发布 macOS 已签名 DMG 并优化移动端快捷键

.github/release-notes/v1.7.7.md

@@ -0,0 +1,51 @@
+[English](#v1-7-7-english) · [简体中文](#v1-7-7-zh)
+
+<a id="v1-7-7-english"></a>
+### English
+
+> macOS releases now use signed and notarized DMG files, and the mobile terminal shortcut bar is more compact. The macOS ZIP package is no longer generated.
+
+#### Important fixes
+
+- macOS Gatekeeper startup issue tracked in [Issue #36](https://github.com/zmide/Terma/issues/36) is addressed with signed and notarized release DMGs for both Intel and Apple Silicon.
+
+#### Important additions
+
+- macOS releases now provide only signed and notarized x64 and arm64 DMG files; the less-used ZIP package is no longer generated.
+
+#### Other improvements
+
+- Mobile terminal shortcut buttons use a more compact layout while keeping horizontal scrolling available.
+
+#### Changes in this release
+
+- [PR #56](https://github.com/zmide/Terma/pull/56) — corrected release documentation, by [@JunXiaoRuo](https://github.com/JunXiaoRuo).
+- [PR #57](https://github.com/zmide/Terma/pull/57) — added the Gatekeeper temporary-workaround prerequisite, by [@JunXiaoRuo](https://github.com/JunXiaoRuo).
+- [PR #58](https://github.com/zmide/Terma/pull/58) — published signed macOS DMGs, removed the macOS ZIP package, and compacted mobile terminal shortcuts, by [@JunXiaoRuo](https://github.com/JunXiaoRuo).
+
+**Full Changelog**: [v1.7.6...v1.7.7](https://github.com/zmide/Terma/compare/v1.7.6...v1.7.7)
+
+<a id="v1-7-7-zh"></a>
+### 简体中文
+
+> macOS 新版现在使用已签名并公证的 DMG，移动端终端快捷键栏也更加紧凑；使用较少的 macOS ZIP 包不再生成。
+
+#### 重要修复
+
+- [Issue #36](https://github.com/zmide/Terma/issues/36) 跟踪的 macOS Gatekeeper 启动问题已通过 Intel 和 Apple 芯片均使用已签名并公证的发布包得到处理。
+
+#### 重要新增
+
+- macOS 新版只提供已签名并公证的 x64 和 arm64 DMG，不再生成使用较少的 ZIP 包。
+
+#### 其他优化
+
+- 移动端终端快捷键按钮改为更紧凑的布局，同时保留横向滚动操作。
+
+#### 本次变更
+
+- [PR #56](https://github.com/zmide/Terma/pull/56) —— 修正文档发布说明，贡献者：[[@JunXiaoRuo](https://github.com/JunXiaoRuo)]。
+- [PR #57](https://github.com/zmide/Terma/pull/57) —— 补充 Gatekeeper 临时处理前置步骤，贡献者：[[@JunXiaoRuo](https://github.com/JunXiaoRuo)]。
+- [PR #58](https://github.com/zmide/Terma/pull/58) —— 发布已签名 macOS DMG、移除 macOS ZIP 并收紧移动端终端快捷键，贡献者：[[@JunXiaoRuo](https://github.com/JunXiaoRuo)]。
+
+**完整变更**：[v1.7.6...v1.7.7](https://github.com/zmide/Terma/compare/v1.7.6...v1.7.7)

.github/workflows/release.yml

@@ -134,7 +134,7 @@ jobs:
         run: npm ci
 
       - name: Build macOS packages
-        run: npm run dist -- --mac dmg zip --x64 --arm64 --publish never
+        run: npm run dist -- --mac dmg --x64 --arm64 --publish never
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: false
 
