manaflow-ai · lawrencecchen · Mar 23, 2026 · Mar 23, 2026 · Mar 23, 2026 · Mar 23, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -35,6 +35,9 @@ jobs:
       - name: Validate release asset guard
         run: node scripts/release_asset_guard.test.js
 
+      - name: Validate app signing helper
+        run: ./tests/test_ci_codesign_app_bundle.sh
+
       - name: Validate current GhosttyKit checksum pin
         run: ./tests/test_ci_ghosttykit_checksum_present.sh
 

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
@@ -368,16 +368,7 @@ jobs:
           for APP_PATH in \
             "build-universal/Build/Products/Release/cmux NIGHTLY.app"
           do
-            CLI_PATH="$APP_PATH/Contents/Resources/bin/cmux"
-            HELPER_PATH="$APP_PATH/Contents/Resources/bin/ghostty"
-            if [ -f "$CLI_PATH" ]; then
-              /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$ENTITLEMENTS" "$CLI_PATH"
-            fi
-            if [ -f "$HELPER_PATH" ]; then
-              /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$ENTITLEMENTS" "$HELPER_PATH"
-            fi
-            /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$ENTITLEMENTS" --deep "$APP_PATH"
-            /usr/bin/codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+            ./scripts/codesign_app_bundle.sh "$APP_PATH" "$APPLE_SIGNING_IDENTITY" "$ENTITLEMENTS"
           done
 
       - name: Notarize apps and dmgs

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -235,16 +235,7 @@ jobs:
           fi
           APP_PATH="build/Build/Products/Release/cmux.app"
           ENTITLEMENTS="cmux.entitlements"
-          CLI_PATH="$APP_PATH/Contents/Resources/bin/cmux"
-          HELPER_PATH="$APP_PATH/Contents/Resources/bin/ghostty"
-          if [ -f "$CLI_PATH" ]; then
-            /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$ENTITLEMENTS" "$CLI_PATH"
-          fi
-          if [ -f "$HELPER_PATH" ]; then
-            /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$ENTITLEMENTS" "$HELPER_PATH"
-          fi
-          /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$ENTITLEMENTS" --deep "$APP_PATH"
-          /usr/bin/codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+          ./scripts/codesign_app_bundle.sh "$APP_PATH" "$APPLE_SIGNING_IDENTITY" "$ENTITLEMENTS"
 
       - name: Notarize app
         if: steps.guard_release_assets.outputs.skip_all != 'true'

diff --git a/Resources/Localizable.xcstrings b/Resources/Localizable.xcstrings
@@ -77797,6 +77797,57 @@
           }
         }
       }
+    },
+    "update.downloadLatestDmg": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Download Latest DMG"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "最新のDMGをダウンロード"
+          }
+        }
+      }
+    },
+    "update.error.installationFailed.message": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "cmux couldn't install the downloaded update. Download the latest DMG to update manually."
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "cmux はダウンロード済みのアップデートをインストールできませんでした。手動で更新するには最新のDMGをダウンロードしてください。"
+          }
+        }
+      }
+    },
+    "update.error.installationFailed.title": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Update Installation Failed"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "アップデートのインストールに失敗しました"
+          }
+        }
+      }
     }
   }
 }
diff --git a/Sources/Update/UpdateDriver.swift b/Sources/Update/UpdateDriver.swift
@@ -117,6 +117,20 @@ class UpdateDriver: NSObject, SPUUserDriver {
                           acknowledgement: @escaping () -> Void) {
         let details = formatErrorForLog(error)
         UpdateLogStore.shared.append("show updater error: \(details)")
+        if usesStandardPresentation,
+           let manualDownloadURL = UpdateViewModel.manualDownloadURL(for: error) {
+            clearCustomStateForStandardPresentation()
+            presentManualDownloadAlert(for: error, manualDownloadURL: manualDownloadURL) { [weak self] shouldRetry in
+                self?.finishUserInitiatedCheckPresentation()
+                acknowledgement()
+                guard shouldRetry else { return }
+                DispatchQueue.main.async {
+                    guard let delegate = NSApp.delegate as? AppDelegate else { return }
+                    delegate.checkForUpdates(nil)
+                }
+            }
+            return
+        }
         if usesStandardPresentation {
             clearCustomStateForStandardPresentation()
             standard.showUpdaterError(error) { [weak self] in
@@ -457,6 +471,40 @@ class UpdateDriver: NSObject, SPUUserDriver {
         }
     }
 
