Release v0.1.5: richer schemas, multi-file import, paper look, signed macOS app

.github/workflows/build.yml

@@ -33,9 +33,13 @@ jobs:
           - platform: macos-latest
             args: --target aarch64-apple-darwin
             bunTarget: darwin-arm64
+            macTarget: aarch64-apple-darwin
+            publishArgs: --config '{"bundle":{"macOS":{"hardenedRuntime":true}}}'
           - platform: macos-latest
             args: --target x86_64-apple-darwin
             bunTarget: darwin-x64
+            macTarget: x86_64-apple-darwin
+            publishArgs: --config '{"bundle":{"macOS":{"hardenedRuntime":true}}}'
           - platform: ubuntu-22.04
             args: '--verbose'
             bunTarget: linux-x64
@@ -131,13 +135,31 @@ jobs:
           if-no-files-found: warn
           retention-days: 7
 
+      - name: Import the Developer ID certificate
+        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+        run: ./scripts/macos/import-signing-identity.sh
+
+      - name: Sign Sparkle's helpers
+        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
+        run: ./scripts/macos/sign-sparkle-helpers.sh
+
       - name: Build and publish
         if: ${{ inputs.publish }}
+        timeout-minutes: 150
         uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          APPLE_API_KEY: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_API_KEY || '' }}
+          APPLE_API_ISSUER: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_API_ISSUER || '' }}
           APPIMAGE_EXTRACT_AND_RUN: '1'
           NO_STRIP: 'true'
           BUN_TARGET: ${{ matrix.bunTarget }}
@@ -155,7 +177,36 @@ jobs:
           # succeed, so users never see a partial release.
           releaseDraft: true
           prerelease: ${{ inputs.prerelease }}
-          args: ${{ matrix.args }}
+          args: ${{ matrix.args }} ${{ matrix.publishArgs }}
+
+      - name: Notarize the disk image
+        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
+        timeout-minutes: 150
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          TAG_NAME: ${{ inputs.tag-name }}
+          BUNDLE_DIR: src-tauri/target/${{ matrix.macTarget }}/release/bundle
+        run: |
+          dmgs=("$BUNDLE_DIR"/dmg/*.dmg)
+          if [ "${#dmgs[@]}" -ne 1 ] || [ ! -f "${dmgs[0]}" ]; then
+            echo "::error::Expected one disk image in $BUNDLE_DIR/dmg, found: ${dmgs[*]}"
+            exit 1
+          fi
+          ./scripts/macos/notarize-dmg.sh "${dmgs[0]}" "$TAG_NAME"
+
+      - name: Check the signature and notarization
+        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
+        env:
+          BUNDLE_DIR: src-tauri/target/${{ matrix.macTarget }}/release/bundle
+        run: ./scripts/macos/check-signature.sh "$BUNDLE_DIR/macos/SocaDB.app" "$BUNDLE_DIR"/dmg/*.dmg
+
+      - name: Remove the signing keychain
+        if: ${{ always() && inputs.publish && matrix.platform == 'macos-latest' }}
+        run: |
+          security delete-keychain "$RUNNER_TEMP/macos-signing/signing.keychain-db" || true
+          rm -rf "$RUNNER_TEMP/macos-signing"
 
       - name: Upload AppImage debug artifacts on failure
         if: failure() && matrix.platform == 'ubuntu-22.04'

eslint-suppressions.json

@@ -0,0 +1,82 @@
+{
+  "src/components/ChatToolCall/ChatToolCall.tsx": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 2
+    }
+  },
+  "src/hooks/useChatStream.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/hooks/useMcpBridge.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/i18n.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/stores/chatStore.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 2
+    }
+  },
+  "src/stores/updateStore.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 2
+    }
+  },
+  "src/types/chat.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/utils/chatCommands.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/utils/chatEventHandler.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 9
+    }
+  },
+  "src/utils/chatPersistence.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 3
+    }
+  },
+  "src/utils/exportPng.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/utils/exportSvg.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/utils/fileOperations.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 3
+    }
+  },
+  "src/utils/importJson.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 3
+    }
+  },
+  "src/utils/languagePersistence.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  },
+  "src/utils/themePersistence.ts": {
+    "@typescript-eslint/consistent-type-assertions": {
+      "count": 1
+    }
+  }
+}

eslint.config.js

@@ -6,6 +6,7 @@ import prettier from "eslint-config-prettier";
 
