From 3d236df64a249ad9248a6aa6e59a9f43054e83f7 Mon Sep 17 00:00:00 2001
From: Lexus2016 <lexus@cdzv.com>
Date: Mon, 28 Sep 2026 16:59:16 +0200
Subject: [PATCH] feat(release): build and publish macOS from the Mac, not CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Developer ID certificate and the notarytool keychain profile live only in
the release Mac's keychain, so a CI runner can only produce an unsigned mac
build — and the app now updates itself through Squirrel.Mac, which refuses an
update not signed by the same Developer ID. macOS is released locally:

  npm run release patch   # tag → release.yml + Windows/Linux in CI (unchanged)
  npm run release:mac     # this Mac: build, verify, upload, bump the cask

scripts/release-mac.js:
- preflight: HEAD is the tag, tree clean, origin's tag = HEAD; the notarytool
  profile works; the GitHub Release exists and is not a draft.
- electron-builder --mac --publish NEVER: it skips notarization silently when
  the profile is missing, so --publish always would ship that build.
- verify before upload: codesign; spctl (exit 0 + "Notarized Developer ID")
  on the app and on the app inside the mounted dmg, both at the tag's version;
  stapler; latest-mac.yml names this zip and carries the real sha512 of the
  zip and dmg.
- gh release upload; existing mac assets only with --force; a part-way failure
  says what is and is not on the release.
- transitional cask bump with the dmg's sha256 only once it equals the digest
  GitHub serves; --cask-only redoes that step.

release-desktop.yml builds Windows/Linux only; the MAC_*/APPLE_* secrets and
bump-cask are gone (HOMEBREW_TAP_TOKEN is now unused). Reviewed by codex; its
findings are fixed and pinned. Verified on the notarized 7.17.0 build: the
verification step passes, --cask-only refuses a dmg that is not the release's.

Tests: test/release-mac.test.js (38 checks, each guard mutation-checked);
test/mac-signing.test.js now pins that CI does not build macOS.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release-desktop.yml |  98 +-------
 CLAUDE.md                             |  17 +-
 docs/electron-desktop/MAC-SIGNING.md  |  80 +++----
 homebrew-tap/README.md                |   8 +-
 package.json                          |   3 +-
 scripts/release-mac.js                | 310 ++++++++++++++++++++++++++
 scripts/release.js                    |   4 +
 test/mac-signing.test.js              |  75 +++----
 test/release-mac.test.js              | 177 +++++++++++++++
 9 files changed, 582 insertions(+), 190 deletions(-)
 create mode 100644 scripts/release-mac.js
 create mode 100644 test/release-mac.test.js

diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index c929f77f..f961f698 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -1,19 +1,17 @@
 name: Release Desktop
 
 # Runs on the same version tags as the web release workflow. release.yml creates
-# the GitHub Release + changelog; this workflow builds the desktop apps for all
-# three OSes and uploads them to that release, then bumps the Homebrew Cask.
+# the GitHub Release + changelog; this workflow builds the Windows and Linux apps
+# and uploads them to that release. Both stay unsigned
+# (CSC_IDENTITY_AUTO_DISCOVERY=false).
 #
-# The cask bump depends on the macOS build ONLY (build-mac) — never on the
-# Windows/Linux legs. A slow Windows build no longer delays macOS auto-updates,
-# and a failing Windows/Linux build can no longer block the cask bump entirely
-# (previously `bump-cask: needs: build` waited for the whole matrix and was
-# skipped if any leg failed, so macOS users were stranded on the old version).
-#
-# macOS: Apple Silicon only, signed with the Developer ID certificate and notarized
-# (docs/electron-desktop/MAC-SIGNING.md). Without the MAC_CSC_* / APPLE_* secrets
-# the mac leg FAILS — the app self-updates via Squirrel.Mac, which refuses unsigned
-# updates. Windows/Linux stay unsigned (CSC_IDENTITY_AUTO_DISCOVERY=false).
+# macOS is NOT built here. It is signed with the Developer ID certificate and
+# notarized with a notarytool keychain profile, and both live only in the release
+# Mac's keychain — `npm run release:mac` builds, verifies and uploads it from there
+# (scripts/release-mac.js, docs/electron-desktop/MAC-SIGNING.md). A runner has
+# neither, and an unsigned mac build would break every installed copy: the app
+# updates itself through Squirrel.Mac, which refuses an update not signed by the
+# same Developer ID.
 on:
   push:
     tags: ['v*.*.*']
@@ -23,45 +21,7 @@ permissions:
   contents: write
 
 jobs:
-  build-mac:
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-      - run: npm ci
-      - name: Build & publish desktop app (macOS)
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # MAC_-prefixed secrets: electron-builder reads CSC_LINK on Windows too, so the
-          # name has to say which platform this certificate belongs to.
-          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
-          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: |
-          set -euo pipefail
-          # No unsigned fallback. The app updates itself through Squirrel.Mac, which
-          # installs only an update signed by the same Developer ID — an unsigned
-          # release would be refused by every installed copy, and its dmg blocked by
-          # Gatekeeper for every new one.
-          if [ -z "${CSC_LINK:-}" ]; then
-            echo "::error::MAC_CSC_LINK is not set — refusing to publish an unsigned macOS build. See docs/electron-desktop/MAC-SIGNING.md."
-            exit 1
-          fi
-          if [ -z "${APPLE_ID:-}" ] || [ -z "${APPLE_APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${APPLE_TEAM_ID:-}" ]; then
-            # electron-builder would sign, log "skipped macOS notarization" and publish.
-            # Gatekeeper refuses a signed-but-unnotarized download exactly like an
-            # unsigned one, so that build is a failure that looks like a success.
-            echo "::error::MAC_CSC_LINK is set but APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD / APPLE_TEAM_ID are not — refusing to publish a signed but un-notarized dmg."
-            exit 1
-          fi
-          npx electron-builder --mac --arm64 --publish always
-
-  build-others:
+  build:
     strategy:
       fail-fast: false
       matrix:
@@ -83,39 +43,3 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_IDENTITY_AUTO_DISCOVERY: 'false'
         run: npx electron-builder ${{ matrix.args }} --publish always
-
-  bump-cask:
-    needs: build-mac
-    runs-on: ubuntu-latest
-    steps:
-      - name: Update Homebrew tap cask (skips if HOMEBREW_TAP_TOKEN not set)
-        env:
-          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [ -z "${TAP_TOKEN:-}" ]; then
-            echo "HOMEBREW_TAP_TOKEN not set — skipping cask bump. See homebrew-tap/README.md to enable the tap."
-            exit 0
-          fi
-          VERSION="${GITHUB_REF_NAME#v}"
-          BASE="https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}"
-          curl -fL "$BASE/claude-code-studio-${VERSION}-arm64.dmg" -o arm64.dmg
-          ARM_SHA="$(shasum -a 256 arm64.dmg | awk '{print $1}')"
-          git clone "https://x-access-token:${TAP_TOKEN}@github.com/${GITHUB_REPOSITORY_OWNER}/homebrew-claude-code-studio.git" tap
-          CASK="tap/Casks/claude-code-studio.rb"
-          sed -i -E "s/^  version \".*\"/  version \"${VERSION}\"/" "$CASK"
-          sed -i -E "s/^  sha256 \"[a-f0-9]{64}\"/  sha256 \"${ARM_SHA}\"/" "$CASK"
-          # sed exits 0 when its pattern matches nothing. A cask in any other shape
-          # (the old per-arch `sha256 arm:/intel:` stanza) would be pushed with the
-          # NEW version and the OLD checksum — every install then fails brew's sha
-          # check. Refuse instead of publishing that.
