From f7f62c36cf8deef5b06848a058d8e3459b9f70c8 Mon Sep 17 00:00:00 2001
From: elkaix <melkholy@techmatrix.com>
Date: Mon, 17 Aug 2026 17:35:49 -0400
Subject: [PATCH 1/4] fix(web): align the MCP server form and the provider
 dialog corners

The form used an auto-fit grid, so on a wide pane the five fields packed four
to a row, mixed short inputs with taller textareas, and left the last row three
columns empty. Name and Transport now share the first row and every longer field
spans both columns, with the grid capped so the inputs stop stretching.

The provider dialog rounded its border but did not clip its children, so the
header background, the footer, and the list scrollbar painted square over the
top corners. The footer worked around this with its own radius; clipping at the
dialog covers all three.
---
 .../web-connectors-form-and-dialog-corners.md |  5 +++
 .../src/components/ProviderManager.vue        |  4 ++-
 .../src/components/settings/McpServerForm.vue | 20 ++++++++----
 .../test/connectors-page.test.ts              | 17 ++++++++++
 .../test/provider-manager-chrome.test.ts      | 32 +++++++++++++++++++
 5 files changed, 71 insertions(+), 7 deletions(-)
 create mode 100644 .changeset/web-connectors-form-and-dialog-corners.md
 create mode 100644 apps/pythinker-web/test/provider-manager-chrome.test.ts

diff --git a/.changeset/web-connectors-form-and-dialog-corners.md b/.changeset/web-connectors-form-and-dialog-corners.md
new file mode 100644
index 00000000..de9bd004
--- /dev/null
+++ b/.changeset/web-connectors-form-and-dialog-corners.md
@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Lay the MCP server form out in even rows instead of a ragged grid, and stop the provider manager header and footer from squaring off the dialog corners.
diff --git a/apps/pythinker-web/src/components/ProviderManager.vue b/apps/pythinker-web/src/components/ProviderManager.vue
index e74b2752..2f26e8fa 100644
--- a/apps/pythinker-web/src/components/ProviderManager.vue
+++ b/apps/pythinker-web/src/components/ProviderManager.vue
@@ -353,6 +353,9 @@ function statusLabel(status: AppProvider['status']): string {
   max-height: calc(100vh - 80px);
   display: flex;
   flex-direction: column;
+  /* The header, the footer, and the list scrollbar all paint to the dialog
+     edge, so they square off the rounded corners without this. */
+  overflow: hidden;
   font-family: var(--mono);
   box-shadow: 0 8px 32px rgba(0,0,0,0.14);
 }
@@ -578,7 +581,6 @@ function statusLabel(status: AppProvider['status']): string {
   color: var(--faint);
   border-top: 1px solid var(--line2);
   background: var(--panel);
-  border-radius: 0 0 4px 4px;
 }
 
 @media (max-width: 640px) {
diff --git a/apps/pythinker-web/src/components/settings/McpServerForm.vue b/apps/pythinker-web/src/components/settings/McpServerForm.vue
index 5ec4168a..1df7b603 100644
--- a/apps/pythinker-web/src/components/settings/McpServerForm.vue
+++ b/apps/pythinker-web/src/components/settings/McpServerForm.vue
@@ -99,23 +99,23 @@ function submit(): void {
           <option value="sse">sse</option>
         </select>
       </label>
-      <label v-if="form.transport === 'stdio'" class="connector-field">
+      <label v-if="form.transport === 'stdio'" class="connector-field connector-field-wide">
         <span class="rlabel">{{ t('settings.connectors.form.command') }}</span>
         <input v-model="form.command" class="page-search" required />
       </label>
-      <label v-if="form.transport === 'stdio'" class="connector-field">
+      <label v-if="form.transport === 'stdio'" class="connector-field connector-field-wide">
         <span class="rlabel">{{ t('settings.connectors.form.args') }}</span>
         <textarea v-model="form.args" class="page-search connector-textarea" :placeholder="t('settings.connectors.form.argsHint')" />
       </label>
-      <label v-if="form.transport === 'stdio'" class="connector-field">
+      <label v-if="form.transport === 'stdio'" class="connector-field connector-field-wide">
         <span class="rlabel">{{ t('settings.connectors.form.env') }}</span>
         <textarea v-model="form.env" class="page-search connector-textarea" :placeholder="t('settings.connectors.form.objectHint')" />
       </label>
-      <label v-else class="connector-field">
+      <label v-else class="connector-field connector-field-wide">
         <span class="rlabel">{{ t('settings.connectors.form.url') }}</span>
         <input v-model="form.url" class="page-search" type="url" required />
       </label>
-      <label v-if="form.transport !== 'stdio'" class="connector-field">
+      <label v-if="form.transport !== 'stdio'" class="connector-field connector-field-wide">
         <span class="rlabel">{{ t('settings.connectors.form.headers') }}</span>
         <textarea v-model="form.headers" class="page-search connector-textarea" :placeholder="t('settings.connectors.form.objectHint')" />
       </label>
@@ -139,11 +139,16 @@ function submit(): void {
   background: var(--panel);
 }
 .connector-fields {
+  /* Two fixed columns, not auto-fit: a pane-wide grid stretches the short
+     fields and leaves a ragged tail row. Name and Transport share the first
+     row; every longer field spans both columns so no row ends half empty. */
   display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  grid-template-columns: repeat(2, minmax(0, 1fr));
   gap: 8px 12px;
+  max-width: 640px;
 }
 .connector-field { min-width: 0; }
+.connector-field-wide { grid-column: 1 / -1; }
 .connector-field .page-search { margin: 4px 0 0; }
 .connector-textarea {
   min-height: 64px;
@@ -155,4 +160,7 @@ function submit(): void {
   gap: 8px;
   margin-top: 4px;
 }
+@media (max-width: 640px) {
+  .connector-fields { grid-template-columns: 1fr; }
+}
 </style>
diff --git a/apps/pythinker-web/test/connectors-page.test.ts b/apps/pythinker-web/test/connectors-page.test.ts
index c386aed1..e1534d7e 100644
--- a/apps/pythinker-web/test/connectors-page.test.ts
+++ b/apps/pythinker-web/test/connectors-page.test.ts
@@ -87,6 +87,23 @@ describe('ConnectorsPage', () => {
     expect(wrapper.findAll('.connector-remove')).toHaveLength(1);
   });
 
