Tag v0.1.0

AGENTS.md

@@ -4,23 +4,27 @@ These are requirements, not preferences. Changing one needs the owner's agreemen
 
 ## Workflow
 
-- Never deploy unless the owner asks for it in the current turn. A finished change is reported undeployed; the owner deploys it, or asks you to. Never run `go install ./cmd/byre` or restart the service on your own initiative, not even to check that a change works.
+- Never deploy unless the owner asks for it in the current turn. A finished change is reported undeployed; the owner deploys it, or asks you to. Never run `mac/deploy.sh` or restart the service on your own initiative, not even to check that a change works.
 - `docs/operations.md` describes the layout, data, service and APIs; keep it current with every change.
 - Never add tests. byre has no test suite; check a change with `go vet ./...`; when `mac/` or `api/openapi.yaml` changed, `mac/bundle.sh` (release only; debug builds are refused); and when `hands/` changed, `swift build --package-path hands --configuration release`.
 
 ## Deploying
 
-When asked to deploy, do exactly this, from the worktree root:
+A deploy is a release that isn't uploaded: the same notarized disk image, installed on the owner's Macs instead of published. When asked to deploy, do exactly this, from the worktree root:
 
-1. `go install ./cmd/byre && codesign --force --sign "Apple Development" --identifier run.fc.byre ~/bin/byre && swift build --package-path hands --configuration release && install hands/.build/release/byre-hands ~/bin/ && launchctl kickstart -k gui/$(id -u)/run.fc.byre`, always as that one command, never `go install` on its own, and always the last action of the turn. The signature gives byre a stable identity, so the macOS privacy grants it holds (Screen Recording, Accessibility, Automation) survive the rebuild; `go install`'s own ad-hoc signature changes with every build and loses them. `install` replaces `byre-hands` with a new file rather than writing over the one running agents have open.
+1. Run `mac/deploy.sh`, always as the last action of the turn. It runs `mac/package.sh` (the build, both notarizations and the disk image, as for a release, into `mac/.build/release/<version>/`), installs the image's app as `/Applications/Byre.app` with `mac/install.sh`, relaunches the app on iso only when one was running there (it never starts one that wasn't), and restarts the service with `launchctl kickstart -k`. The service runs `/Applications/Byre.app/Contents/Helpers/byre`, so the kickstart starts the new server and `byre-hands`. Everything is signed with Developer ID, so the macOS privacy grants (Screen Recording, Accessibility, Automation) survive.
 2. When you resume, confirm it came up: read the tail of `~/Library/Logs/byre.log`, and `GET /api/admin/status` through the `tailscale serve` URL (`tailscale serve status` shows it). Report what you deployed and what you checked.
-3. Once the service is confirmed healthy, rebuild and relaunch the macOS app: run `mac/bundle.sh`, then update every Mac whose app is running: on iso, `pkill -x Byre` and `open mac/.build/Byre.app`, only when an app was running there (never start one that wasn't); on each client Mac, replace and relaunch the installed app through the client tools without asking first. The app reads its server address from its iCloud-synced SwiftData store, shared by every build, so the new build reconnects to prod with no setup. Report each Mac's app commit.
+3. Once the service is confirmed healthy, update each client Mac whose app is running, through the client tools and without asking first: upload the disk image (`mac/.build/release/<version>/byre-<version>.dmg`) and `mac/install.sh`, quit the app, run `install.sh <dmg>`, and `open /Applications/Byre.app`. The app reads its server address from its iCloud-synced SwiftData store, so it reconnects to prod with no setup. Report each Mac's app commit (`install.sh` prints it).
 
 What to expect:
 
-- `go install` does not restart the service. If byre restarts after your install without your kickstart, another agent deployed its own branch, and the running binary is theirs, not yours.
+- The notarizations take a minute or two each; `notarytool` prints "In Progress" until "Accepted". A rejection stops the script before anything is installed; `xcrun notarytool log <id> --keychain-profile byre-notary` says why.
-- You run inside byre, so the kickstart kills your own turn partway through the command. That is expected, not a reason to skip it. You resume with a "byre restarted while you were mid-turn" message; do the checks then, and confirm the service started after your kickstart.
+- You run inside byre, so the kickstart kills your own turn partway through the script. That is expected, not a reason to skip it. You resume with a "byre restarted while you were mid-turn" message; do the checks then, and confirm the service started after your kickstart.
-- The restart can cut off the record of the last tool call before the kickstart, or the kickstart itself, so you may resume with no memory of having deployed. Before concluding that another agent restarted byre, compare the service's start time (`started_at` in `/api/admin/status`, or the last `listening` line in the log) with your most recent `go install`: a restart right after your own install is most likely your kickstart.
+- The restart can cut off the record of the last tool call, so you may resume with no memory of having deployed. Before concluding that another agent restarted byre, compare the service's start time (`started_at` in `/api/admin/status`, or the last `listening` line in the log) with when you ran `mac/deploy.sh`: a restart a few minutes after it, once the notarizations are done, is most likely your kickstart. If byre restarts without your kickstart, another agent deployed its own branch, and the running build is theirs.
+
+## Releasing
+
+A release is a deploy that is uploaded, and goes to every Mac through the app's updater. Make one only when the owner asks. It needs a `v<version>` tag on a commit of main, pushed by itself (`git push origin v<version>`, never moving or recreating a tag), and a clean checkout at that tag on iso, where `mac/release.sh` checks the tag, runs `mac/package.sh`, and publishes the image, its `.sha256` and `appcast.xml` as the release on g.fc.run. `docs/operations.md`, "Releases", has the details.
 
 When the owner tells the lead "deploy byre", or anything that means the same, that is the owner asking for both the deploy and the discard below. The lead:
 
@@ -32,7 +36,7 @@ When the owner tells the lead "deploy byre", or anything that means the same, th
 
 - Exactly two panes, side by side, each exactly half the width, at every window size. Never three or more columns, never a sidebar, never a resizable or collapsible split.
 - No navbar. The panes fill the window, below only the identity banner when it shows.
-- The left pane has three tabs: Lead (the user's lead agent), Status and Settings, with the connection dot and the user's name at the end of its tab strip. Nothing else goes in it. The right pane always shows one task, through tabs of that task's views; the lead sets the task, which tabs come first and which one is selected, and the human can switch the task (⌘K) and tabs too. A new task view is a new tab in the right pane, never a new column or region.
+- The left pane has four tabs: Lead (the user's lead agent), Status, Server (the byre service on this Mac) and Settings (the user's and this client's preferences), with the connection dot and the user's name at the end of its tab strip. Nothing else goes in it. The right pane always shows one task, through tabs of that task's views; the lead sets the task, which tabs come first and which one is selected, and the human can switch the task (⌘K) and tabs too. A new task view is a new tab in the right pane, never a new column or region.
 - Overlays (the task switcher, confirmation dialogs) are allowed; they sit above the panes and don't change the layout.
 
