Merge fix-bundle-module-launch-crash: the real cause of the launch crash

Bundle.module fatalErrors in any packaged .app, because its only resolvable
candidate was an absolute .build path from the compiling machine. Reproduced
locally by hiding .build (old build: Trace/BPT trap 5, exit 133; fixed build:
runs), which matches the Mac mini crash report exactly.

Author: mannasdev

Scripts/package-app.sh

@@ -16,11 +16,21 @@ rm -rf "$APP"
 mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 cp "$BIN" "$APP/Contents/MacOS/HudsonApp"
 
-# SwiftPM resource bundles (bundled fonts, etc.) go in Contents/Resources —
-# that's the FIRST location `Bundle.module` probes (via Bundle.main.resourceURL)
-# AND the only spot codesign accepts a nested bundle. Putting them in
-# Contents/MacOS launches fine unsigned but makes codesign reject the whole
+# SwiftPM resource bundles (bundled fonts, etc.) go in Contents/Resources
+# because that is the only spot codesign accepts a nested bundle. Putting them
+# in Contents/MacOS launches fine unsigned but makes codesign reject the whole
 # app as "bundle format unrecognized," so it must be Resources for notarization.
+#
+# This comment used to also claim Contents/Resources is "the FIRST location
+# Bundle.module probes (via Bundle.main.resourceURL)". That was wrong, and it
+# cost two shipped releases. The generated accessor probes
+# `Bundle.main.bundleURL` — the bundle ROOT, not its Resources directory — and
+# then an absolute .build path from the compiling machine, and `fatalError`s
+# when both miss. So placing the bundle here is correct for codesign and
+# invisible to `Bundle.module`, which is why HudsonUI now resolves its own
+# resources (see `Typography.bundledFontURLs`) instead of relying on it.
+# Anything that reads bundled resources must do the same or it will crash on
+# every Mac except this one.
 shopt -s nullglob
 for b in ".build/$CONFIG"/*.bundle; do cp -R "$b" "$APP/Contents/Resources/"; done
 

Sources/HudsonUI/Theme/Typography.swift

@@ -18,19 +18,84 @@ public enum Typography {
     // safe, no lock needed.
     private static var didRegister = false
 
-    /// Registers every `.ttf` bundled under `Resources/Fonts`. Enumerates the
-    /// directory rather than hard-coding filenames, so a missing or renamed
-    /// face never crashes registration — it just doesn't get picked up, and
-    /// `serif`/`ui` fall back to a system font.
+    /// Registers every bundled `.ttf`. Enumerates the bundle rather than
+    /// hard-coding filenames, so a missing or renamed face never crashes
+    /// registration — it just doesn't get picked up, and `serif`/`ui` fall back
+    /// to a system font.
     public static func register() {
         guard !didRegister else { return }
         didRegister = true
-        let fonts = Bundle.module.urls(forResourcesWithExtension: "ttf", subdirectory: "Fonts") ?? []
-        for url in fonts {
+        for url in bundledFontURLs() {
             CTFontManagerRegisterFontsForURL(url as CFURL, .process, nil)
         }
     }
 