-          grep -q "^  version \"${VERSION}\"$" "$CASK" && grep -q "^  sha256 \"${ARM_SHA}\"$" "$CASK" || {
-            echo "::error::$CASK was not updated to ${VERSION} / ${ARM_SHA} — it must carry a single-arch \`sha256 \"…\"\` line."
-            exit 1
-          }
-          cd tap
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Casks/claude-code-studio.rb
-          git commit -m "chore: claude-code-studio ${VERSION}" || echo "cask unchanged"
-          git push
diff --git a/CLAUDE.md b/CLAUDE.md
index 09081cb6..a188ef54 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,7 +20,7 @@ docker compose up -d
 docker compose logs -f claude-chat
 ```
 
-No linting and no build step configured. `npm test` chains 85 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 66 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and a CI job that refuses a signed-but-unnotarized dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
+No linting and no build step configured. `npm test` chains 86 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 67 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
 
 ## Architecture
 
@@ -1035,14 +1035,17 @@ Developer ID signed, notarized, **arm64 only**. Pinned by `test/mac-signing.test
   (`utilityProcess`).
 - **Notarization is skipped silently, not failed.** electron-builder notarizes only
   after a successful signature and only with `APPLE_*` credentials in the env; otherwise
-  it logs `skipped macOS notarization` and publishes. The CI job therefore fails
-  outright when the certificate is set and the credentials are not.
+  it logs `skipped macOS notarization` and carries on — see the release bullet below.
 - **Local credentials live in the keychain** (a `notarytool` profile), named by
   `APPLE_KEYCHAIN_PROFILE` in the gitignored `electron-builder.env`. That file is also
   excluded from the bundle.
-- **No unsigned mac release, ever.** The app updates itself through `electron-updater`
-  (Squirrel.Mac), which refuses an update not signed by the same Developer ID. So the
-  CI mac leg FAILS without `MAC_CSC_LINK` instead of falling back to an unsigned build.
+- **macOS is released from the Mac, never from CI.** The certificate and the notarytool
+  profile exist only in that Mac's keychain, and an unsigned mac build would break every
+  installed copy (Squirrel.Mac refuses an update not signed by the same Developer ID).
+  `npm run release:mac` (`scripts/release-mac.js`) builds with `--publish never` and
+  uploads only after spctl says `Notarized Developer ID` — electron-builder skips
+  notarization SILENTLY when the profile is missing, so `--publish always` would have
+  published that build. `release-desktop.yml` builds Windows/Linux only.
 - **The in-app updater has three traps, all pinned by `test/update-flow.test.js`.**
   Squirrel closes every window BEFORE quitting, so `before-quit-for-update` must set
   `app.isQuiting` or close-to-tray cancels the quit and the update never lands. The
@@ -1064,7 +1067,7 @@ Developer ID signed, notarized, **arm64 only**. Pinned by `test/mac-signing.test
 
 ## How to Verify Changes
 
-`npm test` runs 85 test files under `test/` (19 `test/render/*.test.mjs` + 66 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
+`npm test` runs 86 test files under `test/` (19 `test/render/*.test.mjs` + 67 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
 
 ```bash
 # 1. Start server
diff --git a/docs/electron-desktop/MAC-SIGNING.md b/docs/electron-desktop/MAC-SIGNING.md
index 095fddf1..67cfc6d8 100644
--- a/docs/electron-desktop/MAC-SIGNING.md
+++ b/docs/electron-desktop/MAC-SIGNING.md
@@ -75,45 +75,44 @@ spctl -a -vvv -t exec "$APP"          # after notarization: source=Notarized Dev
 xcrun stapler validate "$APP"
 ```
 
-## CI (`.github/workflows/release-desktop.yml`, job `build-mac`)
+## Releasing macOS (`npm run release:mac`)
 
-Repository secrets:
+macOS is **not built in CI**. The Developer ID certificate and the notarytool
+profile live only in the release Mac's keychain, and a runner has neither — while an
+unsigned mac build would break every installed copy, because Squirrel.Mac refuses an
+update not signed by the same Developer ID. `release-desktop.yml` builds Windows and
+Linux only.
 
-| Secret | Value |
-|---|---|
-| `MAC_CSC_LINK` | the certificate **with its private key**, exported as `.p12` and base64-encoded |
-| `MAC_CSC_KEY_PASSWORD` | the password set on that `.p12` export |
-| `APPLE_ID` | the Apple ID email |
-| `APPLE_APP_SPECIFIC_PASSWORD` | the app-specific password |
-| `APPLE_TEAM_ID` | `BKZ6Y9W9MF` |
-
-Export the `.p12`: Keychain Access → login → My Certificates → "Developer ID
-Application: Ievgenii Muran (BKZ6Y9W9MF)" → right-click → Export → `.p12`, with a
-password. Then:
+A release is two commands:
 
 ```bash
-base64 -i DeveloperID.p12 | gh secret set MAC_CSC_LINK
-gh secret set MAC_CSC_KEY_PASSWORD
-gh secret set APPLE_ID
-gh secret set APPLE_APP_SPECIFIC_PASSWORD
-gh secret set APPLE_TEAM_ID --body BKZ6Y9W9MF
-rm DeveloperID.p12
+npm run release patch     # tag + push → release.yml creates the GitHub Release,
+                          #   release-desktop.yml builds Windows/Linux
+npm run release:mac       # on this Mac: build, verify, upload, bump the cask
 ```
 
-The secrets are `MAC_`-prefixed because electron-builder reads `CSC_LINK` on Windows
-too. The job maps them onto the names electron-builder expects.
-
-The job has three outcomes, and only one of them publishes:
-
-- **No `MAC_CSC_LINK`** → the job **fails**. There is no unsigned fallback any more:
-  every installed copy updates through Squirrel.Mac, which refuses an update not
-  signed by the same Developer ID, and Gatekeeper blocks an unsigned dmg for every
-  new user. An unsigned release is a broken release.
-- **`MAC_CSC_LINK` but an incomplete `APPLE_*` set** → the job **fails**. Publishing a
-  signed but un-notarized dmg would look like success and behave like an unsigned
-  one.
-- **All five** → signed, notarized, stapled, published, together with the
-  `latest-mac.yml` the in-app updater reads.
+`scripts/release-mac.js`, in this order (pinned by `test/release-mac.test.js`):
+
+1. **Preflight.** HEAD is the tag `v<package.json version>`, the tree is clean, and
+   origin's tag points at the same commit (a moved local tag would build one commit and
+   publish it under another); the notarytool profile named by `APPLE_KEYCHAIN_PROFILE`
+   works; the GitHub Release exists and is not a draft (it waits up to 3 min for
+   `release.yml`).
+2. **`electron-builder --mac --publish never`.** Never `--publish always`: electron-builder
+   SKIPS notarization with one log line and exit 0 when the credentials are missing,
+   and that dmg would already be on the release.
+3. **Verify.** `codesign --verify --deep --strict`; `spctl` must exit 0 and say
+   `Notarized Developer ID` for the app AND for the app inside the mounted dmg, and both
+   must carry the tag's version; `stapler validate`; `latest-mac.yml` must name this
+   version's zip in `path:` and carry the actual sha512 of the zip and the dmg —
+   electron-updater checks the download against it, so a stale file breaks every
+   update.
+4. **Upload** with `gh release upload`: the dmg, the zip, both blockmaps and
+   `latest-mac.yml`. Mac assets already on the release are refused unless `--force`. If
+   the upload stops part-way, it says which files are on the release and which are not.