 ## UI look

README.md

@@ -25,14 +25,8 @@ macOS, [Tailscale](https://tailscale.com) on every Mac, and on the Mac that runs
 ## Installing
 
 1. Download the latest `byre-<version>.dmg` from [the releases page](https://g.fc.run/ai/byre/releases) and drag `Byre.app` to Applications, on every Mac you'll use byre from.
-2. On the Mac that runs the server, from a terminal whose `PATH` finds `claude`, `codex`, `agy`, `git` and `npx`:
+2. On the Mac that runs the server, open byre and click **Run byre on this Mac**. It installs the server as a launchd service, using your login shell's `PATH` to find `claude`, `codex`, `agy`, `git` and `npx`, serves it through `tailscale serve`, and connects to it. The Server tab shows its URL and turns it off and on.
-
+3. Open byre on each other Mac; it picks up the server's URL through iCloud, or enter that URL.
-   ```
-   /Applications/Byre.app/Contents/Helpers/byre install
-   ```
-
-   It installs the server as a launchd service and serves it through `tailscale serve`, printing the URL.
-3. Open byre on each Mac and enter that URL.
 
 The app updates itself, and the server along with it on the server's Mac. To build from source instead, see "Running as a service" and "macOS app" in [docs/operations.md](docs/operations.md); that needs Go and Xcode.
 

cmd/byre/install.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"syscall"
 
 	"g.fc.run/ai/byre/internal/tailscale"
 )
@@ -69,19 +70,27 @@ func installCmd() {
 	}
 	fmt.Println("wrote", plistPath)
 
-	domain := fmt.Sprintf("gui/%d", os.Getuid())
-	service := domain + "/" + serviceLabel
-	if exec.Command("launchctl", "print", service).Run() == nil {
-		run("launchctl", "bootout", service)
-	}
-	run("launchctl", "bootstrap", domain, plistPath)
-	fmt.Println("started", service, "running", exe)
-
 	url, err := tailscale.ServeRoot(context.Background(), "http://"+defaultListen)
 	if err != nil {
 		fatal("tailscale serve", "err", err)
 	}
 	fmt.Println("byre is at", url)
+
+	domain := fmt.Sprintf("gui/%d", os.Getuid())
+	service := domain + "/" + serviceLabel
+	if exec.Command("launchctl", "print", service).Run() != nil {
+		run("launchctl", "bootstrap", domain, plistPath)
+		fmt.Println("started", service, "running", exe)
+		return
+	}
+	// bootout kills every process the service started, which includes this one when an agent runs it.
+	reload := exec.Command("/bin/sh", "-c", `launchctl bootout "$1"; launchctl bootstrap "$2" "$3"`, "sh", service, domain, plistPath)
+	reload.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	err = reload.Start()
+	if err != nil {
+		fatal("restart service", "err", err)
+	}
+	fmt.Println("restarting", service, "on", exe)
 }
 
 func run(name string, args ...string) {

docs/macos.md

@@ -20,7 +20,7 @@ The project is a Swift package under `mac/`, built with `swift build`, not an Xc
 
 ## Signing
 
-Every build is signed for distribution outside the App Store: the team's Developer ID Application certificate (`codesign --sign "Developer ID Application"`), `--options runtime` (the hardened runtime notarization requires) and `--timestamp`, with the entitlements in `mac/byre.entitlements` (the team-prefixed application identifier, the iCloud container with CloudKit in its Production environment, production push for sync, and Apple Events for driving Orion) and `mac/byre.provisionprofile` embedded as `Contents/embedded.provisionprofile`. iCloud outside the App Store needs that profile: a Developer ID profile for the App ID `run.fc.byre.mac` with iCloud (CloudKit, container `iCloud.run.fc.byre.mac`) enabled, made at developer.apple.com under Certificates, Identifiers & Profiles → Profiles → Developer ID. It names no devices, so the app runs on any Mac. `security cms -D -i mac/byre.provisionprofile` prints it, `DeveloperCertificates` included, and `security find-identity -v -p codesigning` lists the certificates on this Mac. Only the team's Account Holder can create a Developer ID Application certificate (Xcode → Settings → Accounts → Manage Certificates → + → Developer ID Application, signed in as the Account Holder); a Mac that builds the app needs that certificate and its private key in its keychain. A build that isn't notarized still runs on a Mac that didn't download it, such as one it was copied to with `client_upload`, since only downloaded files are quarantined; `mac/release.sh` notarizes releases (see "Releases" in `docs/operations.md`).
+Every build is signed for distribution outside the App Store: the team's Developer ID Application certificate (`codesign --sign "Developer ID Application"`), `--options runtime` (the hardened runtime notarization requires) and `--timestamp`, with the entitlements in `mac/byre.entitlements` (the team-prefixed application identifier, the iCloud container with CloudKit in its Production environment, production push for sync, and Apple Events for driving Orion) and `mac/byre.provisionprofile` embedded as `Contents/embedded.provisionprofile`. iCloud outside the App Store needs that profile: a Developer ID profile for the App ID `run.fc.byre.mac` with iCloud (CloudKit, container `iCloud.run.fc.byre.mac`) enabled, made at developer.apple.com under Certificates, Identifiers & Profiles → Profiles → Developer ID. It names no devices, so the app runs on any Mac. `security cms -D -i mac/byre.provisionprofile` prints it, `DeveloperCertificates` included, and `security find-identity -v -p codesigning` lists the certificates on this Mac. Only the team's Account Holder can create a Developer ID Application certificate (Xcode → Settings → Accounts → Manage Certificates → + → Developer ID Application, signed in as the Account Holder); a Mac that builds the app needs that certificate and its private key in its keychain. A build that isn't notarized still runs on a Mac that didn't download it, such as one it was copied to with `client_upload`, since only downloaded files are quarantined; `mac/package.sh` notarizes deploys and releases (see "Releases" in `docs/operations.md`).
 
