review(coderabbit): dedup cargo stages into bundle-lib.sh + doc/test fixes

roost_find_cargo / roost_setup_cargo_profile / roost_cargo_target_dir
extracted so bundle-iced.sh and the roostctl embed stage share one
copy of cargo discovery, profile mapping, and CARGO_TARGET_DIR
anchoring (the comment said the paths must not diverge; a second copy
is what permits divergence). bundle-iced.sh's header no longer files
shared deferrals (notarize/DMG) under "unlike bundle.sh", and its
Developer ID bullet is gone — the script does sign with one when
ROOST_DEVELOPER_ID_IDENTITY is set. client.py's app_dock_badge
docstring now names the Swift app's unknown-op answer instead of
claiming every other UI says not-implemented. tempfile.mktemp replaced
with a uuid-based never-created path helper (ruff S306).

Verified: shellcheck clean, test-harness 101 OK, bundle rebuilt +
e2e-iced-bundle 14 passed.

Skipped (replied on the thread): the cross-language bundle-identity
consistency check — executable-name drift already fails the eager
Contents/MacOS/Roost-Iced validation, and app-id drift fails the
identity assertion with the exact wanted line quoted, so drift is loud
today; a three-way generator is more machinery than the risk warrants.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AyvCPrbetEKy3iHgKLQmwq

Author: charliek

mac/scripts/bundle-iced.sh

@@ -35,8 +35,9 @@
 #     the two bundles (6c decision, not made here); see the header
 #     comment in Info-iced.plist.template for why the Sparkle plist
 #     keys are absent too.
-#   * Code-sign with a Developer ID certificate (ad-hoc until #83,
-#     same as bundle.sh).
+#
+# Deferred the same way bundle.sh defers them (shared posture, not a
+# difference):
 #   * Notarize via `notarytool`.
 #   * Build a DMG (out of scope — plan 027 scope brief: local build
 #     only, no release.yml wiring).
@@ -95,42 +96,18 @@ APP_DIR="${OUT_DIR}/${APP_NAME}.app"
 
 roost_check_libghostty_archive "${REPO_ROOT}"
 
-CARGO_BIN="$(command -v cargo || true)"
-if [ -z "${CARGO_BIN}" ] && [ -x "${HOME}/.cargo/bin/cargo" ]; then
-  CARGO_BIN="${HOME}/.cargo/bin/cargo"
-fi
-if [ -z "${CARGO_BIN}" ]; then
-  echo "error: cargo not found on PATH or at ~/.cargo/bin/cargo" >&2
-  exit 1
-fi
+CARGO_BIN="$(roost_find_cargo)"
+roost_setup_cargo_profile "${CONFIG}"
 
-CARGO_PROFILE_FLAG="--release"
-CARGO_PROFILE_DIR="release"
-if [ "${CONFIG}" = "debug" ]; then
-  CARGO_PROFILE_FLAG=""
-  CARGO_PROFILE_DIR="debug"
-fi
-
-echo "==> Building roost-iced (cargo build -p roost-iced --${CARGO_PROFILE_DIR})"
+echo "==> Building roost-iced (cargo build -p roost-iced --${ROOST_CARGO_PROFILE_DIR})"
 (
   cd "${REPO_ROOT}"
-  # shellcheck disable=SC2086  # CARGO_PROFILE_FLAG must word-split (empty => no flag)
-  "${CARGO_BIN}" build -p roost-iced ${CARGO_PROFILE_FLAG}
+  # shellcheck disable=SC2086  # ROOST_CARGO_PROFILE_FLAG must word-split (empty => no flag)
+  "${CARGO_BIN}" build -p roost-iced ${ROOST_CARGO_PROFILE_FLAG}
 )
 