@@ -170,15 +170,77 @@ jobs:
           done < <(find release -path "*/${PRODUCT_FILENAME}.app/Contents/Info.plist" -type f -print)
           test "$app_count" -eq 2
       - name: Upload macOS workflow artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: terma-macos-unsigned-x64-arm64
+          overwrite: true
+          retention-days: 7
+          if-no-files-found: error
+          path: release/*.dmg
+
+  macos-sign:
+    name: macOS Sign and notarize
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    needs: macos
+    runs-on: [self-hosted, macOS, ARM64, terma-signer]
+    environment: macos-signing
+    timeout-minutes: 60
+    concurrency:
+      group: terma-macos-sign-${{ github.ref }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+    steps:
+      - name: Download unsigned macOS DMGs
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: terma-macos-unsigned-x64-arm64
+          digest-mismatch: error
+          path: macos-unsigned
+
+      - name: Sign and notarize macOS DMGs
+        shell: bash
+        run: |
+          rm -rf macos-signed
+          mkdir -p macos-signed
+          /Users/bing/terma-actions-runner/sign-terma-release.sh \
+            "$GITHUB_WORKSPACE/macos-unsigned" \
+            "$GITHUB_WORKSPACE/macos-signed" \
+            "$GITHUB_REF_NAME"
+
+      - name: Verify signed and notarized macOS DMGs
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          dmgs=(macos-signed/*.dmg)
+          test "${#dmgs[@]}" -eq 2
+          for dmg in "${dmgs[@]}"; do
+            xcrun stapler validate "$dmg"
+            (
+              mountpoint="$(mktemp -d)"
+              cleanup() {
+                hdiutil detach "$mountpoint" -quiet >/dev/null 2>&1 || true
+                rmdir "$mountpoint" 2>/dev/null || true
+              }
+              trap cleanup EXIT
+              hdiutil attach "$dmg" -nobrowse -readonly -mountpoint "$mountpoint" >/dev/null
+              app="$(find "$mountpoint" -type d -name '*.app' -print -quit)"
+              test -n "$app"
+              codesign --verify --deep --strict --verbose=2 "$app"
+              spctl -a -vvv -t open --context context:primary-signature "$dmg"
+              spctl -a -vvv -t exec "$app"
+            )
+          done
+
+      - name: Upload signed macOS workflow artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Terma-macos-x64-arm64
           overwrite: true
           retention-days: 7
-          path: |
-            release/*.dmg
-            release/*.zip
-            release/*.blockmap
+          if-no-files-found: error
+          path: macos-signed/*.dmg
 
   linux-source:
     name: Linux Source
@@ -242,7 +304,7 @@ jobs:
     needs:
       - windows
       - linux
-      - macos
+      - macos-sign
       - linux-source
     runs-on: ubuntu-latest
     permissions:

README.md

@@ -131,7 +131,7 @@ The desktop app is an Electron container around the same Web UI and Node.js serv
 | Platform | Desktop | Web mode | Release artifacts |
 | --- | --- | --- | --- |
 | Windows 10/11 | Supported | Supported | Installer and portable executable |
-| macOS | Supported | Supported | DMG and installation-free ZIP |
+| macOS | Supported | Supported | Signed and notarized DMG |
 | Linux | Supported | Supported | AppImage, DEB, and RPM |
 | Termux / headless Linux | Not recommended | Supported | Run from source |
 
@@ -263,15 +263,14 @@ npm run dist -- --win nsis portable --x64 --publish never
 npm run dist -- --linux AppImage deb rpm --x64 --publish never
 
 # macOS: Intel and Apple Silicon
-npm run dist -- --mac dmg zip --x64 --arm64 --publish never
+npm run dist -- --mac dmg --x64 --arm64 --publish never
 ```
 
 Build output is written to `release/`:
 
 - Windows installer: run `*-installer.exe` and follow the wizard; run `*-portable.exe` directly for the portable build.
 - Linux: run `chmod +x release/*.AppImage` before launching an AppImage; install DEB and RPM packages with the system package manager.
-- macOS DMG: open the `.dmg` for the machine architecture and drag Terma to Applications.
-- macOS ZIP: extract and run `Terma.app` without installation. “Installation-free” applies to the app bundle only; runtime data is still stored in the system user-data directory. Choose `x64` for Intel or `arm64` for Apple Silicon.
+- macOS DMG: official release packages are signed and notarized. DMGs built locally are not guaranteed to be signed or notarized. Open the `.dmg` for the machine architecture and drag Terma to Applications. Choose `x64` for Intel or `arm64` for Apple Silicon.
 
 Pushing a `v*` tag starts the Release workflow, which builds and verifies Windows, Linux, and macOS artifacts separately.
 

README.zh-CN.md

@@ -131,7 +131,7 @@ Electron 桌面端 ─┐
 | 平台 | 桌面端 | Web 模式 | 发布产物 |
 | --- | --- | --- | --- |
 | Windows 10/11 | 支持 | 支持 | 安装版、便携版 |
-| macOS | 支持 | 支持 | DMG 安装镜像、ZIP 免安装运行包 |
+| macOS | 支持 | 支持 | 已签名并公证的 DMG |
 | Linux | 支持 | 支持 | AppImage、DEB、RPM |
 | Termux / 无图形 Linux | 不建议 | 支持 | 源码运行 |
 
@@ -263,15 +263,14 @@ npm run dist -- --win nsis portable --x64 --publish never
 npm run dist -- --linux AppImage deb rpm --x64 --publish never
 
 # macOS：Intel 与 Apple Silicon
-npm run dist -- --mac dmg zip --x64 --arm64 --publish never
+npm run dist -- --mac dmg --x64 --arm64 --publish never
 ```
 
