One Window, One Signature

Two commits today, both on the desktop app, both the annoying kind of bug: nothing crashes, it just looks wrong the first time someone touches it.

The Brain admin interface used to open in its own window. A second window, small, no real chrome — it read like a stray popup that got loose, not the admin screen you actually asked for. Now it opens where chat was: same window, same frame, content swapped. Clicking the logo brings chat back. The fix generalizes past Brain specifically — any page the app’s own server wants to show in its own window now gets shown in that same one window instead. The desktop app cannot grow a second window anymore, full stop. Links to anywhere outside the app still open in the Mac’s own apps, because that boundary is correct and stays. One side effect of going down to a single window: the rule that force-quit the whole app when the main window closed turned out to be dead weight. With one window, closing it already quits. Rule deleted — about 30 lines of window-handling code gone, net.

The second commit fixes something that looked worse than it was, which is almost worse. The desktop build’s signature only ever covered the inner binary, not the full app bundle wrapped around it. Download that build through a browser and Gatekeeper called it damaged — not unverified, not “open with caution,” damaged, like the zip got corrupted on the way down. That’s the wrong message for a build that works fine, and it sends people straight to deleting the download instead of to Privacy & Security, where the real override lives. Signing the whole bundle instead of just the binary fixes the message: it now reads as the normal unidentified-developer warning, not a damaged-file error. Hardened runtime stays off on purpose. An ad-hoc build can’t be notarized either way, so there’s no distribution upside to turning it on, and doing it without the matching entitlements would have cut off microphone access — which voice needs. Right-sized fix: change what Gatekeeper is told, don’t reach for a setting that breaks something else to fix a message.

Different files, same instinct: the desktop app should present as one coherent thing, not a binary with a window problem and a signature with a wording problem, patched in isolation. Getting someone from “downloaded the file” to “looking at a working app” without a scary dialog or a stray popup window is unglamorous work. It’s also the whole first impression, and first impressions decide whether anyone opens the app a second time.

• Brain now opens inside the app’s single window instead of popping a separate, tiny window that read like a popup

• Any server page asking for its own window gets shown in that same one window — the desktop app can no longer grow a second window

• The rule that quit the app when the main window closed is gone; with one window, closing it already quits

• The desktop bundle is now signed as a whole, not just the inner binary, so Gatekeeper calls it unverified instead of damaged

• Hardened runtime stays off on purpose — an ad-hoc build can’t be notarized either way, and turning it on without entitlements would break the microphone