terminal background images

use native border (remove transparency from app window), remove css borders, remove default --term variables, force setClientData to set --term font variables on first set.
Support Linux packaging via electron-builder (#371 )
2026-04-22 15:26:58 -07:00 · 2024-03-04 23:33:00 -08:00 · 2024-03-04 22:59:00 -08:00 · 2024-03-04 22:03:53 -08:00 · 2024-03-04 21:06:10 -08:00 · 2024-03-04 17:05:05 -08:00
178 changed files with 5442 additions and 5407 deletions
@@ -1,76 +1,44 @@
 name: "Build Helper"
 on: workflow_dispatch
 env:
-    WAVETERM_VERSION: 0.6.1
    GO_VERSION: "1.21.5"
    NODE_VERSION: "21.5.0"
 jobs:
-    runbuild-darwin-x64:
-        name: "Build MacOS x64"
-        runs-on: macos-latest
-        steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-go@v4
-              with:
-                  go-version: ${{env.GO_VERSION}}
-                  cache-dependency-path: |
-                      wavesrv/go.sum
-                      waveshell/go.sum
-            - run: brew tap scripthaus-dev/scripthaus
-            - run: brew install scripthaus
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: ${{env.NODE_VERSION}}
-                  cache: "yarn"
-            - run: yarn --frozen-lockfile
-            - run: scripthaus run build-package
-            - uses: actions/upload-artifact@v4
-              with:
-                  name: waveterm-build-darwin-x64
-                  path: out/make/zip/darwin/x64/*.zip
-                  retention-days: 2
-    runbuild-darwin-arm64:
-        name: "Build MacOS arm64"
-        runs-on: macos-latest-xlarge
-        steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-go@v4
-              with:
-                  go-version: ${{env.GO_VERSION}}
-                  cache-dependency-path: |
-                      wavesrv/go.sum
-                      waveshell/go.sum
-            - run: brew tap scripthaus-dev/scripthaus
-            - run: brew install scripthaus
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: ${{env.NODE_VERSION}}
-                  cache: "yarn"
-            - run: yarn --frozen-lockfile
-            - run: scripthaus run build-package
-            - uses: actions/upload-artifact@v4
-              with:
-                  name: waveterm-build-darwin-arm64
-                  path: out/make/zip/darwin/arm64/*.zip
-                  retention-days: 2
-    runbuild-linux:
-        name: "Build Linux x64"
-        runs-on: ubuntu-latest
-        needs: [runbuild-darwin-x64, runbuild-darwin-arm64]
+    runbuild:
+        outputs:
+            WAVETERM_VERSION: ${{ steps.set-version.outputs.WAVETERM_VERSION }}
+        strategy:
+            matrix:
+                include:
+                    - platform: "darwin"
+                      arch: "universal"
+                      runner: "macos-latest-xlarge"
+                      scripthaus: "build-package"
+                    - platform: "linux"
+                      arch: "amd64"
+                      runner: "ubuntu-latest"
+                      scripthaus: "build-package-linux"
+        runs-on: ${{ matrix.runner }}
        steps:
            - uses: actions/checkout@v4
            - uses: actions/checkout@v4
              with:
                  repository: scripthaus-dev/scripthaus
                  path: scripthaus
-            - uses: actions/setup-go@v4
+            - name: Install Linux Build Dependencies
+              if: matrix.platform == 'linux'
+              run: |
+                  sudo apt-get update
+                  sudo apt-get install rpm
+            - uses: actions/setup-go@v5
              with:
                  go-version: ${{env.GO_VERSION}}
                  cache-dependency-path: |
                      wavesrv/go.sum
                      waveshell/go.sum
                      scripthaus/go.sum
-            - run: |
+            - name: Install Scripthaus
+              run: |
                  go work use ./scripthaus;
                  cd scripthaus;
                  go get ./...;
@@ -79,22 +47,39 @@ jobs:
              with:
                  node-version: ${{env.NODE_VERSION}}
                  cache: "yarn"
-            - run: yarn --frozen-lockfile
-            - run: ./scripthaus/scripthaus run build-package-linux
+            - name: Set Version
+              id: set-version
+              run: |
+                  VERSION=$(node -e 'console.log(require("./version.js"))')
+                  echo "WAVETERM_VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+            - name: Install Yarn Dependencies
+              run: yarn --frozen-lockfile
+            - name: Build ${{ matrix.platform }}/${{ matrix.arch }}
+              run: ./scripthaus/scripthaus run ${{ matrix.scripthaus }}
+              env:
+                  GOARCH: ${{ matrix.arch }}
+            - uses: actions/upload-artifact@v4
+              with:
+                  name: waveterm-build-${{ matrix.platform }}
+                  path: make/*.* # only upload files from the make directory, not subdirectories
+                  retention-days: 2
+    upload:
+        name: "Upload Builds"
+        runs-on: ubuntu-latest
+        needs: [runbuild]
+        steps:
            - uses: actions/download-artifact@v4
              with:
                  merge-multiple: true
                  path: buildtemp
-            - run: |
-                  mv out/make/zip/linux/x64/Wave-linux-x64-$WAVETERM_VERSION.zip buildtemp/waveterm-linux-x64-v$WAVETERM_VERSION.zip
-            - run: (cd buildtemp; zip ../waveterm-builds.zip *)
-            - run: aws s3 cp waveterm-builds.zip s3://waveterm-github-artifacts/
+            - name: Set `version.txt`
+              run: |
+                  echo "${{ needs.runbuild.outputs.WAVETERM_VERSION }}" >> buildtemp/version.txt
+            - name: Zip Builds
+              run: (cd buildtemp; zip -q ../waveterm-builds.zip *)
+            - name: Upload to S3
+              run: aws s3 cp waveterm-builds.zip s3://waveterm-github-artifacts/
              env:
                  AWS_ACCESS_KEY_ID: "${{ secrets.S3_USERID }}"
                  AWS_SECRET_ACCESS_KEY: "${{ secrets.S3_SECRETKEY }}"
                  AWS_DEFAULT_REGION: us-west-2
-            - uses: actions/upload-artifact@v4
-              with:
-                  name: waveterm-builds
-                  path: buildtemp
-                  retention-days: 2
@@ -12,70 +12,69 @@
 name: "CodeQL"

