[Fei2411]

Issue

No issue.

Supersedes #332: the same changes, with the commits authored as Fei2411.

What changed / 改了什么

The desktop app now builds, installs and runs on macOS, one DMG per architecture:
DeepSeek-Bot-<version>-mac-arm64.dmg (Apple chip) and DeepSeek-Bot-<version>-mac-x64.dmg (Intel).

• Packaging: mac.identity: '-' and hardenedRuntime: false in electron-builder.yml. Without an identity electron-builder signs nothing, the bundle is not sealed (codesign --verify --deep --strict fails: "code has no resources but signature indicates they must be present"), and a downloaded copy is reported as damaged. With an ad-hoc signature the bundle verifies; Gatekeeper still blocks the first open, and the user allows it in System Settings → Privacy & Security → Open Anyway. No Developer ID, no notarization. electron-builder skips signing on pull-request builds, so the macOS CI job sets CSC_FOR_PULL_REQUEST=true; ad-hoc signing uses no certificate or secret.
• One build per architecture, on its own runner. npmRebuild: false packs the native modules from node_modules. A combined --arm64 --x64 build on an Apple chip Mac put 12 arm64-only native modules (sharp, koffi, node-pty, sherpa-onnx, ripgrep, …) in the x64 app. So CI and release use a matrix: arm64 on macos-latest, x64 on macos-26-intel.
• Updates on macOS: watchReleases() in src/updates.mjs reads GitHub's releases?per_page=20 at start and every 4 hours and takes the highest release newer than app.getVersion() (isNewer, semver) that has DeepSeek-Bot-<version>-mac-<arch>.dmg attached. Drafts are skipped; prereleases count only for a prerelease install (as electron-updater does). A release whose DMG is not uploaded yet is not shown, and is shown on a later check once it is. It asks once per version. Download → shell.openExternal(html_url) (HTTPS only); Later closes the dialog. Nothing is installed. When the start fails and a newer version exists, the error box says so and the release page opens after it. Windows (watchUpdates, electron-updater) is unchanged.
• DS_BOT_UPDATE_URL on macOS is a URL that answers like GitHub's releases list (tag_name, html_url, draft, prerelease, assets[].name). Throwaway runs (DS_BOT_HOME) check only that URL, never ask and never open a browser.
• scripts/check-update.mjs <app> <version> on macOS serves such a list locally, runs the packaged app on throwaway folders, waits for update <version> available, then closes the app and requires exit code 0.
• CI (test.yml): job app-package-macos (arm64 + x64) builds the DMG, runs check-packed, installs the app from the DMG into /Applications, checks its signature and CPU type, runs check-packed and check-update on it. It is part of result.
• Release (release.yml): job app-macos (arm64 + x64), after publish, builds, runs check-packed, uploads only the DMG.
• Docs: design doc (known limits, change log), app/README.md (Package, Updates, data location ~/Library/Application Support/DeepSeek Bot), release checklist section 13 (macOS).

Known limit, kept for now: on macOS, closing the window quits the app (same as Windows); it does not stay in the Dock.

Changelog

The desktop app is available for macOS (Apple chip and Intel) as a DMG, and tells you when a new version is ready to download.

How I checked it / 怎么验证的

• npm test (in ds-bot/)
• node scripts/build-client.mjs --check
• npm run lint
• Smoke test, for changes to index.js or src/host/ / 改了 index.js 或 src/host/ 时跑冒烟测试 (not changed)
• Screenshot attached, for interface changes / 界面改动已附截图

On an Apple chip Mac (macOS 26): app npm test (42 pass); arm64 npm run dist; check-packed on the build and on the app installed from the DMG; codesign --verify --deep --strict on the built and the mounted app; check-update.mjs … 99.0.0. x64 was built under Rosetta with an x64 Node: all packed native modules are x86_64, and the app reaches the chat, but under Rosetta it is too slow for check-packed's timeouts. The native Intel runner in CI is the real x64 check.

Checklist / 检查

• One issue, one subject. / 只做一件事。
• src/client/ changed → npm run build ran and client.js is committed. / 改了 src/client/ 就已重新 build 并提交 client.js。 (not changed)
• No keys, tokens or personal data, also in screenshots. / 没有密钥、token 或个人信息，截图里也没有。
• No AI tool as author or Co-authored-by. / 没有把 AI 工具写成作者或 Co-authored-by。

UI check on macOS 26 (arm64, mock model, temp folders)

Installed from the DMG; first start (two folder pickers, locations.json), mock chat, quit on close, update prompt in English and Chinese, Later, Download → release page, no prompt for the same version. A quarantined copy is blocked ("Not Opened", not "damaged") and Privacy & Security offers Open Anyway; the last step needs an administrator password and was not completed.

Mock chat	Update prompt	新版提示

Gatekeeper block	Open Anyway

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T06:16:09.461378Z	677b3e9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.