 构建结果位于 `release/`。各平台运行方式：
 
 - Windows 安装版：运行 `*-installer.exe` 并按向导安装；便携版直接运行 `*-portable.exe`。
 - Linux：AppImage 执行 `chmod +x release/*.AppImage` 后即可运行；DEB、RPM 使用系统包管理器安装。
-- macOS DMG：打开与机器架构对应的 `.dmg`，将 Terma 拖入“应用程序”后启动。
-- macOS ZIP：解压后可直接运行 `Terma.app`，无需安装；它只表示应用免安装，运行数据仍保存在系统用户数据目录。Intel 选择 `x64`，Apple Silicon 选择 `arm64`。
+- macOS DMG：官方发布包会完成代码签名和公证；使用此命令本地构建的 DMG 不保证完成签名和公证。打开与机器架构对应的 `.dmg`，将 Terma 拖入“应用程序”后启动。Intel 选择 `x64`，Apple Silicon 选择 `arm64`。
 
 推送 `v*` 标签时，Release 工作流会在 Windows、Linux 和 macOS 上分别构建并验证产物。
 

docs-site/components/DownloadPanel.vue

@@ -30,7 +30,6 @@ const definitions = computed(() => {
     const suffix = architecture.value === 'arm64' ? 'arm64' : 'x64'
     return [
       { key: 'dmg', label: '安装镜像', extension: 'dmg', filename: `Terma-${version.value}-macos-${suffix}.dmg` },
-      { key: 'zip', label: '免安装压缩包', extension: 'zip', filename: `Terma-${version.value}-macos-${suffix}.zip` },
     ]
   }
   return [