+5. **Bump the Homebrew cask** (transitional, below) — with the dmg's sha256 only after
+   it matches the `digest` GitHub reports for the uploaded asset. If only this step
+   fails, `npm run release:mac -- --cask-only` redoes it.
 
 ## In-app updates
 
@@ -158,11 +157,11 @@ exists now only so installs from before the signed release can reach it: their u
 button runs `brew upgrade --cask claude-code-studio`. Once they are on the new version
 the app updates itself and brew plays no part.
 
-- **One checksum line**, `sha256 "<hex>"`, plus `depends_on arch: :arm64`. The
-  `bump-cask` job rewrites `version` and that line, then **checks that both rewrites
-  happened**. `sed` exits 0 when its pattern matches nothing, so a cask still in the
-  old per-arch shape (`sha256 arm: …, intel: …`) would otherwise be pushed with the new
-  version and the old checksum, and every `brew install` would fail its sha check.
+- **One checksum line**, `sha256 "<hex>"`, plus `depends_on arch: :arm64`.
+  `release-mac.js` (`rewriteCask`) rewrites `version` and that line and **refuses** a
+  cask in any other shape: a regex that matches nothing leaves the old checksum in
+  place, and a cask with the new version and the old checksum fails every
+  `brew install`.
 - **`auto_updates false` stays for the transition.** With `true`, a plain `brew upgrade`
   skips the cask, and some of the installs this cask exists for update exactly that
   way. (An explicitly named `brew upgrade --cask claude-code-studio`, which is what the
@@ -177,8 +176,9 @@ the app updates itself and brew plays no part.
 
 1. In the tap, add `disable! date: "<today>", because: "is distributed as a signed .dmg that updates itself"`
    to the cask. brew then prints that reason instead of a missing-tap error.
-2. Remove the `bump-cask` job from `release-desktop.yml` and `homebrew-tap/README.md`
-   from this repo, and drop the bump-cask check from `test/mac-signing.test.js`.
+2. Remove `bumpCask()` and `--cask-only` from `scripts/release-mac.js` (and their checks
+   in `test/release-mac.test.js`), and `homebrew-tap/README.md` from this repo. The
+   `HOMEBREW_TAP_TOKEN` repo secret is already unused and can be deleted.
 
 ## Intel users already installed
 
diff --git a/homebrew-tap/README.md b/homebrew-tap/README.md
index a137face..9ac5ce4a 100644
--- a/homebrew-tap/README.md
+++ b/homebrew-tap/README.md
@@ -16,11 +16,9 @@ Apple Silicon only (Intel dropped in September 2026). Signing and notarization:
 [Claude Code CLI](https://docs.anthropic.com/en/claude-code) installed and logged in.
 
 - **Tap repo (cask source of truth):** https://github.com/Lexus2016/homebrew-claude-code-studio
-- **Auto-bump:** the `bump-cask` job in
-  [`.github/workflows/release-desktop.yml`](../.github/workflows/release-desktop.yml) updates the
-  tap's cask `version` + `sha256` (arm64 dmg) on every release, using the repo secret
-  `HOMEBREW_TAP_TOKEN`. If that secret is removed, the job skips cleanly (the release never fails)
-  and you bump the cask manually in the tap repo.
+- **Bump:** `npm run release:mac` (`scripts/release-mac.js`) rewrites the tap's cask
+  `version` + `sha256` from the dmg it has just verified and uploaded. The macOS build is
+  not made in CI, so neither is the bump.
 
 Versions before the signed release update by running `brew upgrade --cask claude-code-studio`; later ones update themselves.
 
diff --git a/package.json b/package.json
index a7979a74..be7a51cb 100644
--- a/package.json
+++ b/package.json
@@ -8,9 +8,10 @@
   "scripts": {
     "start": "node server.js",
     "dev": "node --watch server.js",
-    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/worktree-manager.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/mac-signing.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/responsive-ui.test.js && node test/kanban-delegation.test.js && node test/kanban-group-button.test.js && node test/terminal-keys.test.js",
+    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/worktree-manager.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/mac-signing.test.js && node test/release-mac.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/responsive-ui.test.js && node test/kanban-delegation.test.js && node test/kanban-group-button.test.js && node test/terminal-keys.test.js",
     "postinstall": "node scripts/install-hooks.js",
     "release": "node scripts/release.js",
+    "release:mac": "node scripts/release-mac.js",
     "electron:dev": "electron .",
     "electron:smoke": "electron electron/smoke.js",
     "dist:mac": "electron-builder --mac",
diff --git a/scripts/release-mac.js b/scripts/release-mac.js
new file mode 100644
index 00000000..d094bc72
--- /dev/null
+++ b/scripts/release-mac.js
@@ -0,0 +1,310 @@
+#!/usr/bin/env node
+/**
+ * scripts/release-mac.js — build, verify and publish the macOS release from this Mac
+ *
+ * Usage (after `npm run release …` has pushed the tag):
+ *   npm run release:mac              build, verify, upload, bump the Homebrew cask
+ *   npm run release:mac -- --force   overwrite mac assets already on the release
+ *   npm run release:mac -- --cask-only   redo only the cask step (the dmg is on the release)
+ *
+ * The macOS build needs the Developer ID certificate and the notarytool keychain
+ * profile, and both live only in this Mac's keychain — so it is not built in CI.
+ * docs/electron-desktop/MAC-SIGNING.md has the one-time setup.
+ *
+ * What it does, in this order:
+ *   1. Preflight: HEAD is the tag v<package.json version>, the tree is clean, the
+ *      notarytool profile works, the GitHub Release exists (release.yml creates it).
+ *   2. electron-builder --mac --publish never — signs and notarizes.
+ *   3. Verify: codesign, spctl "Notarized Developer ID" on the app AND on the app
+ *      inside the dmg, stapler, the bundle version, latest-mac.yml.
+ *   4. gh release upload — only now, and only what was verified.
+ *   5. Transitional (retire ~2026-10-28): bump the Homebrew cask.
+ *
+ * Why the build never publishes by itself: electron-builder SKIPS notarization — one
+ * log line, exit 0 — when the credentials are missing, and `--publish always` would
+ * already have put that dmg on the release. Pinned by test/release-mac.test.js.
+ */
+
+'use strict';
+
+const { execFileSync, spawnSync } = require('child_process');
+const fs   = require('fs');
+const os   = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const DIST = path.join(ROOT, 'dist-desktop');
+const REPO = 'Lexus2016/claude-code-studio';
+const TAP  = 'Lexus2016/homebrew-claude-code-studio';
+const CASK = 'Casks/claude-code-studio.rb';
+
+// ── Pure helpers (exported for the test) ──────────────────────────────────────
+
+// electron-builder.yml, mac: artifactName "claude-code-studio-${version}-${arch}.${ext}".
+function macArtifacts(version) {
+  const base = `claude-code-studio-${version}-arm64`;
+  return [`${base}.dmg`, `${base}.dmg.blockmap`, `${base}.zip`, `${base}.zip.blockmap`, 'latest-mac.yml'];
+}
+
+// latest-mac.yml is what every installed copy reads, and electron-updater checks the
+// downloaded zip against its sha512. So it must describe the very files being uploaded
+// — a stale one, or one whose checksum is another build's, breaks every update.
+// `digests` maps file name → base64 sha512 of the file on disk.
