feature: built-in auto-update (appcast + sha256 + staged install), version 0.2.0

Info.plist

@@ -15,9 +15,11 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>0.1.0</string>
+	<string>0.2.0</string>
 	<key>CFBundleVersion</key>
 	<string>1</string>
+	<key>CFBundleIconFile</key>
+	<string>AppIcon</string>
 	<key>LSUIElement</key>
 	<true/>
 	<key>LSMinimumSystemVersion</key>

Sources/Shotdeck/AppModel.swift

@@ -39,6 +39,8 @@ public final class AppModel {
     /// Currently bound capture combo (the last one Carbon accepted, or the preferred load).
     private(set) var captureHotkey: HotkeyPreference
     var hotkeyDisplayString: String { captureHotkey.displayString }
+    /// Staged update offered in the menu. Set only after checksum + payload validation.
+    public private(set) var updateAvailable: (version: String, notes: String)?
 
     let paths: AppSupportPaths
     let spool: SpoolStore
@@ -48,6 +50,7 @@ public final class AppModel {
     let picker: RegionPickerController
     let ledger: ReturnLedger
     let watcher: ReturnWatcher
+    let updateChecker: UpdateChecker
 
     public init(
         paths: AppSupportPaths,
@@ -83,6 +86,14 @@ public final class AppModel {
         self.outboxDisplayName = folders.outbox.lastPathComponent
         self.watchFolderDisplayName = folders.watch.lastPathComponent
         self.captureHotkey = HotkeyPreference.load()
+        self.updateChecker = UpdateChecker()
+        self.updateChecker.onChecked = { [weak self] in
+            guard let self else { return }
+            self.updateAvailable = self.updateChecker.availableUpdate
+            if let message = self.updateChecker.statusMessage {
+                self.setStatus(message)
+            }
+        }
     }
 
     // MARK: Seam mutators — the only way a WP-4b/4c extension changes state.
@@ -154,6 +165,20 @@ public final class AppModel {
         if !bindCaptureHotkey(pref) {
             setStatus("\(pref.displayString) is already used by another app — capture only works from the menu.")
         }
+
+        let skipSchedule =
+            ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"] != nil
+            || ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"] != nil
+            || ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
+        if !skipSchedule {
+            updateChecker.startSchedule()
+        }
+    }
+
+    /// Installs the staged update over `/Applications/Redline.app` and relaunches.
+    /// Does nothing unless the user clicked the menu row.
+    public func installUpdate() {
+        updateChecker.installStaged()
     }
 
     /// Unregisters `capture` and binds `HotkeyPreference.load()`. If Carbon rejects the new

Sources/Shotdeck/MenuBarView.swift

@@ -74,6 +74,15 @@ struct MenuBarView: View {
 
     private var actionsList: some View {
         VStack(alignment: .leading, spacing: 2) {
+            if let update = model.updateAvailable {
+                Button {
+                    model.installUpdate()
+                } label: {
+                    actionLabel("Update to \(update.version)")
+                        .foregroundStyle(Color.accentColor)
+                }
+            }
+
             Button {
                 let anchor = NSApp.keyWindow?.contentView
                 if let sender = model as? SendCapable {

Sources/Shotdeck/PickerSelfTest.swift

@@ -113,8 +113,11 @@ enum PickerSelfTest {
         fflush(stdout)
 
         runRegionPersistPhase()
+        if !startUpdateSelfTestIfRequested() {
             exit(0)
         }
+        // UPDATE-SELFTEST hops to a later main-actor turn and exits itself.
+    }
 
     /// Phase 2: writes a known region under `CaptureRegion.defaultsKey`, reloads it through
     /// `AppModel.loadPersistedRegion()` (the same path init uses), then restores whatever
@@ -157,6 +160,179 @@ enum PickerSelfTest {
         fflush(stdout)
     }
 
