Launch the signed bundled CLI in the packaged-app smoke

[claude]

Requested by Justin · project thread

Before: the release smoke only checked that Contents/Helpers/transcripted-mcp exists. The bundled transcripted-cli was only run (build-info) before signing, so nothing proved it still launches once it's signed with the hardened runtime and loads its frameworks from the app bundle. Also, a plain bash build.sh (no --no-open) built fine and then exited non-zero on your own account.

After: transcripted-qa packaged-app-smoke runs the shipped transcripted-cli build-info and fails the release unless it exits cleanly and reports the full meeting pipeline. bash build.sh opens the app again.

Why

Deep review findings M15 and M16 for 1.1.62. The CLI will be tested by a user right after release, and the Release Candidate workflow's packaged-app smoke is the only place the notarized app gets run before publishing.

Product Impact

• Affects: agent artifacts
• Lane: release ops
• Why this matters: a CLI that dies under library validation would ship silently.

What changed

• PackagedAppSmoke.swift: new cli-helper check (exists + executable) and cli-launch check (runs Contents/Helpers/transcripted-cli build-info, expects {"mode":"meeting","transcription":true,"diarization":true,"meetingImport":true}). Reads the last JSON line, since the command runner merges stderr into stdout. Skips the launch if the helper is missing so there's one clear failure.
• PackagedAppSmokeTests.swift: fixture now bundles a CLI stub; new tests for pass, missing helper, launch failure (dyld-style exit 134), retrieval-only build, missing JSON, and stderr noise before the JSON.
• scripts/entrypoints/build.sh: drop the native-smoke-isolation guard right before open. It's meant for automated smokes; under set -e it made the normal dev open fail (since Guard native QA launches from active macOS account #1757). Automated launch smokes stay guarded.

How I checked it

• scripts/dev/agent-preflight.sh
• python3 scripts/dev/check-build-source-lists.py, bash -n on build.sh, the build.sh entrypoint and lib/bundle-cli.sh
• swift test --package-path Tools/TranscriptedQA: no Swift toolchain in the session (Linux), so hosted CI is the compile and test check
• bash build.sh --no-open: CI
• Manual check: the new check only runs for real in the Release Candidate workflow on the notarized app

Risk Review

• Privacy / local-first behavior reviewed (build-info loads no models, touches no user paths, no network)
• Release/update impact reviewed: adds one required check to the RC smoke. Local build.sh also bundles the CLI, so the QA bench smoke sees it too.
• No private transcripts, audio, tokens, personal paths, or customer data are included

Agent handoff

COORD_DONE: BRIEF | this PR | M15 CLI launch check + M16 build.sh open | none | none | preflight, source lists, bash -n; Swift via CI | merge before 1.1.62 publishes

🤖 Generated with Claude Code

https://claude.ai/code/session_018E4d9Q4eEHgeHYdXFxFAMV

---

Generated by Claude Code

[claude]

spm-tests is red, but not from this PR. The XCTest stall detector aborted the Core package tests in CoreAudioSystemAudioCaptureTests.testAttemptFinishSubscriberCanCancelAcrossBackendQueueWithoutDeadlock (CoreAudioSystemAudioCaptureTests.swift:193). This PR doesn't touch Sources/TranscriptedCore or its tests. The same test stalled the same way on #1756 (main + Info.plist only) earlier today, and no fix exists yet.

Because the abort kills the job, the later Tools package tests step never ran, so this PR's new PackagedAppSmokeTests are still unverified. It needs one re-run of spm-tests. This session can't re-run jobs (403), so that has to be done by hand.

---

Generated by Claude Code