+    private func presentManualDownloadAlert(
+        for error: any Error,
+        manualDownloadURL: URL,
+        completion: @escaping (Bool) -> Void
+    ) {
+        runOnMain {
+            let alert = NSAlert()
+            alert.alertStyle = .warning
+            alert.messageText = UpdateViewModel.userFacingErrorTitle(for: error)
+            alert.informativeText = UpdateViewModel.userFacingErrorMessage(for: error)
+            alert.addButton(withTitle: String(localized: "update.downloadLatestDmg", defaultValue: "Download Latest DMG"))
+            alert.addButton(withTitle: String(localized: "common.retry", defaultValue: "Retry"))
+            alert.addButton(withTitle: String(localized: "common.ok", defaultValue: "OK"))
+
+            let handleResponse: (NSApplication.ModalResponse) -> Void = { response in
+                switch response {
+                case .alertFirstButtonReturn:
+                    NSWorkspace.shared.open(manualDownloadURL)
+                    completion(false)
+                case .alertSecondButtonReturn:
+                    completion(true)
+                default:
+                    completion(false)
+                }
+            }
+
+            if let window = NSApp.keyWindow ?? NSApp.mainWindow {
+                alert.beginSheetModal(for: window, completionHandler: handleResponse)
+            } else {
+                handleResponse(alert.runModal())
+            }
+        }
+    }
+
     private func runOnMain(_ action: @escaping () -> Void) {
         if Thread.isMainThread {
             action()

diff --git a/Sources/Update/UpdatePopoverView.swift b/Sources/Update/UpdatePopoverView.swift
@@ -345,6 +345,7 @@ fileprivate struct UpdateErrorView: View {
             technicalDetails: error.technicalDetails,
             feedURLString: error.feedURLString
         )
+        let manualDownloadURL = UpdateViewModel.manualDownloadURL(for: error.error)
 
         VStack(alignment: .leading, spacing: 16) {
             VStack(alignment: .leading, spacing: 8) {
@@ -389,6 +390,15 @@ fileprivate struct UpdateErrorView: View {
 
                 Spacer()
 
+                if let manualDownloadURL {
+                    Button(String(localized: "update.downloadLatestDmg", defaultValue: "Download Latest DMG")) {
+                        error.dismiss()
+                        dismiss()
+                        NSWorkspace.shared.open(manualDownloadURL)
+                    }
+                    .controlSize(.small)
+                }
+
                 Button(String(localized: "common.retry", defaultValue: "Retry")) {
                     error.retry()
                     dismiss()

diff --git a/Sources/Update/UpdateViewModel.swift b/Sources/Update/UpdateViewModel.swift
@@ -4,6 +4,9 @@ import SwiftUI
 import Sparkle
 