+    /// Phase 3: builds a fake 99.0.0 bundle, serves a local appcast, stages via
+    /// `checkNow`, then `installStaged` into the env dir — never `/Applications`.
+    /// Returns true when the async phase was scheduled (it calls `exit` itself).
+    @discardableResult
+    private static func startUpdateSelfTestIfRequested() -> Bool {
+        guard let raw = ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"],
+              !raw.isEmpty
+        else { return false }
+
+        let output = URL(fileURLWithPath: raw, isDirectory: true)
+        Task { @MainActor in
+            do {
+                try await runUpdateSelfTest(outputDirectory: output)
+                print("UPDATE-SELFTEST PASS version=99.0.0")
+                fflush(stdout)
+                exit(0)
+            } catch let error as UpdateSelfTestError {
+                updateFail(error.description)
+            } catch {
+                updateFail(String(describing: error))
+            }
+        }
+        return true
+    }
+
+    private static func runUpdateSelfTest(outputDirectory: URL) async throws {
+        let fm = FileManager.default
+        try fm.createDirectory(at: outputDirectory, withIntermediateDirectories: true)
+
+        guard let sourceApp = ownAppBundleURL() else {
+            throw UpdateSelfTestError.detail("own bundle is not a .app (\(Bundle.main.bundleURL.path))")
+        }
+
+        let payload = outputDirectory.appendingPathComponent("payload", isDirectory: true)
+        if fm.fileExists(atPath: payload.path) {
+            try fm.removeItem(at: payload)
+        }
+        try fm.createDirectory(at: payload, withIntermediateDirectories: true)
+        let fakeApp = payload.appendingPathComponent("Redline.app")
+        try fm.copyItem(at: sourceApp, to: fakeApp)
+
+        let plistURL = fakeApp.appendingPathComponent("Contents/Info.plist")
+        let plistData = try Data(contentsOf: plistURL)
+        guard var plist = try PropertyListSerialization.propertyList(from: plistData, format: nil) as? [String: Any] else {
+            throw UpdateSelfTestError.detail("could not parse copied Info.plist")
+        }
+        plist["CFBundleShortVersionString"] = "99.0.0"
+        let rewritten = try PropertyListSerialization.data(fromPropertyList: plist, format: .xml, options: 0)
+        try rewritten.write(to: plistURL)
+
+        let zipURL = outputDirectory.appendingPathComponent("Redline-99.0.0.zip")
+        if fm.fileExists(atPath: zipURL.path) {
+            try fm.removeItem(at: zipURL)
+        }
+        try runDitto(arguments: ["-c", "-k", payload.path, zipURL.path])
+
+        let zipData = try Data(contentsOf: zipURL)
+        let hex = UpdateChecker.sha256Hex(zipData)
+
+        let appcastURL = outputDirectory.appendingPathComponent("appcast.json")
+        let appcast: [String: String] = [
+            "version": "99.0.0",
+            "zipURL": zipURL.absoluteString,
+            "sha256": hex,
+            "notes": "UPDATE-SELFTEST",
+        ]
+        let appcastData = try JSONSerialization.data(withJSONObject: appcast, options: [.sortedKeys])
+        try appcastData.write(to: appcastURL)
+
+        let defaults = UserDefaults.standard
+        let previous = defaults.string(forKey: UpdateChecker.appcastURLDefaultsKey)
+        defaults.set(appcastURL.absoluteString, forKey: UpdateChecker.appcastURLDefaultsKey)
+        defer {
+            if let previous {
+                defaults.set(previous, forKey: UpdateChecker.appcastURLDefaultsKey)
+            } else {
+                defaults.removeObject(forKey: UpdateChecker.appcastURLDefaultsKey)
+            }
+        }
+
+        let (model, isolatedRoot) = try makeIsolatedUpdateModel()
+        defer { try? fm.removeItem(at: isolatedRoot) }
+
+        await model.updateChecker.checkNow()
+
+        guard model.updateAvailable?.version == "99.0.0" else {
+            throw UpdateSelfTestError.detail(