 on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '36 5 * * 5'
+    push:
+        branches: ["main"]
+    pull_request:
+        branches: ["main"]
+    schedule:
+        - cron: "36 5 * * 5"

 jobs:
-  analyze:
-    name: Analyze
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners
-    # Consider using larger runners for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
+    analyze:
+        name: Analyze
+        # Runner size impacts CodeQL analysis time. To learn more, please see:
+        #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+        #   - https://gh.io/supported-runners-and-hardware-resources
+        #   - https://gh.io/using-larger-runners
+        # Consider using larger runners for possible analysis time improvements.
+        runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+        timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+        permissions:
+            actions: read
+            contents: read
+            security-events: write

-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'go', 'javascript-typescript' ]
-        # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
-        # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
-        # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+        strategy:
+            fail-fast: false
+            matrix:
+                language: ["go", "javascript-typescript"]
+                # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
+                # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
+                # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+                # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4

-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
+            # Initializes the CodeQL tools for scanning.
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@v3
+              with:
+                  languages: ${{ matrix.language }}
+                  # If you wish to specify custom queries, you can do so here or in a config file.
+                  # By default, queries listed here will override any specified in a config file.
+                  # Prefix the list here with "+" to use these queries and those in the config file.

-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+                  # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+                  # queries: security-extended,security-and-quality

+            # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+            # If this step fails, then you should remove it and run the build manually (see below)
+            - name: Autobuild
+              uses: github/codeql-action/autobuild@v3

-    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+            # ℹ️ Command-line programs to run using the OS shell.
+            # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+            #   If the Autobuild fails above, remove it and uncomment the following three lines.
+            #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.