+    /// The name SwiftPM gives HudsonUI's resource bundle. Derived from
+    /// `<package>_<target>`, so it changes only if the package or target is
+    /// renamed — at which point `bundledFontURLs()` returns empty and the app
+    /// renders in system faces rather than failing to launch.
+    /// `nonisolated` for the same reason as the lookups below: it is an
+    /// immutable constant, so actor isolation buys nothing and only forces
+    /// callers to hop.
+    nonisolated static let resourceBundleName = "Hudson_HudsonUI.bundle"
+
+    /// Every bundled `.ttf`, located WITHOUT ever touching `Bundle.module`.
+    ///
+    /// Touching it at all was the bug. SwiftPM's generated `Bundle.module`
+    /// probes exactly two paths and calls `fatalError` when both miss: the app
+    /// bundle ROOT (`Bundle.main.bundleURL`, NOT its `Resources` directory),
+    /// and an absolute path into the `.build` directory of the machine that
+    /// compiled the binary. Neither survives packaging. `codesign` requires a
+    /// nested resource bundle to sit in `Contents/Resources`, which is not the
+    /// root, and a user's Mac has no `.build` directory — so `Bundle.module`
+    /// resolved on the maintainer's machine via the build path and hard-crashed
+    /// everywhere else, inside the first `Typography.serif` call that renders
+    /// `RootView.loadingPlaceholder`. The app died before drawing one frame.
+    ///
+    /// An empty return is a legitimate outcome, not a failure to report:
+    /// `resolved(_:size:weight:fallback:)` falls back to system faces, so a
+    /// missing font costs fidelity. It must never cost a launch.
+    /// `nonisolated` because it reads only the filesystem and its arguments —
+    /// the main-actor isolation on this enum exists for `didRegister`, and
+    /// borrowing it here would force every caller and test onto the main actor
+    /// for a pure lookup.
+    nonisolated static func bundledFontURLs(searchPaths: [URL] = resourceSearchPaths()) -> [URL] {
+        for directory in searchPaths {
+            guard let bundle = Bundle(url: directory.appending(path: resourceBundleName))
+            else { continue }
+            // SwiftPM FLATTENS `Resources/Fonts/*.ttf` into the bundle root, so
+            // the original `subdirectory: "Fonts"` matched nothing and the faces
+            // never registered even on the machine where the lookup succeeded —
+            // the app has been rendering in system fonts throughout. Both
+            // layouts are probed so that neither a change in SwiftPM's
+            // flattening nor a deliberate move back into a folder silently
+            // drops the fonts again.
+            let found = (bundle.urls(forResourcesWithExtension: "ttf", subdirectory: nil) ?? [])
+                + (bundle.urls(forResourcesWithExtension: "ttf", subdirectory: "Fonts") ?? [])
+            if !found.isEmpty { return found }
+        }
+        return []
+    }
+
+    /// Where the nested resource bundle can legitimately sit, in the order the
+    /// three shipping shapes actually occur:
+    ///   - a packaged `.app`     → `Contents/Resources`
+    ///   - `swift run HudsonApp` → beside the executable in `.build/<config>`
+    ///   - the test runner       → also `.build/<config>`, next to the `.xctest`
+    ///
+    /// Probing all three is what makes the packaged app and the dev loop agree.
+    /// The old code only ever worked in the dev loop, which is precisely why the
+    /// break reached a user before it reached a test.
+    nonisolated static func resourceSearchPaths() -> [URL] {
+        var paths: [URL] = []
+        if let resources = Bundle.main.resourceURL { paths.append(resources) }
+        paths.append(Bundle.main.bundleURL)
+        if let executableDirectory = Bundle.main.executableURL?.deletingLastPathComponent() {
+            paths.append(executableDirectory)
+        }
+        return paths
+    }
+
     public static func serif(_ size: CGFloat, _ weight: Font.Weight = .regular) -> Font {
         register()
         return resolved(serifCandidates, size: size, weight: weight, fallback: .serif)