 Only the release configuration is built. A debug build stops at an `#error` in `ByreApp.swift`, and even a failed one leaves the next release build in the same build directory recompiling every target, since the two configurations share it. The generated API client is its own target, `ByreAPI`, so an edit to the app recompiles only the `Byre` target. SwiftPM builds release targets whole-module, so that is one compile of the whole `Byre` target, and a one-file change still costs that. The app keeps its server origin, drafts and visits in SwiftData (see "Persistence").
 
@@ -84,7 +84,7 @@ Focus lives in `Store`. In-app `#/` links go through `Store.route`: `#/task/<id>
 
 One window. The panes follow the "UI layout" rules in `AGENTS.md`: an `HStack` of two panes of exactly equal width at every size, no sidebar, no navbar, nothing above them but the identity banner when the user has no git identity. The title bar is the standard one; no byre controls go in it or in a toolbar.
 
-- **Left pane:** tabs Lead, Status, Settings, with "reconnecting…", the connection dot and the user's name at the end of the strip.
+- **Left pane:** tabs Lead, Status, Server, Settings, with "reconnecting…", the connection dot and the user's name at the end of the strip.
 - **Right pane:** the task bar (task picker `<project> ▸ <title> ▾` and the preview links), then the task's tabs in the server's focus order, hiding Questions, Reviews and Workflow when they have nothing, with a **More ▾** menu for tabs that don't fit, carrying their badges. The pane's accent is the selected task's colour.
 
 Overlays (the switcher, alerts, confirmations, the merge dialog, keyboard help) are SwiftUI views drawn above the panes inside the window, not system sheets or alerts. The switcher and the Discard confirmation sit just below their anchor; the merge dialog is centred in the right pane.
@@ -151,7 +151,7 @@ The app menu has About, Check for Updates…, Change Server…, Hide, Hide Other
 
 ## Connection
 
-On first launch the window shows one field, Server URL (an `https` origin with no path), and Connect. Connect calls `GET /api/admin/status` and explains a failure: an untrusted certificate, an unreachable server ("Is Tailscale connected?"), 401 (no Tailscale identity: use the `ts.net` HTTPS address), 403 (the request didn't come through `tailscale serve`); anything else shows the error's own text. Certificate validation is never relaxed. On success the origin, normalized to a lower-case host with any port, is kept as the app's one `ServerRecord` (see "Persistence") and startup runs; later launches start against it directly. While the connection screen shows with an empty field, each finished CloudKit import (`NSPersistentCloudKitContainer.eventChangedNotification`) looks for a `ServerRecord` again and starts against it, so on a new Mac the address another Mac saved connects without typing.
+On first launch the window shows one field, Server URL (an `https` origin with no path), Connect, and Run byre on this Mac. Run byre on this Mac runs the bundle's `Contents/Helpers/byre install` through the user's login shell (`pw_shell -l -c 'exec "$BYRE_HELPER" install'`, which sh, zsh, bash and fish all accept), since `byre install` copies its `PATH` into the service and the app's own `PATH` from launchd finds none of `claude`, `codex`, `agy` or `npx`; it takes the address from the `byre is at` line, polls `GET /api/admin/status` for up to 10 s while the service starts, then connects to it as Connect does. Connect calls `GET /api/admin/status` and explains a failure: an untrusted certificate, an unreachable server ("Is Tailscale connected?"), 401 (no Tailscale identity: use the `ts.net` HTTPS address), 403 (the request didn't come through `tailscale serve`); anything else shows the error's own text. Certificate validation is never relaxed. On success the origin, normalized to a lower-case host with any port, is kept as the app's one `ServerRecord` (see "Persistence") and startup runs; later launches start against it directly. While the connection screen shows with an empty field, each finished CloudKit import (`NSPersistentCloudKitContainer.eventChangedNotification`) looks for a `ServerRecord` again and starts against it, so on a new Mac the address another Mac saved connects without typing.
 
 ## Updates
 

docs/operations.md

@@ -113,25 +113,21 @@ A team task has several agents working at once in its one worktree, branch and p
 
 The listen address is `byre serve --listen`, whose default is `defaultListen` in `cmd/byre/serve.go` (`go run ./cmd/byre serve --help` prints it); keep it on loopback, since identity relies on requests arriving from `tailscale serve`.
 
-`byre install` (`cmd/byre/install.go`) sets the service up for the binary it is run as, with `byre-hands` beside it: it writes `~/Library/LaunchAgents/run.fc.byre.plist` running `<that binary> serve`, with a `PATH` of that binary's directory (so `byre-hands` beside it is found) followed by the `PATH` of the shell it was run from (which must find `claude`, `codex`, `agy`, `curl`, `git` and `npx`, `curl` for Antigravity's hooks and `npx` for the Playwright MCP server, which also needs Google Chrome) and logs to `~/Library/Logs/byre.log`; boots out the service if it is loaded, so the new plist is read; bootstraps it; and runs `tailscale serve --bg --https=443 http://<default listen address>` through the Tailscale app's CLI (`tailscale.ServeRoot`, see "Previews"), printing `byre is at https://<machine>.<tailnet>.ts.net`. Running it again after an update restarts the service on the new binary. From a release, that is `/Applications/Byre.app/Contents/Helpers/byre install`. From a checkout:
+`byre install` (`cmd/byre/install.go`) sets the service up for the binary it is run as, with `byre-hands` beside it: it writes `~/Library/LaunchAgents/run.fc.byre.plist` running `<that binary> serve`, with a `PATH` of that binary's directory (so `byre-hands` beside it is found) followed by the `PATH` of the shell it was run from (which must find `claude`, `codex`, `agy`, `curl`, `git` and `npx`, `curl` for Antigravity's hooks and `npx` for the Playwright MCP server, which also needs Google Chrome) and logs to `~/Library/Logs/byre.log`; runs `tailscale serve --bg --https=443 http://<default listen address>` through the Tailscale app's CLI (`tailscale.ServeRoot`, see "Previews"), printing `byre is at https://<machine>.<tailnet>.ts.net`; and bootstraps the service. When the service is already loaded, it hands `launchctl bootout` and `bootstrap` to a detached `sh` in its own session and exits, so the new plist is read: `bootout` kills every process in the service's process groups, which includes `byre install` itself when an agent byre runs is the one running it. The service always runs from the app, `/Applications/Byre.app/Contents/Helpers/byre install`, which the app's Server tab and connection screen run for you (see "UI").
-
-```
-go install ./cmd/byre
-codesign --force --sign "Apple Development" --identifier run.fc.byre ~/bin/byre
-swift build --package-path hands --configuration release
-install hands/.build/release/byre-hands ~/bin/
-~/bin/byre install
-```
 
 byre is served at the root of the machine's `ts.net` name on 443 (`https://<machine>.<tailnet>.ts.net`), not under a path: the API uses absolute paths, and the macOS app takes an origin with no path. `tailscale serve status` shows the URL and what else the machine serves. `launchctl print gui/$(id -u)/run.fc.byre` shows the service and the program it runs.
 
