Merge upstream mattt/iMCP (1.5.4)

.github/workflows/ci.yml

@@ -27,18 +27,34 @@ jobs:
             - name: Checkout code
               uses: actions/checkout@v6
 
+            # Key the cache on the exact Xcode build,
+            # so a runner image update can't restore module files
+            # compiled against an older toolchain.
+            - name: Read Xcode build number
+              id: xcode
+              run: echo "build=$(xcodebuild -version | awk '/Build version/ {print $3}')" >> "${GITHUB_OUTPUT}"
+
             - name: Cache Xcode build artifacts
               uses: actions/cache@v5
               with:
                   path: |
                       ~/Library/Developer/Xcode/DerivedData
+                      !~/Library/Developer/Xcode/DerivedData/ModuleCache.noindex
                       ~/Library/Caches/org.swift.swiftpm
-                  key: ${{ runner.os }}-xcode-${{ matrix.xcode }}-derived-${{ hashFiles('**/Package.resolved') }}
+                  key: ${{ runner.os }}-xcode-${{ steps.xcode.outputs.build }}-derived-${{ hashFiles('**/Package.resolved') }}
                   restore-keys: |
-                      ${{ runner.os }}-xcode-${{ matrix.xcode }}-derived-
+                      ${{ runner.os }}-xcode-${{ steps.xcode.outputs.build }}-derived-
 
             - name: Lint
               run: swift format lint --strict --recursive .
 
             - name: Build
               run: xcodebuild -quiet -scheme iMCP -configuration Debug -destination "platform=macOS" build
+
+            # The cache action's exclude pattern has not kept the module cache out of
+            # the archive, and runner images with the same Xcode build can differ in
+            # toolchain file timestamps, which makes a restored module cache fatal.
+            # Remove it before the cache is saved at the end of the job.
+            - name: Drop the module cache before saving
+              if: always()
+              run: rm -rf ~/Library/Developer/Xcode/DerivedData/ModuleCache.noindex