 class UpdateViewModel: ObservableObject {
+    static let manualDownloadDMGURLString = "https://github.com/manaflow-ai/cmux/releases/latest/download/cmux-macos.dmg"
+    static let manualDownloadNightlyDMGURLString = "https://github.com/manaflow-ai/cmux/releases/download/nightly/cmux-nightly-macos.dmg"
+
     @Published var state: UpdateState = .idle
     @Published var overrideState: UpdateState?
     @Published var detectedUpdateVersion: String?
@@ -235,8 +238,8 @@ class UpdateViewModel: ObservableObject {
         }
         if nsError.domain == SUSparkleErrorDomain {
             switch nsError.code {
-            case 4005:
-                return String(localized: "update.error.permissionError.title", defaultValue: "Updater Permission Error")
+            case 4000, 4001, 4002, 4003, 4004, 4005, 4010, 4012:
+                return String(localized: "update.error.installationFailed.title", defaultValue: "Update Installation Failed")
             case 2001:
                 return String(localized: "update.error.downloadFailed.title", defaultValue: "Couldn't Download Update")
             case 1000, 1002:
@@ -282,6 +285,8 @@ class UpdateViewModel: ObservableObject {
         }
         if nsError.domain == SUSparkleErrorDomain {
             switch nsError.code {
+            case 4000, 4001, 4002, 4003, 4004, 4005, 4010, 4012:
+                return String(localized: "update.error.installationFailed.message", defaultValue: "cmux couldn't install the downloaded update. Download the latest DMG to update manually.")
             case 2001:
                 return String(localized: "update.error.feedDownload.message", defaultValue: "cmux couldn't download the update feed. Check your connection and try again.")
             case 1000, 1002:
@@ -292,7 +297,7 @@ class UpdateViewModel: ObservableObject {
                 return String(localized: "update.error.insecureFeed.message", defaultValue: "The update feed is insecure. Please contact support.")
             case 1, 2, 3001, 3002:
                 return String(localized: "update.error.signatureError.message", defaultValue: "The update's signature could not be verified. Please try again later.")
-            case 1003, 1005, 4005:
+            case 1003, 1005:
                 return String(localized: "update.error.permissionError.message", defaultValue: "Move cmux into Applications and relaunch to enable updates.")
             default:
                 break
@@ -340,6 +345,14 @@ class UpdateViewModel: ObservableObject {
         return lines.joined(separator: "\n")
     }
 
+    static func manualDownloadURL(for error: Swift.Error) -> URL? {
+        let nsError = error as NSError
+        guard shouldOfferManualDownload(for: nsError) else { return nil }
+        let infoFeedURL = Bundle.main.object(forInfoDictionaryKey: "SUFeedURL") as? String
+        let isNightly = UpdateFeedResolver.resolvedFeedURLString(infoFeedURL: infoFeedURL).isNightly
+        return URL(string: isNightly ? manualDownloadNightlyDMGURLString : manualDownloadDMGURLString)
+    }
+
     private static func networkError(from error: NSError) -> NSError? {
         if error.domain == NSURLErrorDomain {
             return error
@@ -357,6 +370,14 @@ class UpdateViewModel: ObservableObject {
         case 2: return "SUInsufficientSigningError"
         case 3: return "SUInsecureFeedURLError"
         case 4: return "SUInvalidFeedURLError"
+        case 4000: return "SUFileCopyFailure"
+        case 4001: return "SUAuthenticationFailure"
+        case 4002: return "SUMissingUpdateError"
+        case 4003: return "SUMissingInstallerToolError"
+        case 4004: return "SURelaunchError"
+        case 4005: return "SUInstallationError"
+        case 4010: return "SUAgentInvalidationError"
+        case 4012: return "SUInstallationWriteNoPermissionError"
         case 1000: return "SUAppcastParseError"
         case 1001: return "SUNoUpdateError"
         case 1002: return "SUAppcastError"
@@ -370,6 +391,19 @@ class UpdateViewModel: ObservableObject {
         }
     }
 
+    private static func shouldOfferManualDownload(for error: NSError) -> Bool {
+        guard error.domain == SUSparkleErrorDomain else {
+            return false
+        }
+
+        switch error.code {
+        case 4000, 4001, 4002, 4003, 4004, 4005, 4010, 4012:
+            return true
+        default:
+            return false
+        }
+    }
+
     static func normalizedDetectedUpdateVersion(from version: String) -> String? {
         let trimmed = version.trimmingCharacters(in: .whitespacesAndNewlines)
         return trimmed.isEmpty ? nil : trimmed

diff --git a/cmuxTests/ShortcutAndCommandPaletteTests.swift b/cmuxTests/ShortcutAndCommandPaletteTests.swift
@@ -6,6 +6,7 @@ import WebKit
 import ObjectiveC.runtime
 import Bonsplit
 import UserNotifications
+import Sparkle
 