+  it('spans every long field across both form columns', async () => {
+    const wrapper = mountPage();
+
+    await wrapper.get('button.act').trigger('click');
+    const labelOf = (field: ReturnType<typeof wrapper.get>): string => field.get('.rlabel').text();
+    const wide = wrapper.findAll('.connector-field-wide').map(labelOf);
+    const narrow = wrapper
+      .findAll('.connector-field')
+      .filter((field) => !field.classes().includes('connector-field-wide'))
+      .map(labelOf);
+
+    // Name and Transport pair up on the first row; the rest take a full row,
+    // so no row is left half empty.
+    expect(narrow).toEqual(['Name', 'Transport']);
+    expect(wide).toEqual(['Command', 'Arguments', 'Environment (JSON)']);
+  });
+
   it('shows the daemon validation message after a rejected write', () => {
     const wrapper = mountPage({ connectorsError: 'MCP server id must be trimmed' });
 
diff --git a/apps/pythinker-web/test/provider-manager-chrome.test.ts b/apps/pythinker-web/test/provider-manager-chrome.test.ts
new file mode 100644
index 00000000..9bd3353f
--- /dev/null
+++ b/apps/pythinker-web/test/provider-manager-chrome.test.ts
@@ -0,0 +1,32 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+// The header, the footer, and the provider list all paint their own background
+// to the dialog edge, so a rounded dialog needs to clip them. jsdom applies no
+// scoped-SFC styles, so the rule itself is the contract under test.
+const source = readFileSync(
+  resolve(import.meta.dirname, '../src/components/ProviderManager.vue'),
+  'utf8',
+);
+
+function blockOf(selector: string): string {
+  const start = source.indexOf(`\n${selector} {`);
+  expect(start).toBeGreaterThan(-1);
+  const end = source.indexOf('\n}', start);
+  return source.slice(start, end);
+}
+
+describe('ProviderManager dialog chrome', () => {
+  it('clips its children to the rounded corners', () => {
+    const dialog = blockOf('.dialog');
+
+    expect(dialog).toMatch(/border-radius:\s*4px/);
+    expect(dialog).toMatch(/overflow:\s*hidden/);
+  });
+
+  it('leaves the corner rounding to the dialog instead of the footer', () => {
+    expect(blockOf('.footer-hint')).not.toMatch(/border-radius/);
+  });
+});

From aeddc90a79a8e6afa9da39c773f762efd0636fda Mon Sep 17 00:00:00 2001
From: elkaix <melkholy@techmatrix.com>
Date: Mon, 17 Aug 2026 18:11:39 -0400
Subject: [PATCH 2/4] test(web): cover the http form layout and add the unicode
 regex flag