+                "updateAvailable=\(model.updateAvailable?.version ?? "nil")"
+            )
+        }
+        guard let staged = model.updateChecker.stagedAppURL else {
+            throw UpdateSelfTestError.detail("staged payload missing")
+        }
+        guard staged.lastPathComponent == "Redline.app" else {
+            throw UpdateSelfTestError.detail("staged name \(staged.lastPathComponent)")
+        }
+        let stagedExe = staged.appendingPathComponent("Contents/MacOS/Shotdeck")
+        guard fm.fileExists(atPath: stagedExe.path) else {
+            throw UpdateSelfTestError.detail("staged Contents/MacOS/Shotdeck missing")
+        }
+
+        let targetRoot = outputDirectory.appendingPathComponent("target", isDirectory: true)
+        if fm.fileExists(atPath: targetRoot.path) {
+            try fm.removeItem(at: targetRoot)
+        }
+        let target = targetRoot.appendingPathComponent("Redline.app")
+        model.updateChecker.installStaged(to: target)
+
+        let installedPlist = target.appendingPathComponent("Contents/Info.plist")
+        guard let installed = NSDictionary(contentsOf: installedPlist) as? [String: Any],
+              let installedVersion = installed["CFBundleShortVersionString"] as? String
+        else {
+            throw UpdateSelfTestError.detail("installed Info.plist unreadable")
+        }
+        guard installedVersion == "99.0.0" else {
+            throw UpdateSelfTestError.detail("installed version \(installedVersion)")
+        }
+    }
+
+    private static func ownAppBundleURL() -> URL? {
+        let bundle = Bundle.main.bundleURL
+        if bundle.pathExtension == "app" { return bundle }
+        let up3 = bundle
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+        if up3.pathExtension == "app" { return up3 }
+        return nil
+    }
+
+    private static func makeIsolatedUpdateModel() throws -> (AppModel, URL) {
+        let root = FileManager.default.temporaryDirectory
+            .appendingPathComponent("shotdeck-update-selftest-\(UUID().uuidString)", isDirectory: true)
+        let paths = try AppSupportPaths(
+            root: root,
+            outbox: root.appendingPathComponent("outbox", isDirectory: true),
+            watchFolder: root.appendingPathComponent("watch", isDirectory: true)
+        )
+        let ledger = try ReturnLedger(paths: paths)
+        let model = AppModel(
+            paths: paths,
+            spool: try SpoolStore(paths: paths),
+            composer: PDFComposer(),
+            capturer: ScreenCapturer(),
+            hotkeys: HotkeyCenter(),
+            picker: RegionPickerController(),
+            ledger: ledger,
+            watcher: ReturnWatcher(paths: paths, ledger: ledger)
+        )
+        return (model, root)
+    }
+
+    private static func runDitto(arguments: [String]) throws {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/ditto")
+        process.arguments = arguments
+        let err = Pipe()
+        process.standardError = err
+        process.standardOutput = Pipe()
+        try process.run()
+        process.waitUntilExit()
+        guard process.terminationStatus == 0 else {
+            let message = String(data: err.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+            throw UpdateSelfTestError.detail("ditto failed: \(message)")
+        }
+    }
+
+    private static func updateFail(_ detail: String) -> Never {
+        print("UPDATE-SELFTEST FAIL \(detail)")
+        fflush(stdout)
+        exit(1)
+    }
+
     private static func interpolate(_ step: Int) -> NSPoint {
         let t = CGFloat(step) / CGFloat(dragSteps)
         return NSPoint(
@@ -213,3 +389,12 @@ enum PickerSelfTest {
         exit(1)
     }
 }
+
+private enum UpdateSelfTestError: Error, CustomStringConvertible {
+    case detail(String)
+    var description: String {
+        switch self {
+        case .detail(let s): return s
+        }
+    }
+}

