Release v0.1.1 and repair macOS overlay reliability

.github/workflows/release.yml

@@ -47,6 +47,18 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
+      # An unsigned bundle is installable but can never hold an Accessibility
+      # grant: macOS lists it, accepts the toggle, and still reports the process
+      # as untrusted. Build and check the signature before anything is published;
+      # the release step below reuses this cached build.
+      - name: Build and verify the signed bundle
+        run: |
+          pnpm tauri build --target universal-apple-darwin --bundles app
+          app="src-tauri/target/universal-apple-darwin/release/bundle/macos/Desktop Translator.app"
+          codesign --verify --verbose=2 "$app"
+          codesign -dv --verbose=2 "$app" 2>&1 | grep -q '^Signature=' \
+            || { echo "bundle is unsigned"; exit 1; }
+
       - uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -73,6 +85,11 @@ jobs:
             On first run, grant Accessibility permission when prompted, then
             add your own Google Cloud Translation API key in Settings.
 
+            The app is ad-hoc signed, so its code identity changes with every
+            release. After installing an update, macOS drops the old grant:
+            remove the stale entry in Privacy & Security → Accessibility and
+            add the new one.
+
             ## Platform support
 
             macOS only. The Windows adapters are written but have not been

.gitignore

@@ -1,4 +1,5 @@
 .work-bundle/
+.codegraph/
 AGENTS.md
 roles/
 node_modules/

README.md

@@ -82,7 +82,16 @@ Two things are needed before the first translation.
 **1. Grant Accessibility permission.** The app reads the selected text and its
 on-screen position through the macOS Accessibility API. On first launch it will
 point you at *System Settings → Privacy & Security → Accessibility*; enable
-Desktop Translator there.
+Desktop Translator there, then **quit the app from the menu bar and open it
+again**. macOS does not apply a new Accessibility grant to a process that is
+already running, which is why the warning can remain after the switch is on.
+
+> [!IMPORTANT]
+> Releases are ad-hoc signed, so the code identity changes with every version.
+> macOS ties an Accessibility grant to that identity, which means an update
+> silently invalidates the old grant even though the switch still looks enabled.
+> After updating, remove the stale Desktop Translator entry from the
+> Accessibility list and add the new app again.
 
 > [!NOTE]
 > No screen capture is involved and no Screen Recording permission is requested.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "desktop-translator",
   "private": true,
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "scripts": {
     "dev": "vite",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "desktop-translator"
-version = "0.1.0"
+version = "0.1.1"
 description = "Lightweight cross-platform selection translator"
 authors = ["Desktop Translator Contributors"]
 edition = "2021"
@@ -17,7 +17,11 @@ async-trait = "0.1.92"
 crossbeam-channel = "0.5.16"
 html-escape = "0.2.15"
 keyring = { version = "4.1.6", default-features = false, features = ["apple-native-keyring-store", "v1", "windows-native-keyring-store"] }
-reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls"] }
+# `system-proxy` and `socks` are part of reqwest's defaults and must be kept
+# explicitly: without them the client only honours HTTP_PROXY-style variables,
+# which a GUI app launched from Finder never inherits. Users who reach Google
+# only through a local proxy would see every request time out.
+reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls", "socks", "system-proxy"] }
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 tauri = { version = "2.11.5", features = ["image-png", "macos-private-api", "tray-icon"] }