bundle.sh

#!/bin/bash
# Builds BotDeck and assembles a signed .app bundle.
# TCC (Screen Recording, Accessibility) keys off the bundle ID + code signature,
# so a bare SwiftPM executable can never hold those permissions.
set -euo pipefail
cd "$(dirname "$0")"

APP="${1:-$HOME/Applications/BotDeck.app}"
swift build -c release
rm -rf "$APP"
mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
cp .build/release/BotDeck "$APP/Contents/MacOS/BotDeck"

cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>CFBundleName</key><string>BotDeck</string>
  <key>CFBundleDisplayName</key><string>Bot Deck</string>
  <key>CFBundleIdentifier</key><string>sh.botdeck.app</string>
  <key>CFBundleExecutable</key><string>BotDeck</string>
  <key>CFBundlePackageType</key><string>APPL</string>
  <key>CFBundleShortVersionString</key><string>0.1</string>
  <key>CFBundleVersion</key><string>1</string>
  <key>LSMinimumSystemVersion</key><string>14.0</string>
  <key>NSHighResolutionCapable</key><true/>
  <key>LSUIElement</key><false/>
</dict>
</plist>
PLIST

# Sign with a stable self-signed identity if present. TCC records a designated
# requirement pinned to the certificate, so Screen Recording / Accessibility
# grants survive rebuilds. Ad-hoc signing pins the code hash instead, which
# changes every build and silently drops both permissions.
IDENTITY="BotDeck Local Signing"
if security find-identity -v -p codesigning | grep -q "$IDENTITY"; then
  codesign --force --deep --sign "$IDENTITY" "$APP"
  echo "signed with '$IDENTITY'"
else
  codesign --force --deep --sign - "$APP"
  echo "signed ad-hoc (permissions will reset on each rebuild)"
fi
echo "built $APP"