Sources/Shotdeck/UpdateChecker.swift

@@ -0,0 +1,281 @@
+import AppKit
+import CryptoKit
+import Foundation
+
+/// Built-in updater. Checks an appcast, stages a verified payload, and installs
+/// only when the user clicks the menu row — never automatically.
+@MainActor
+final class UpdateChecker {
+    static let appcastURLDefaultsKey = "ai.flowmaster.shotdeck.appcastURL"
+    static let defaultAppcastURL = URL(string: "https://get.baobab-ts.com/cowork/redline/appcast.json")!
+    static let defaultInstallTarget = URL(fileURLWithPath: "/Applications/Redline.app")
+
+    private(set) var availableUpdate: (version: String, notes: String)?
+    private(set) var stagedAppURL: URL?
+    private(set) var statusMessage: String?
+
+    var onChecked: (() -> Void)?
+
+    private let urlSession: URLSession
+    private var repeatingTimer: Timer?
+    private var firstCheckTask: Task<Void, Never>?
+    private var isChecking = false
+    private var stagingDirectory: URL?
+
+    init() {
+        let config = URLSessionConfiguration.ephemeral
+        config.timeoutIntervalForRequest = 15
+        config.timeoutIntervalForResource = 15
+        config.httpCookieAcceptPolicy = .never
+        config.httpShouldSetCookies = false
+        config.httpCookieStorage = nil
+        config.urlCache = nil
+        urlSession = URLSession(configuration: config)
+    }
+
+    /// First check 10 seconds after start, then every 6 hours. Stages only — never installs.
+    func startSchedule() {
+        firstCheckTask?.cancel()
+        firstCheckTask = Task { [weak self] in
+            try? await Task.sleep(for: .seconds(10))
+            guard !Task.isCancelled else { return }
+            await self?.checkNow()
+        }
+        repeatingTimer?.invalidate()
+        let timer = Timer(timeInterval: 6 * 60 * 60, repeats: true) { [weak self] _ in
+            Task { @MainActor in
+                await self?.checkNow()
+            }
+        }
+        RunLoop.main.add(timer, forMode: .common)
+        repeatingTimer = timer
+    }
+
+    func checkNow() async {
+        guard !isChecking else { return }
+        isChecking = true
+        defer { isChecking = false }
+
+        let appcast: Appcast
+        do {
+            appcast = try await fetchAppcast()
+        } catch {
+            statusMessage = "Could not check for updates."
+            onChecked?()
+            return
+        }
+
+        guard Self.isNewer(appcast.version, than: Self.currentVersion()) else {
+            clearOffer()
+            statusMessage = nil
+            onChecked?()
+            return
+        }
+
+        do {
+            try await downloadAndStage(appcast)
+            availableUpdate = (version: appcast.version, notes: appcast.notes ?? "")
+            statusMessage = nil
+        } catch UpdateCheckError.checksumMismatch {
+            discardStaging()
+            availableUpdate = nil
+            statusMessage = "Update file failed the checksum — not installed."
+        } catch {
+            discardStaging()
+            availableUpdate = nil
+            statusMessage = "The update could not be prepared."
+        }
+        onChecked?()
+    }
+
+    /// Copies the staged app onto `target` with ditto (in place; never deletes the old app).
+    /// Relaunches unless `SHOTDECK_UPDATE_SELFTEST` is set, so the in-process self-test
+    /// can assert the installed Info.plist without killing the process.
+    func installStaged(to target: URL = UpdateChecker.defaultInstallTarget) {
+        guard let staged = stagedAppURL else {
+            statusMessage = "No update is staged."
+            onChecked?()
+            return
+        }
+
+        do {
+            try FileManager.default.createDirectory(
+                at: target.deletingLastPathComponent(),
+                withIntermediateDirectories: true
+            )
+            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [staged.path, target.path])
+        } catch {
+            statusMessage = "The update could not be installed."
+            onChecked?()
+            return
+        }
+
+        let isSelfTest = ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
+        if isSelfTest { return }
+
+        do {
+            try Self.runProcess(executable: "/usr/bin/open", arguments: ["-n", target.path])
+        } catch {
+            statusMessage = "The update was installed but Redline could not relaunch. Open it from Applications."
+            onChecked?()
+            return
+        }
+        NSApp.terminate(nil)
+    }
+
+    static func resolvedAppcastURL() -> URL {
+        if let env = ProcessInfo.processInfo.environment["REDLINE_APPCAST_URL"],
+           !env.isEmpty,
+           let url = URL(string: env)
+        {
+            return url
+        }
+        if let stored = UserDefaults.standard.string(forKey: appcastURLDefaultsKey),
+           !stored.isEmpty,
+           let url = URL(string: stored)
+        {
+            return url
+        }
+        return defaultAppcastURL