The layout test only checked the stdio branch, so a regression in the URL or
Headers span could pass. It now asserts both branches. The three CSS assertions
also carry the u flag the repo uses everywhere else.
---
 .../test/connectors-page.test.ts              | 25 +++++++++++++------
 .../test/provider-manager-chrome.test.ts      |  6 ++---
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/apps/pythinker-web/test/connectors-page.test.ts b/apps/pythinker-web/test/connectors-page.test.ts
index e1534d7e..f2b73289 100644
--- a/apps/pythinker-web/test/connectors-page.test.ts
+++ b/apps/pythinker-web/test/connectors-page.test.ts
@@ -92,16 +92,27 @@ describe('ConnectorsPage', () => {
 
     await wrapper.get('button.act').trigger('click');
     const labelOf = (field: ReturnType<typeof wrapper.get>): string => field.get('.rlabel').text();
-    const wide = wrapper.findAll('.connector-field-wide').map(labelOf);
-    const narrow = wrapper
-      .findAll('.connector-field')
-      .filter((field) => !field.classes().includes('connector-field-wide'))
-      .map(labelOf);
+    const layout = (): { narrow: string[]; wide: string[] } => ({
+      narrow: wrapper
+        .findAll('.connector-field')
+        .filter((field) => !field.classes().includes('connector-field-wide'))
+        .map(labelOf),
+      wide: wrapper.findAll('.connector-field-wide').map(labelOf),
+    });
 
     // Name and Transport pair up on the first row; the rest take a full row,
     // so no row is left half empty.
-    expect(narrow).toEqual(['Name', 'Transport']);
-    expect(wide).toEqual(['Command', 'Arguments', 'Environment (JSON)']);
+    expect(layout()).toEqual({
+      narrow: ['Name', 'Transport'],
+      wide: ['Command', 'Arguments', 'Environment (JSON)'],
+    });
+
+    await wrapper.get('select').setValue('http');
+
+    expect(layout()).toEqual({
+      narrow: ['Name', 'Transport'],
+      wide: ['URL', 'Headers (JSON)'],
+    });
   });
 
   it('shows the daemon validation message after a rejected write', () => {
diff --git a/apps/pythinker-web/test/provider-manager-chrome.test.ts b/apps/pythinker-web/test/provider-manager-chrome.test.ts
index 9bd3353f..e1eb2bb8 100644
--- a/apps/pythinker-web/test/provider-manager-chrome.test.ts
+++ b/apps/pythinker-web/test/provider-manager-chrome.test.ts
@@ -22,11 +22,11 @@ describe('ProviderManager dialog chrome', () => {
   it('clips its children to the rounded corners', () => {
     const dialog = blockOf('.dialog');
 
-    expect(dialog).toMatch(/border-radius:\s*4px/);
-    expect(dialog).toMatch(/overflow:\s*hidden/);
+    expect(dialog).toMatch(/border-radius:\s*4px/u);
+    expect(dialog).toMatch(/overflow:\s*hidden/u);
   });
 
   it('leaves the corner rounding to the dialog instead of the footer', () => {
-    expect(blockOf('.footer-hint')).not.toMatch(/border-radius/);
+    expect(blockOf('.footer-hint')).not.toMatch(/border-radius/u);
   });
 });

From 08a2902bd01eaf22875bc1ca20765a845bf73ab1 Mon Sep 17 00:00:00 2001
From: elkaix <melkholy@techmatrix.com>
Date: Mon, 17 Aug 2026 18:12:55 -0400
Subject: [PATCH 3/4] ci(desktop): sign macOS releases and refuse unsigned
 tagged builds

The release job exported only the Apple ID notarization trio, so the App
Store Connect API key path could not be used remotely. It also fell back to
an unsigned build whenever the certificate secret was absent, logged a note
and exited zero, which ships a release macOS refuses to install updates from.

Accept the API key as a base64 secret, materialize it outside the workspace,
and gate tagged releases on the existing signing preflight so a missing
credential fails the job with the name of what is missing.
---
 .changeset/ci-mac-release-signing.md          |  5 ++++
 .github/workflows/desktop-release.yml         | 23 ++++++++++++++++-
 .../desktop/scripts/assert-release-signing.ts | 25 +++++++++++++++++++
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/ci-mac-release-signing.md
 create mode 100644 apps/desktop/scripts/assert-release-signing.ts