-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+            # - run: |
+            #     echo "Run, Build Application using script"
+            #     ./location_of_script_within_repo/buildscript.sh

-    # - run: |
-    #     echo "Run, Build Application using script"
-    #     ./location_of_script_within_repo/buildscript.sh
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"
+            - name: Perform CodeQL Analysis
+              uses: github/codeql-action/analyze@v3
+              with:
+                  category: "/language:${{matrix.language}}"
@@ -0,0 +1,26 @@
+name: TestDriver.ai Regression Testing
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "0 21 * * *" # every day at 9pm
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: "TestDriver"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dashcamio/testdriver@main
+        id: testdriver
+        # note that .testdriver/prerun.sh runs before this, so the app has launched already
+        with:
+          prompt: |
+            2. click "Continue"
+            2. focus the Wave input with the keyboard shorcut Command + I
+            3. type 'ls' into the input
+            4. press return
+            5. validate Wave shows the result of 'ls'
@@ -20,3 +20,5 @@ temp.sql
 .idea/
 test/
 .vscode/
+make/
+waveterm-builds.zip
@@ -0,0 +1,17 @@
+rm ~/Desktop/WITH-LOVE-FROM-AMERICA.txt
+cd ~/actions-runner/_work/testdriver/testdriver/
+brew install go
+brew tap scripthaus-dev/scripthaus
+brew install scripthaus
+npm install -g yarn
+scripthaus run build-backend
+echo "Yarn"
+yarn
+echo "Rebuild"
+scripthaus run electron-rebuild
+echo "Webpack"
+scripthaus run webpack-build
+echo "Starting Electron"
+scripthaus run electron 1>/dev/null 2>&1 &
+echo "Electron Done"
+exit
@@ -1,15 +1,15 @@
 <p align="center">
  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="./assets/wave-logo_horizontal-coloronblack.svg">
-    <source media="(prefers-color-scheme: light)" srcset="./assets/wave-logo_horizontal-coloronwhite.svg">
-    <img alt="Wave Terminal Logo" src="./assets/wave-logo_horizontal-coloronwhite.svg" width="352" height="59" style="max-width: 100%;">
+    <source media="(prefers-color-scheme: dark)" srcset="./assets/waveterm-logo-horizontal-dark.png">
+    <source media="(prefers-color-scheme: light)" srcset="./assets/waveterm-logo-horizontal-light.png">
+    <img alt="Wave Terminal Logo" src="./assets/waveterm-logo-horizontal-light.png" width="240" height="80" style="max-width: 100%;">
  </picture>
  <br/>
 </p>

 # Wave Terminal

-A open-source, cross-platform, AI-integrated, modern terminal for seamless workflows.
+An open-source, cross-platform, AI-integrated, modern terminal for seamless workflows.

 Wave isn't just another terminal emulator; it's a rethink on how terminals are built. Wave combines command line with the power of the open web to help veteran CLI users and new developers alike.

@@ -179,11 +179,11 @@ THE SOFTWARE.

 -----

-## github.com/google/go-github/v57/github
+## github.com/google/go-github/v59/github