+    }
+
+    static func currentVersion() -> String {
+        Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "0.0.0"
+    }
+
+    static func isNewer(_ candidate: String, than current: String) -> Bool {
+        let a = semverParts(candidate)
+        let b = semverParts(current)
+        for i in 0..<3 {
+            if a[i] != b[i] { return a[i] > b[i] }
+        }
+        return false
+    }
+
+    static func sha256Hex(_ data: Data) -> String {
+        SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined()
+    }
+
+    // MARK: - Private
+
+    private struct Appcast: Decodable {
+        var version: String
+        var zipURL: URL
+        var sha256: String
+        var notes: String?
+    }
+
+    private enum UpdateCheckError: Error {
+        case checksumMismatch
+        case invalidPayload
+        case httpStatus(Int)
+        case processFailed(String)
+    }
+
+    private func fetchAppcast() async throws -> Appcast {
+        let data = try await fetchData(from: Self.resolvedAppcastURL())
+        return try JSONDecoder().decode(Appcast.self, from: data)
+    }
+
+    private func fetchData(from url: URL) async throws -> Data {
+        if url.isFileURL {
+            return try Data(contentsOf: url)
+        }
+        let (data, response) = try await urlSession.data(from: url)
+        if let http = response as? HTTPURLResponse, !(200...299).contains(http.statusCode) {
+            throw UpdateCheckError.httpStatus(http.statusCode)
+        }
+        return data
+    }
+
+    private func downloadAndStage(_ appcast: Appcast) async throws {
+        let zipData = try await fetchData(from: appcast.zipURL)
+        let expected = appcast.sha256.trimmingCharacters(in: .whitespacesAndNewlines)
+        let actual = Self.sha256Hex(zipData)
+        guard actual.caseInsensitiveCompare(expected) == .orderedSame else {
+            throw UpdateCheckError.checksumMismatch
+        }
+
+        discardStaging()
+        let root = FileManager.default.temporaryDirectory
+            .appendingPathComponent("shotdeck-update-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+        stagingDirectory = root
+
+        let zipURL = root.appendingPathComponent("update.zip")
+        try zipData.write(to: zipURL)
+
+        let extracted = root.appendingPathComponent("extracted", isDirectory: true)
+        try FileManager.default.createDirectory(at: extracted, withIntermediateDirectories: true)
+        try Self.runProcess(
+            executable: "/usr/bin/ditto",
+            arguments: ["-x", "-k", zipURL.path, extracted.path]
+        )
+
+        guard let appURL = Self.findRedlineApp(in: extracted) else {
+            throw UpdateCheckError.invalidPayload
+        }
+        let executable = appURL.appendingPathComponent("Contents/MacOS/Shotdeck")
+        guard FileManager.default.fileExists(atPath: executable.path) else {
+            throw UpdateCheckError.invalidPayload
+        }
+        stagedAppURL = appURL
+    }
+
+    private func clearOffer() {
+        availableUpdate = nil
+        discardStaging()
+    }
+
+    private func discardStaging() {
+        if let stagingDirectory {
+            try? FileManager.default.removeItem(at: stagingDirectory)
+        }
+        stagingDirectory = nil
+        stagedAppURL = nil
+    }
+
+    private static func findRedlineApp(in directory: URL) -> URL? {
+        let fm = FileManager.default
+        let direct = directory.appendingPathComponent("Redline.app")
+        if fm.fileExists(atPath: direct.path) { return direct }
+
+        guard let enumerator = fm.enumerator(
+            at: directory,
+            includingPropertiesForKeys: [.isDirectoryKey],
+            options: [.skipsHiddenFiles]
+        ) else { return nil }
+
+        while let item = enumerator.nextObject() as? URL {
+            if item.lastPathComponent == "Redline.app" {
+                return item
+            }
+            if item.pathExtension == "app" {
+                enumerator.skipDescendants()
+            }
+        }
+        return nil
+    }
+
+    private static func semverParts(_ string: String) -> [Int] {
+        let core = string.split(separator: "-").first.map(String.init) ?? string
+        var parts = core.split(separator: ".").prefix(3).map { Int($0) ?? 0 }
+        while parts.count < 3 { parts.append(0) }
+        return parts
+    }
+
+    private static func runProcess(executable: String, arguments: [String]) throws {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: executable)
+        process.arguments = arguments
+        let err = Pipe()
+        process.standardError = err
+        process.standardOutput = Pipe()
+        try process.run()
+        process.waitUntilExit()
+        guard process.terminationStatus == 0 else {
+            let message = String(data: err.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+            throw UpdateCheckError.processFailed("\(executable) failed: \(message)")
+        }
+    }
+}

