From bcab84e0720e7e8073bc13a4c96a6896426cc9cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=A8=8B=E5=BA=8F=E5=91=98=E9=98=BF=E6=B1=9F=28Relakkes?=
 =?UTF-8?q?=29?= <relakkes@gmail.com>
Date: Fri, 8 May 2026 11:11:20 +0800
Subject: [PATCH] Fix macOS build artifacts to keep notification identity
 stable

The notification bridge fix was correct, but the local macOS build script still left Tauri's raw app and DMG outputs available with the executable's ad-hoc signing identifier. Opening that raw artifact made macOS treat notification authorization as a different app identity, so the UI could fall back to the unsupported environment state even though the canonical output worked.

Normalize the Tauri-produced app bundle in place before copying it to the canonical output, then replace the Tauri-generated DMG with the rebuilt canonical DMG. This keeps every path printed by the build script on the same bundle identity and prevents testers from accidentally opening the unstable raw artifact.

Constraint: Local test builds use ad-hoc signing, but macOS notification authorization still depends on stable app identity.
Rejected: Only tell testers to open canonical output | the script still printed and preserved misleading usable-looking artifacts.
Confidence: high
Scope-risk: narrow
Directive: Keep Tauri raw app and canonical app signing identifiers aligned before reporting build artifacts as runnable.
Tested: bash -n desktop/scripts/build-macos-arm64.sh
Tested: SKIP_INSTALL=1 ./desktop/scripts/build-macos-arm64.sh
Tested: codesign -dv --verbose=4 shows com.claude-code-haha.desktop for both target bundle app and canonical app
Tested: hdiutil verify target DMG and canonical DMG
Tested: Computer Use opened target bundle app and verified Settings -> General shows notifications as authorized.
Not-tested: Fresh first-time notification prompt after resetting macOS notification permissions for this bundle id.
---
 desktop/scripts/build-macos-arm64.sh | 39 ++++++++++++++++++----------
 1 file changed, 25 insertions(+), 14 deletions(-)

diff --git a/desktop/scripts/build-macos-arm64.sh b/desktop/scripts/build-macos-arm64.sh
index 8c146770..2a0062de 100755
--- a/desktop/scripts/build-macos-arm64.sh
+++ b/desktop/scripts/build-macos-arm64.sh
@@ -281,11 +281,13 @@ sign_canonical_app_bundle() {
   codesign --verify --deep --strict --verbose=2 "${app_bundle}"
 }
 
-if [[ -n "${LATEST_DMG}" ]]; then
-  cp -f "${LATEST_DMG}" "${CANONICAL_OUTPUT_DIR}/"
-fi
-
 if [[ -n "${LATEST_APP}" ]]; then
+  # Normalize the Tauri-produced app in place before copying it anywhere.
+  # Without this, opening target/.../bundle/macos/Claude Code Haha.app directly
+  # uses the executable's ad-hoc signing identifier instead of the app bundle id,
+  # which makes macOS notification authorization behave like a different app.
+  sign_canonical_app_bundle "${LATEST_APP}"
+
   # 不要 deep re-sign。曾经脚本在这里跑过
   # `codesign --force --deep --sign - --identifier <bundle-id>` 来统一
   # sidecar 和外层的 signing identifier,但这会改变 sidecar binary 的
@@ -296,16 +298,25 @@ if [[ -n "${LATEST_APP}" ]]; then
   cp -R "${LATEST_APP}" "${CANONICAL_OUTPUT_DIR}/"
   sign_canonical_app_bundle "${CANONICAL_OUTPUT_DIR}/${APP_BUNDLE_NAME}"
   rm -f "${CANONICAL_OUTPUT_DIR}/"*.dmg
+  CANONICAL_DMG="${CANONICAL_OUTPUT_DIR}/$(basename "${LATEST_DMG:-Claude Code Haha_0.1.0_aarch64.dmg}")"
   build_canonical_dmg \
     "${CANONICAL_OUTPUT_DIR}/${APP_BUNDLE_NAME}" \
-    "${CANONICAL_OUTPUT_DIR}/$(basename "${LATEST_DMG:-Claude Code Haha_0.1.0_aarch64.dmg}")"
+    "${CANONICAL_DMG}"
+
+  if [[ -n "${LATEST_DMG}" ]]; then
+    cp -f "${CANONICAL_DMG}" "${LATEST_DMG}"
+  fi
+elif [[ -n "${LATEST_DMG}" ]]; then
+  cp -f "${LATEST_DMG}" "${CANONICAL_OUTPUT_DIR}/"
 fi
 
 cat > "${CANONICAL_OUTPUT_DIR}/BUILD_INFO.txt" <<EOF
 Target triple: ${TARGET_TRIPLE}
 Canonical output: ${CANONICAL_OUTPUT_DIR}
-Source DMG: ${LATEST_DMG:-not found}
-Source app: ${LATEST_APP:-not found}
+Canonical app: ${CANONICAL_OUTPUT_DIR}/${APP_BUNDLE_NAME}
+Canonical DMG: ${CANONICAL_DMG:-not found}
+Tauri app output: ${LATEST_APP:-not found}
+Tauri DMG output: ${LATEST_DMG:-not found}
 Built at: $(date '+%Y-%m-%d %H:%M:%S %z')
 EOF
 
@@ -315,18 +326,18 @@ fi
 
 echo
 echo "[build-macos-arm64] Build finished."
-if [[ -n "${LATEST_DMG}" ]]; then
-  echo "[build-macos-arm64] DMG source: ${LATEST_DMG}"
-else
-  echo "[build-macos-arm64] No DMG found in ${TARGETED_DMG_DIR} or ${FALLBACK_DMG_DIR}" >&2
-fi
-
 if [[ -n "${LATEST_APP}" ]]; then
-  echo "[build-macos-arm64] App source: ${LATEST_APP}"
+  echo "[build-macos-arm64] Tauri app output (identity normalized): ${LATEST_APP}"
 else
   echo "[build-macos-arm64] No .app found in ${TARGETED_APP_DIR} or ${FALLBACK_APP_DIR}" >&2
 fi
 
+if [[ -n "${LATEST_DMG}" ]]; then
+  echo "[build-macos-arm64] Tauri DMG output (replaced with canonical DMG): ${LATEST_DMG}"
+else
+  echo "[build-macos-arm64] No DMG found in ${TARGETED_DMG_DIR} or ${FALLBACK_DMG_DIR}" >&2
+fi
+
 echo "[build-macos-arm64] Canonical output: ${CANONICAL_OUTPUT_DIR}"
 echo "[build-macos-arm64] Removed legacy bundle dir: ${LEGACY_BUNDLE_ROOT}"