-* Name: github.com/google/go-github/v57/github
-* Version: v57.0.0
-* License: [BSD-3-Clause](https://github.com/google/go-github/blob/v57.0.0/LICENSE)
+* Name: github.com/google/go-github/v59/github
+* Version: v59.0.0
+* License: [BSD-3-Clause](https://github.com/google/go-github/blob/v59.0.0/LICENSE)

 ```txt
 Copyright (c) 2013 The go-github AUTHORS. All rights reserved.
@@ -1,3 +1,3 @@
-temp/
+*/
 *.zip
-*.dmg
+*.dmg
@@ -0,0 +1,67 @@
+# Building for release
+
+## Build Helper workflow
+
+Our release builds are managed by the "Build Helper" GitHub Action, which is defined 
+in [`build-helper.yml`](../.github/workflows/build-helper.yml).
+
+Under the hood, this will call the `build-package` and `build-package-linux` scripts in
+[`scripthaus.md`](../scripthaus.md), which will build the Electron codebase using
+WebPack and then the `wavesrv` and `mshell` binaries, then it will call `electron-builder`
+to generate the distributable app packages. The configuration for `electron-builder`
+is [`electron-builder.config.js`](../electron-builder.config.js).
+
+We are working to fully automate the building of release artifacts. For now,
+manual steps are still required to sign and notarize the macOS artifacts. The
+Linux artifacts do not require additional modification before being published.
+
+## Local signing and notarizing for macOS
+
+The [`prepare-macos.sh`](./prepare-macos.sh) script will download the latest build
+artifacts from S3 and sign and notarize the macOS binaries within it. It will then
+generate a DMG and a new ZIP archive with the new signed app.
+
+This will call a few different JS scripts to perform more complicated operations.
+[`osx-sign.js`](./osx-sign.js) and [`osx-notarize.js`](./osx-notarize.js) call
+underlying Electron APIs to sign and notarize the package.
+[`update-latest-mac.js`](./update-latest-mac.js) will then update the `latest-mac.yml`
+file with the SHA512 checksum and file size of the new signed and notarized installer. This
+is important for the `electron-updater` auto-update mechanism to then find and validate new releases.
+
+## Uploading release artifacts for distribution
+
+### Upload script
+
+Once the build has been fully validated and is ready to be released, the
+[`upload-release.sh`](./upload-release.sh) script is then used to grab the completed
+artifacts and upload them to the `dl.waveterm.dev` S3 bucket for distribution.
+
+### Homebrew
+
+Homebrew currently requires a manual bump of the version, but now that we have auto-updates,
+we should add our cask to the list of apps that can be automatically bumped.
+
+### Linux
+
+We do not currently submit the Linux packages to any of the package repositories. We
+are working on addressing this in the near future.
+
+## `electron-build` configuration
+
+Most of our configuration is fairly standard. The main exception to this is that we exclude
+our Go binaries from the ASAR archive that Electron generates. ASAR files cannot be executed
+by NodeJS because they are not seen as files and therefore cannot be executed via a Shell
+command. More information can be found
+[here](https://www.electronjs.org/docs/latest/tutorial/asar-archives#executing-binaries-inside-asar-archive).
+
+We also exclude most of our `node_modules` from packaging, as WebPack handles packaging
+of any dependencies for us. The one exception is `monaco-editor`.
+
+## Automatic updates
+
+Thanks to `electron-updater`, we are able to provide automatic app updates for macOS and Linux,
+as long as the app was distributed as a DMG, AppImage, RPM, or DEB file.
+
+With each release, `latest-mac.yml` and `latest-linux.yml` files will be produced that point to the
+newest release. These also include file sizes and checksums to aid in validating the packages. The app