+function latestMacProblem(yml, version, digests) {
+  const text = String(yml || '');
+  const v = /^version:\s*(\S+)\s*$/m.exec(text);
+  if (!v || v[1] !== version) return `latest-mac.yml is for ${v ? v[1] : 'no version'}, not ${version}`;
+  const zip = `claude-code-studio-${version}-arm64.zip`;
+  const p = /^path:\s*(\S+)\s*$/m.exec(text);
+  if (!p || p[1] !== zip) return `latest-mac.yml path: is ${p ? p[1] : 'missing'}, not ${zip}`;
+  for (const [name, sha] of Object.entries(digests || {})) {
+    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const e = new RegExp(`^\\s*- url:\\s*${esc}\\s*\\n\\s*sha512:\\s*(\\S+)`, 'm').exec(text);
+    if (!e) return `latest-mac.yml has no entry for ${name}`;
+    if (e[1] !== sha) return `latest-mac.yml sha512 for ${name} is not the file being uploaded`;
+  }
+  return null;
+}
+
+function isNotarized(spctlOutput, exitCode) {
+  const s = String(spctlOutput || '');
+  return exitCode === 0 && /: accepted$/m.test(s) && /^source=Notarized Developer ID$/m.test(s);
+}
+
+// `git ls-remote origin refs/tags/<tag>*`: an annotated tag lists its own object and,
+// as `<tag>^{}`, the commit it points at — that commit is what must match HEAD.
+function remoteTagCommit(lsRemote, tag) {
+  const rows = String(lsRemote || '').split('\n').map((l) => l.split('\t'));
+  const peeled = rows.find((r) => r[1] === `refs/tags/${tag}^{}`);
+  const plain = rows.find((r) => r[1] === `refs/tags/${tag}`);
+  return (peeled || plain || [null])[0] || null;
+}
+
+function tagProblem({ version, headTags, dirty, headCommit, remoteTagCommit: remote }) {
+  const tag = `v${version}`;
+  if (String(dirty || '').trim()) return `the working tree is not clean:\n${dirty}`;
+  if (!(headTags || []).includes(tag)) return `HEAD is not the tag ${tag} — check it out first (git checkout ${tag})`;
+  if (!remote) return `the tag ${tag} is not on origin — push it first (npm run release does)`;
+  if (remote !== headCommit) return `the local tag ${tag} is ${headCommit}, origin's is ${remote} — this would build one commit and publish it under another`;
+  return null;
+}
+
+// The checksum GitHub itself reports for a release asset ("sha256:<hex>").
+function assetDigest(assets, name) {
+  const a = (assets || []).find((x) => x.name === name);
+  const m = a && /^sha256:([a-f0-9]{64})$/.exec(String(a.digest || ''));
+  return m ? m[1] : null;
+}
+
+// The environment wins, then electron-builder.env — the same order electron-builder
+// itself uses (dotenv never overrides a variable that is already set).
+function keychainProfile(envFileText, env) {
+  if (env && env.APPLE_KEYCHAIN_PROFILE) return env.APPLE_KEYCHAIN_PROFILE;
+  const m = /^\s*APPLE_KEYCHAIN_PROFILE\s*=\s*(\S+)\s*$/m.exec(String(envFileText || ''));
+  return m ? m[1] : null;
+}
+
+// sed-style rewriting exits happily when nothing matched; this refuses instead, so a
+// cask in any other shape is never pushed with the new version and the old checksum.
+function rewriteCask(rb, version, sha) {
+  if (!/^[a-f0-9]{64}$/.test(String(sha))) throw new Error(`not a sha256: ${sha}`);
+  // Exactly one of each: with two, only the first would be rewritten.
+  const versionRe = /^  version "[^"]*"$/gm;
+  const shaRe = /^  sha256 "[a-f0-9]{64}"$/gm;
+  if ((String(rb).match(versionRe) || []).length !== 1) throw new Error('cask must have exactly one `  version "…"` line');
+  if ((String(rb).match(shaRe) || []).length !== 1) throw new Error('cask must have exactly one single-arch `  sha256 "…"` line');
+  return rb.replace(versionRe, `  version "${version}"`).replace(shaRe, `  sha256 "${sha}"`);
+}
+
+// ── Side effects ──────────────────────────────────────────────────────────────
+
+// Every short command gets a timeout, so a stalled network call ends the run instead
+// of hanging it. The build does not: notarization legitimately takes many minutes, and
+// its output is on screen.
+const SHORT = 10 * 60 * 1000;
+function sh(cmd, args, opts = {}) {
+  return String(execFileSync(cmd, args, { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: SHORT, ...opts }));
+}
+// spctl and stapler report on stderr; merge both so the verdict can be read.
+function shAll(cmd, args) {
+  const r = spawnSync(cmd, args, { cwd: ROOT, encoding: 'utf8', timeout: SHORT });
+  return { code: r.status, out: `${r.stdout || ''}${r.stderr || ''}` };
+}
+function releaseAssets(tag) {
+  return JSON.parse(sh('gh', ['release', 'view', tag, '--repo', REPO, '--json', 'assets'])).assets;
+}
+function fileDigest(file, algo, enc) {
+  return require('crypto').createHash(algo).update(fs.readFileSync(file)).digest(enc);
+}
+function step(msg) { console.log(`\n▸ ${msg}`); }
+function die(msg) { console.error(`\n⛔ ${msg}\n`); process.exit(1); }
+
+function productName() {
+  const m = /^productName:\s*(.+)$/m.exec(fs.readFileSync(path.join(ROOT, 'electron-builder.yml'), 'utf8'));
+  return m ? m[1].trim() : 'Claude Code Studio';
+}
+
+function preflight(version) {
+  step('Preflight');
+  const tag = `v${version}`;
+  const problem = tagProblem({
+    version,
+    headTags: sh('git', ['tag', '--points-at', 'HEAD']).split('\n').map((s) => s.trim()).filter(Boolean),
+    dirty: sh('git', ['status', '--porcelain']).trim(),
+    headCommit: sh('git', ['rev-parse', 'HEAD']).trim(),
+    remoteTagCommit: remoteTagCommit(sh('git', ['ls-remote', 'origin', `refs/tags/${tag}*`]), tag),
+  });
+  if (problem) die(problem);
+  console.log(`  ✓ HEAD = ${tag} = origin's ${tag}`);
+
+  const envFile = path.join(ROOT, 'electron-builder.env');
+  const profile = keychainProfile(fs.existsSync(envFile) ? fs.readFileSync(envFile, 'utf8') : '', process.env);
+  if (!profile) die('no notarytool keychain profile — put APPLE_KEYCHAIN_PROFILE=<name> in electron-builder.env (see docs/electron-desktop/MAC-SIGNING.md)');
+  const hist = shAll('xcrun', ['notarytool', 'history', '--keychain-profile', profile]);
+  if (hist.code !== 0) die(`notarytool profile "${profile}" does not work:\n${hist.out.trim()}`);
+  console.log(`  ✓ notarytool profile "${profile}"`);
+
+  // release.yml creates the release a minute or so after the tag lands.
+  let view;
+  for (let i = 0; ; i++) {
+    view = shAll('gh', ['release', 'view', tag, '--repo', REPO, '--json', 'isDraft']);
+    if (view.code === 0) break;
+    if (i >= 36) die(`GitHub Release ${tag} does not exist — did release.yml run for the tag?`);
+    if (i === 0) console.log(`  … waiting for GitHub Release ${tag}`);
+    spawnSync('sleep', ['5']);
+  }
+  // A draft's download URLs are not public: the cask and every updater would 404.
+  if (JSON.parse(view.out).isDraft) die(`GitHub Release ${tag} is a draft — publish it first`);
+  console.log(`  ✓ GitHub Release ${tag}`);
+}
+
+function build() {
+  step('electron-builder --mac --publish never');
+  // Anything left from an earlier build must not be mistaken for this one.