docs-site/guide/build.md

@@ -20,6 +20,6 @@ Windows/macOS 构建复用 Electron 头文件缓存，默认原站准备失败
 npm run dist
 ```
 
-构建结果位于 `release/`。Windows 会生成安装版和便携版，Linux 会生成 AppImage、DEB、RPM，macOS 会生成 DMG 和 ZIP。
+构建结果位于 `release/`。Windows 会生成安装版和便携版，Linux 会生成 AppImage、DEB、RPM，macOS 会生成 DMG；正式发布时由专用 macOS 签名机完成代码签名和公证。
 
 发布前应在目标平台验证启动、SSH、终端、SFTP、远程桌面和更新检查，并保留对应的第三方许可证文件。

docs-site/guide/download.md

@@ -12,8 +12,7 @@ import DownloadPanel from '../components/DownloadPanel.vue'
 
 - **Windows 安装版**：通过安装向导安装，可选择安装目录。
 - **Windows 便携版**：无需安装，直接运行；运行数据仍会保存到 Terma 的数据目录。
-- **macOS DMG**：将 Terma 拖到“应用程序”目录。Intel 选择 `x64`，Apple Silicon 选择 `arm64`。
-- **macOS ZIP**：解压后直接运行 `Terma.app`。
+- **macOS DMG**：发布包已完成代码签名和公证；将 Terma 拖到“应用程序”目录。Intel 选择 `x64`，Apple Silicon 选择 `arm64`。
 - **Linux AppImage / DEB / RPM**：按发行版选择；AppImage 需要先执行 `chmod +x`。
 - **SHA256SUMS**：发布文件的校验和，不是安装包。
 

docs-site/guide/installation.md

@@ -5,7 +5,7 @@
 从 [GitHub Releases](https://github.com/zmide/Terma/releases) 下载对应平台的安装包：
 
 - Windows：安装版或便携版。
-- macOS：DMG 或 ZIP；Intel 选择 `x64`，Apple Silicon 选择 `arm64`。
+- macOS：已签名并公证的 DMG；Intel 选择 `x64`，Apple Silicon 选择 `arm64`。
 - Linux：AppImage、DEB 或 RPM。
 
 首次启动后，在“设置 > 安全”中配置 Web 密码或访问 Token（自托管 Web 模式尤其重要）。

docs-site/guide/platforms.md

@@ -7,7 +7,7 @@
 | 平台 | 桌面端 | Web 模式 | 发布产物 |
 | --- | --- | --- | --- |
 | Windows 10/11 | 支持 | 支持 | 安装版、便携版 |
-| macOS | 支持 | 支持 | DMG、ZIP |
+| macOS | 支持 | 支持 | 已签名并公证的 DMG |
 | Linux | 支持 | 支持 | AppImage、DEB、RPM |
 | Termux / 无图形 Linux | 不建议 | 支持 | 源码运行 |
 

docs/update.md

@@ -2,30 +2,84 @@
 
 ## Next release draft / 下一版草稿
 
-[English](#v1-7-7-english) · [简体中文](#v1-7-7-zh)
+[English](#v1-7-8-english) · [简体中文](#v1-7-8-zh)
 
-<a id="v1-7-7-english"></a>
+<a id="v1-7-8-english"></a>
 ### English
 
-> The v1.7.7 draft continues recoverable-session, interoperability, and cross-platform remote desktop acceptance.
+> The v1.7.8 draft continues recoverable-session, interoperability, and cross-platform remote desktop acceptance.
 
 #### Planned
 
 - Complete real network and reload acceptance for recoverable sessions on Linux, macOS, Windows fallback, and browser mode.
 - Expand terminal AI interoperability tests with additional OpenAI-compatible gateways while keeping command execution and MCP approval boundaries unchanged.
 - Complete real TigerVNC/noVNC/system-client clipboard acceptance for text, Chinese, and image transfer on all three desktop platforms.
 
-<a id="v1-7-7-zh"></a>
+<a id="v1-7-8-zh"></a>
 ### 简体中文
 
-> v1.7.7 草稿继续推进可恢复会话、互操作场景和跨平台远程桌面验收。
+> v1.7.8 草稿继续推进可恢复会话、互操作场景和跨平台远程桌面验收。
 
 #### 计划
 
 - 完成 Linux、macOS、Windows 降级和浏览器模式下的真实断网、重载与会话恢复验收。
 - 使用更多 OpenAI 兼容网关扩展终端 AI 互操作测试，同时保持命令执行和 MCP 确认边界不变。
 - 完成 TigerVNC、noVNC、系统客户端在三种桌面平台上的文本、中文和图片剪贴板验收。
 
+## v1.7.7
+
+[English](#v1-7-7-english) · [简体中文](#v1-7-7-zh)
+
+<a id="v1-7-7-english"></a>
+### English
+
+> macOS releases now use signed and notarized DMG files, and the mobile terminal shortcut bar is more compact. The macOS ZIP package is no longer generated.
+
+#### Important fixes
+
+- macOS Gatekeeper startup issue tracked in [Issue #36](https://github.com/zmide/Terma/issues/36) is addressed with signed and notarized release DMGs for both Intel and Apple Silicon.
+
+#### Important additions
+
+- macOS releases now provide only signed and notarized x64 and arm64 DMG files; the less-used ZIP package is no longer generated.
+
+#### Other improvements
+
+- Mobile terminal shortcut buttons use a more compact layout while keeping horizontal scrolling available.
+
+#### Changes in this release
+