.github/workflows/release.yml

@@ -0,0 +1,211 @@
+name: Release
+
+# Builds, signs, notarizes, and publishes a release
+# with the same Scripts/release.sh steps used locally.
+#
+# A pushed version tag (for example 1.5.0) runs the full flow.
+# Manual runs default to a dry run,
+# which does everything except create the GitHub release and upload assets;
+# the artifacts are attached to the workflow run instead.
+
+on:
+    push:
+        tags: ["[0-9]+.[0-9]+.[0-9]+"]
+    workflow_dispatch:
+        inputs:
+            version:
+                description: "Version to release (defaults to the tag name when run from a tag)"
+                required: false
+                type: string
+            dry_run:
+                description: "Skip creating the GitHub release and uploading assets"
+                required: false
+                type: boolean
+                default: true
+
+permissions:
+    contents: write
+
+concurrency:
+    group: release-${{ github.ref }}
+    cancel-in-progress: false
+
+env:
+    DEVELOPER_DIR: "/Applications/Xcode_26.0.app/Contents/Developer"
+    TEAM_ID: TTY35UM57S
+    SIGNING_CERTIFICATE: "Developer ID Application: dododo, LLC (TTY35UM57S)"
+    SPARKLE_VERSION: "2.9.6"
+    SPARKLE_SHA256: "52bf9e88cdd972fc0c81501377a880e90d47031bd8ca5462488f843e2609e192"
+
+jobs:
+    release:
+        name: Build, notarize, and publish
+        runs-on: macos-26
+        timeout-minutes: 60
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v6
+
+            - name: Resolve version
+              id: version
+              env:
+                  INPUT_VERSION: ${{ inputs.version }}
+              run: |
+                  if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+                    version="${GITHUB_REF_NAME}"
+                  else
+                    version="${INPUT_VERSION}"
+                  fi
+                  if [[ -z "${version}" ]]; then
+                    echo "No version: push a version tag or pass the version input." >&2
+                    exit 1
+                  fi
+                  project_version="$(grep -m1 -o 'MARKETING_VERSION = [0-9.]*' iMCP.xcodeproj/project.pbxproj | awk '{print $3}')"
+                  if [[ "${project_version}" != "${version}" ]]; then
+                    echo "MARKETING_VERSION in the project is ${project_version}, not ${version}." >&2
+                    exit 1
+                  fi
+                  echo "VERSION=${version}" >> "${GITHUB_ENV}"
+
+            # Tag pushes always publish; manual runs publish only when dry_run is off.
+            - name: Note dry run
+              if: github.event_name == 'workflow_dispatch' && inputs.dry_run
+              run: echo "DRY_RUN=1" >> "${GITHUB_ENV}"
+
+            # A manual publish must run from the version's tag,
+            # so the release's source matches the binary it ships.
+            - name: Require the release tag
+              if: github.event_name == 'workflow_dispatch' && !inputs.dry_run
+              run: |
+                  if [[ "${GITHUB_REF_TYPE}" != "tag" || "${GITHUB_REF_NAME}" != "${VERSION}" ]]; then
+                    echo "Publishing runs must be started from the ${VERSION} tag, not ${GITHUB_REF_TYPE} ${GITHUB_REF_NAME}." >&2
+                    exit 1
+                  fi
+
+            - name: Import signing certificate
+              env:
+                  CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE_P12 }}
+                  CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+              run: |
+                  keychain="${RUNNER_TEMP}/release.keychain-db"
+                  keychain_password="$(uuidgen)"
+                  certificate="${RUNNER_TEMP}/certificate.p12"
+                  echo "${CERTIFICATE_P12}" | base64 --decode > "${certificate}"
+                  security create-keychain -p "${keychain_password}" "${keychain}"
+                  security set-keychain-settings -lut 21600 "${keychain}"
+                  security unlock-keychain -p "${keychain_password}" "${keychain}"
+                  security import "${certificate}" -P "${CERTIFICATE_PASSWORD}" -A -t cert -f pkcs12 -k "${keychain}"
+                  security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${keychain_password}" "${keychain}" > /dev/null
+                  security list-keychains -d user -s "${keychain}" login.keychain-db
+                  rm -f "${certificate}"
+                  security find-identity -v -p codesigning "${keychain}"
+                  echo "RELEASE_KEYCHAIN=${keychain}" >> "${GITHUB_ENV}"
+
+            - name: Install provisioning profile
+              env:
+                  PROVISIONING_PROFILE: ${{ secrets.PROVISIONING_PROFILE }}
+              run: |
+                  profile="${RUNNER_TEMP}/profile.provisionprofile"
+                  echo "${PROVISIONING_PROFILE}" | base64 --decode > "${profile}"
+                  plist="${RUNNER_TEMP}/profile.plist"
+                  security cms -D -i "${profile}" > "${plist}"
+                  uuid="$(/usr/libexec/PlistBuddy -c "Print UUID" "${plist}")"
+                  for dir in "${HOME}/Library/MobileDevice/Provisioning Profiles" "${HOME}/Library/Developer/Xcode/UserData/Provisioning Profiles"; do
+                    mkdir -p "${dir}"
+                    cp "${profile}" "${dir}/${uuid}.provisionprofile"
+                  done
+                  echo "PROVISIONING_PROFILE_UUID=${uuid}" >> "${GITHUB_ENV}"
+                  /usr/libexec/PlistBuddy -c "Print Name" "${plist}"
+
+            - name: Write notarization key
+              env:
+                  APP_STORE_CONNECT_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}
+              run: |
+                  key="${RUNNER_TEMP}/AuthKey.p8"
+                  printf '%s\n' "${APP_STORE_CONNECT_PRIVATE_KEY}" > "${key}"
+                  chmod 600 "${key}"
+                  echo "NOTARY_KEY_FILE=${key}" >> "${GITHUB_ENV}"
+
+            - name: Install Sparkle tools
+              run: |
+                  archive="${RUNNER_TEMP}/Sparkle-${SPARKLE_VERSION}.tar.xz"
+                  curl -sSL -o "${archive}" "https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
+                  echo "${SPARKLE_SHA256}  ${archive}" | shasum -a 256 -c -
+                  mkdir -p "${RUNNER_TEMP}/sparkle"
+                  tar -xJf "${archive}" -C "${RUNNER_TEMP}/sparkle" ./bin/generate_appcast ./bin/sign_update
+                  echo "SPARKLE_BIN=${RUNNER_TEMP}/sparkle/bin" >> "${GITHUB_ENV}"
+
+            - name: Write Sparkle signing key
+              env:
+                  SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
+              run: |
+                  key="${RUNNER_TEMP}/sparkle_private_key"
+                  printf '%s' "${SPARKLE_PRIVATE_KEY}" > "${key}"
+                  chmod 600 "${key}"
+                  echo "SPARKLE_PRIVATE_KEY_FILE=${key}" >> "${GITHUB_ENV}"
+
+            - name: Archive
+              run: ./Scripts/release.sh archive
+
+            - name: Export
+              run: ./Scripts/release.sh export
+
+            - name: Notarize
+              env:
+                  NOTARY_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+                  NOTARY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+              run: ./Scripts/release.sh notarize
+
+            - name: Staple
+              run: |
+                  ./Scripts/release.sh staple
+                  xcrun stapler validate dist/export/*.app
+
+            - name: Package
+              run: ./Scripts/release.sh package
+
+            - name: Generate appcast
+              env:
+                  SPARKLE_PUBLIC_KEY: ${{ vars.SPARKLE_PUBLIC_KEY }}
+              run: ./Scripts/release.sh appcast
+
+            # Everything is built and validated before anything is published.
+            # The release stays a draft until both uploads have succeeded.
+            - name: Create draft release
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: ./Scripts/release.sh release
+
+            - name: Upload release asset
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: ./Scripts/release.sh upload
+
+            - name: Upload appcast
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: ./Scripts/release.sh upload-appcast
+
+            - name: Publish release
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: ./Scripts/release.sh publish
+
+            - name: Attach build products to the workflow run
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: iMCP-${{ env.VERSION }}
+                  path: |
+                      dist/*.zip
+                      dist/*.sha256
+                      dist/appcast/appcast.xml
+                  if-no-files-found: ignore
+
+            - name: Clean up secrets
+              if: always()
+              run: |
+                  rm -f "${RUNNER_TEMP}/sparkle_private_key" "${RUNNER_TEMP}/AuthKey.p8" "${RUNNER_TEMP}/profile.provisionprofile"
+                  if [[ -n "${RELEASE_KEYCHAIN:-}" && -f "${RELEASE_KEYCHAIN}" ]]; then
+                    security delete-keychain "${RELEASE_KEYCHAIN}"
+                  fi