scripts/build-app.sh

@@ -43,6 +43,7 @@ mkdir -p "${APP_BUNDLE}/Contents/Resources"
 cp "${BIN_PATH}" "${APP_BUNDLE}/Contents/MacOS/Shotdeck"
 chmod +x "${APP_BUNDLE}/Contents/MacOS/Shotdeck"
 cp "${ROOT}/Info.plist" "${APP_BUNDLE}/Contents/Info.plist"
+cp "${ROOT}/Resources/AppIcon.icns" "${APP_BUNDLE}/Contents/Resources/AppIcon.icns"
 
 if [[ "${SKIP_SIGN}" -eq 1 ]]; then
     echo

scripts/make-icon.swift

@@ -0,0 +1,324 @@
+#!/usr/bin/env swift
+import Foundation
+import CoreGraphics
+import ImageIO
+
+// Programmatic Redline app icon.
+// Draws a 1024×1024 master, writes AppIcon.iconset (16…1024 incl. @2x),
+// and compiles Resources/AppIcon.icns via iconutil.
+//
+// Usage:
+//   swift scripts/make-icon.swift
+//   swift scripts/make-icon.swift --preview /path/to/icon-512.png
+
+private let masterSize = 1024
+
+private enum Palette {
+    static let charcoalTop = CGColor(srgbRed: 44.0 / 255.0, green: 44.0 / 255.0, blue: 46.0 / 255.0, alpha: 1)
+    static let charcoalBottom = CGColor(srgbRed: 28.0 / 255.0, green: 28.0 / 255.0, blue: 30.0 / 255.0, alpha: 1) // #1C1C1E
+    static let white = CGColor(srgbRed: 1, green: 1, blue: 1, alpha: 1)
+    static let redline = CGColor(srgbRed: 229.0 / 255.0, green: 72.0 / 255.0, blue: 63.0 / 255.0, alpha: 1) // #E5483F
+}
+
+private struct IconsetEntry {
+    let filename: String
+    let pixels: Int
+}
+
+private let iconsetEntries: [IconsetEntry] = [
+    IconsetEntry(filename: "icon_16x16.png", pixels: 16),
+    IconsetEntry(filename: "icon_16x16@2x.png", pixels: 32),
+    IconsetEntry(filename: "icon_32x32.png", pixels: 32),
+    IconsetEntry(filename: "icon_32x32@2x.png", pixels: 64),
+    IconsetEntry(filename: "icon_128x128.png", pixels: 128),
+    IconsetEntry(filename: "icon_128x128@2x.png", pixels: 256),
+    IconsetEntry(filename: "icon_256x256.png", pixels: 256),
+    IconsetEntry(filename: "icon_256x256@2x.png", pixels: 512),
+    IconsetEntry(filename: "icon_512x512.png", pixels: 512),
+    IconsetEntry(filename: "icon_512x512@2x.png", pixels: 1024),
+]
+
+// MARK: - Geometry
+
+/// Apple-style continuous-corner rounded square (squircle-like).
+/// Superellipse |x/a|^n + |y/b|^n = 1 with n≈5, inset 1px so antialiased
+/// edge pixels are not clipped by the bitmap.
+private func continuousRoundedSquare(size: CGFloat, exponent n: CGFloat = 5.0, segments: Int = 256) -> CGPath {
+    let inset: CGFloat = 1
+    let a = (size - inset * 2) / 2
+    let cx = size / 2
+    let cy = size / 2
+    let twoOverN = 2 / n
+    let path = CGMutablePath()
+    for i in 0...segments {
+        let theta = CGFloat(i) / CGFloat(segments) * 2 * .pi
+        let ct = cos(theta)
+        let st = sin(theta)
+        let x = cx + (ct < 0 ? -1 : 1) * pow(abs(ct), twoOverN) * a
+        let y = cy + (st < 0 ? -1 : 1) * pow(abs(st), twoOverN) * a
+        if i == 0 {
+            path.move(to: CGPoint(x: x, y: y))
+        } else {
+            path.addLine(to: CGPoint(x: x, y: y))
+        }
+    }
+    path.closeSubpath()
+    return path
+}
+
+// MARK: - Drawing
+
+private func drawMasterIcon(size: Int) -> CGImage {
+    let s = CGFloat(size)
+    let colorSpace = CGColorSpace(name: CGColorSpace.sRGB)!
+    let bitmapInfo = CGBitmapInfo.byteOrder32Big.rawValue | CGImageAlphaInfo.premultipliedLast.rawValue
+    guard let ctx = CGContext(
+        data: nil,
+        width: size,
+        height: size,
+        bitsPerComponent: 8,
+        bytesPerRow: 0,
+        space: colorSpace,
+        bitmapInfo: bitmapInfo
+    ) else {
+        fputs("error: failed to create \(size)×\(size) bitmap context\n", stderr)
+        exit(1)
+    }
+
+    ctx.setShouldAntialias(true)
+    ctx.setAllowsAntialiasing(true)
+    ctx.interpolationQuality = .high
+
+    // Flip to top-left origin so "top-to-bottom gradient" is literal.
+    ctx.translateBy(x: 0, y: s)
+    ctx.scaleBy(x: 1, y: -1)
+
+    ctx.clear(CGRect(x: 0, y: 0, width: s, height: s))
+
+    let squircle = continuousRoundedSquare(size: s)