+- [PR #56](https://github.com/zmide/Terma/pull/56) — corrected release documentation, by [@JunXiaoRuo](https://github.com/JunXiaoRuo).
+- [PR #57](https://github.com/zmide/Terma/pull/57) — added the Gatekeeper temporary-workaround prerequisite, by [@JunXiaoRuo](https://github.com/JunXiaoRuo).
+- [PR #58](https://github.com/zmide/Terma/pull/58) — published signed macOS DMGs, removed the macOS ZIP package, and compacted mobile terminal shortcuts, by [@JunXiaoRuo](https://github.com/JunXiaoRuo).
+
+**Full Changelog**: [v1.7.6...v1.7.7](https://github.com/zmide/Terma/compare/v1.7.6...v1.7.7)
+
+<a id="v1-7-7-zh"></a>
+### 简体中文
+
+> macOS 新版现在使用已签名并公证的 DMG，移动端终端快捷键栏也更加紧凑；使用较少的 macOS ZIP 包不再生成。
+
+#### 重要修复
+
+- [Issue #36](https://github.com/zmide/Terma/issues/36) 跟踪的 macOS Gatekeeper 启动问题已通过 Intel 和 Apple 芯片均使用已签名并公证的发布包得到处理。
+
+#### 重要新增
+
+- macOS 新版只提供已签名并公证的 x64 和 arm64 DMG，不再生成使用较少的 ZIP 包。
+
+#### 其他优化
+
+- 移动端终端快捷键按钮改为更紧凑的布局，同时保留横向滚动操作。
+
+#### 本次变更
+
+- [PR #56](https://github.com/zmide/Terma/pull/56) —— 修正文档发布说明，贡献者：[[@JunXiaoRuo](https://github.com/JunXiaoRuo)]。
+- [PR #57](https://github.com/zmide/Terma/pull/57) —— 补充 Gatekeeper 临时处理前置步骤，贡献者：[[@JunXiaoRuo](https://github.com/JunXiaoRuo)]。
+- [PR #58](https://github.com/zmide/Terma/pull/58) —— 发布已签名 macOS DMG、移除 macOS ZIP 并收紧移动端终端快捷键，贡献者：[[@JunXiaoRuo](https://github.com/JunXiaoRuo)]。
+
+**完整变更**：[v1.7.6...v1.7.7](https://github.com/zmide/Terma/compare/v1.7.6...v1.7.7)
+
 ## v1.7.6
 
 [English](#v1-7-6-english) · [简体中文](#v1-7-6-zh)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "terma",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "releaseRevision": 1,
   "private": true,
   "license": "GPL-3.0-only",
@@ -203,8 +203,7 @@
         }
       ],
       "target": [
-        "dmg",
-        "zip"
+        "dmg"
       ]
     }
   }

public/app.css

@@ -1821,6 +1821,16 @@ body.sftp-task-center-open .notification-stack { z-index:9; }
 .terminal-quick-command-bar.compact .terminal-quick-command-name { max-width:86px; font-size:11px; }
 .terminal-quick-command-bar.compact .terminal-quick-command small { display:none; }
 .terminal-quick-command-bar.compact .terminal-quick-command-manage { top:9px; right:5px; width:24px; min-width:24px; height:24px; min-height:24px; }
+@media (max-width:760px) {
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command-list { flex-wrap:nowrap; align-items:center; overflow-x:auto; overflow-y:hidden; padding:2px 37px 3px 5px; gap:4px; }
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command { min-width:72px; min-height:30px; padding:2px 6px 2px 3px; gap:3px; }
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command.no-badge { min-width:56px; }
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command-drag { height:20px; }
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command-badge { width:19px; height:19px; font-size:9px; }
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command-name { max-width:86px; font-size:11px; }
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command small { display:none; }
+  .terminal-quick-command-bar:not(.compact) .terminal-quick-command-manage { top:9px; right:5px; width:24px; min-width:24px; height:24px; min-height:24px; }
+}
 .snippet-quick-settings { min-width:0; margin:12px 0; padding:10px 12px 12px; border:1px solid var(--line); border-radius:5px; background:color-mix(in srgb,var(--field) 70%,var(--panel)); }
 .snippet-quick-settings legend { padding:0 5px; font-size:12px; font-weight:700; }
 .snippet-quick-grid { margin-top:9px; }