 export default tseslint.config(
   { ignores: ["dist", "src-tauri"] },
+  { linterOptions: { noInlineConfig: true } },
   js.configs.recommended,
   ...tseslint.configs.strict,
   ...tseslint.configs.stylistic,
@@ -16,11 +17,69 @@ export default tseslint.config(
     },
     rules: {
       ...reactHooks.configs.recommended.rules,
-      "react-refresh/only-export-components": [
-        "warn",
-        { allowConstantExport: true },
+      "react-refresh/only-export-components": ["warn", { allowConstantExport: true }],
+      "@typescript-eslint/consistent-type-assertions": [
+        "error",
+        { assertionStyle: "never" },
+      ],
+      "no-console": "error",
+      "no-restricted-properties": [
+        "error",
+        { object: "Math", property: "random", message: "Use genId() from utils/id.ts." },
+        { property: "randomUUID", message: "Use genId() from utils/id.ts." },
+      ],
+      "no-restricted-imports": [
+        "error",
+        {
+          paths: [
+            { name: "lucide-react", message: "Icons come from @phosphor-icons/react." },
+            { name: "nanoid", message: "Use genId() from utils/id.ts." },
+            { name: "uuid", message: "Use genId() from utils/id.ts." },
+            {
+              name: "@tauri-apps/plugin-dialog",
+              importNames: ["message", "ask", "confirm"],
+              message:
+                "Use a sonner toast or the app's Modal: native dialogs look foreign and devctl can't drive them.",
+            },
+          ],
+        },
+      ],
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector:
+            "ImportDeclaration[source.value='@phosphor-icons/react'] ImportSpecifier[imported.name!=/^(Icon(?:[A-Z]\\w*)?|\\w+Icon)$/]",
+          message: "Import Phosphor icons as `XIcon as X`.",
+        },
+        {
+          selector:
+            "ImportDeclaration[source.value='@phosphor-icons/react'] ImportNamespaceSpecifier",
+          message: "Import Phosphor icons as `XIcon as X`.",
+        },
+        {
+          selector: "JSXAttribute[name.name='target'][value.value='_blank']",
+          message:
+            "The WebView blocks target=_blank: open links with @tauri-apps/plugin-opener.",
+        },
+      ],
+    },
+  },
+  {
+    files: ["src/utils/id.ts"],
+    rules: { "no-restricted-properties": "off" },
+  },
+  {
+    files: ["src/**/index.ts", "src/**/index.tsx"],
+    rules: {
+      "no-restricted-syntax": [
+        "error",
+        { selector: "Program", message: "No barrel files: import the source file." },
       ],
     },
   },
+  {
+    files: ["**/*.test.ts"],
+    rules: { "@typescript-eslint/consistent-type-assertions": "off" },
+  },
   prettier,
 );

mcp-server/runtime.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+</dict>
+</plist>

mcp-server/src/build.ts

@@ -180,8 +180,9 @@ if (os === "darwin") {
   if (process.platform !== "darwin") {
     throw new Error("A macOS runtime can only be built on macOS (it must be re-signed)");
   }
-  console.log(`Ad-hoc signing bundled binaries`);
-  console.log(`  ok: ${adHocSignMachOs("dist")} binaries`);
+  const identity = process.env.APPLE_SIGNING_IDENTITY;
+  console.log(identity ? `Signing bundled binaries as ${identity}` : `Ad-hoc signing bundled binaries`);
+  console.log(`  ok: ${signMachOs("dist", identity)} binaries`);
 }
 
 console.log(`Done.`);
@@ -204,12 +205,19 @@ function isMachO(path: string): boolean {
   }
 }
 
-function adHocSignMachOs(dir: string): number {
+// Tauri signs the app and its frameworks but not resources, so the notary
+// service would reject these binaries unless they carry the Developer ID,
+// a timestamp and the hardened runtime. Under that runtime the Bun-compiled
+// ones (bun, claude, socadb-mcp) can't JIT without runtime.entitlements.
+function signMachOs(dir: string, identity: string | undefined): number {
+  const args = identity
+    ? ["--force", "--sign", identity, "--options", "runtime", "--timestamp", "--entitlements", "runtime.entitlements"]
+    : ["--force", "--sign", "-"];
   let count = 0;
   for (const rel of readdirSync(dir, { recursive: true }) as string[]) {
     const path = join(dir, rel);
     if (!lstatSync(path).isFile() || !isMachO(path)) continue;
-    execFileSync("codesign", ["--force", "--sign", "-", path], { stdio: "pipe" });
+    execFileSync("codesign", [...args, path], { stdio: "pipe" });
     execFileSync("codesign", ["--verify", "--strict", path], { stdio: "pipe" });
     count++;
   }

mcp-server/src/tools/read.ts

@@ -20,7 +20,7 @@ export function registerReadTools(server: McpServer) {
     "get_schema",
     {
       description:
-        "Get the complete database schema including all tables, columns, and relations",
+        "Get the complete database schema: tables with notes, columns (type parameters, default and its kind, enum values, note) and indexes, relations, and PostgreSQL enum types",
       inputSchema: {},
     },
     async () => ok(await send("get_schema")),
@@ -29,7 +29,7 @@ export function registerReadTools(server: McpServer) {
   server.registerTool(
     "get_table",
     {
-      description: "Get a specific table by name with all its columns",
+      description: "Get a specific table by name with its note, columns and indexes",
       inputSchema: {
         name: z.string().describe("The table name to look up"),
       },