+will check these files in our S3 bucket every hour to see if a new version is available.
@@ -1,20 +0,0 @@
-const eu = require("@electron/universal");
-const path = require("path");
-
-let x64Path = path.resolve(__dirname, "temp", "x64", "Wave.app")
-let arm64Path = path.resolve(__dirname, "temp", "arm64", "Wave.app")
-let outPath = path.resolve(__dirname, "temp", "Wave.app")
-
-console.log("building universal package");
-console.log("x64 path", x64Path);
-console.log("arm64 path", arm64Path);
-console.log("output path", outPath);
-
-(async () => {
-    await eu.makeUniversalApp({
-        x64AppPath: x64Path,
-        arm64AppPath: arm64Path,
-        outAppPath: outPath,
-    });
-    console.log("created macos universal app");
-})();
@@ -1,62 +0,0 @@
-#!/bin/bash
-
-# assumes we have Wave-darwin-x64-[version].zip and Wave-darwin-arm64-[version].zip in current directory
-VERSION=0.6.1
-rm -rf temp
-rm -rf builds
-mkdir temp
-mkdir temp/x64
-aws s3 cp s3://waveterm-github-artifacts/waveterm-builds.zip .
-BUILDS_ZIP=waveterm-builds.zip
-if ! [ -f $BUILDS_ZIP ]; then
-    echo "no $BUILDS_ZIP found";
-    exit 1;
-fi
-echo "unzipping $BUILDS_ZIP"
-unzip -q $BUILDS_ZIP -d builds
-X64_ZIP="builds/Wave-darwin-x64-$VERSION.zip"
-ARM64_ZIP="builds/Wave-darwin-arm64-$VERSION.zip"
-if ! [ -f $X64_ZIP ]; then
-    echo "no $X64_ZIP found";
-    exit 1;
-fi
-if ! [ -f $ARM64_ZIP ]; then
-    echo "no $ARM64_ZIP found"
-    exit 1;
-fi
-set -e
-echo "unzipping version v$VERSION zip files"
-ls -l "$X64_ZIP" "$ARM64_ZIP"
-unzip -q $X64_ZIP -d temp/x64
-mkdir temp/arm64
-unzip -q $ARM64_ZIP -d temp/arm64
-lipo -create -output temp/wavesrv temp/x64/Wave.app/Contents/Resources/app/bin/wavesrv temp/arm64/Wave.app/Contents/Resources/app/bin/wavesrv
-rm -rf temp/arm64/Wave.app/Contents/Resources/app
-mv temp/x64/Wave.app/Contents/Resources/app temp/
-cp temp/wavesrv temp/app/bin/wavesrv
-mkdir temp/x64/Wave.app/Contents/Resources/app
-mkdir temp/arm64/Wave.app/Contents/Resources/app
-node build-universal.js
-rm -rf temp/Wave.app/Contents/Resources/app
-mv temp/app temp/Wave.app/Contents/Resources/app
-node osx-sign.js
-DEBUG=electron-notarize node osx-notarize.js
-echo "universal app creation success (build/sign/notarize)"
-echo "creating universal dmg"
-rm -f *.dmg
-DMG_VERSION=$(node -e 'console.log(require("../version.js"))')
-DMG_NAME="waveterm-macos-universal-${DMG_VERSION}.dmg"
-../../create-dmg/create-dmg \
-  --volname "WaveTerm" \
-  --window-pos 200 120 \
-  --window-size 600 300 \
-  --icon-size 100 \
-  --icon "Wave.app" 200 130 \
-  --hide-extension "Wave.app" \
-  --app-drop-link 400 125 \
-  $DMG_NAME \
-  "temp/Wave.app"
-echo "success, created $DMG_NAME"
-mv $DMG_NAME builds/
-rm builds/Wave-darwin-*.zip
-spctl -a -vvv -t install temp/Wave.app/
@@ -0,0 +1,46 @@
+// Usage: node generate-hash.js <path-to-installer>
+// Example: node generate-hash.js ./make/Wave-0.0.1.dmg
+// This script will generate a hash of the installer file, as defined by electron-builder.
+// Courtesy of https://github.com/electron-userland/electron-builder/issues/3913#issuecomment-504698845
+
+const path = require("path");
+const fs = require("fs");
+const crypto = require("crypto");
+
+/**
+ * Generate a hash of a file, as defined by electron-builder
+ * @param {string} file - Path to the file
+ * @param {string} algorithm - Hash algorithm to use
+ * @param {string} encoding - Encoding to use
+ * @returns {Promise<string>} - The hash of the file
+ */
+async function hashFile(file, algorithm = "sha512", encoding = "base64") {
+    return new Promise((resolve, reject) => {
+        const hash = crypto.createHash(algorithm);
+        hash.on("error", reject).setEncoding(encoding);
+        fs.createReadStream(file, {
+            highWaterMark: 1024 * 1024,
+            /* better to use more memory but hash faster */