-# Respect CARGO_TARGET_DIR for artifact discovery, exactly like the
-# roostctl embed step in bundle-lib.sh — shared caches (sccache, CI
-# matrices fanning out across configs) routinely override the default
-# `<repo>/target/` location.
-CARGO_TARGET="${CARGO_TARGET_DIR:-${REPO_ROOT}/target}"
-# Cargo resolves a relative CARGO_TARGET_DIR from its own CWD (the repo
-# root, where the build subshell cd's) — anchor discovery the same way so
-# the two can't diverge.
-case "${CARGO_TARGET}" in
-  /*) ;;
-  *) CARGO_TARGET="${REPO_ROOT}/${CARGO_TARGET}" ;;
-esac
-ICED_BUILD_BIN="${CARGO_TARGET}/${CARGO_PROFILE_DIR}/roost-iced"
+CARGO_TARGET="$(roost_cargo_target_dir "${REPO_ROOT}")"
+ICED_BUILD_BIN="${CARGO_TARGET}/${ROOST_CARGO_PROFILE_DIR}/roost-iced"
 if [ ! -x "${ICED_BUILD_BIN}" ]; then
   echo "error: cargo build did not produce ${ICED_BUILD_BIN}" >&2
   exit 1

mac/scripts/bundle-lib.sh

@@ -142,6 +142,58 @@ roost_install_app_icon() {
   fi
 }
 
+# roost_find_cargo
+#
+# Prints the cargo to invoke. Discovers `cargo` on PATH instead of
+# hardcoding ~/.cargo/bin/cargo — release runners may have cargo at a
+# different prefix (toolchain managed by mise / rustup / system
+# package). Falling back to the literal path preserves the prior
+# behavior for the common dev case.
+roost_find_cargo() {
+  local cargo_bin
+  cargo_bin="$(command -v cargo || true)"
+  if [ -z "${cargo_bin}" ] && [ -x "${HOME}/.cargo/bin/cargo" ]; then
+    cargo_bin="${HOME}/.cargo/bin/cargo"
+  fi
+  if [ -z "${cargo_bin}" ]; then
+    echo "error: cargo not found on PATH or at ~/.cargo/bin/cargo" >&2
+    exit 1
+  fi
+  echo "${cargo_bin}"
+}
+
+# roost_setup_cargo_profile CONFIG
+#
+# Sets ROOST_CARGO_PROFILE_FLAG (word-split deliberately; empty for
+# debug) and ROOST_CARGO_PROFILE_DIR in the caller's scope — the same
+# caller-scope convention roost_setup_signing uses.
+roost_setup_cargo_profile() {
+  ROOST_CARGO_PROFILE_FLAG="--release"
+  ROOST_CARGO_PROFILE_DIR="release"
+  if [ "$1" = "debug" ]; then
+    ROOST_CARGO_PROFILE_FLAG=""
+    ROOST_CARGO_PROFILE_DIR="debug"
+  fi
+}
+
+# roost_cargo_target_dir REPO_ROOT
+#
+# Prints the artifact root, honoring CARGO_TARGET_DIR — shared caches
+# (e.g. sccache + CI matrices that fan out across configs) routinely
+# override the default `<repo>/target/` location. Cargo resolves a
+# relative CARGO_TARGET_DIR from its own CWD (the repo root, where the
+# build subshells cd) — discovery anchors the same way so the two
+# can't diverge.
+roost_cargo_target_dir() {
+  local repo_root="$1"
+  local cargo_target="${CARGO_TARGET_DIR:-${repo_root}/target}"
+  case "${cargo_target}" in
+    /*) ;;
+    *) cargo_target="${repo_root}/${cargo_target}" ;;
+  esac
+  echo "${cargo_target}"
+}
+
 # roost_build_and_embed_roostctl REPO_ROOT APP_DIR CONFIG
 #
 # Embed roostctl under Contents/Resources/bin/ so `claude install`
@@ -150,32 +202,16 @@ roost_install_app_icon() {
 # fast and tracked through the same Cargo cache as any cargo build
 # invocation; rebuilding here keeps the bundle in lockstep with
 # whatever roost-cli source the developer has checked out.
-#
-# Discovers `cargo` on PATH instead of hardcoding ~/.cargo/bin/cargo.
-# Release runners may have cargo at a different prefix (toolchain
-# managed by mise / rustup / system package). Falling back to the
-# literal path preserves the prior behavior for the common dev case.
 roost_build_and_embed_roostctl() {
   local repo_root="$1"
   local app_dir="$2"
   local config="$3"
 