-After rebuilding from a checkout: step 1 of "Deploying" in `AGENTS.md`, which restarts whatever the plist runs, so it only takes effect when the plist points at `~/bin/byre`. Logs go to `~/Library/Logs/byre.log`.
+A new build reaches the service by replacing `/Applications/Byre.app` and restarting the service: `mac/deploy.sh` (see "Releases"), or the app's updater, which restarts the service when it launches as a new version. Logs go to `~/Library/Logs/byre.log`.
 
 ## Releases
 
 A release is one notarized disk image, `byre-<version>.dmg`, holding `Byre.app`: the macOS app, with the server (`Contents/Helpers/byre`) and `byre-hands` (`Contents/Helpers/byre-hands`) inside it. Every Mac installs the same app; the server's Mac also runs `byre install` from it (see "Running as a service"). Releases are on the repo's releases page on g.fc.run, `https://g.fc.run/ai/byre/releases`.
 
-`mac/release.sh` makes one, run on byre's host from a checkout whose `HEAD` carries a `v<version>` tag already pushed to `origin`, with a clean tree; it fetches the tag from `origin` and stops unless it names `HEAD`. It builds with `mac/bundle.sh` (signed with Developer ID, see `docs/macos.md`), zips the app and notarizes it with `xcrun notarytool submit --keychain-profile byre-notary --wait`, staples the ticket, builds the disk image with `hdiutil` (the app and an `/Applications` link), signs, notarizes and staples that too, and writes its SHA-256 beside it. It then signs the image for Sparkle with `sign_update --account byre` and writes `appcast.xml`, a feed with that one release. Last, it creates the release as a draft through the Gitea API (`POST /api/v1/repos/ai/byre/releases`, notes the commit subjects since the previous tag), uploads the image, its `.sha256` and `appcast.xml` as assets, and only then publishes it (`PATCH` with `draft: false`), so the `latest` release always has its appcast. A run that fails part way leaves the draft on the releases page; delete it there before running again. Everything lands in `mac/.build/release/<version>/`, and the script prints the release page.
+`mac/package.sh` builds one for whatever the checkout holds, into `mac/.build/release/<version>/`, `<version>` being the bundle's `CFBundleShortVersionString`, and prints the image's path. It builds with `mac/bundle.sh` (signed with Developer ID, see `docs/macos.md`), zips the app and notarizes it with `xcrun notarytool submit --keychain-profile byre-notary --wait`, staples the ticket, builds the disk image with `hdiutil` (the app and an `/Applications` link), signs, notarizes and staples that too, and writes its SHA-256 beside it. It then signs the image for Sparkle with `sign_update --account byre` and writes `appcast.xml`, a feed with that one release.
+
+A deploy is that image installed rather than published: `mac/deploy.sh` runs `package.sh`, installs the image's app with `mac/install.sh <dmg>` (mounts the image, copies `Byre.app` to `/Applications/Byre.app.new`, removes the old bundle and moves the new one into place, so nothing running from the old bundle has its files written over; it prints the installed `ByreCommit`), relaunches the app when one is running, and restarts the service with `launchctl kickstart -k`. Client Macs get the same image through the client tools and `install.sh` (`AGENTS.md`, "Deploying"). A deployed build's `CFBundleVersion` is at least the last release's, so the updater never offers to go back to it.
+
+`mac/release.sh` publishes one, run on byre's host from a checkout whose `HEAD` carries a `v<version>` tag already pushed to `origin`, with a clean tree; it fetches the tag from `origin` and stops unless it names `HEAD`, then runs `package.sh`. Last, it creates the release as a draft through the Gitea API (`POST /api/v1/repos/ai/byre/releases`, notes the commit subjects since the previous tag), uploads the image, its `.sha256` and `appcast.xml` as assets, and only then publishes it (`PATCH` with `draft: false`), so the `latest` release always has its appcast. A run that fails part way leaves the draft on the releases page; delete it there before running again. Everything lands in `mac/.build/release/<version>/`, and the script prints the release page.
 
 It needs, on that Mac:
 
@@ -148,7 +144,7 @@ Clients reach `tailscale serve` over HTTP/2; it proxies to byre over HTTP/1.1 an
 
 **Building.** `mac/bundle.sh`, from any directory, builds the release configuration with `swift build` in `~/Library/Caches/byre/build`, one build directory every worktree shares and takes turns in (`docs/macos.md`, "Stack", says why), and assembles `mac/.build/Byre.app`: the `Byre` executable in `Contents/MacOS`; the server, built with `go build ./cmd/byre`, and `byre-hands`, built from `hands/`, in `Contents/Helpers` (not beside `Byre`: the default APFS volume ignores case, so `byre` and `Byre` would be one file); Sparkle's framework in `Contents/Frameworks`; `mac/Info.plist` with a `ByreCommit` key added holding the worktree's `git rev-parse HEAD`, `CFBundleShortVersionString` its `git describe --tags --always` without the leading `v` (`0.1.0` on a release tag, `0.1.0-12-gabc1234` after it) and `CFBundleVersion` its `git rev-list --count HEAD` (the About panel shows them as "Version <version> (<count>)", and Sparkle compares the count); the `mac/fonts/` woff2 files, an icon rendered from `mac/icon.svg` with `rsvg-convert` and `iconutil` (cached as `mac/.build/byre.icns` until the SVG changes) and `mac/byre.provisionprofile`. It signs each piece with the Developer ID Application certificate, a secure timestamp and the hardened runtime, innermost first: `byre-hands` as `run.fc.byre.hands` and the server as `run.fc.byre`, both with `mac/automation.entitlements` (Apple Events, which the hardened runtime otherwise refuses), Sparkle's `Autoupdate`, `Updater.app` and framework (its XPC services, only needed by sandboxed apps, are removed), then the bundle with `mac/byre.entitlements`. It prints the bundle's path. It needs Xcode selected (`xcode-select --print-path` prints `/Applications/Xcode.app/Contents/Developer`), Go, `rsvg-convert` (Homebrew's `librsvg`), the team's Developer ID Application certificate and network access for the timestamp, and it stops first unless `mac/byre.provisionprofile` has `ProvisionsAllDevices` (a Developer ID profile; a development profile can't authorize the Developer ID signature); `docs/macos.md`, "Signing", covers the certificate and profile. Debug builds are refused by an `#error` in `ByreApp.swift`. The first build on a Mac fetches the Swift packages pinned in `mac/Package.resolved` and compiles them and the generated API client; later builds, from any worktree, recompile only the targets whose sources differ from the last build's, usually just `Byre`. The API client is generated from `api/openapi.yaml` at build time. The palette is `mac/Sources/Byre/Palette.swift`, one light and one dark value per colour.
 