+
+    ctx.saveGState()
+    ctx.addPath(squircle)
+    ctx.clip()
+
+    let gradient = CGGradient(
+        colorsSpace: colorSpace,
+        colors: [Palette.charcoalTop, Palette.charcoalBottom] as CFArray,
+        locations: [0, 1]
+    )!
+    ctx.drawLinearGradient(
+        gradient,
+        start: CGPoint(x: s / 2, y: 0),
+        end: CGPoint(x: s / 2, y: s),
+        options: [.drawsBeforeStartLocation, .drawsAfterEndLocation]
+    )
+    ctx.restoreGState()
+
+    // Viewfinder corner brackets: thick L-strokes, rounded caps/joins, inset ~18%.
+    let inset = s * 0.18
+    let bracketWidth = s * 0.095
+    let arm = s * 0.155
+    let centerline = inset + bracketWidth / 2
+
+    ctx.saveGState()
+    ctx.addPath(squircle)
+    ctx.clip()
+    ctx.setStrokeColor(Palette.white)
+    ctx.setLineWidth(bracketWidth)
+    ctx.setLineCap(.round)
+    ctx.setLineJoin(.round)
+
+    func strokeBracket(cornerX: CGFloat, cornerY: CGFloat, dirX: CGFloat, dirY: CGFloat) {
+        let path = CGMutablePath()
+        path.move(to: CGPoint(x: cornerX + dirX * arm, y: cornerY))
+        path.addLine(to: CGPoint(x: cornerX, y: cornerY))
+        path.addLine(to: CGPoint(x: cornerX, y: cornerY + dirY * arm))
+        ctx.addPath(path)
+        ctx.strokePath()
+    }
+
+    // Top-left, top-right, bottom-left, bottom-right.
+    strokeBracket(cornerX: centerline, cornerY: centerline, dirX: 1, dirY: 1)
+    strokeBracket(cornerX: s - centerline, cornerY: centerline, dirX: -1, dirY: 1)
+    strokeBracket(cornerX: centerline, cornerY: s - centerline, dirX: 1, dirY: -1)
+    strokeBracket(cornerX: s - centerline, cornerY: s - centerline, dirX: -1, dirY: -1)
+
+    // Bold redline slash over the frame, lower-left bracket area → upper-right.
+    let slashWidth = s * 0.078
+    ctx.setStrokeColor(Palette.redline)
+    ctx.setLineWidth(slashWidth)
+    ctx.setLineCap(.round)
+    ctx.setLineJoin(.round)
+    let slashInset = centerline + arm * 0.12
+    let slash = CGMutablePath()
+    slash.move(to: CGPoint(x: slashInset, y: s - slashInset))
+    slash.addLine(to: CGPoint(x: s - slashInset, y: slashInset))
+    ctx.addPath(slash)
+    ctx.strokePath()
+    ctx.restoreGState()
+
+    guard let image = ctx.makeImage() else {
+        fputs("error: failed to materialize master CGImage\n", stderr)
+        exit(1)
+    }
+    return image
+}
+
+private func scaledImage(_ image: CGImage, pixels: Int) -> CGImage {
+    if image.width == pixels && image.height == pixels {
+        return image
+    }
+    let colorSpace = CGColorSpace(name: CGColorSpace.sRGB)!
+    let bitmapInfo = CGBitmapInfo.byteOrder32Big.rawValue | CGImageAlphaInfo.premultipliedLast.rawValue
+    guard let ctx = CGContext(
+        data: nil,
+        width: pixels,
+        height: pixels,
+        bitsPerComponent: 8,
+        bytesPerRow: 0,
+        space: colorSpace,
+        bitmapInfo: bitmapInfo
+    ) else {
+        fputs("error: failed to create \(pixels)×\(pixels) scale context\n", stderr)
+        exit(1)
+    }
+    ctx.interpolationQuality = .high
+    ctx.setShouldAntialias(true)
+    ctx.draw(image, in: CGRect(x: 0, y: 0, width: pixels, height: pixels))
+    guard let out = ctx.makeImage() else {
+        fputs("error: failed to scale image to \(pixels)px\n", stderr)
+        exit(1)
+    }
+    return out
+}
+
+private func writePNG(_ image: CGImage, to url: URL) {
+    let dir = url.deletingLastPathComponent()
+    try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+    if FileManager.default.fileExists(atPath: url.path) {
+        try? FileManager.default.removeItem(at: url)
+    }
+    guard let dest = CGImageDestinationCreateWithURL(url as CFURL, "public.png" as CFString, 1, nil) else {
+        fputs("error: cannot create PNG destination at \(url.path)\n", stderr)
+        exit(1)
+    }
+    CGImageDestinationAddImage(dest, image, nil)
+    if !CGImageDestinationFinalize(dest) {