+        })
+            .on("error", reject)
+            .on("end", () => {
+                hash.end();
+                resolve(hash.read());
+            })
+            .pipe(hash, {
+                end: false,
+            });
+    });
+}
+
+if (require.main === module) {
+    const installerPath = path.resolve(process.cwd(), process.argv[2]);
+    (async () => {
+        const hash = await hashFile(installerPath);
+        console.log(`hash of ${installerPath}: ${hash}`);
+    })();
+}
+
+module.exports = {
+    hashFile,
+};
@@ -1,14 +1,37 @@
-const { notarize } = require('@electron/notarize');
-// DEBUG=electron-notarize
+// Notarize the Wave.app for macOS

-console.log("running osx-notarize");
-notarize({
-    appPath: "temp/Wave.app",
-    tool: "notarytool",
-    keychainProfile: "notarytool-creds",
-}).then(() => {
-    console.log("notarize success");
-}).catch((e) => {
-    console.log("notarize error", e);
-    process.exit(1);
-});
+const { notarize } = require("@electron/notarize");
+const path = require("path");
+
+/**
+ * Notarize the Wave.app for macOS
+ * @param {string} waveAppPath - Path to the Wave.app
+ * @returns {Promise<void>}
+ */
+async function notarizeApp(waveAppPath) {
+    return notarize({
+        appPath: waveAppPath,
+        tool: "notarytool",
+        keychainProfile: "notarytool-creds",
+    })
+        .then(() => {
+            console.log("notarize success");
+        })
+        .catch((e) => {
+            console.log("notarize error", e);
+            process.exit(1);
+        });
+}
+
+if (require.main === module) {
+    console.log("running osx-notarize");
+    const waveAppPath = path.resolve(__dirname, "temp", "Wave.app");
+    (async () => {
+        await notarizeApp(waveAppPath);
+        console.log("notarization complete");
+    })();
+}
+
+module.exports = {
+    notarizeApp,
+};
@@ -1,20 +1,45 @@
-const { signAsync } = require("@electron/osx-sign");
-// DEBUG="electron-osx-sign*"
+// Sign the app and binaries for macOS

-console.log("running osx-sign");
-let waveAppPath = "temp/Wave.app";
-signAsync({
-    app: "temp/Wave.app",
-    binaries: [
-        waveAppPath + "/Contents/Resources/app/bin/wavesrv",
-        waveAppPath + "/Contents/Resources/app/bin/mshell/mshell-v0.4-linux.amd64",
-        waveAppPath + "/Contents/Resources/app/bin/mshell/mshell-v0.4-linux.arm64",
-        waveAppPath + "/Contents/Resources/app/bin/mshell/mshell-v0.4-darwin.amd64",
-        waveAppPath + "/Contents/Resources/app/bin/mshell/mshell-v0.4-darwin.arm64",
-    ],
-}).then(() => {
-    console.log("signing success");
-}).catch((e) => {
-    console.log("signing error", e);
-    process.exit(1);
-});
+const { signAsync } = require("@electron/osx-sign");
+const path = require("path");
+const fs = require("fs");
+
+/**
+ * Sign the app and binaries for macOS
+ * @param {string} waveAppPath - Path to the Wave.app
+ * @returns {Promise<void>}
+ */
+async function signApp(waveAppPath) {
+    const binDirPath = path.resolve(waveAppPath, "Contents", "Resources", "app.asar.unpacked", "bin");
+    const binFilePaths = fs
+        .readdirSync(binDirPath, { recursive: true, withFileTypes: true })
+        .filter((f) => f.isFile())
+        .map((f) => path.resolve(binDirPath, f.path, f.name));
+    console.log("waveAppPath", waveAppPath);
+    console.log("binDirPath", binDirPath);
+    console.log("binFilePaths", binFilePaths);
+    return signAsync({
+        app: waveAppPath,
+        binaries: binFilePaths,
+    })
+        .then(() => {
+            console.log("signing success");
+        })
+        .catch((e) => {
+            console.log("signing error", e);
+            process.exit(1);
+        });
+}
+
+if (require.main === module) {
+    console.log("running osx-sign");