diff --git a/.changeset/ci-mac-release-signing.md b/.changeset/ci-mac-release-signing.md
new file mode 100644
index 00000000..e2216f52
--- /dev/null
+++ b/.changeset/ci-mac-release-signing.md
@@ -0,0 +1,5 @@
+---
+'@pymodel/pythinker-code': patch
+---
+
+Sign and notarize the macOS desktop build in the release pipeline, and fail a tagged release outright when the signing credentials are missing instead of quietly shipping an unsigned app.
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 0f84ea6c..b164c76e 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -136,19 +136,40 @@ jobs:
         env:
           IN_CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
           IN_CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
+          IN_CSC_NAME: ${{ secrets.MAC_CSC_NAME }}
           IN_APPLE_ID: ${{ secrets.APPLE_ID }}
           IN_APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           IN_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          IN_APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          IN_APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          IN_APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
         run: |
-          for name in CSC_LINK CSC_KEY_PASSWORD APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
+          for name in CSC_LINK CSC_KEY_PASSWORD CSC_NAME APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID APPLE_API_KEY_ID APPLE_API_ISSUER; do
             input="IN_${name}"
             value="${!input:-}"
             if [ -n "$value" ]; then printf '%s<<__EOF__\n%s\n__EOF__\n' "$name" "$value" >> "$GITHUB_ENV"; fi
           done
+          # The App Store Connect key is held as base64 because it is a file, not a
+          # string. notarytool and electron-builder both want a path, so materialize
+          # it outside the workspace to keep it out of the packaged app.
+          if [ -n "${IN_APPLE_API_KEY_P8:-}" ]; then
+            key_path="${RUNNER_TEMP}/AuthKey.p8"
+            printf '%s' "$IN_APPLE_API_KEY_P8" | base64 -d > "$key_path"
+            chmod 600 "$key_path"
+            echo "APPLE_API_KEY=${key_path}" >> "$GITHUB_ENV"
+          fi
           if [ -z "${IN_CSC_LINK:-}" ]; then
             echo 'CSC_IDENTITY_AUTO_DISCOVERY=false' >> "$GITHUB_ENV"
             echo 'No macOS signing certificate configured; building unsigned.'
           fi
+
+      # A tag build that quietly produces an unsigned app is worse than a failed
+      # one: macOS rejects unsigned updates, so it ships a release users cannot
+      # install or update from. Manual runs stay free to build unsigned.
+      - name: Require signing for tagged releases
+        if: startsWith(github.ref, 'refs/tags/desktop-v')
+        working-directory: apps/desktop
+        run: node --import tsx scripts/assert-release-signing.ts
       - name: Mint releases-repo token
         id: releases_token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # pinned from v3.2.0
diff --git a/apps/desktop/scripts/assert-release-signing.ts b/apps/desktop/scripts/assert-release-signing.ts
new file mode 100644
index 00000000..de108eba
--- /dev/null
+++ b/apps/desktop/scripts/assert-release-signing.ts
@@ -0,0 +1,25 @@
+/** Fail a tagged desktop release that would ship an unsigned or un-notarized macOS build. */
+
+import { spawnSync } from 'node:child_process'
+import { assertMacReleaseReady } from './release-preflight'
+
+function listCodeSigningIdentities(): string {
+  const result = spawnSync('security', ['find-identity', '-v', '-p', 'codesigning'], { encoding: 'utf8' })
+  if (result.error !== undefined) throw result.error
+  if (result.status !== 0) throw new Error(`security find-identity exited with ${String(result.status)}`)
+  return result.stdout
+}
+
+try {
+  const result = assertMacReleaseReady({
+    env: process.env,
+    platform: process.platform,
+    listCodeSigningIdentities,
+  })
+  console.log(
+    `macOS release signing is configured: ${result.identity}; signing via ${result.signing}; notarization via ${result.notarization}`,
+  )
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error))
+  process.exit(1)
+}

From 0ac1bb425f22b9140b9ac08dfd4d43976837f114 Mon Sep 17 00:00:00 2001
From: elkaix <melkholy@techmatrix.com>
Date: Mon, 17 Aug 2026 18:25:25 -0400
Subject: [PATCH 4/4] ci(desktop): draw the GITHUB_ENV delimiter at random

A credential containing the fixed heredoc marker could close its own value
and let the remainder become separate environment entries.
---
 .github/workflows/desktop-release.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index b164c76e..1c7d2eb8 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -144,10 +144,14 @@ jobs:
           IN_APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           IN_APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
         run: |
+          # A fixed heredoc marker lets a credential that happens to contain that
+          # line close its own value early and turn the rest into environment
+          # entries. Draw the delimiter at random so no secret can carry it.
+          delimiter="EOF_$(openssl rand -hex 16)"
           for name in CSC_LINK CSC_KEY_PASSWORD CSC_NAME APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID APPLE_API_KEY_ID APPLE_API_ISSUER; do
             input="IN_${name}"
             value="${!input:-}"
-            if [ -n "$value" ]; then printf '%s<<__EOF__\n%s\n__EOF__\n' "$name" "$value" >> "$GITHUB_ENV"; fi
+            if [ -n "$value" ]; then printf '%s<<%s\n%s\n%s\n' "$name" "$delimiter" "$value" "$delimiter" >> "$GITHUB_ENV"; fi
           done
           # The App Store Connect key is held as base64 because it is a file, not a
           # string. notarytool and electron-builder both want a path, so materialize