+  fs.rmSync(path.join(DIST, 'latest-mac.yml'), { force: true });
+  const r = spawnSync('npx', ['electron-builder', '--mac', '--publish', 'never'], { cwd: ROOT, stdio: 'inherit' });
+  if (r.status !== 0) die('electron-builder failed');
+}
+
+function verifyNotarized(version) {
+  step('Verify signature and notarization');
+  const app = path.join(DIST, 'mac-arm64', `${productName()}.app`);
+  if (!fs.existsSync(app)) die(`no ${app}`);
+
+  const bundleVersion = sh('defaults', ['read', path.join(app, 'Contents', 'Info.plist'), 'CFBundleShortVersionString']).trim();
+  if (bundleVersion !== version) die(`the built app is ${bundleVersion}, not ${version}`);
+
+  const cs = shAll('codesign', ['--verify', '--deep', '--strict', app]);
+  if (cs.code !== 0) die(`codesign --verify failed:\n${cs.out}`);
+  const sp = shAll('spctl', ['-a', '-vvv', '-t', 'exec', app]);
+  if (!isNotarized(sp.out, sp.code)) die(`the app is not notarized — electron-builder skips notarization silently when the profile is missing:\n${sp.out}`);
+  const st = shAll('xcrun', ['stapler', 'validate', app]);
+  if (st.code !== 0) die(`no stapled ticket:\n${st.out}`);
+  console.log('  ✓ app: signed, notarized, stapled');
+
+  // The dmg is what people download; check the app inside it, not only the one on disk.
+  const dmg = path.join(DIST, macArtifacts(version)[0]);
+  const attach = shAll('hdiutil', ['attach', '-nobrowse', '-readonly', '-noautoopen', dmg]);
+  const mount = ((/\t(\/Volumes\/.+)$/m.exec(attach.out) || [])[1] || '').trim();
+  if (attach.code !== 0 || !mount) die(`cannot mount ${dmg}:\n${attach.out}`);
+  // Decide first, detach, then die: die() exits the process, which would skip a
+  // `finally` and leave the image mounted.
+  let problem = null;
+  try {
+    const inner = path.join(mount, `${productName()}.app`);
+    const innerVersion = shAll('defaults', ['read', path.join(inner, 'Contents', 'Info.plist'), 'CFBundleShortVersionString']).out.trim();
+    const sp2 = shAll('spctl', ['-a', '-vvv', '-t', 'exec', inner]);
+    if (innerVersion !== version) problem = `the app inside the dmg is ${innerVersion}, not ${version}`;
+    else if (!isNotarized(sp2.out, sp2.code)) problem = `the app inside the dmg is not notarized:\n${sp2.out}`;
+  } finally {
+    shAll('hdiutil', ['detach', mount, '-quiet']);
+  }
+  if (problem) die(problem);
+  console.log(`  ✓ dmg: the app inside is ${version} and notarized`);
+}
+
+function uploadAssets(tag, files, force) {
+  step(`Upload to GitHub Release ${tag}`);
+  const names = files.map((f) => path.basename(f));
+  const existing = releaseAssets(tag).map((a) => a.name);
+  const clash = names.filter((n) => existing.includes(n));
+  if (clash.length && !force) die(`the release already has ${clash.join(', ')} — rerun with --force to replace them`);
+  const r = spawnSync('gh', ['release', 'upload', tag, ...files, '--repo', REPO, ...(force ? ['--clobber'] : [])], { cwd: ROOT, stdio: 'inherit', timeout: 60 * 60 * 1000 });
+  const after = releaseAssets(tag);
+  // gh uploads one file at a time; a failure part-way leaves the release mixed.
+  const wrong = names.filter((n) => {
+    const a = after.find((x) => x.name === n);
+    return !a || a.size !== fs.statSync(path.join(DIST, n)).size;
+  });
+  if (r.status !== 0 || wrong.length) {
+    die(`the upload did not complete — the release now has ${names.filter((n) => !wrong.includes(n)).join(', ') || 'none of the files'}; missing or different: ${wrong.join(', ')}.\n   Rerun with: npm run release:mac -- --force`);
+  }
+  console.log(`  ✓ ${files.length} files on the release`);
+}
+
+// Transitional: the cask exists only so installs from before the signed release —
+// whose update button runs `brew upgrade --cask` — can reach it. Retire ~2026-10-28
+// together with this step (docs/electron-desktop/MAC-SIGNING.md).
+function bumpCask(version, dmgPath) {
+  step('Bump the Homebrew cask (transitional)');
+  const sha = fileDigest(dmgPath, 'sha256', 'hex');
+  // The cask must carry the checksum of what GitHub serves, not of whatever file with
+  // that name is on disk now (--cask-only runs after the upload, possibly much later).
+  const served = assetDigest(releaseAssets(`v${version}`), path.basename(dmgPath));
+  if (!served) throw new Error(`GitHub reports no sha256 for ${path.basename(dmgPath)} on v${version}`);
+  if (served !== sha) throw new Error(`${path.basename(dmgPath)} on disk is not the one on the release (${sha.slice(0, 12)}… vs ${served.slice(0, 12)}…)`);
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-tap-'));
+  try {
+    sh('git', ['clone', '-q', `https://github.com/${TAP}.git`, dir]);
+    const file = path.join(dir, CASK);
+    const before = fs.readFileSync(file, 'utf8');
+    const after = rewriteCask(before, version, sha);
+    if (after === before) { console.log('  ✓ cask already at this version and checksum'); return; }
+    fs.writeFileSync(file, after);
+    const who = ['-c', `user.name=${sh('git', ['config', 'user.name']).trim()}`, '-c', `user.email=${sh('git', ['config', 'user.email']).trim()}`];
+    sh('git', [...who, 'commit', '-q', '-am', `chore: claude-code-studio ${version}`], { cwd: dir });
+    sh('git', ['push', '-q', 'origin', 'HEAD'], { cwd: dir });
+    console.log(`  ✓ cask → ${version} (${sha.slice(0, 12)}…)`);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function main() {
+  if (process.platform !== 'darwin') die('the macOS release is built on macOS');
+  const args = process.argv.slice(2);
+  const force = args.includes('--force');
+  const version = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')).version;
+  const tag = `v${version}`;
+  const files = macArtifacts(version).map((f) => path.join(DIST, f));
+  console.log(`\n🍎 macOS release ${tag}`);
+
+  if (args.includes('--cask-only')) {
+    if (!fs.existsSync(files[0])) die(`no ${files[0]} — the cask checksum is computed from the uploaded dmg`);
+    try { bumpCask(version, files[0]); } catch (e) { die(e.message); }
+    return;
+  }
+
+  preflight(version);
+  build();
+  verifyNotarized(version);
+  for (const f of files) if (!fs.existsSync(f)) die(`missing ${f}`);
+  const [dmg, , zip] = files;
+  const problem = latestMacProblem(fs.readFileSync(path.join(DIST, 'latest-mac.yml'), 'utf8'), version, {
+    [path.basename(zip)]: fileDigest(zip, 'sha512', 'base64'),
+    [path.basename(dmg)]: fileDigest(dmg, 'sha512', 'base64'),
+  });
+  if (problem) die(problem);
+  console.log('  ✓ latest-mac.yml describes exactly these files');
+  uploadAssets(tag, files, force);
+  try {
+    bumpCask(version, files[0]);
+  } catch (e) {
+    die(`the release is published, but the cask bump failed: ${e.message}\n   Retry with: npm run release:mac -- --cask-only`);
+  }
+  console.log(`\n✅ macOS ${tag} is on https://github.com/${REPO}/releases/tag/${tag}\n`);
+}
+
+module.exports = { macArtifacts, latestMacProblem, isNotarized, remoteTagCommit, tagProblem, assetDigest, keychainProfile, rewriteCask, verifyNotarized };
+
+if (require.main === module) main().catch((e) => die(e.stack || e.message));
diff --git a/scripts/release.js b/scripts/release.js
index 2b73af33..4b66acb9 100644
--- a/scripts/release.js
+++ b/scripts/release.js
@@ -98,3 +98,7 @@ run(`git push origin ${tag}`);
 
 console.log(`\n✅ Done! GitHub Actions will create the release automatically.`);
 console.log(`   https://github.com/Lexus2016/claude-code-studio/releases/tag/${tag}\n`);
+// CI builds Windows/Linux only; macOS needs the Developer ID certificate and the
+// notarytool profile from this Mac's keychain (docs/electron-desktop/MAC-SIGNING.md).