Tests/HudsonUITests/TypographyBundleTests.swift

@@ -0,0 +1,158 @@
+import Foundation
+import Testing
+
+@testable import HudsonUI
+
+// MARK: - The regression tests for the 0.1.1 launch crash
+//
+// Hudson 0.1.0 and 0.1.1 died on launch on every Mac except the maintainer's,
+// inside `Bundle.module`:
+//
+//   0  libswiftCore  _assertionFailure(_:_:file:line:flags:)
+//   1  HudsonApp     closure #1 in variable initialization expression of
+//                    static NSBundle.module
+//   5  HudsonApp     specialized static Typography.register()
+//   6  HudsonApp     specialized static Typography.serif(_:_:)
+//   7  HudsonApp     closure #1 in RootView.loadingPlaceholder.getter
+//
+// SwiftPM's generated accessor probes the app bundle ROOT and an absolute
+// `.build` path from the compiling machine, then calls `fatalError`. A packaged
+// .app matches neither: codesign puts the nested bundle in Contents/Resources,
+// and a user's Mac has no .build directory.
+//
+// These tests drive `bundledFontURLs(searchPaths:)` against the real on-disk
+// layouts rather than the ambient one, because the ambient layout is exactly
+// what hid the bug — the dev loop resolved, so nothing ever exercised the
+// shape a user receives.
+
+/// Builds a throwaway resource bundle holding one file named like a font.
+///
+/// The content is not a real typeface: every assertion here is about whether
+/// the URL is *found*, and CoreText never sees these. Keeping it fake also
+/// keeps the tests independent of which faces the app happens to ship.
+private func makeResourceBundle(
+    at directory: URL, fontSubdirectory: String? = nil
+) throws -> URL {
+    let bundle = directory.appending(path: Typography.resourceBundleName)
+    let fontDirectory = fontSubdirectory.map { bundle.appending(path: $0) } ?? bundle
+    try FileManager.default.createDirectory(at: fontDirectory, withIntermediateDirectories: true)
+    try Data("not a real typeface".utf8)
+        .write(to: fontDirectory.appending(path: "Newsreader.ttf"))
+    return bundle
+}
+
+private func makeScratchDirectory() throws -> URL {
+    let directory = URL(fileURLWithPath: NSTemporaryDirectory())
+        .appending(path: "TypographyBundleTests-\(UUID().uuidString)")
+    try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+    return directory
+}
+
+// MARK: - The shape a user actually receives
+
+/// **The regression test for the reported crash.**
+///
+/// Reproduces a packaged `.app`: `Hudson.app/Contents/Resources/` holds the
+/// nested resource bundle, and `Hudson.app/` itself does not. That is the one
+/// arrangement `Bundle.module` cannot resolve, and the one every download has.
+@Test func findsFontsInAPackagedAppResourcesDirectory() throws {
+    let scratch = try makeScratchDirectory()
+    defer { try? FileManager.default.removeItem(at: scratch) }
+
+    let appBundle = scratch.appending(path: "Hudson.app")
+    let resources = appBundle.appending(path: "Contents/Resources")
+    try FileManager.default.createDirectory(at: resources, withIntermediateDirectories: true)
+    _ = try makeResourceBundle(at: resources)
+
+    let found = Typography.bundledFontURLs(searchPaths: [resources, appBundle])
+    #expect(found.count == 1)
+    #expect(found.first?.lastPathComponent == "Newsreader.ttf")
+}
+
+/// The bundle root is searched too, which is the `swift run HudsonApp` layout:
+/// SwiftPM drops `Hudson_HudsonUI.bundle` beside the executable rather than
+/// inside a `Resources` directory. Both shapes have to work from one code path,
+/// or the dev loop and the shipped app disagree again.
+@Test func findsFontsBesideTheExecutable() throws {
+    let scratch = try makeScratchDirectory()
+    defer { try? FileManager.default.removeItem(at: scratch) }
+    _ = try makeResourceBundle(at: scratch)
+
+    #expect(Typography.bundledFontURLs(searchPaths: [scratch]).count == 1)
+}
+
+// MARK: - The second bug: the fonts never registered at all
+
+/// SwiftPM flattens `Resources/Fonts/*.ttf` to the bundle root, so the original
+/// `subdirectory: "Fonts"` matched nothing and no bundled face was ever
+/// registered — including on the maintainer's Mac, where the app quietly
+/// rendered in system fonts instead of Newsreader.
+@Test func findsFontsFlattenedIntoTheBundleRoot() throws {
+    let scratch = try makeScratchDirectory()
+    defer { try? FileManager.default.removeItem(at: scratch) }
+    _ = try makeResourceBundle(at: scratch, fontSubdirectory: nil)
+
+    let found = Typography.bundledFontURLs(searchPaths: [scratch])
+    #expect(found.count == 1, "a flattened bundle is the layout SwiftPM actually produces")
+}
+
+/// The nested layout is probed as well, so a future SwiftPM that stops
+/// flattening — or a deliberate move back into a folder — does not silently
+/// strip the typography again.
+@Test func findsFontsInsideANestedFontsDirectory() throws {
+    let scratch = try makeScratchDirectory()
+    defer { try? FileManager.default.removeItem(at: scratch) }
+    _ = try makeResourceBundle(at: scratch, fontSubdirectory: "Fonts")
+
+    #expect(Typography.bundledFontURLs(searchPaths: [scratch]).count == 1)
+}
+
+// MARK: - Absence must cost fidelity, never a launch
+
+/// The crash was not "the fonts are missing", it was "the app decided a missing
+/// bundle is fatal". A resolver that finds nothing has to return empty and let
+/// `resolved(_:size:weight:fallback:)` fall back to system faces.
+@Test func returnsEmptyRatherThanCrashingWhenNoBundleExists() throws {
+    let scratch = try makeScratchDirectory()
+    defer { try? FileManager.default.removeItem(at: scratch) }
+
+    #expect(Typography.bundledFontURLs(searchPaths: [scratch]).isEmpty)
+}
+
+/// An empty search path list is the degenerate version of the same guarantee.
+@Test func returnsEmptyForNoSearchPathsAtAll() {
+    #expect(Typography.bundledFontURLs(searchPaths: []).isEmpty)
+}
+
+/// A bundle directory that exists but holds no `.ttf` must also be survivable —
+/// `Bundle(url:)` succeeds on any directory, so this is a reachable state
+/// whenever a build drops the fonts.
+@Test func returnsEmptyForABundleContainingNoFonts() throws {
+    let scratch = try makeScratchDirectory()
+    defer { try? FileManager.default.removeItem(at: scratch) }
+    try FileManager.default.createDirectory(
+        at: scratch.appending(path: Typography.resourceBundleName),
+        withIntermediateDirectories: true)
+
+    #expect(Typography.bundledFontURLs(searchPaths: [scratch]).isEmpty)
+}
+
+// MARK: - Registration itself
+
+/// `register()` is the frame that crashed. Calling it must be safe regardless
+/// of what the ambient layout holds, and must stay idempotent.
+@Test @MainActor func registerIsSafeAndIdempotent() {
+    Typography.register()
+    Typography.register()
+    // Reaching here at all is the assertion: the old implementation trapped
+    // inside Bundle.module on any machine without the compiling .build path.
+    #expect(Bool(true))
+}
+
+/// The real ambient lookup must never trap in the environment the suite runs
+/// in, which is the third shipping shape (`.build/<config>` beside the
+/// `.xctest`).
+@Test func ambientSearchPathsResolveWithoutTrapping() {
+    #expect(!Typography.resourceSearchPaths().isEmpty)
+    _ = Typography.bundledFontURLs()
+}