+    const waveAppPath = path.resolve(__dirname, "temp", "Wave.app");
+    (async () => {
+        await signApp(waveAppPath);
+        console.log("signing complete");
+    })();
+}
+
+module.exports = {
+    signApp,
+};
@@ -0,0 +1,88 @@
+#!/bin/bash
+# This script is used to sign and notarize the universal app for macOS
+
+# Gets the directory of the script
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Remove old files and dirs, create new ones
+rm -f *.zip *.dmg
+ZIP_DIR=$SCRIPT_DIR/zip
+rm -rf $ZIP_DIR
+mkdir $ZIP_DIR
+TEMP_DIR=$SCRIPT_DIR/temp
+rm -rf $TEMP_DIR
+mkdir $TEMP_DIR
+BUILDS_DIR=$SCRIPT_DIR/builds
+rm -rf $BUILDS_DIR
+
+# Download the builds zip
+aws s3 cp s3://waveterm-github-artifacts/waveterm-builds.zip .
+BUILDS_ZIP=waveterm-builds.zip
+if ! [ -f $BUILDS_ZIP ]; then
+    echo "no $BUILDS_ZIP found";
+    exit 1;
+fi
+echo "unzipping $BUILDS_ZIP"
+unzip -q $BUILDS_ZIP -d $BUILDS_DIR
+rm $BUILDS_ZIP
+
+# Finds a file in a directory matching a filename pattern. Ensures there is exactly one match.
+find_file() 
+{
+    local FILE_DIR=$1
+    local FILE_PATTERN=$2
+    local FILE_PATH=$(find $FILE_DIR -type f -iname "$FILE_PATTERN")
+    local NUM_MATCHES=$(echo $FILE_PATH | wc -l)
+    if [ "0" -eq "$NUM_MATCHES" ]; then
+        echo "no $FILE_PATTERN found in $FILE_DIR"
+        exit 1
+    elif [ "1" -lt "$NUM_MATCHES" ]; then
+        echo "multiple $FILE_PATTERN found in $FILE_DIR"
+        exit 1
+    fi
+    echo $FILE_PATH
+}
+
+# Unzip Mac build
+MAC_ZIP=$(find_file $BUILDS_DIR "Wave-darwin-universal-*.zip")
+unzip -q $MAC_ZIP -d $TEMP_DIR
+
+# Sign and notarize the app
+node $SCRIPT_DIR/osx-sign.js
+DEBUG=electron-notarize node $SCRIPT_DIR/osx-notarize.js
+
+# Zip and move
+echo "creating universal zip"
+ZIP_NAME=$(basename $MAC_ZIP)
+TEMP_WAVE_DIR_UNIVERSAL=$TEMP_DIR/Wave.app
+ditto $TEMP_WAVE_DIR_UNIVERSAL $ZIP_DIR/Wave.app
+cd $ZIP_DIR
+zip -9yqr $ZIP_NAME Wave.app
+mv $ZIP_NAME $BUILDS_DIR/
+cd $SCRIPT_DIR
+
+# Create a dmg
+# Expects create-dmg repo to be cloned in the same parent directory as the waveterm repo.
+echo "creating universal dmg"
+DMG_NAME=$(echo $ZIP_NAME | sed 's/\.zip/\.dmg/')
+$SCRIPT_DIR/../../create-dmg/create-dmg \
+  --volname "WaveTerm" \
+  --window-pos 200 120 \
+  --window-size 600 300 \
+  --icon-size 100 \
+  --icon "Wave.app" 200 130 \
+  --hide-extension "Wave.app" \
+  --app-drop-link 400 125 \
+  $DMG_NAME \
+  "$TEMP_WAVE_DIR_UNIVERSAL"
+echo "success, created $DMG_NAME"
+mv $DMG_NAME $BUILDS_DIR/
+spctl -a -vvv -t install $TEMP_WAVE_DIR_UNIVERSAL/
+
+# Update latest-mac.yml
+echo "updating latest-mac.yml"
+LATEST_MAC_YML=$BUILDS_DIR/latest-mac.yml
+node $SCRIPT_DIR/update-latest-mac.js $MAC_ZIP $LATEST_MAC_YML
+
+# Clean up
+rm -rf $TEMP_DIR $ZIP_DIR
@@ -1,50 +0,0 @@
-## MacOS Universal Build Notes
-
-This doesn't work out of the box and doesn't seem to be well documented anywhere.
-The basic idea is that we have to create separate x64 and a arm64 builds and
-then link them together using @electron/universal.  Seems easy, but in
-practice it isn't.
-
-(1) The separate x64 and arm64 builds *cannot* be signed (osx-sign).  This
-makes sense because once we lipo the executables together they need to be
-resigned (their SHA sums will change).  If you accidentally sign them
-@electron/universal will also refuse to work.
-
-(2) We already deal with architecture specific builds with Go for wavesrv and
-waveshell.  This upsets @electron/universal as well since these are *binaries*
-and we don't want to lipo them together.
-
-(3) Small differences in waveterm.js.  The non-executable files must be
-*identical*.  Well, that's a problem when we inject build times into the files.
-Other small differences can also happen (like different go toolchains, etc.).
-
