macOS builds: Mac App Store vs. Developer ID

Mirrored from iblai/os · docs/macos-builds.md. This page is generated — edit it in the repository, not here.

The app ships in two macOS variants because Cowork (GhostOS) and the Mac App Store are mutually exclusive.

Why two builds

macOS blocks a sandboxed app from controlling other apps through the Accessibility API — even after the user grants Accessibility permission. So the sandboxed MAS build can show the permission prompt but GhostOS can't actually drive other apps. App Sandbox is required for the Mac App Store and not allowed for what Cowork does, hence the split.

Accessibility itself needs no entitlement — it's a runtime (TCC) permission the user grants in System Settings → Privacy & Security → Accessibility. The app requests it via tauri-plugin-macos-permissions (the "Grant Access" button in User Profile → Advanced → Cowork).

Building

# Mac App Store (sandboxed) — uses the default config
pnpm tauri:build:mas

# Developer ID (non-sandboxed, Cowork works) — applies the overlay
pnpm tauri:build:devid

tauri:build:devid merges src-tauri/tauri.devid.conf.json over the base config, swapping the signing identity and entitlements. Everything else (hardened runtime, provider short name, min OS) is inherited.

Post-build (distribution)

Developer ID: hardened-runtime .app/.dmg must be notarized:

xcrun notarytool submit "path/to/ibl.ai.dmg" \
  --apple-id "$APPLE_ID" --team-id L4FWRM8W5Z --password "$APP_SPECIFIC_PASSWORD" --wait
xcrun stapler staple "path/to/ibl.ai.dmg"

Mac App Store: the signed .app must be wrapped in a .pkg and uploaded:

xcrun productbuild --component "path/to/ibl.ai.app" /Applications "ibl.ai.pkg" \
  --sign "3rd Party Mac Developer Installer: Class Generation, LLC (L4FWRM8W5Z)"
xcrun altool --upload-app -f "ibl.ai.pkg" -t macos \
  --apple-id "$APPLE_ID" --password "$APP_SPECIFIC_PASSWORD"

Prerequisites / certs

Both certificates live under the same team (L4FWRM8W5Z):

• Apple Distribution + a Mac App Store provisioning profile → MAS build.
• Developer ID Application (and Developer ID Installer if you also ship a signed installer) → Developer ID build.

If a cert is missing, signing fails. For unsigned local testing, set signingIdentity to "-" (ad-hoc) in the relevant config.

Note: the Developer ID signing identity string in tauri.devid.conf.json is a placeholder following Apple's naming (Developer ID Application: Class Generation, LLC (L4FWRM8W5Z)). Adjust it to match the exact name in your keychain (security find-identity -v -p codesigning).