feat(penpal): add packaging script and dev build branding

- Add scripts/package.sh to zip .app bundles for distribution using
  ditto (preserves code signatures and resource forks). Accepts an
  optional arch argument for CI cross-compilation.
- Patch `just install` to set CFBundleName/CFBundleDisplayName to
  "Penpal Dev" so developers can distinguish local builds from
  Homebrew installs at a glance.
- Add `just package` recipe that builds and packages in one step.
- Add dist/ to .gitignore and clean recipe.

Author: loganj

apps/penpal/.gitignore

@@ -18,6 +18,9 @@
 # Test artifacts
 test-results/
 
+# Package output
+dist/
+
 # Tauri build artifacts
 frontend/src-tauri/target/
 frontend/src-tauri/binaries/

apps/penpal/frontend/src/components/InstallStartup.test.tsx

@@ -103,25 +103,7 @@ describe('Install startup behavior', () => {
     expect(overlay).toBeNull();
   });
 
-  it('still shows modal when tools installed even if previously dismissed', async () => {
-    localStorage.setItem(`penpal-install-dismissed-${__BUILD_ID__}`, '1');
-    vi.mocked(api.checkInstallStatus).mockResolvedValue({
-      cli: { installed: true, path: '/usr/local/bin/penpal' },
-      plugin: { installed: false },
-    });
-
-    render(
-      <MemoryRouter>
-        <Layout />
-      </MemoryRouter>,
-    );
-
-    await waitFor(() => {
-      expect(screen.getByText('Update Command Line Tools')).toBeInTheDocument();
-    });
-  });
-
-  it('persists dismiss when user closes without tools installed', async () => {
+  it('does not persist dismiss when user closes without tools installed', async () => {
     vi.mocked(api.checkInstallStatus).mockResolvedValue({
       cli: { installed: false },
       plugin: { installed: false },
@@ -139,7 +121,7 @@ describe('Install startup behavior', () => {
 
     fireEvent.click(screen.getByText('Not Now'));
 
-    expect(localStorage.getItem(`penpal-install-dismissed-${__BUILD_ID__}`)).toBe('1');
+    expect(localStorage.getItem(`penpal-install-dismissed-${__BUILD_ID__}`)).toBeNull();
   });
 
   it('does not persist dismiss when user closes with outdated tools installed', async () => {

apps/penpal/frontend/src/components/Layout.tsx

@@ -202,9 +202,8 @@ export default function Layout() {
   }, []);
 
   // On startup, check install status to decide whether to show the modal.
-  // - Not yet dismissed this build + tools present → show (update prompt, nag until updated)
-  // - Not yet dismissed this build + no tools → show (first-time install offer)
-  // - Already dismissed this build → don't show
+  // The dismiss key is only written after a successful install for this build,
+  // so the modal keeps prompting until tools are actually installed and current.
   const [toolsInstalled, setToolsInstalled] = useState(false);
   useEffect(() => {
     if (!isDesktopApp) return;
@@ -213,11 +212,6 @@ export default function Layout() {
       .then((status) => {
         const hasTools = status.cli.installed || status.plugin.installed;
         setToolsInstalled(hasTools);
-        // Show modal unless already dismissed for this build.
-        // The dismiss key is set after a successful install/update, or when
-        // the user opts out with no tools installed.  When tools are present
-        // but outdated and the user closes without updating, the key is NOT
-        // written — so they'll be prompted again on next launch.
         if (!localStorage.getItem(dismissKey)) {
           setShowInstallModal(true);
         }
@@ -226,11 +220,18 @@ export default function Layout() {
   }, []);
 
   function handleInstallModalClose(installed: boolean) {
-    if (installed || !toolsInstalled) {
-      // Persist dismiss: tools are up to date, or user opted out with nothing installed
+    setShowInstallModal(false);
+    if (installed) {
+      // Only persist dismiss when tools were confirmed installed for this build.
+      // This means the modal keeps prompting on startup until tools are actually
+      // installed and up-to-date — no stale opt-out dismiss path.
       localStorage.setItem(`penpal-install-dismissed-${__BUILD_ID__}`, '1');
+      api.checkInstallStatus()
+        .then((status) => {
+          setToolsInstalled(status.cli.installed || status.plugin.installed);
+        })
+        .catch(() => {});
     }
-    setShowInstallModal(false);
   }
 