-**Installing.** A release is installed from its disk image into `/Applications` (see "Releases") and updates itself (`docs/macos.md`, "Updates"). A build from a checkout runs from where it was built: `open mac/.build/Byre.app` in the worktree that built it. A new build replaces the bundle, so quit the running app first (`pkill -x Byre` quits every running copy, whichever worktree built it) and open the new one; step 4 of "Deploying" in `AGENTS.md` does this after a deploy. Every build shares the bundle identifier `run.fc.byre.mac` and the same store, so any build reconnects to the server the last one used. Closing the window leaves the app running for notifications; ⌘Q quits it.
+**Installing.** A release is installed from its disk image into `/Applications` (see "Releases") and updates itself (`docs/macos.md`, "Updates"). A deploy installs its build there the same way (see "Releases"). A build from a checkout can also run from where it was built, `open mac/.build/Byre.app` in the worktree that built it, after quitting the running app (`pkill -x Byre` quits every running copy). Every build shares the bundle identifier `run.fc.byre.mac` and the same store, so any build reconnects to the server the last one used. Closing the window leaves the app running for notifications; ⌘Q quits it.
 
 **Storage.** The app keeps three kinds of record in SwiftData (`mac/Sources/Byre/Persistence.swift`): the server origin, when each task was last selected, and composer and answer drafts as JSON, one record per server and login (`docs/macos.md`, "Persistence" and "Drafts"). The store is `~/Library/Application Support/run.fc.byre.mac/byre.store`, with its `-shm` and `-wal` files and CloudKit's working files beside it in that directory; the app isn't sandboxed, so it names its own file rather than SwiftData's default `default.store`, which every unsandboxed app shares. The store syncs through the iCloud private database of container `iCloud.run.fc.byre.mac`, in CloudKit's Production environment (`com.apple.developer.icloud-container-environment` in `mac/byre.entitlements`), whose schema is deployed from Development in the CloudKit console before a release that changes the SwiftData models; the CloudKit console (icloud.developer.apple.com, the container, Production, Private Database, zone `com.apple.coredata.cloudkit.zone`) shows the records. Deleting the local files while the app isn't running makes the next launch download the records again from iCloud; deleting the records in the console as well starts from the connection screen. Pasted images stay in memory and are dropped on Change Server… and quit. The app logs through `os.Logger`: `log show --last 10m --predicate 'subsystem == "run.fc.byre.mac"'` prints it.
 
@@ -277,7 +273,7 @@ Each user has one long-running lead agent, shown in the left pane. It is not tie
 Task agents get notes too. An implementer session's instructions end with `taskNotesGuidance` and `notesText` for the task's creator, limited to the every-project notes and the task's project's (`startLive` in `internal/agents/manager.go`), fixed when the agent process starts like the lead's. Reviewers get none. Implementers have a `suggest_note` tool (`text`, `evidence`) that queues a lead signal for the task's creator naming the task, the suggested text, the evidence and the project id, and refuses when the creator has no live lead session. The lead's guidance tells it to save a suggestion with `remember`, choosing its project, only when it holds and isn't already covered, and to tell the human nothing either way. A suggestion leaves no record of its own beyond the signal; a saved one shows as the lead's `lead.note_saved`.
 - **Restarts.** On shutdown, byre marks each running lead session idle with "byre stopped mid-turn" and holds a restart notice for it, so a lead is never left `running` for a build without lead support to find. After a crash, startup resumes a running lead like a task session. Startup then delivers any held input.
 
