From 146a709358b7c8c89df9a0a25f39fbcaa865f5f7 Mon Sep 17 00:00:00 2001
From: TZGyn <spectator_brethren761@slmails.com>
Date: Fri, 30 Oct 2026 22:50:46 +0800
Subject: [PATCH] Avoid the macOS case-insensitive app/CLI build collision

---
 AGENTS.md                      | 9 +++++++--
 scripts/build-desktop-app.sh   | 6 +++---
 scripts/release-desktop-app.sh | 6 +++---
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index ae9d5d1..3cc31a9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -189,8 +189,8 @@ what we take vs. skip). Never vendor it into the build.
 - No third-party deps beyond `github.com/coder/websocket`,
   `golang.org/x/crypto` (ACME), and `fyne.io/fyne/v2` (desktop UI). Keep it
   that way unless a milestone calls for it.
-- **Releases**: `v0.2.0` (tag on `d5689ce`) is published on Gitea with
-  darwin/linux CLI tarballs and a **notarized** `Tunnel-0.2.0.zip`
+- **Releases**: `v0.2.1` (tag on `5f98c28`) is published on Gitea with
+  darwin/linux CLI tarballs and a **notarized** `Tunnel-0.2.1.zip`
   (`spctl` = accepted / `Notarized Developer ID`). Homebrew: formula
   `tzgyn-tunnel` (CLI, installs `tunnel`) and cask `tzgyn-tunnel-app` (desktop,
   installs `Tunnel.app`), both in `TZGyn/homebrew-tap`. Rebuild the app with
@@ -202,6 +202,11 @@ what we take vs. skip). Never vendor it into the build.
   desktop app runs the service in-process. `tunnel check [route]` and the
   desktop **Check now** button check the local TCP target plus a public TLS
   handshake (DNS, proxy, bridge, certificate); public checks use a 5s deadline.
+- **macOS is case-insensitive**: `.local/tunnel` (CLI) and `.local/Tunnel`
+  (desktop) are the same file. The desktop scripts build to
+  `.local/desktop/Tunnel`; use `.local/tunnel-cli` when testing both
+  side-by-side. Symptom of a collision: `tunnel check` opens a GUI window and
+  `check` hangs/does nothing.
 - Milestones: M1 core data path (done); M2 real ACME DNS-01 + renewals (done);
   M3 rate limits/admin/hardening (done); M4 Go client (done); M5 desktop app
   (done). Remaining optional work: launchd/systemd agents for the Go client,
diff --git a/scripts/build-desktop-app.sh b/scripts/build-desktop-app.sh
index 2ca47e7..69aa084 100755
--- a/scripts/build-desktop-app.sh
+++ b/scripts/build-desktop-app.sh
@@ -16,11 +16,11 @@ if [ ! -x "$FYNE" ]; then
   FYNE="$(go env GOPATH)/bin/fyne"
 fi
 
-mkdir -p .local
-go build -o .local/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
+mkdir -p .local/desktop
+go build -o .local/desktop/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
 rm -rf Tunnel.app
 "$FYNE" package -os darwin \
-  -executable .local/Tunnel \
+  -executable .local/desktop/Tunnel \
   -name Tunnel -app-id dev.tzgyn.tunnel \
   -app-version "$VERSION" -app-build "$BUILD" \
   -icon assets/icon.png -release
diff --git a/scripts/release-desktop-app.sh b/scripts/release-desktop-app.sh
index e792656..e45e0e7 100755
--- a/scripts/release-desktop-app.sh
+++ b/scripts/release-desktop-app.sh
@@ -21,11 +21,11 @@ FYNE="$(command -v fyne || true)"
 IDENT="$(security find-identity -v -p codesigning | awk '/Developer ID Application:/{print $2; exit}')"
 [ -n "$IDENT" ] || { echo "no Developer ID Application identity"; exit 1; }
 
-mkdir -p "$OUT"
-go build -o .local/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
+mkdir -p "$OUT" .local/desktop
+go build -o .local/desktop/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
 rm -rf "$APP"
 "$FYNE" package -os darwin \
-  -executable .local/Tunnel \
+  -executable .local/desktop/Tunnel \
   -name Tunnel -app-id dev.tzgyn.tunnel \
   -app-version "$VERSION" -app-build "$BUILD" \
   -icon assets/icon.png -release