 #if canImport(cmux_DEV)
 @testable import cmux_DEV
@@ -949,6 +950,59 @@ final class UpdateViewModelPresentationTests: XCTestCase {
         XCTAssertFalse(viewModel.showsDetectedBackgroundUpdate)
         XCTAssertEqual(viewModel.text, "Checking for Updates…")
     }
+
+    func testSparkleInstallationErrorUsesManualInstallCopy() {
+        let error = NSError(
+            domain: SUSparkleErrorDomain,
+            code: 4005,
+            userInfo: [NSLocalizedDescriptionKey: "Failed to create installation cache directory"]
+        )
+
+        XCTAssertEqual(UpdateViewModel.userFacingErrorTitle(for: error), "Update Installation Failed")
+        XCTAssertEqual(
+            UpdateViewModel.userFacingErrorMessage(for: error),
+            "cmux couldn't install the downloaded update. Download the latest DMG to update manually."
+        )
+    }
+
+    func testSparkleInstallationErrorOffersManualDownloadURL() {
+        let error = NSError(
+            domain: SUSparkleErrorDomain,
+            code: 4005,
+            userInfo: [NSLocalizedDescriptionKey: "Failed to create installation cache directory"]
+        )
+
+        XCTAssertEqual(
+            UpdateViewModel.manualDownloadURL(for: error)?.absoluteString,
+            "https://github.com/manaflow-ai/cmux/releases/latest/download/cmux-macos.dmg"
+        )
+    }
+
+    func testSparkleInstallationErrorDetailsUseSparkleCodeName() {
+        let error = NSError(
+            domain: SUSparkleErrorDomain,
+            code: 4005,
+            userInfo: [NSLocalizedDescriptionKey: "Failed to create installation cache directory"]
+        )
+
+        let details = UpdateViewModel.errorDetails(
+            for: error,
+            technicalDetails: nil,
+            feedURLString: nil
+        )
+
+        XCTAssertTrue(details.contains("Code: SUInstallationError (4005)"))
+    }
+
+    func testNetworkErrorDoesNotOfferManualDownloadURL() {
+        let error = NSError(
+            domain: NSURLErrorDomain,
+            code: NSURLErrorTimedOut,
+            userInfo: [NSLocalizedDescriptionKey: "Timed out"]
+        )
+
+        XCTAssertNil(UpdateViewModel.manualDownloadURL(for: error))
+    }
 }
 
 @MainActor

diff --git a/scripts/build-sign-upload.sh b/scripts/build-sign-upload.sh
@@ -92,15 +92,7 @@ echo "Sparkle keys injected"
 
 # --- Codesign ---
 echo "Codesigning..."
-CLI_PATH="$APP_PATH/Contents/Resources/bin/cmux"
-if [ -f "$CLI_PATH" ]; then
-  /usr/bin/codesign --force --options runtime --timestamp --sign "$SIGN_HASH" --entitlements "$ENTITLEMENTS" "$CLI_PATH"
-fi
-if [ -f "$HELPER_PATH" ]; then
-  /usr/bin/codesign --force --options runtime --timestamp --sign "$SIGN_HASH" --entitlements "$ENTITLEMENTS" "$HELPER_PATH"
-fi
-/usr/bin/codesign --force --options runtime --timestamp --sign "$SIGN_HASH" --entitlements "$ENTITLEMENTS" --deep "$APP_PATH"
-/usr/bin/codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+./scripts/codesign_app_bundle.sh "$APP_PATH" "$SIGN_HASH" "$ENTITLEMENTS"
 echo "Codesign verified"
 
 # --- Notarize app ---