   local cargo_bin
-  cargo_bin="$(command -v cargo || true)"
-  if [ -z "${cargo_bin}" ] && [ -x "${HOME}/.cargo/bin/cargo" ]; then
-    cargo_bin="${HOME}/.cargo/bin/cargo"
-  fi
-  if [ -z "${cargo_bin}" ]; then
-    echo "error: cargo not found on PATH or at ~/.cargo/bin/cargo" >&2
-    exit 1
-  fi
-
-  local cargo_profile_flag="--release"
-  local cargo_profile_dir="release"
-  if [ "${config}" = "debug" ]; then
-    cargo_profile_flag=""
-    cargo_profile_dir="debug"
-  fi
+  cargo_bin="$(roost_find_cargo)"
+  roost_setup_cargo_profile "${config}"
+  local cargo_profile_flag="${ROOST_CARGO_PROFILE_FLAG}"
+  local cargo_profile_dir="${ROOST_CARGO_PROFILE_DIR}"
   echo "==> Building roostctl (cargo build -p roost-cli --${cargo_profile_dir})"
   (
     # shellcheck disable=SC2164  # callers run this lib under `set -e`
@@ -184,17 +220,8 @@ roost_build_and_embed_roostctl() {
     "${cargo_bin}" build -p roost-cli ${cargo_profile_flag}
   )
 
-  # Respect CARGO_TARGET_DIR for the artifact-discovery step. Shared
-  # caches (e.g. sccache + CI matrices that fan out across configs)
-  # routinely override the default `<repo>/target/` location.
-  local cargo_target="${CARGO_TARGET_DIR:-${repo_root}/target}"
-  # Cargo resolves a relative CARGO_TARGET_DIR from its own CWD (the
-  # repo root, where the build subshell cd's) — anchor discovery the
-  # same way so the two can't diverge.
-  case "${cargo_target}" in
-    /*) ;;
-    *) cargo_target="${repo_root}/${cargo_target}" ;;
-  esac
+  local cargo_target
+  cargo_target="$(roost_cargo_target_dir "${repo_root}")"
   local roostctl_src="${cargo_target}/${cargo_profile_dir}/roostctl"
   if [ ! -x "${roostctl_src}" ]; then
     echo "error: cargo build did not produce ${roostctl_src}" >&2

tools/roosttest/client.py

@@ -565,8 +565,10 @@ def app_dock_badge(self) -> str | None:
         the badge write actually landed.
 
         Gated by ROOST_TEST_MODE=1 (raises `RoostError('not-enabled')`
-        when off) and macOS-iced-only: every other UI, and the iced UI on
-        Linux, answers `RoostError('not-implemented')`."""
+        when off) and macOS-iced-only: the GTK UI and the iced UI on
+        Linux answer `RoostError('not-implemented')`; the Swift Mac app
+        has no dispatcher case at all and answers
+        `RoostError('unknown-op')` (same as `tab.feed_ime`)."""
         res = self.call("app.dock_badge", {})
         # Direct key access: a missing field is a protocol violation, and
         # `.get` would read it as "badge cleared" — the exact state the

tools/roosttest_unit/test_iced_bundle_launch.py

@@ -15,16 +15,24 @@
 import sys
 import tempfile
 import unittest
+import uuid
 from pathlib import Path
 from unittest.mock import Mock, patch
 
