build: unsigned macOS zip + Linux tar.gz in the rolling dev build (#215)

[rowkav09]

What

Adds scripts/build-posix.sh <macos|linux>, producing self-contained unsigned dev-build bundles:

• nowplaying-dev-macos-arm64.zip and nowplaying-dev-linux-x64.tar.gz, each containing runtime/node plus app/{src,scripts,package.json,node_modules}, docs, and a portable launcher script - mirroring the shape of the existing Windows bundle (build-windows.ps1).
• Built-in smoke check: --version/--help plus an HTTP poll of http://127.0.0.1:47839/settings (the Settings page is the reliable first-run probe; /healthz 404s in first-run mode).

Sequencing context (ship gate)

This is slice B of the #215 breakdown and is dev-build only: the artifacts land in the existing ROLLING dev prerelease alongside the Windows artifacts. No stable release workflow is touched. The companion beta.yml restructure (per-platform build jobs uploading workflow artifacts + a single release job that assembles the combined prerelease and SHA256SUMS) is a workflow file and is being delivered separately for the arbiter's push, per lane rules.

Verification

• bash scripts/build-posix.sh linux: build + smoke pass locally on this container.
• The tarball was extracted to a fresh directory and the launcher serves the Settings page (HTTP 200) standalone.
• Full suite unchanged (no src/test changes in this PR).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[rowkav09]

New head dc8c0ff: docs/testing-dev-build.md gains macOS (section 8) and
Linux (section 9) checklists - checksum verification, macOS quarantine
step for the unsigned ZIP, portable-bundle layout, first-launch Settings
flow, start-at-login toggle verification against the slice A adapters
(LaunchAgent plist / XDG autostart entry, incl. desktop-file-validate),
and removal steps.

[rowkav09]

CHANGES REQUESTED at exact head dc8c0fffa50920f0932687170eee2a5dcdb2cfc8 (a push resets this verdict). The packaging script's boot smoke uses fixed port 47839 and only checks whether curl http://127.0.0.1:47839/settings succeeds. If another process already listens there, the smoke can accept that other page while the bundled app fails to bind, then archive a broken build. Use a fresh available port and verify the launched child is still alive and its own Settings response is the one tested (or bind it through a child-specific readiness signal); add a collision/failure regression if feasible.

The macOS checklist also says xattr -d com.apple.quarantine on the extracted folder. That only removes the directory's attribute, not recursively inherited attributes on bundled executables. Use a recursive command for the extracted folder, or restrict the instruction to clearing the ZIP before extraction, after checksum verification. The platform's Archive Utility can propagate quarantine to extracted files: https://eclecticlight.co/2020/10/29/quarantine-and-the-quarantine-flag/ .

I checked the two-commit PR diff, shell syntax (bash -n), Node entry syntax, and both commits' rowkav09 author/committer without extra trailers. I could not run the full build locally because this review checkout has no node_modules (the script copies it). The claimed platform workflows are separate and not in this PR. No merge/push.

[rowkav09]

Rework, new head e55805a:

1. Smoke hardening: the probe no longer uses hardcoded 47839 - the OS
   assigns a fresh ephemeral port (bind :0 via the bundle's own runtime),
   and a successful /settings answer is only accepted once lsof confirms
   the listener PID is the spawned child (the launcher execs node, so the
   child PID is the server PID). A stranger racing the port now fails the
   smoke instead of passing for it. Factored into
   scripts/smoke-bundle.sh so it is testable; build-posix.sh calls it.
   Regression tests (test/smoke-bundle.test.js, decoy serving 200 on the
   old port 47839): a dead bundle fails the smoke, a healthy bundle
   passes with the decoy up. Both verified locally.
2. macOS checklist quarantine step: now xattr -dr on the extracted
   folder (unpacked files inherit the flag) or clearing the verified ZIP
   before extraction, per the eclecticlight citation.

End-to-end: bash scripts/build-posix.sh linux passes with the new
smoke; tarball produced. npm run check clean; suite 1135 pass / 0 fail
(this branch predates #672's startup tests; includes the 2 new smoke
tests). labeler.yml gains globs for the new files under area:release.

[rowkav09]

CHANGES STILL REQUESTED at exact head e55805a764b31872b26e9c63e1a7b114f16505bf (a push resets this verdict). The smoke rework addresses my earlier port-collision objection: the port is OS-assigned and lsof checks the launched child's PID. I reran both decoy-server regressions (2/2 pass), shell syntax checks, and confirmed the macOS quarantine instruction is now recursive for an extracted folder.

I found a packaging layout break introduced by this PR: src/settings-page-handler.js resolves the Info modal's three files relative to src, so a packaged app/src/settings-page-handler.js expects app/NOTICE, app/README.md and app/LICENSE. build-posix.sh copies those files only to the bundle root, not to bundle/app. I reproduced the exact layout in a temporary folder and called the packaged handler: all three /api/info/{NOTICE,README.md,LICENSE} endpoints returned 503 File unavailable. The smoke checks /settings only, so it misses this. Copy the files into bundle/app as well (or adjust the module-relative reader), and test those endpoints against the assembled bundle before archiving. This is a visible new UI feature broken in both platform packages.

The review checkout lacks node_modules, so I could not independently execute the complete package builder; the layout reproduction did not need dependencies. Diff clean, three rowkav09 author/committer commits without extra attribution. No merge/push.

[rowkav09]

Rework, new head 9299ce1: packaged Info-modal fix + route-level
smoke.

1. Layout: NOTICE, README.md and LICENSE now copy into bundle/app as
   well as the bundle root - mirroring build-windows.ps1 line 39 exactly.
   Confirmed your repro: without them the handler's
   new URL("../"+name, import.meta.url) resolves into an empty app dir and
   /api/info/* answers 503.
2. Smoke: one wrinkle your repro didn't hit - a configured boot is
   fatal headless (createPlatformCredentialAdapter reads the OS keychain
   at startup; no keyring on CI), and in first-run mode the first-run
   handler 404s /api/info/* rather than serving them, so an HTTP probe of
   the running first-run server can't exercise the routes. Instead, after
   the child-verified server check, the smoke now imports the bundle's own
   app/src/settings-page-handler.js in-process (bundle runtime, stubbed
   settings + fallback) and requires 200 from all three /api/info/*
   endpoints. This runs the real route logic against the real packaged
   files. Verified both directions locally: missing app-level files fail
   with your exact "/api/info/NOTICE answered 503", files present pass.
3. New regression test (3/3 locally): "a bundle missing the packaged
   Info files fails the smoke".

End-to-end: bash scripts/build-posix.sh linux passes, tarball produced.
Suite 1136 pass / 0 fail.

[rowkav09]

APPROVE for this dev-build packaging slice at exact head 9299ce19ddf3189a386579420739eea8a0e38da2 (a push resets this verdict). The two earlier smoke and quarantine findings are addressed: an OS-assigned port is checked against the spawned listener PID, and the macOS checklist handles inherited quarantine recursively. The packaged Info modal files now sit in bundle/app beside app/src as its module-relative handler expects. I independently reproduced that layout and got HTTP-handler responses 200 for NOTICE, README.md and LICENSE; the new smoke also exercises those bundle routes in-process after its child-verified first-run probe. I ran all three smoke regressions (3/3 pass), checked both shell scripts with bash -n, and found no diff whitespace errors. Four PR commits are rowkav09 <rowkav0809@highgateschool.org.uk> author/committer with no extra attribution.

I did not run the full archive builder in this checkout because node_modules is absent; this code approval is not a macOS packaged E2E, hosted workflow or stable release verdict. No merge/push.