-The UI is two panes filling the window, with no navbar. The left has three tabs: Lead, the lead's transcript and composer (the same view as a task transcript, with only the Compact button in its header), Status and Settings, and at the end of its tab strip the connection dot and the user's name. Which left tab is selected is kept only in memory (`Overlays`); the Lead view stays mounted while another tab shows, and Status or Settings mounts each time its tab is selected. The right shows the focused task, or project with no task: a top row holding the task picker, centred, and the task's preview links at its right end (see "Previews"), then the tab strip, then the selected tab's view with its own header. The tabs are Transcript, Board, Changes, Files, Terminal, Questions, Reviews, Workflow and Project, the lead's `tabs` first. Board shows only on a team task (see "Teams"), Reviews only once it has a `review.*` event, Inbox only while the task has open items, and Workflow only on a task with a `workflow_run` (see "Workflows"); the selected tab always shows. Tabs that don't fit in the strip move, from the end, into a **More ▾** menu (`MoreButton` in `mac/Sources/Byre/Panes.swift`); the selected tab never moves there, and More carries the Questions highlight and count when Questions is in it. The **Go** menu holds the shortcuts, each also on its Ctrl key outside the terminal. ⌘K opens the task switcher. ⌘P selects the Project tab, keeping the right pane's task. ⌘L selects the Lead tab and puts the cursor in the lead's composer. ⌘S opens the right pane's task's Merge confirmation, from any tab, when the Merge button would be enabled. ⌘/ opens a dialog listing every keyboard shortcut; the list is `shortcuts` in `mac/Sources/Byre/Switcher.swift`, kept in step with the menu by hand. The shortcuts do nothing while a dialog is open.
+The UI is two panes filling the window, with no navbar. The left has four tabs: Lead, the lead's transcript and composer (the same view as a task transcript, with only the Compact button in its header), Status, Server and Settings, and at the end of its tab strip the connection dot and the user's name. Server is about the byre service on the Mac the app runs on, whatever server the app is connected to (`mac/Sources/Byre/Server.swift`): it is On when launchd has the service loaded (`launchctl print gui/<uid>/run.fc.byre` succeeds), showing the address from `tailscale serve status --json` and Turn off (`launchctl bootout`), and Off otherwise, showing Turn on, which runs the bundle's `byre install` as the connection screen's Run byre on this Mac does. Both Turn on and Run byre on this Mac use the running service's address instead of reinstalling when it is already on, since a reinstall restarts it and the old service could answer the first status check. It reads the state again each time it shows and when the app becomes active. Settings holds the user's and this client's preferences. Which left tab is selected is kept only in memory (`Overlays`); the Lead view stays mounted while another tab shows, and Status, Server or Settings mounts each time its tab is selected. The right shows the focused task, or project with no task: a top row holding the task picker, centred, and the task's preview links at its right end (see "Previews"), then the tab strip, then the selected tab's view with its own header. The tabs are Transcript, Board, Changes, Files, Terminal, Questions, Reviews, Workflow and Project, the lead's `tabs` first. Board shows only on a team task (see "Teams"), Reviews only once it has a `review.*` event, Inbox only while the task has open items, and Workflow only on a task with a `workflow_run` (see "Workflows"); the selected tab always shows. Tabs that don't fit in the strip move, from the end, into a **More ▾** menu (`MoreButton` in `mac/Sources/Byre/Panes.swift`); the selected tab never moves there, and More carries the Questions highlight and count when Questions is in it. The **Go** menu holds the shortcuts, each also on its Ctrl key outside the terminal. ⌘K opens the task switcher. ⌘P selects the Project tab, keeping the right pane's task. ⌘L selects the Lead tab and puts the cursor in the lead's composer. ⌘S opens the right pane's task's Merge confirmation, from any tab, when the Merge button would be enabled. ⌘/ opens a dialog listing every keyboard shortcut; the list is `shortcuts` in `mac/Sources/Byre/Switcher.swift`, kept in step with the menu by hand. The shortcuts do nothing while a dialog is open.
 
 ## TODO
 

mac/Sources/Byre/Dialogs.swift

@@ -37,7 +37,7 @@ struct OverlayAlert: Identifiable {
 }
 
 enum LeftTab {
-    case lead, status, settings
+    case lead, status, server, settings
 }
 
 @MainActor

mac/Sources/Byre/Panes.swift

@@ -138,6 +138,9 @@ private struct LeftPane: View {
                 PaneTabButton(label: "Status", active: tab == .status) {
                     overlays.leftTab = .status
                 }
+                PaneTabButton(label: "Server", active: tab == .server) {
+                    overlays.leftTab = .server
+                }
                 PaneTabButton(label: "Settings", active: tab == .settings) {
                     overlays.leftTab = .settings
                 }
@@ -169,6 +172,8 @@ private struct LeftPane: View {
                     .accessibilityHidden(tab != .lead)
                 if tab == .status {
                     StatusView()
+                } else if tab == .server {
+                    ServerView()
                 } else if tab == .settings {
                     SettingsView()
                 }

mac/Sources/Byre/Server.swift

@@ -0,0 +1,161 @@
+import Foundation
+import SwiftUI
+
+struct LaunchAgent: Decodable {
+    let programArguments: [String]
+
+    enum CodingKeys: String, CodingKey {
+        case programArguments = "ProgramArguments"
+    }
+}
+
+let agentPlist = FileManager.default.homeDirectoryForCurrentUser.appending(path: "Library/LaunchAgents/run.fc.byre.plist")
+let serverHelper = Bundle.main.bundleURL.appending(path: "Contents/Helpers/byre").path
+private let service = "gui/\(getuid())/run.fc.byre"
+
+struct ServerState {
+    var on = false
+    var address: String?
+}
+
+struct ProcessFailure: LocalizedError {
+    let errorDescription: String?
+}
+
+private func execute(_ path: String, _ args: [String], env: [String: String] = [:]) async throws -> (status: Int32, output: String) {
+    try await Task.detached {
+        let p = Process()
+        p.executableURL = URL(filePath: path)
+        p.arguments = args
+        p.environment = ProcessInfo.processInfo.environment.merging(env) { $1 }
+        let out = Pipe()
+        p.standardOutput = out
+        p.standardError = out
+        try p.run()
+        let data = out.fileHandleForReading.readDataToEndOfFile()
+        p.waitUntilExit()
+        return (p.terminationStatus, String(decoding: data, as: UTF8.self))
+    }.value
+}
+
+private func launchctl(_ args: String...) async throws {
+    let r = try await execute("/bin/launchctl", args)
+    if r.status != 0 {
+        throw ProcessFailure(errorDescription: "launchctl \(args.joined(separator: " ")): \(r.output.trimmingCharacters(in: .whitespacesAndNewlines))")
+    }
+}
+
+enum Server {
+    static func state() async -> ServerState {
+        guard let r = try? await execute("/bin/launchctl", ["print", service]), r.status == 0 else {
+            return ServerState()
+        }
+        return ServerState(on: true, address: await address())
+    }
+
+    private static func address() async -> String? {
+        guard let r = try? await execute("/Applications/Tailscale.app/Contents/MacOS/Tailscale", ["serve", "status", "--json"], env: ["TAILSCALE_BE_CLI": "1"]), r.status == 0,
+              let json = try? JSONSerialization.jsonObject(with: Data(r.output.utf8)) as? [String: Any],
+              let web = json["Web"] as? [String: Any],
+              let host = web.keys.first(where: { $0.hasSuffix(":443") })
+        else {
+            return nil
+        }
+        return "https://" + host.dropLast(4)
+    }
+
+    // byre install copies its PATH into the service, which needs the login shell's to find claude, codex, agy and npx.
+    static func install() async throws -> URL {
+        let shell = unsafe String(cString: getpwuid(getuid()).pointee.pw_shell)
+        let r = try await execute(shell, ["-l", "-c", "exec \"$BYRE_HELPER\" install"], env: ["BYRE_HELPER": serverHelper])
+        let prefix = "byre is at "
+        guard r.status == 0, let line = r.output.split(separator: "\n").first(where: { $0.hasPrefix(prefix) }), let url = URL(string: String(line.dropFirst(prefix.count))) else {
+            throw ProcessFailure(errorDescription: "byre install failed: \(r.output.trimmingCharacters(in: .whitespacesAndNewlines))")
+        }
+        return url
+    }
+
+    // Reinstalling a running service restarts it, so an address read right after could still be answered by the old one.
+    static func turnOn() async throws -> URL {
+        let state = await state()
+        if state.on, let address = state.address, let url = URL(string: address) {
+            return url
+        }
+        return try await install()
+    }
+
+    static func turnOff() async throws {
+        try await launchctl("bootout", service)
+    }
+}
+
+struct ServerView: View {
+    @Environment(Overlays.self) private var overlays
+    @ViewState private var state: ServerState?
+    @ViewState private var busy = false
+
+    var body: some View {
+        ScrollView {
+            VStack(alignment: .leading, spacing: 8) {
+                Text("Server on this Mac")
+                    .font(Fonts.font(13, weight: 700))
+                    .padding(.top, 16)
+                if let state {
+                    details(state)
+                }
+            }
+            .padding(.horizontal, 16)
+            .padding(.top, 8)
+            .padding(.bottom, 16)
+            .frame(maxWidth: .infinity, alignment: .leading)
+        }
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+        .background(Palette.bg)
+        .task {
+            await refresh()
+        }
+        .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
+            Task {
+                await refresh()
+            }
+        }
+    }
+
+    @ViewBuilder
+    private func details(_ state: ServerState) -> some View {
+        if state.on {
+            Text("On").foregroundStyle(Palette.ok)
+            if let address = state.address {
+                Text(address).textSelection(.enabled)
+            }
+            button("Turn off", Server.turnOff)
+        } else {
+            Text("Off").foregroundStyle(Palette.muted)
+            button("Turn on") {
+                _ = try await Server.turnOn()
+            }
+        }
+    }
+
+    private func button(_ label: String, _ action: @escaping () async throws -> Void) -> some View {
+        Button(label) {
+            busy = true
+            Task {
+                do {
+                    try await action()
+                } catch {
+                    overlays.showAlert(errorText(error))
+                }
+                await refresh()
+                busy = false
+            }
+        }
+        .buttonStyle(WebButtonStyle())
+        .disabled(busy)
+        .padding(.top, 4)
+    }
+
+    private func refresh() async {
+        state = await Server.state()
+    }
+}

