed via GitHub Releases without signing
+
+## Cost-Benefit Analysis
+
+**Code Signing ($99/year):**
+- ✅ Zero friction for users
+- ✅ Professional appearance
+- ✅ App Store distribution possible
+- ❌ $99/year recurring cost
+- ❌ Requires maintaining Apple Developer account
+
+**Current Solution (xattr commands):**
+- ✅ Free
+- ✅ Works perfectly once configured
+- ❌ Extra steps for users
+- ❌ Looks less professional
+- ✅ Fine for developer/power user audience
+
+For an IDE targeting developers, the current solution may be acceptable since the target audience is comfortable with terminal commands.
+
+## Recommended Configuration
+
+Based on research of successful unsigned Electron apps, here's the optimal electron-builder configuration:
+
+```json
+{
+  "mac": {
+    "target": [
+      {
+        "target": "dmg",
+        "arch": ["x64", "arm64"]
+      },
+      {
+        "target": "zip",
+        "arch": ["x64", "arm64"]
+      }
+    ],
+    "identity": null,
+    "hardenedRuntime": false,
+    "gatekeeperAssess": false,
+    "category": "public.app-category.developer-tools"
+  }
+}
+```
+
+**Key settings for unsigned builds:**
+- `identity: null` - Explicitly disables code signing (recommended by electron-builder maintainers)
+- `hardenedRuntime: false` - Not needed without signing
+- `gatekeeperAssess: false` - Already set in our config
+- Provide both DMG and ZIP - Users can choose which works better
+
+## Immediate Action Items
+
+1. **Update electron-builder config** to add `identity: null` and ZIP target
+2. **Submit to Homebrew Cask** - This is the PRIMARY recommended distribution method
+3. **Update README** with System Settings method (Option 1) as the easiest solution
+4. **Test both DMG and ZIP** to see if either has fewer issues
+
+## Homebrew Cask Submission
+
+Priority: HIGH - This solves the distribution problem for macOS users.
+
+**Steps:**
+1. Ensure releases have stable URLs (already done via GitHub Releases)
+2. Create Cask formula in homebrew/homebrew-cask
+3. Formula example:
+```ruby
+cask "tactus-ide" do
+  version "0.32.2"
+  sha256 "..." # calculate with: shasum -a 256 Tactus*.dmg
+
+  url "https://github.com/AnthusAI/Tactus/releases/download/v#{version}/Tactus.IDE-#{version}-mac.dmg"
+  name "Tactus IDE"
+  desc "IDE for Tactus workflow automation"
+  homepage "https://github.com/AnthusAI/Tactus"
+
+  app "Tactus IDE.app"
+end
+```

{tactus-0.32.2 → tactus-0.33.0}/tactus-desktop/README.md

@@ -56,13 +56,49 @@ python3 --version  # Should show 3.11 or higher
 - Windows: `dist-electron/Tactus-IDE-Setup-{version}.exe`
 - Linux: `dist-electron/Tactus-IDE-{version}-{arch}.AppImage`
 
-## Unsigned Builds
+## Installing Unsigned Builds
 
-This MVP does not include code signing. Users will see security warnings:
+This application is not code-signed (requires $99/year Apple Developer Program). Users need to remove macOS quarantine attributes after downloading.
 
-- **macOS**: Right-click > Open (bypass "unidentified developer")
-- **Windows**: "More info" > "Run anyway" (SmartScreen warning)
-- **Linux**: No issues with unsigned binaries
+### macOS Installation
+
+**Option 1: Install via Homebrew (Recommended)**
+```bash
+# Coming soon - Homebrew Cask handles quarantine automatically
+brew install --cask tactus-ide
+```
+
+**Option 2: System Settings Method (Easiest for Direct Downloads)**
+
+If you see "app is damaged" error after downloading:
+
+1. Try to open the app (it will be blocked)
+2. Go to **System Settings → Privacy & Security**
+3. Scroll down and click **"Open Anyway"** button
+4. Click **"Open"** when the confirmation appears
+
+This is Apple's official method for opening unsigned apps. More info: https://support.apple.com/en-us/102445
+
+**Option 3: Terminal Command (Advanced Users)**
+```bash
+# Remove quarantine from the DMG first
+xattr -cr ~/Downloads/Tactus*.dmg
+
+# Open DMG, drag to Applications, then remove quarantine from app
+xattr -cr "/Applications/Tactus IDE.app"
+```
+
+**Why this is needed:** macOS Gatekeeper blocks downloaded apps that aren't code-signed with an Apple Developer certificate ($99/year). Despite the "damaged" message, the app is fine - it's a security warning, not actual corruption.
+
+### Windows Installation
+
+- Click "More info" > "Run anyway" when SmartScreen warning appears
+- No additional steps needed after that
+
+### Linux Installation
+
+- No issues with unsigned binaries
+- Make AppImage executable: `chmod +x Tactus*.AppImage`
 
 ## Project Structure
 

{tactus-0.32.2 → tactus-0.33.0}/tactus-desktop/package.json

@@ -57,9 +57,11 @@
       "category": "public.app-category.developer-tools",
       "icon": "resources/app-icon.icns",
       "target": [
-        "dmg"
+        "dmg",
+        "zip"
       ],
       "artifactName": "${productName}-${version}-${os}.${ext}",
+      "identity": null,
       "hardenedRuntime": false,
       "gatekeeperAssess": false
     },