.gitignore

@@ -1,3 +1,6 @@
+# macOS
+.DS_Store
+
 # Xcode
 #
 # gitignore contributors: remember to update Global/Xcode.gitignore, Objective-C.gitignore & Swift.gitignore

App/App.swift

@@ -1,25 +1,57 @@
-import MenuBarExtraAccess
+import Sparkle
 import SwiftUI
 
 @main
 struct App: SwiftUI.App {
+    @NSApplicationDelegateAdaptor(AppDelegate.self) private var appDelegate
+    @Environment(\.openSettings) private var openSettings
     @StateObject private var serverController = ServerController()
     @AppStorage("isEnabled") private var isEnabled = true
-    @State private var isMenuPresented = false
+    @AppStorage("showMenuBarExtra") private var showMenuBarExtra = true
+
+    // `startingUpdater: true` makes this the sole owner of update checking
+    // for the app's lifetime.
+    // Without it (or without ever constructing an updater at all),
+    // the SUFeedURL / SUPublicEDKey keys in Info.plist are inert
+    // and installs never learn about newer releases,
+    // no matter how long they run.
+    private let updaterController = SPUStandardUpdaterController(
+        startingUpdater: true,
+        updaterDelegate: nil,
+        userDriverDelegate: nil
+    )
 
     var body: some Scene {
-        MenuBarExtra("iMCP", image: #"MenuIcon-\#(isEnabled ? "On" : "Off")"#) {
+        @Bindable var appDelegate = appDelegate
+
+        // The binding lets removal hide the item without terminating the server.
+        MenuBarExtra(
+            "iMCP",
+            image: #"MenuIcon-\#(isEnabled ? "On" : "Off")"#,
+            isInserted: $appDelegate.isMenuBarExtraInserted
+        ) {
             ContentView(
                 serverManager: serverController,
                 isEnabled: $isEnabled,
-                isMenuPresented: $isMenuPresented
+                updater: updaterController.updater
             )
         }
         .menuBarExtraStyle(.window)
-        .menuBarExtraAccess(isPresented: $isMenuPresented)
+        .onChange(of: showMenuBarExtra) { _, showMenuBarExtra in
+            appDelegate.isMenuBarExtraInserted = showMenuBarExtra
+        }
+        .onChange(of: appDelegate.shouldOpenSettings, initial: true) { _, shouldOpenSettings in
+            guard shouldOpenSettings else { return }
+            appDelegate.shouldOpenSettings = false
+            NSApp.activate(ignoringOtherApps: true)
+            openSettings()
+        }
 
         Settings {
-            SettingsView(serverController: serverController)
+            SettingsView(
+                serverController: serverController,
+                isMenuBarExtraInserted: appDelegate.isMenuBarExtraInserted
+            )
         }
 
         .commands {
@@ -32,3 +64,24 @@ struct App: SwiftUI.App {
         }
     }
 }
+
+@Observable
+final class AppDelegate: NSObject, NSApplicationDelegate {
+    var shouldOpenSettings = false
+    // System removal must not overwrite the user's saved preference.
+    var isMenuBarExtraInserted =
+        UserDefaults.standard.object(forKey: "showMenuBarExtra") as? Bool ?? true
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        // An unset preference defaults to showing the menu bar item.
+        if UserDefaults.standard.object(forKey: "showMenuBarExtra") as? Bool == false {
+            shouldOpenSettings = true
+        }
+    }
+
+    func applicationShouldHandleReopen(_ sender: NSApplication, hasVisibleWindows: Bool) -> Bool {
+        // Reopening the app must work even when the menu bar item is absent.
+        shouldOpenSettings = true
+        return false
+    }
+}