mac/Sources/Byre/Startup.swift

@@ -86,6 +86,46 @@ final class Connection {
         await start(origin)
     }
 
+    func installHere() async {
+        connecting = true
+        problem = nil
+        let gen = generation
+        do {
+            let origin = try await Server.turnOn()
+            serverText = origin.absoluteString
+            try await waitForServer(origin)
+        } catch {
+            if gen == generation {
+                connecting = false
+                problem = errorText(error)
+            }
+            return
+        }
+        guard gen == generation else {
+            return
+        }
+        await connect()
+    }
+
+    private func waitForServer(_ origin: URL) async throws {
+        let api = API(origin: origin)
+        try await withThrowingTaskGroup(of: Void.self) { group in
+            group.addTask {
+                while (try? await api.client.getStatus().ok) == nil {
+                    try await Task.sleep(for: .milliseconds(500))
+                }
+            }
+            group.addTask {
+                try await Task.sleep(for: .seconds(10))
+                throw ProcessFailure(errorDescription: "byre was installed but \(origin.absoluteString) didn't answer within 10 s.")
+            }
+            defer {
+                group.cancelAll()
+            }
+            try await group.next()
+        }
+    }
+
     func changeServer() {
         generation += 1
         if let store {
@@ -175,8 +215,11 @@ struct ConnectView: View {
             TextField("https://byre.example.ts.net", text: $connection.serverText)
                 .textFieldStyle(.roundedBorder)
                 .onSubmit(connect)
-            Button("Connect", action: connect)
+            HStack(spacing: 10) {
-                .disabled(connection.connecting)
+                Button("Connect", action: connect)
+                Button("Run byre on this Mac", action: installHere)
+            }
+            .disabled(connection.connecting)
             if let problem = connection.problem {
                 Text(problem)
                     .foregroundStyle(Palette.danger)
@@ -193,6 +236,12 @@ struct ConnectView: View {
             await connection.connect()
         }
     }
+
+    private func installHere() {
+        Task {
+            await connection.installHere()
+        }
+    }
 }
 
 struct FatalView: View {

mac/Sources/Byre/Updater.swift

@@ -1,14 +1,6 @@
 import Foundation
 import Sparkle
 
-private struct LaunchAgent: Decodable {
-    let programArguments: [String]
-
-    enum CodingKeys: String, CodingKey {
-        case programArguments = "ProgramArguments"
-    }
-}
-
 private let lastVersionKey = "lastLaunchedVersion"
 
 @MainActor
@@ -31,11 +23,9 @@ final class Updater {
     }
 
     private func restartServer() {
-        let agent = FileManager.default.homeDirectoryForCurrentUser.appending(path: "Library/LaunchAgents/run.fc.byre.plist")
+        guard let data = try? Data(contentsOf: agentPlist),
-        let server = Bundle.main.bundleURL.appending(path: "Contents/Helpers/byre").path
-        guard let data = try? Data(contentsOf: agent),
               let plist = try? PropertyListDecoder().decode(LaunchAgent.self, from: data),
-              plist.programArguments.first == server
+              plist.programArguments.first == serverHelper
         else {
             return
         }

mac/deploy.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+mac=$(cd "$(dirname "$0")" && pwd)
+
+"$mac/package.sh"
+version=$(plutil -extract CFBundleShortVersionString raw "$mac/.build/Byre.app/Contents/Info.plist")
+dmg=$mac/.build/release/$version/byre-$version.dmg
+"$mac/install.sh" "$dmg"
+if pgrep -xq Byre; then
+	pkill -x Byre
+	while pgrep -xq Byre; do
+		sleep 0.2
+	done
+	open /Applications/Byre.app
+fi
+launchctl kickstart -k "gui/$(id -u)/run.fc.byre"