-(4) ASAR builds.  By default if there are differences in the "app" folder
-@electron/universal plays some neat tricks to separate out the x64 from the
-arm64 code using a app.asar stub.  That's great for standard electron builds
-where the entrypoint is hardcoded to index.js.  Ours isn't so this doesn't work.
-
-(5) ASAR builds and unpacked files.  I don't know all the details here, but
-for Wave to work we have to have some files unpacked (not in ASAR format).
-The reason is that we execute them directly (e.g. wavesrv and waveshell), they
-aren't just loaded by electron.
-
-(6) Ignoring and skipping files in @electron/universal is hard because
-it just takes one minimatch pattern.
-
---
-
-## Solution
-
-1. Create unsigned builds on x64 and arm64
-2. Move the builds to the core build machine and *extract* their "app" directories.
-In theory because we aren't using any native node modules they function the same in
-both environments.
-3. Run @electron/universal on the two unsigned builds (without their app directories).
-4. lipo wavesrv from x64 and arm64 manually to create a universal wavesrv binary.
-5. Copy our extracted "app" directory (with the newly created universal "wavesrv")
-back into the universal Wave.app created by @electron/universal.
-6. Manually run osx-sign to sign the new universal build (make sure to
-pass the wavesrv and waveshell programs as extra binaries).
-7. Manually create the new universal dmg (using create-dmg).
-
-
@@ -0,0 +1,40 @@
+// Updates the latest-mac.yml file with the signed and notarized version of the latest installer
+// Usage: node update-latest.js <path-to-installer>
+
+const path = require("path");
+const fs = require("fs");
+const { hashFile } = require("./generate-hash");
+const yaml = require("yaml");
+
+/**
+ * Updates the latest-mac.yml file with the signed and notarized version of the latest installer
+ * @param {string} installerPath - Path to the installer
+ * @param {string} ymlPath - Path to the latest-mac.yml file
+ * @returns {Promise<void>}
+ */
+async function updateLatestMac(installerPath, ymlPath) {
+    const hash = (await hashFile(installerPath)).trim();
+    const size = fs.statSync(installerPath).size;
+    const yml = yaml.parse(fs.readFileSync(ymlPath, "utf8"));
+    for (const file of yml.files) {
+        if (file.url === path.basename(installerPath)) {
+            file.sha512 = hash;
+            file.size = size;
+        }
+    }
+    yml.sha512 = hash;
+    fs.writeFileSync(ymlPath, yaml.stringify(yml));
+}
+
+if (require.main === module) {
+    const installerPath = path.resolve(process.cwd(), process.argv[2]);
+    const ymlPath = path.resolve(process.cwd(), process.argv[3]);
+    (async () => {
+        await updateLatestMac(installerPath, ymlPath);
+        console.log("latest-mac.yml updated");
+    })();
+}
+
+module.exports = {
+    updateLatestMac,
+};
@@ -0,0 +1,35 @@
+#!/bin/bash
+# This script is used to upload signed and notarized releases to S3 and update the Electron auto-update release feeds.
+
+# Gets the directory of the script
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+BUILDS_DIR=$SCRIPT_DIR/builds
+TEMP2_DIR=$SCRIPT_DIR/temp2
+
+AUTOUPDATE_RELEASE_PATH="dl.waveterm.dev/releases"
+
+# Copy the builds to the temp2 directory
+echo "Copying builds to temp2"
+rm -rf $TEMP2_DIR
+mkdir -p $TEMP2_DIR
+cp -r $BUILDS_DIR/* $TEMP2_DIR
+
+UVERSION=$(cat $TEMP2_DIR/version.txt)
+
+if [ -z "$UVERSION" ]; then
+    echo "version.txt is empty"
+    exit 1
+fi
+
+# Remove files we don't want to upload
+rm $TEMP2_DIR/version.txt
+rm $TEMP2_DIR/builder-*.yml
+
+# Upload the artifacts
+echo "Uploading build artifacts to $AUTOUPDATE_RELEASE_PATH"
+aws s3 cp $TEMP2_DIR/ s3://$AUTOUPDATE_RELEASE_PATH/ --recursive
+
+# Clean up
+echo "Cleaning up"
+rm -rf $TEMP2_DIR
--- a/Show More
+++ b/Show More