+console.log(`🍎 macOS is not built by CI. On the Mac with the Developer ID certificate run:`);
+console.log(`   npm run release:mac\n`);
diff --git a/test/mac-signing.test.js b/test/mac-signing.test.js
index 03041011..40c32f32 100644
--- a/test/mac-signing.test.js
+++ b/test/mac-signing.test.js
@@ -8,11 +8,11 @@
 //   responsible process) under the hardened runtime. Without
 //   `com.apple.security.automation.apple-events` they are refused (-1743) with no
 //   prompt — "Open in Terminal" silently does nothing.
-// - electron-builder signs, logs "skipped macOS notarization" and publishes when
-//   the certificate is present but the APPLE_* credentials are not. Gatekeeper
-//   rejects that dmg exactly like an unsigned one.
-// - The tap bump rewrites the cask with `sed`, which exits 0 when nothing matched:
-//   a new version with the old checksum, and every `brew install` fails.
+// - A CI runner has neither the Developer ID certificate nor the notarytool
+//   profile. A mac leg there published an UNSIGNED build, and the app updates itself
+//   through Squirrel.Mac, which refuses an update not signed by the same Developer
+//   ID. macOS is released from the Mac that holds both (scripts/release-mac.js,
+//   pinned by test/release-mac.test.js), so CI must not build it at all.
 //
 // See docs/electron-desktop/MAC-SIGNING.md. Run: node test/mac-signing.test.js
 'use strict';
@@ -37,12 +37,6 @@ function yamlBlock(src, name) {
   assert.ok(m, `no top-level "${name}:" block`);
   return m[1];
 }
-// A job inside the workflow: from `  <job>:` to the next job at the same indent.
-function job(name) {
-  const m = new RegExp(`^  ${name}:\\n([\\s\\S]*?)(?=^  [a-z][\\w-]*:\\n|(?![\\s\\S]))`, 'm').exec(WF);
-  assert.ok(m, `no job "${name}" in release-desktop.yml`);
-  return m[1];
-}
 const MAC = yamlBlock(YML, 'mac');
 const macKey = (k) => { const m = new RegExp(`^  ${k}:\\s*(.*)$`, 'm').exec(MAC); return m && m[1].replace(/^"|"$/g, '').trim(); };
 
@@ -80,51 +74,32 @@ check('mac targets are arm64 only', () => {
   assert.ok(arches.length >= 2, `expected an arch on every mac target, got ${JSON.stringify(arches)}`);
   assert.deepStrictEqual([...new Set(arches)], ['arm64']);
 });
-check('the CI mac build asks for arm64 and nothing else', () => {
-  const run = /npx electron-builder --mac[^\n]*/.exec(job('build-mac'));
-  assert.ok(run, 'no electron-builder --mac invocation in build-mac');
-  assert.ok(/--arm64\b/.test(run[0]) && !/--x64\b|--universal\b/.test(run[0]), run[0]);
+check('npm run release:mac builds the mac target this config pins', () => {
+  const pkg = JSON.parse(read('package.json'));
+  assert.strictEqual(pkg.scripts['release:mac'], 'node scripts/release-mac.js');
+  assert.ok(/\['electron-builder', '--mac', '--publish', 'never'\]/.test(read('scripts/release-mac.js')));
 });
 
-// ── 3. CI signing: credentials in, half-configured refused ───────────────────
-check('build-mac maps the MAC_CSC_* and APPLE_* secrets into electron-builder\'s env', () => {
-  const j = job('build-mac');
-  for (const [env, secret] of [
-    ['CSC_LINK', 'MAC_CSC_LINK'], ['CSC_KEY_PASSWORD', 'MAC_CSC_KEY_PASSWORD'],
-    ['APPLE_ID', 'APPLE_ID'], ['APPLE_APP_SPECIFIC_PASSWORD', 'APPLE_APP_SPECIFIC_PASSWORD'],
-    ['APPLE_TEAM_ID', 'APPLE_TEAM_ID'],
-  ]) {
-    assert.ok(new RegExp(`^\\s+${env}: \\$\\{\\{ secrets\\.${secret} \\}\\}$`, 'm').test(j), `${env} ← secrets.${secret}`);
-  }
+// ── 3. CI does not build macOS ───────────────────────────────────────────────
+// Code only: the header comment explains why, and names what it does not do.
+const WF_CODE = WF.split('\n').filter(l => !/^\s*#/.test(l)).join('\n');
+check('release-desktop.yml has no macOS leg', () => {
+  assert.ok(!/macos-/.test(WF_CODE), 'a macOS runner is still used');
+  assert.ok(!/--mac\b/.test(WF_CODE), 'electron-builder --mac is still run');
 });
-check('build-mac never switches signing off', () => {
-  // Squirrel.Mac (the in-app updater) refuses an update not signed by the same
-  // Developer ID, so an unsigned mac release is a broken release, not a fallback.
-  assert.ok(!/CSC_IDENTITY_AUTO_DISCOVERY/.test(job('build-mac')));
+check('...and carries no Apple signing secrets', () => {
+  assert.ok(!/MAC_CSC|APPLE_ID|APPLE_APP_SPECIFIC_PASSWORD|APPLE_TEAM_ID|CSC_LINK/.test(WF_CODE));
 });
-// The two guards, as the job's own shell runs them — before the build, both exit 1.
-function guard(re, what) {
-  const j = job('build-mac');
-  const g = re.exec(j);
-  assert.ok(g, `no ${what} guard`);
-  assert.ok(/exit 1/.test(g[0]), `${what} guard does not fail the job`);
-  assert.ok(j.indexOf(g[0]) < j.indexOf('npx electron-builder --mac'), `${what} guard must run before the build`);
-}
-check('no certificate fails the job', () =>
-  guard(/if \[ -z "\$\{CSC_LINK:-\}" \]; then[\s\S]*?\n\s*fi\n/, 'missing-certificate'));
-check('a certificate without notarization credentials fails the job', () =>
-  guard(/if[^\n]*APPLE_ID[^\n]*APPLE_APP_SPECIFIC_PASSWORD[^\n]*APPLE_TEAM_ID[\s\S]*?\n\s*fi\n/, 'partial-credentials'));
-
-// ── 4. tap bump ──────────────────────────────────────────────────────────────
-check('bump-cask fetches only the arm64 dmg and verifies what sed wrote', () => {
-  // Comment lines dropped: the one explaining the check names the old `intel:` stanza.
