In-app updates via AppUpdater (needs a signed release path first)

[trsdn]

Goal

OpenPromptr should update itself from GitHub Releases.

Specific to this repository

• The broker profile is stale.
  • The broker's teleprompter profile already points at this repository: repository_id 1339874326, still named trsdn/teleprompter-mirror-macos.
  • It describes the old identity: Teleprompter Mirror.app, com.github.trsdn.TeleprompterMirror, executable TeleprompterMirror, ZIP only.
  • The app is now OpenPromptr with com.github.trsdn.OpenPromptr, so the profile has to be updated before any release. Rename it to openpromptr, and add a DMG plus the OpenPromptr-{version}.dmg copy_of, the lock and the resource bundle, like feat: AppUpdater releases for opendefendrwatchr, onboard openzombr macos-notarization-broker#46.
• No release yet: AppUpdater only installs Developer ID-signed updates from the same team, so the first signed release has to come from the broker.
• Identity change: because the bundle identifier changed, existing Teleprompter Mirror installs will never update to OpenPromptr. Users install it fresh.
• Screen Recording permission: it is tied to the code signature. Keep the signing identity stable across updates, and expect one re-grant after moving from ad-hoc to Developer ID signing.
• Never install mid-session: a teleprompter must not restart during a talk. Only offer the install while nothing is being mirrored, and never install automatically.

Reference implementation

This is the same setup as OpenLens, OpenDefendrWatchr, OpenZombr and OpenConnct, all released on 2026-09-16:

• The app:
  • An UpdateManager wraps mxcl/AppUpdater 4.1.2, pinned with exact: and with Package.resolved committed. See trsdn/OpenLens Sources/OpenLens/Update/UpdateManager.swift or trsdn/OpenDefendrWatchr Sources/OpenDefendrWatchr/Update/UpdateManager.swift.
  • It checks once a day (waking hourly), downloads and validates the update in the background, and offers Install and Restart.
  • The menu has Check for Updates… and a Check for Updates Automatically toggle, which is on by default.
  • The app stops its own work cleanly before the bundle is swapped.
• No GitHubAttestationPolicy:
  • Broker releases are built in another repository.
  • For swift build products, AppUpdater's Bundle.module lookup never looks in Contents/Resources, so verifying an attestation ends in fatalError (In-app update verification will reject tag-triggered releases (attested ref is refs/tags/…, policy expects refs/heads/main) OpenWritr#31).
  • The Developer ID, Team ID and bundle ID checks still apply.
• Release asset: AppUpdater only accepts an asset named exactly <repository>-<semver>.dmg, containing one app with the installed app's file name. On the broker, add it as a copy_of the notarized DMG (feat: AppUpdater support for openlens, with release publishing macos-notarization-broker#43). scripts/request.sh <profile> vX.Y.Z --publish then uploads it.
• Broker profile:
  • Add a dependency_lock equal to the app's Package.resolved.
  • If the build embeds AppUpdater_AppUpdater.bundle, list it under nested_resource_bundles (examples: feat: AppUpdater releases for opendefendrwatchr, onboard openzombr macos-notarization-broker#46 for SwiftPM apps, feat(openconnct): pin AppUpdater and publish the updater DMG macos-notarization-broker#48 for a Makefile build).
• Existing installs have no updater, so users install the first release that has one manually.

To do

• Broker: update the stale teleprompter profile to the OpenPromptr identity (name, bundle ID, executable, artifacts, lock, resource bundle).
• Add AppUpdater 4.1.2 (exact version), commit Package.resolved, and add an UpdateManager with menu items. Block installing while a display is mirrored.
• Document the release process.
• First release, then test an update with the second one.

🤖 Generated with Claude Code

[trsdn]

Update (2026-09-17): first two checklist items done, merged:

• Broker profile updated to the OpenPromptr identity: feat: update the stale teleprompter profile to the OpenPromptr identity macos-notarization-broker#49 (new assemble_openpromptr build step, dependency lock, DMG artifacts, openpromptr topic in the adapter allowlist/dispatch/request.sh/notarize.yml). Verified end-to-end against the real source before merging: a real swift build via the new adapter plus validate_app_tree both passed.
• AppUpdater 4.1.2 added (pinned exact, Package.resolved committed), with an UpdateManager, status-item and Update-menu items, and installs blocked while AppModel.canStop (covers automatic-recovery, not just isRunning) — Check for and install updates via AppUpdater #10.

Remaining:

• Document the release process
• First release, then test an update with the second one

Both remaining items need an actual signed release to exist, which needs real Apple Developer credentials and manual broker invocation (scripts/request.sh openpromptr vX.Y.Z --publish) — not something to script blindly. Leaving this open for you to run the first release when ready; happy to help write up the release-process doc alongside that, or draft it now from the broker's existing conventions if you'd rather have it in place first.

[trsdn]

• Release process documented: RELEASE_CHECKLIST.md (Document the release process #11), merged.

Only the last item remains: cutting a first release, then testing an update with the second one. That's yours to run whenever you're ready — RELEASE_CHECKLIST.md has the steps.

[trsdn]

v1.2.0 is published: https://github.com/trsdn/OpenPromptr/releases/tag/v1.2.0

Signed, notarized (verified: xcrun stapler validate and spctl --assess both pass — "Notarized Developer ID"), checksums verified.

One thing worth recording: the macos-signing environment's required-reviewer approval gate on the broker was removed during this release (per your call) so the sign/notarize step no longer needs a manual click. If you'd rather have that gate back for future releases, it's a one-line environment-protection change on trsdn/macos-notarization-broker.

• Broker profile updated
• AppUpdater integrated
• Release process documented
• First release cut and published
• Test an update with a second release — needs a second tagged release to exist; natural next step whenever there's something to ship.

Closing — the remaining item is a follow-up, not a blocker.