Fix macOS DMG bundle signing

.github/workflows/build-dmg.yml

@@ -49,6 +49,18 @@ jobs:
           test -n "$app"
           node scripts/verify-packaged-runtime.mjs "$app"
 
+      - name: Verify packaged macOS signature
+        run: |
+          app=$(find release -type d -name "Backchat.app" -print -quit)
+          test -n "$app"
+          node scripts/verify-packaged-macos-signature.mjs "$app"
+
+      - name: Verify packaged first prompt
+        run: |
+          app=$(find release -type f -path "*/Backchat.app/Contents/MacOS/Backchat" -print -quit)
+          test -n "$app"
+          node scripts/verify-packaged-first-prompt.mjs "$app"
+
       - name: Upload workflow artifact
         uses: actions/upload-artifact@v4
         with:
@@ -73,13 +85,6 @@ jobs:
           cp "$versioned" "$stable"
           gh release create "${GITHUB_REF_NAME}" "$versioned" "$stable" --generate-notes --verify-tag
 
-      - name: Verify packaged first prompt
-        continue-on-error: true
-        run: |
-          app=$(find release -type f -path "*/Backchat.app/Contents/MacOS/Backchat" -print -quit)
-          test -n "$app"
-          node scripts/verify-packaged-first-prompt.mjs "$app"
-
       - name: Upload packaged first-prompt screenshot
         if: always()
         uses: actions/upload-artifact@v4

package.json

@@ -124,6 +124,8 @@
       "**/*.node"
     ],
     "mac": {
+      "identity": "-",
+      "hardenedRuntime": false,
       "target": [
         "dmg"
       ],

scripts/verify-packaged-first-prompt.mjs

@@ -99,7 +99,9 @@ try {
   await page.getByTestId("new-chat-button").waitFor({ timeout: 20_000 });
   await page.getByTestId("new-chat-button").click();
 
-  const composer = page.locator('[data-chat-surface="main"] textarea').last();
+  // The first prompt is submitted from NewChatPage before a persisted chat
+  // surface exists. Session pages gain data-chat-surface only after submit.
+  const composer = page.locator('[data-page="new-chat"] textarea').last();
   await composer.fill("packaged-first-prompt-e2e");
   await composer.press("Enter");
   await page

scripts/verify-packaged-macos-signature.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+
+const appBundle = process.argv[2];
+
+if (!appBundle) {
+  console.error("Usage: node scripts/verify-packaged-macos-signature.mjs <app-bundle>");
+  process.exit(2);
+}
+
+if (process.platform !== "darwin") {
+  console.error("Packaged macOS signature verification requires macOS");
+  process.exit(2);
+}
+
+const result = spawnSync(
+  "/usr/bin/codesign",
+  ["--verify", "--deep", "--strict", "--verbose=4", resolve(appBundle)],
+  { encoding: "utf8" },
+);
+
+if (result.stdout) process.stdout.write(result.stdout);
+if (result.stderr) process.stderr.write(result.stderr);
+if (result.error) throw result.error;
+
+process.exit(result.status ?? 1);

src/main/github-ci-contract.test.ts

@@ -56,12 +56,14 @@ describe("github ci", () => {
     expect(website).toContain("secrets.CLOUDFLARE_API_TOKEN");
   });
 
-  it("keeps packaged-runtime and first-prompt verification on the DMG job", () => {
+  it("verifies packaged runtime, signature, and first prompt before publishing DMGs", () => {
     expect(dmg).toContain("./.github/actions/setup-node-pnpm");
     expect(dmg).toContain("pnpm run test:ci");
     expect(dmg).toContain("verify-packaged-runtime.mjs");
+    expect(dmg).toContain("verify-packaged-macos-signature.mjs");
     expect(dmg).toContain("verify-packaged-first-prompt.mjs");
     expect(dmg).toContain("Backchat-arm64.dmg");
     expect(dmg).toContain("gh release create");
+    expect(dmg).not.toContain("continue-on-error");
   });
 });