mac/install.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+dmg=$1
+mount=$(mktemp -d)
+hdiutil attach -nobrowse -readonly -mountpoint "$mount" "$dmg"
+rm -rf /Applications/Byre.app.new
+ditto "$mount/Byre.app" /Applications/Byre.app.new
+hdiutil detach "$mount"
+rm -rf /Applications/Byre.app
+mv /Applications/Byre.app.new /Applications/Byre.app
+plutil -extract ByreCommit raw /Applications/Byre.app/Contents/Info.plist

mac/package.sh

@@ -0,0 +1,58 @@
+#!/bin/sh
+set -eu
+mac=$(cd "$(dirname "$0")" && pwd)
+repo=ai/byre
+sparkle_version=2.10.0
+sparkle=$HOME/Library/Caches/byre/sparkle-$sparkle_version
+identity="Developer ID Application"
+
+if [ ! -x "$sparkle/bin/sign_update" ]; then
+	mkdir -p "$sparkle"
+	curl -fsSL "https://github.com/sparkle-project/Sparkle/releases/download/$sparkle_version/Sparkle-$sparkle_version.tar.xz" | tar -xJ -C "$sparkle"
+fi
+
+"$mac/bundle.sh"
+app=$mac/.build/Byre.app
+version=$(plutil -extract CFBundleShortVersionString raw "$app/Contents/Info.plist")
+tag=v$version
+out=$mac/.build/release/$version
+rm -rf "$out"
+mkdir -p "$out"
+
+ditto -c -k --keepParent "$app" "$out/byre.zip"
+xcrun notarytool submit "$out/byre.zip" --keychain-profile byre-notary --wait
+xcrun stapler staple "$app"
+rm "$out/byre.zip"
+
+dmg=byre-$version.dmg
+stage=$out/stage
+mkdir "$stage"
+ditto "$app" "$stage/Byre.app"
+ln -s /Applications "$stage/Applications"
+hdiutil create -volname byre -srcfolder "$stage" -format UDZO "$out/$dmg"
+rm -rf "$stage"
+codesign --force --timestamp --sign "$identity" "$out/$dmg"
+xcrun notarytool submit "$out/$dmg" --keychain-profile byre-notary --wait
+xcrun stapler staple "$out/$dmg"
+(cd "$out" && shasum -a 256 "$dmg" > "$dmg.sha256")
+
+build=$(plutil -extract CFBundleVersion raw "$app/Contents/Info.plist")
+minimum=$(plutil -extract LSMinimumSystemVersion raw "$app/Contents/Info.plist")
+signature=$("$sparkle/bin/sign_update" --account byre "$out/$dmg")
+cat > "$out/appcast.xml" <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
+<channel>
+<title>byre</title>
+<item>
+<title>byre $version</title>
+<pubDate>$(LC_ALL=C date -u "+%a, %d %b %Y %H:%M:%S +0000")</pubDate>
+<sparkle:version>$build</sparkle:version>
+<sparkle:shortVersionString>$version</sparkle:shortVersionString>
+<sparkle:minimumSystemVersion>$minimum</sparkle:minimumSystemVersion>
+<enclosure url="https://g.fc.run/$repo/releases/download/$tag/$dmg" type="application/octet-stream" $signature/>
+</item>
+</channel>
+</rss>
+EOF
+echo "$out/$dmg"

mac/release.sh

@@ -4,9 +4,6 @@ mac=$(cd "$(dirname "$0")" && pwd)
 root=$(dirname "$mac")
 repo=ai/byre
 api=https://g.fc.run/api/v1/repos/$repo
-sparkle_version=2.10.0
-sparkle=$HOME/Library/Caches/byre/sparkle-$sparkle_version
-identity="Developer ID Application"
 
 if [ -n "$(git -C "$root" status --porcelain)" ]; then
 	echo "release: the tree has uncommitted changes" >&2
@@ -21,53 +18,9 @@ if [ "$(git -C "$root" rev-parse "FETCH_HEAD^{commit}")" != "$(git -C "$root" re
 fi
 token=$(security find-generic-password -s byre-release -w)
 
-if [ ! -x "$sparkle/bin/sign_update" ]; then
+"$mac/package.sh"
-	mkdir -p "$sparkle"
-	curl -fsSL "https://github.com/sparkle-project/Sparkle/releases/download/$sparkle_version/Sparkle-$sparkle_version.tar.xz" | tar -xJ -C "$sparkle"
-fi
-
-"$mac/bundle.sh"
-app=$mac/.build/Byre.app
 out=$mac/.build/release/$version
-rm -rf "$out"
-mkdir -p "$out"
-
-ditto -c -k --keepParent "$app" "$out/byre.zip"
-xcrun notarytool submit "$out/byre.zip" --keychain-profile byre-notary --wait
-xcrun stapler staple "$app"
-rm "$out/byre.zip"
-
 dmg=byre-$version.dmg
-stage=$out/stage
-mkdir "$stage"
-ditto "$app" "$stage/Byre.app"
-ln -s /Applications "$stage/Applications"
-hdiutil create -volname byre -srcfolder "$stage" -format UDZO "$out/$dmg"
-rm -rf "$stage"
-codesign --force --timestamp --sign "$identity" "$out/$dmg"
-xcrun notarytool submit "$out/$dmg" --keychain-profile byre-notary --wait
-xcrun stapler staple "$out/$dmg"
-(cd "$out" && shasum -a 256 "$dmg" > "$dmg.sha256")
-
-build=$(plutil -extract CFBundleVersion raw "$app/Contents/Info.plist")
-minimum=$(plutil -extract LSMinimumSystemVersion raw "$app/Contents/Info.plist")
-signature=$("$sparkle/bin/sign_update" --account byre "$out/$dmg")
-cat > "$out/appcast.xml" <<EOF
-<?xml version="1.0" encoding="utf-8"?>
-<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
-<channel>
-<title>byre</title>
-<item>
-<title>byre $version</title>
-<pubDate>$(LC_ALL=C date -u "+%a, %d %b %Y %H:%M:%S +0000")</pubDate>
-<sparkle:version>$build</sparkle:version>
-<sparkle:shortVersionString>$version</sparkle:shortVersionString>
-<sparkle:minimumSystemVersion>$minimum</sparkle:minimumSystemVersion>
-<enclosure url="https://g.fc.run/$repo/releases/download/$tag/$dmg" type="application/octet-stream" $signature/>
-</item>
-</channel>
-</rss>
-EOF
 
 previous=$(git -C "$root" describe --tags --abbrev=0 "$tag^" || true)
 if [ -n "$previous" ]; then