feat(update): install verified macOS releases in app

.github/scripts/bundle-macos.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
 # Usage: bundle-macos.sh <target-triple> <arch-label>
-# Package the release binary into dist/tty7.app and wrap it in a
-# drag-to-Applications DMG: dist/tty7-<version>-macos-<arch>.dmg.
+# Package the release binary into dist/tty7.app, then publish both:
+#   dist/tty7-<version>-macos-<arch>.zip  (in-app updater)
+#   dist/tty7-<version>-macos-<arch>.dmg  (drag-to-Applications install)
 #
 # Signing posture is chosen from the environment:
 #   * Developer ID secrets present (APPLE_SIGNING_IDENTITY + APPLE_CERTIFICATE)
@@ -21,6 +22,10 @@ if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
   echo "bundle-macos: could not read a version from Cargo.toml (got '$VERSION')" >&2
   exit 1
 fi
+PACKAGE_UPDATE_ZIP="${TTY7_PACKAGE_UPDATE_ZIP:-1}"
+if [[ "$VERSION" == *-nightly.* ]]; then
+    PACKAGE_UPDATE_ZIP=0
+fi
 APP="dist/tty7.app"
 
 rm -rf dist
@@ -34,6 +39,15 @@ chmod +x "$APP/Contents/MacOS/tty7-app"
 # relative to its own executable.
 cp "target/${TARGET}/release/tty7" "$APP/Contents/MacOS/tty7"
 chmod +x "$APP/Contents/MacOS/tty7"
+if [[ "$PACKAGE_UPDATE_ZIP" != "0" ]]; then
+    # A focused out-of-process updater can replace the bundle after the GUI
+    # exits, then relaunch or roll back without teaching the GUI to mutate
+    # itself. Stable macOS builds carry it beside the app/CLI so its signature
+    # is covered by the outer bundle; Nightly remains byte-for-byte on its old
+    # packaging path for the first updater release.
+    cp "target/${TARGET}/release/tty7-updater" "$APP/Contents/MacOS/tty7-updater"
+    chmod +x "$APP/Contents/MacOS/tty7-updater"
+fi
 cp assets/tty7.icns "$APP/Contents/Resources/tty7.icns"
 # Completion signatures are loaded at runtime (not embedded), resolved relative
 # to the executable as ../Resources/completions — see terminal::signature.
@@ -112,6 +126,10 @@ ENT
     # them.
     codesign --force --options runtime --timestamp \
         --sign "$SIGN_ID" "$APP/Contents/MacOS/tty7"
+    if [[ "$PACKAGE_UPDATE_ZIP" != "0" ]]; then
+        codesign --force --options runtime --timestamp \
+            --sign "$SIGN_ID" "$APP/Contents/MacOS/tty7-updater"
+    fi
     codesign --force --options runtime --timestamp --entitlements "$ENTITLEMENTS" \
         --sign "$SIGN_ID" "$APP/Contents/MacOS/tty7-app"
     codesign --force --options runtime --timestamp --entitlements "$ENTITLEMENTS" \
@@ -137,6 +155,16 @@ else
     codesign --force --deep --sign - "$APP"
 fi
 
+# The stable-channel in-app updater needs the signed, notarized .app itself
+# rather than a disk image that requires Finder interaction. Nightly versions
+# skip this path above: their rolling release remains unchanged until the stable
+# updater has shipped and been exercised.
+ZIP=""
+if [[ "$PACKAGE_UPDATE_ZIP" != "0" ]]; then
+    ZIP="dist/tty7-${VERSION}-macos-${ARCH}.zip"
+    ditto -c -k --keepParent "$APP" "$ZIP"
+fi
+
 # Package the (now stapled) bundle as a drag-to-Applications DMG.
 DMG="dist/tty7-${VERSION}-macos-${ARCH}.dmg"
 STAGE="dist/dmg-stage"
@@ -149,4 +177,7 @@ rm -rf "$STAGE"
 if [[ -n "$SIGN_ID" && -n "${APPLE_CERTIFICATE:-}" ]]; then
     codesign --force --timestamp --sign "$SIGN_ID" "$DMG"
 fi
+if [[ -n "$ZIP" ]]; then
+    echo "✅ $ZIP"
+fi
 echo "✅ $DMG"

.github/workflows/ci.yml

@@ -127,6 +127,11 @@ jobs:
         timeout-minutes: 20
         run: cargo test --locked --target ${{ matrix.target }}
 
+      - name: Test macOS updater
+        if: runner.os == 'macOS'
+        timeout-minutes: 10
+        run: cargo test --locked --features updater --bin tty7-updater --target ${{ matrix.target }}
+
       # There is deliberately no post-mortem step here, and that is worth
       # recording, because an earlier version of this file had one: on failure it
       # dumped the process table to find the surviving test binary.

.github/workflows/release.yml

@@ -76,7 +76,13 @@ jobs:
       # a plain checkout of the tagged commit.
       - name: Build
         working-directory: tty7
-        run: cargo build --release --locked --target ${{ matrix.target }}
+        shell: bash
+        run: |
+          cargo build --release --locked --target "${{ matrix.target }}"
+          if [[ "${{ matrix.os }}" == "macos" ]]; then
+            cargo build --release --locked --features updater \
+              --bin tty7-updater --target "${{ matrix.target }}"
+          fi
 
       # ---- Packaging: one step per OS ----------------------------------------
       # macOS gets a signed + notarized drag-to-Applications DMG. Windows gets
@@ -254,7 +260,7 @@ jobs:
   # created as a **draft** and left that way: a draft is invisible to both
   # /releases/latest and the releases page, so nothing can prompt a user to
   # download a version whose asset set is incomplete or whose notes are still
-  # empty. Publishing is the release skill's job — it verifies the six assets and
+  # empty. Publishing is the release skill's job — it verifies the platform assets and
   # writes the body first, then flips the draft. See .claude/skills/release/SKILL.md.
   draft-release:
     needs: [build, server-musl]