-  const j = job('bump-cask').split('\n').filter(l => !/^\s*#/.test(l)).join('\n');
-  assert.ok(/-arm64\.dmg/.test(j), 'arm64 dmg not fetched');
-  assert.ok(!/x64\.dmg|intel:/.test(j), 'still references the Intel build');
-  assert.ok(/grep -q "\^  sha256 \\"\$\{ARM_SHA\}\\"\$"/.test(j), 'no post-sed checksum verification');
+check('...and no cask bump (release-mac.js does it from the verified dmg)', () => {
+  assert.ok(!/bump-cask|HOMEBREW_TAP_TOKEN|homebrew-claude-code-studio/.test(WF_CODE));
+});
+check('Windows and Linux are still built and published there', () => {
+  assert.ok(/os: windows-latest[\s\S]*?args: "--win"/.test(WF_CODE));
+  assert.ok(/os: ubuntu-latest[\s\S]*?args: "--linux"/.test(WF_CODE));
+  assert.ok(/electron-builder \$\{\{ matrix\.args \}\} --publish always/.test(WF_CODE));
 });
 
-// ── 5. local settings never ship or get committed ────────────────────────────
+// ── 4. local settings never ship or get committed ────────────────────────────
 check('electron-builder.env is excluded from the bundle and from git', () => {
   assert.ok(/^\s+- "!electron-builder\.env"$/m.test(YML), 'not in the files: exclusions');
   assert.ok(/^electron-builder\.env$/m.test(read('.gitignore')), 'not in .gitignore');
diff --git a/test/release-mac.test.js b/test/release-mac.test.js
new file mode 100644
index 00000000..ec49e8b6
--- /dev/null
+++ b/test/release-mac.test.js
@@ -0,0 +1,177 @@
+// scripts/release-mac.js — the macOS release is built, verified and published from the
+// Mac that holds the Developer ID certificate (docs/electron-desktop/MAC-SIGNING.md).
+//
+// What this file pins is the order and the refusals, because every failure here
+// publishes something that looks fine and is not:
+//
+// - electron-builder SKIPS notarization — one log line, exit 0 — when the keychain
+//   profile is missing. With `--publish always` that dmg would already be on the
+//   release. So the build runs with `--publish never`, and nothing is uploaded until
+//   spctl says "Notarized Developer ID" about the app AND about the app inside the dmg.
+// - A stale latest-mac.yml in dist-desktop/ (from another version) would point every
+//   installed app at the wrong zip. It is checked against the version being released.
+// - The Homebrew cask is rewritten with regexes; a cask in another shape would be
+//   pushed with the new version and the old checksum. rewriteCask() refuses instead.
+//
+// Run: node test/release-mac.test.js
+'use strict';
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+let pass = 0, fail = 0;
+function check(label, fn) {
+  try { fn(); pass++; console.log(`  ok   ${label}`); }
+  catch (e) { fail++; console.error(`  FAIL ${label} — ${e.message}`); }
+}
+
+const ROOT = path.join(__dirname, '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'scripts', 'release-mac.js'), 'utf8');
+const R = require('../scripts/release-mac.js');
+
+// ── artefacts ────────────────────────────────────────────────────────────────
+console.log('\nartefacts:');
+check('the five files electron-builder writes for one arm64 mac build', () => {
+  assert.deepStrictEqual(R.macArtifacts('7.18.0'), [
+    'claude-code-studio-7.18.0-arm64.dmg',
+    'claude-code-studio-7.18.0-arm64.dmg.blockmap',
+    'claude-code-studio-7.18.0-arm64.zip',
+    'claude-code-studio-7.18.0-arm64.zip.blockmap',
+    'latest-mac.yml',
+  ]);
+});
+check('...named by the same pattern electron-builder.yml gives the mac target', () => {
+  const yml = fs.readFileSync(path.join(ROOT, 'electron-builder.yml'), 'utf8');
+  const mac = /^mac:\n((?:(?:[ #].*)?\n)*)/m.exec(yml)[1];
+  assert.ok(/artifactName: "claude-code-studio-\$\{version\}-\$\{arch\}\.\$\{ext\}"/.test(mac));
+});
+
+// ── latest-mac.yml ───────────────────────────────────────────────────────────
+// electron-updater verifies the zip against the sha512 in this file, so it must
+// describe the very files being uploaded — not just mention their names.
+console.log('\nlatest-mac.yml:');
+const Z = 'claude-code-studio-7.18.0-arm64.zip', D = 'claude-code-studio-7.18.0-arm64.dmg';
+const YML = (v, zipSha, dmgSha, pathName) => `version: ${v}\nfiles:\n  - url: claude-code-studio-${v}-arm64.zip\n    sha512: ${zipSha}\n    size: 1\n  - url: claude-code-studio-${v}-arm64.dmg\n    sha512: ${dmgSha}\n    size: 2\npath: ${pathName || `claude-code-studio-${v}-arm64.zip`}\nsha512: ${zipSha}\n`;
+const DIG = { [Z]: 'zzz+/=', [D]: 'ddd+/=' };
+check('accepts the file that describes exactly these zip and dmg', () =>
+  assert.strictEqual(R.latestMacProblem(YML('7.18.0', 'zzz+/=', 'ddd+/='), '7.18.0', DIG), null));
+check('refuses one left over from another version', () =>
+  assert.ok(R.latestMacProblem(YML('7.17.0', 'zzz+/=', 'ddd+/='), '7.18.0', DIG)));
+check('refuses a checksum that is not the zip being uploaded', () =>
+  assert.ok(/sha512/.test(R.latestMacProblem(YML('7.18.0', 'OLD', 'ddd+/='), '7.18.0', DIG))));
+check('refuses a checksum that is not the dmg being uploaded', () =>
+  assert.ok(/sha512/.test(R.latestMacProblem(YML('7.18.0', 'zzz+/=', 'OLD'), '7.18.0', DIG))));
+check('refuses a `path:` that points at another zip, even if the name appears elsewhere', () =>
+  assert.ok(R.latestMacProblem(`# ${Z}\n` + YML('7.18.0', 'zzz+/=', 'ddd+/=', 'claude-code-studio-7.17.0-arm64.zip'), '7.18.0', DIG)));
+check('refuses one with no entry for a file', () =>
+  assert.ok(R.latestMacProblem(`version: 7.18.0\npath: ${Z}\nfiles:\n  - url: ${Z}\n    sha512: zzz+/=\n`, '7.18.0', DIG)));
+
+// ── notarization verdict ─────────────────────────────────────────────────────
+console.log('\nspctl verdict:');
+const OK = 'x.app: accepted\nsource=Notarized Developer ID\norigin=Developer ID Application: Ievgenii Muran (BKZ6Y9W9MF)\n';
+check('a notarized app passes', () => assert.strictEqual(R.isNotarized(OK, 0), true));
+check('...but not when spctl itself exited non-zero', () => assert.strictEqual(R.isNotarized(OK, 3), false));
+check('signed but not notarized does not', () => assert.strictEqual(R.isNotarized(
+  'x.app: accepted\nsource=Developer ID\norigin=Developer ID Application: Ievgenii Muran (BKZ6Y9W9MF)\n', 0), false));
+// Verbatim spctl output for a Developer ID signed, un-notarized build (measured).
+check('signed but un-notarized, as spctl really prints it, does not', () => assert.strictEqual(R.isNotarized(
+  'CCS Update Test.app: rejected\nsource=Unnotarized Developer ID\norigin=Developer ID Application: Ievgenii Muran (BKZ6Y9W9MF)\n', 3), false));
+check('a rejection does not, even if "Notarized" appears', () => assert.strictEqual(R.isNotarized(
+  'x.app: rejected\nsource=Notarized Developer ID\n', 0), false));
+
+// ── preflight ────────────────────────────────────────────────────────────────
+console.log('\npreflight:');
+const T = { version: '7.18.0', headTags: ['v7.18.0'], dirty: '', headCommit: 'abc', remoteTagCommit: 'abc' };
+check('HEAD on the tag, clean tree, remote tag = HEAD → ok', () => assert.strictEqual(R.tagProblem(T), null));
+check('a local tag that differs from the pushed one → refused (it would build one commit and publish under another)',
+  () => assert.ok(R.tagProblem({ ...T, remoteTagCommit: 'def' })));
+check('a tag that was never pushed → refused', () => assert.ok(R.tagProblem({ ...T, remoteTagCommit: null })));
+// Measured: an annotated tag lists its object and the peeled commit.