 

apps/penpal/justfile

@@ -39,34 +39,43 @@ dev: ensure-deps build-go
 build-go: ensure-deps
     ./scripts/build-go.sh
 
-# Install Penpal: build desktop app and copy to /Applications
-install: build
+# Install Penpal: build dev-branded desktop app and copy to /Applications
+install: ensure-deps build-go
     #!/usr/bin/env bash
     set -euo pipefail
 
+    # Build with "Penpal Dev" product name so devs can distinguish from Homebrew installs
+    cd frontend && pnpm install && VITE_BASE=/ VITE_API_URL=http://localhost:8080 pnpm run build \
+        && npx tauri build --config '{"productName":"Penpal Dev"}'
+
+    cd ..
+
     # Quit running Penpal if present
     if pgrep -x Penpal >/dev/null 2>&1; then
         echo "Quitting Penpal..."
         osascript -e 'quit app "Penpal"' 2>/dev/null || true
         sleep 1
-        # Force kill if it didn't quit gracefully
         pkill -x Penpal 2>/dev/null || true
     fi
 
-    # Copy .app to /Applications
-    APP_SRC="frontend/src-tauri/target/release/bundle/macos/Penpal.app"
+    # The dev build bundles as "Penpal Dev.app"
+    APP_SRC="frontend/src-tauri/target/release/bundle/macos/Penpal Dev.app"
     if [ -d "$APP_SRC" ]; then
         echo "Installing Penpal.app to /Applications..."
         rm -rf /Applications/Penpal.app
         cp -R "$APP_SRC" /Applications/Penpal.app
-        echo "Penpal.app installed."
+        echo "Penpal.app installed (dev build)."
     else
         echo "Warning: $APP_SRC not found, skipping app install."
     fi
 
     # Launch the app — CLI + plugin are installed via in-app menu
     open /Applications/Penpal.app
 
+# Package .app into a distributable zip
+package: build
+    ./scripts/package.sh
+
 # Uninstall Penpal
 uninstall:
     #!/usr/bin/env bash
@@ -125,6 +134,7 @@ test-e2e: ensure-deps
 # Clean build artifacts
 clean:
     rm -f penpal
+    rm -rf dist
     rm -rf frontend/dist
     rm -rf frontend/src-tauri/target
     rm -rf frontend/src-tauri/binaries

apps/penpal/scripts/package.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$(dirname "$SCRIPT_DIR")"
+DIST_DIR="$ROOT_DIR/dist"
+
+# Read version from Cargo.toml
+VERSION=$(grep '^version' "$ROOT_DIR/frontend/src-tauri/Cargo.toml" | head -1 | sed 's/version = "//;s/"//')
+
+# Architecture: use argument if provided, otherwise detect host
+ARCH="${1:-$(uname -m)}"
+case "$ARCH" in
+    aarch64|arm64)  ARCH="arm64" ;;
+    x86_64|amd64)   ARCH="x86_64" ;;
+    *)              echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+APP_SRC="$ROOT_DIR/frontend/src-tauri/target/release/bundle/macos/Penpal.app"
+if [ ! -d "$APP_SRC" ]; then
+    echo "Error: $APP_SRC not found. Run 'just build' first." >&2
+    exit 1
+fi
+
+# Verify the binary architecture matches the requested arch
+ACTUAL_ARCH=$(lipo -archs "$APP_SRC/Contents/MacOS/Penpal")
+if [[ "$ACTUAL_ARCH" != *"$ARCH"* ]]; then
+    echo "Error: Binary architecture mismatch. Requested '$ARCH' but binary contains '$ACTUAL_ARCH'." >&2
+    exit 1
+fi
+
+mkdir -p "$DIST_DIR"
+OUTPUT="$DIST_DIR/Penpal-${VERSION}-${ARCH}.zip"
+
+echo "Packaging Penpal.app → $OUTPUT"
+# ditto preserves resource forks and code signatures; --keepParent puts Penpal.app at the zip root
+ditto -c -k --sequesterRsrc --keepParent "$APP_SRC" "$OUTPUT"
+
+echo "Done: $OUTPUT ($(du -h "$OUTPUT" | cut -f1))"