 ROOSTTEST_DIR = Path(__file__).resolve().parents[1] / "roosttest"
 sys.path.insert(0, str(ROOSTTEST_DIR))
 
 import ui  # noqa: E402
+
 from client import RoostError  # noqa: E402
 
 
+def _absent_log_path() -> Path:
+    """A unique path that is never created — mocks the UI log location
+    without `tempfile.mktemp`'s predictable-name hazard (ruff S306)."""
+    return Path(tempfile.gettempdir()) / f"roost-absent-{uuid.uuid4().hex}.log"
+
+
 def _make_bundle(root: Path, executable_name: str = "Roost-Iced") -> Path:
     app = root / "Roost-Iced.app"
     macos_dir = app / "Contents" / "MacOS"
@@ -284,7 +292,7 @@ class BundlePidVerificationTests(unittest.TestCase):
 
     def test_mismatched_process_name_refuses_to_adopt_the_pid(self) -> None:
         with (
-            patch("ui._iced_bundle_ui_log_path", return_value=Path(tempfile.mktemp())),
+            patch("ui._iced_bundle_ui_log_path", return_value=_absent_log_path()),
             patch("ui.subprocess.run"),
             patch("ui.wait_alive"),
             patch("ui._answering_pid", return_value=4242),
@@ -309,7 +317,7 @@ def test_matching_process_name_adopts_the_pid(self) -> None:
                 },
                 clear=True,
             ),
-            patch("ui._iced_bundle_ui_log_path", return_value=Path(tempfile.mktemp())),
+            patch("ui._iced_bundle_ui_log_path", return_value=_absent_log_path()),
             patch("ui.subprocess.run") as run,
             patch("ui.wait_alive"),
             patch("ui._answering_pid", return_value=4242),
@@ -340,8 +348,12 @@ def test_matching_process_name_adopts_the_pid(self) -> None:
 
     def _launch_argv_with_env(self, env: dict[str, str]) -> list[str]:
         with (
+            tempfile.TemporaryDirectory() as temp_dir,
             patch.dict(os.environ, env, clear=True),
-            patch("ui._iced_bundle_ui_log_path", return_value=Path(tempfile.mktemp())),
+            patch(
+                "ui._iced_bundle_ui_log_path",
+                return_value=Path(temp_dir) / "iced-ui.log",
+            ),
             patch("ui.subprocess.run") as run,
             patch("ui.wait_alive"),
             patch("ui._answering_pid", return_value=4242),
@@ -372,7 +384,7 @@ def test_executable_outside_the_bundle_refuses_to_adopt_the_pid(self) -> None:
         e.g. a `Roost-Iced` on $PATH from an unrelated build. Must not be
         adopted even though the process-name check alone would pass."""
         with (
-            patch("ui._iced_bundle_ui_log_path", return_value=Path(tempfile.mktemp())),
+            patch("ui._iced_bundle_ui_log_path", return_value=_absent_log_path()),
             patch("ui.subprocess.run"),
             patch("ui.wait_alive"),
             patch("ui._answering_pid", return_value=4242),
@@ -393,7 +405,7 @@ def test_identity_mismatch_pkills_by_name_when_no_pid_was_ever_adopted(
         self,
     ) -> None:
         with (
-            patch("ui._iced_bundle_ui_log_path", return_value=Path(tempfile.mktemp())),
+            patch("ui._iced_bundle_ui_log_path", return_value=_absent_log_path()),
             patch("ui.subprocess.run") as run,
             patch("ui.wait_alive"),
             patch("ui._answering_pid", return_value=4242),
@@ -411,7 +423,7 @@ def test_canary_failure_after_pid_adoption_pid_kills_the_bundle(self) -> None:
         down through the pid-based path, not a name-based `pkill`."""
         with (
             patch.dict(os.environ, {"ROOST_TEST_MODE": "1"}, clear=True),
-            patch("ui._iced_bundle_ui_log_path", return_value=Path(tempfile.mktemp())),
+            patch("ui._iced_bundle_ui_log_path", return_value=_absent_log_path()),
             patch("ui.subprocess.run") as run,
             patch("ui.wait_alive"),
             patch("ui._answering_pid", return_value=4242),