+const LS = 'a506a0ed3dc187b0f3421801dd8dd2991209fd06\trefs/tags/v7.17.0\n9d89ac75dcb4b5f6f360fe21acd11f7c39f8cdcb\trefs/tags/v7.17.0^{}\n';
+check('remoteTagCommit takes the peeled commit of an annotated tag',
+  () => assert.strictEqual(R.remoteTagCommit(LS, 'v7.17.0'), '9d89ac75dcb4b5f6f360fe21acd11f7c39f8cdcb'));
+check('...and the ref itself for a lightweight tag',
+  () => assert.strictEqual(R.remoteTagCommit('1111111111111111111111111111111111111111\trefs/tags/v7.18.0\n', 'v7.18.0'), '1111111111111111111111111111111111111111'));
+check('...and null when the tag is not there',
+  () => assert.strictEqual(R.remoteTagCommit('', 'v7.18.0'), null));
+check('HEAD not on the tag → refused (it would ship another commit under this version)',
+  () => assert.ok(R.tagProblem({ ...T, headTags: [] })));
+check('a dirty tree → refused', () => assert.ok(R.tagProblem({ ...T, dirty: ' M electron/main.js' })));
+check('the keychain profile comes from the environment first', () =>
+  assert.strictEqual(R.keychainProfile('APPLE_KEYCHAIN_PROFILE=from-file\n', { APPLE_KEYCHAIN_PROFILE: 'from-env' }), 'from-env'));
+check('...then from electron-builder.env, comments ignored', () =>
+  assert.strictEqual(R.keychainProfile('# note\nAPPLE_KEYCHAIN_PROFILE=murable\n', {}), 'murable'));
+check('...and is null when neither names one', () => assert.strictEqual(R.keychainProfile('', {}), null));
+
+// ── cask ─────────────────────────────────────────────────────────────────────
+console.log('\nHomebrew cask (transitional):');
+const SHA = 'c'.repeat(64);
+const CASK = 'cask "claude-code-studio" do\n  version "7.17.0"\n  sha256 "' + 'a'.repeat(64) + '"\n\n  url "…"\nend\n';
+check('rewrites version and sha256', () => {
+  const out = R.rewriteCask(CASK, '7.18.0', SHA);
+  assert.ok(/^  version "7\.18\.0"$/m.test(out));
+  assert.ok(new RegExp(`^  sha256 "${SHA}"$`, 'm').test(out));
+});
+check('refuses the old per-arch shape instead of pushing a stale checksum', () => {
+  const old = 'cask "x" do\n  version "7.17.0"\n  sha256 arm:   "' + 'a'.repeat(64) + '",\n         intel: "' + 'b'.repeat(64) + '"\nend\n';
+  assert.throws(() => R.rewriteCask(old, '7.18.0', SHA), /sha256/);
+});
+check('refuses a cask without a version line', () =>
+  assert.throws(() => R.rewriteCask('cask "x" do\n  sha256 "' + 'a'.repeat(64) + '"\nend\n', '7.18.0', SHA), /version/));
+check('refuses a malformed checksum argument', () => assert.throws(() => R.rewriteCask(CASK, '7.18.0', 'nope'), /sha256/));
+check('refuses a cask with two sha256 lines (only one would be rewritten)', () =>
+  assert.throws(() => R.rewriteCask(CASK.replace('\n\n', '\n  sha256 "' + 'b'.repeat(64) + '"\n\n'), '7.18.0', SHA), /sha256/));
+check('the checksum pushed is the one GitHub serves for the dmg', () => {
+  assert.strictEqual(R.assetDigest([{ name: D, digest: 'sha256:' + SHA }], D), SHA);
+  assert.strictEqual(R.assetDigest([{ name: D }], D), null);
+  assert.strictEqual(R.assetDigest([], D), null);
+});
+
+// ── order ────────────────────────────────────────────────────────────────────
+console.log('\norder of operations (scripts/release-mac.js):');
+// Code only: the header explains, in prose, what `--publish always` would do.
+const CODE = SRC.split('\n').filter((l) => !/^\s*(\/\/|\*|\/\*\*)/.test(l)).join('\n');
+const MAIN = (/async function main\(\)[\s\S]*$/.exec(CODE) || [''])[0];
+check('the build never publishes by itself', () => {
+  assert.ok(/'--publish', 'never'/.test(CODE), 'electron-builder is not run with --publish never');
+  assert.ok(!/--publish['",\s]+always/.test(CODE), '--publish always found');
+});
+check('notarization is verified before anything is uploaded', () => {
+  const verify = MAIN.indexOf('verifyNotarized(');
+  const upload = MAIN.indexOf('uploadAssets(');
+  assert.ok(verify > 0 && upload > 0, 'verifyNotarized / uploadAssets not both called from main()');
+  assert.ok(verify < upload, 'upload happens before the notarization check');
+});
+check('the dmg itself is checked, not only the unpacked app', () => assert.ok(/'hdiutil', \['attach'/.test(CODE)));
+check('latest-mac.yml is validated before upload', () => {
+  assert.ok(MAIN.indexOf('latestMacProblem(') > 0 && MAIN.indexOf('latestMacProblem(') < MAIN.indexOf('uploadAssets('));
+});
+check('existing mac assets are not overwritten without --force', () => {
+  assert.ok(/force \? \['--clobber'\] : \[\]/.test(CODE), '--clobber not gated on --force');
+  assert.ok(/if \(clash\.length && !force\) die\(/.test(CODE), 'existing assets are not refused');
+});
+check('the cask is bumped only after the upload', () => {
+  // --cask-only redoes just that step and must return before the build path.
+  const only = /if \(args\.includes\('--cask-only'\)\) \{[\s\S]*?\n  \}/.exec(MAIN);
+  assert.ok(only && /return;/.test(only[0]), 'no --cask-only branch that returns');
+  const rest = MAIN.slice(only.index + only[0].length);
+  const up = rest.indexOf('uploadAssets('), cask = rest.indexOf('bumpCask(');
+  assert.ok(up > 0 && cask > up, 'in the release path, bumpCask is not after uploadAssets');
+});
+
+const fnBody = (name) => (new RegExp(`function ${name}\\([^)]*\\) \\{[\\s\\S]*?\\n\\}`).exec(CODE) || [''])[0];
+check('the cask checksum is compared with GitHub\'s before the tap is even cloned', () => {
+  const b = fnBody('bumpCask');
+  const cmp = b.indexOf('assetDigest('), clone = b.indexOf("'clone'");
+  assert.ok(cmp > 0 && clone > 0 && cmp < clone, 'assetDigest check missing or after git clone');
+  assert.ok(/if \(served !== sha\) throw/.test(b), 'a mismatch does not stop the bump');
+});
+check('the dmg is detached before a failed check exits (die() skips a finally)', () => {
+  const b = fnBody('verifyNotarized');
+  const t = b.slice(b.indexOf('try {'), b.indexOf('} finally {'));
+  assert.ok(t.length > 0, 'no try/finally around the mounted image');
+  assert.ok(!/die\(/.test(t), 'die() inside the try would leave the image mounted');
+});
+
+console.log(`\nrelease-mac: ${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);