+        fputs("error: failed to write PNG \(url.path)\n", stderr)
+        exit(1)
+    }
+}
+
+// MARK: - Paths / CLI
+
+private func repoRoot() -> URL {
+    let cwd = URL(fileURLWithPath: FileManager.default.currentDirectoryPath, isDirectory: true)
+    let arg0 = URL(fileURLWithPath: CommandLine.arguments[0])
+    let scriptURL: URL
+    if arg0.path.hasPrefix("/") {
+        scriptURL = arg0.standardizedFileURL
+    } else {
+        scriptURL = cwd.appendingPathComponent(arg0.path).standardizedFileURL
+    }
+    let fromScript = scriptURL.deletingLastPathComponent().deletingLastPathComponent()
+    if FileManager.default.fileExists(atPath: fromScript.appendingPathComponent("Package.swift").path) {
+        return fromScript
+    }
+    if FileManager.default.fileExists(atPath: cwd.appendingPathComponent("Package.swift").path) {
+        return cwd
+    }
+    fputs("error: could not find repo root (Package.swift)\n", stderr)
+    exit(1)
+}
+
+private func parsePreviewPath() -> String? {
+    let args = CommandLine.arguments
+    var i = 1
+    var preview: String?
+    while i < args.count {
+        let arg = args[i]
+        if arg == "--preview" {
+            i += 1
+            guard i < args.count else {
+                fputs("error: --preview requires a path\n", stderr)
+                exit(1)
+            }
+            preview = args[i]
+        } else if arg.hasPrefix("--preview=") {
+            preview = String(arg.dropFirst("--preview=".count))
+        } else if arg == "--help" || arg == "-h" {
+            fputs("Usage: swift scripts/make-icon.swift [--preview PATH]\n", stderr)
+            exit(0)
+        } else {
+            fputs("error: unknown argument \(arg)\n", stderr)
+            fputs("Usage: swift scripts/make-icon.swift [--preview PATH]\n", stderr)
+            exit(1)
+        }
+        i += 1
+    }
+    return preview
+}
+
+private func runIconutil(iconset: URL, icns: URL) {
+    let proc = Process()
+    proc.executableURL = URL(fileURLWithPath: "/usr/bin/iconutil")
+    proc.arguments = ["-c", "icns", iconset.path, "-o", icns.path]
+    proc.standardOutput = FileHandle.standardOutput
+    proc.standardError = FileHandle.standardError
+    do {
+        try proc.run()
+        proc.waitUntilExit()
+    } catch {
+        fputs("error: failed to launch iconutil: \(error)\n", stderr)
+        exit(1)
+    }
+    if proc.terminationStatus != 0 {
+        fputs("error: iconutil exited \(proc.terminationStatus)\n", stderr)
+        exit(1)
+    }
+}
+
+// MARK: - Main
+
+let root = repoRoot()
+let resources = root.appendingPathComponent("Resources", isDirectory: true)
+let icnsURL = resources.appendingPathComponent("AppIcon.icns")
+let previewPath = parsePreviewPath()
+let fm = FileManager.default
+
+print("==> Drawing \(masterSize)×\(masterSize) master")
+let master = drawMasterIcon(size: masterSize)
+
+let iconset = fm.temporaryDirectory.appendingPathComponent("Redline-AppIcon-\(UUID().uuidString).iconset", isDirectory: true)
+
+do {
+    try fm.createDirectory(at: iconset, withIntermediateDirectories: true)
+    try fm.createDirectory(at: resources, withIntermediateDirectories: true)
+
+    print("==> Writing AppIcon.iconset")
+    for entry in iconsetEntries {
+        let img = scaledImage(master, pixels: entry.pixels)
+        writePNG(img, to: iconset.appendingPathComponent(entry.filename))
+    }
+
+    if fm.fileExists(atPath: icnsURL.path) {
+        try fm.removeItem(at: icnsURL)
+    }
+
+    print("==> Compiling \(icnsURL.path)")
+    runIconutil(iconset: iconset, icns: icnsURL)
+
+    try? fm.removeItem(at: iconset)
+} catch {
+    try? fm.removeItem(at: iconset)
+    fputs("error: \(error)\n", stderr)
+    exit(1)
+}
+
+if let previewPath {
+    let previewURL = URL(fileURLWithPath: previewPath)
+    print("==> Writing 512px preview \(previewURL.path)")
+    writePNG(scaledImage(master, pixels: 512), to: previewURL)
+}
+
+print("App icon: \(icnsURL.path)")