Sotto v1.1.0 (unstable)

New Features

• app-driven update flow — silent download + UpdateBanner restart [build] (ed21ba5)
• auto-check on launch + appcast publish step (in-place-update test) [build] (c119d0c)
• integrate Sparkle 2 auto-update into devid-sandbox [build] (6a9ffd1)
• devid-sandbox target — mas binary + Dev ID + App Sandbox [build] (240ac25)

Bug Fixes

• resolve Dependabot security alerts (4fcb27f)
• move banner clear of titlebar drag strip + instrument install path [build] (84b270e)
• make banner button clickable in titlebar + remove dismiss [build] (1badd26)
• banner label uses text-text-secondary (bare text-secondary is a no-op) [build] (f2855ab)
• visible Restart button + fixed-overlay fade for UpdateBanner [build] (cc67093)
• sign components with explicit empty entitlements (not sandboxed) [build] (f03600c)
• bundle framework on 'mas' platform (devid-sandbox builds --platform mas) [build] (07c9aef)
• inject ElectronTeamID so Chromium Mach rendezvous is authorized [build] (f4f7e22)
• pin Electron 41.7.1 — 42.3.0 breaks better-sqlite3 native build [build] (087c3cd)

Tests

• exclude nested node_modules from vitest scan (2397de8)
• Phase 0 step 4 — add Sparkle -spks/-spki mach-lookup exceptions [build] (4a7c2a0)

Maintenance

• set version to 1.1.0 for the next release (617d26b)
• revert version bump + drop temp click diagnostic (PR cleanup) (00dd094)
• bump to 1.0.2 for app-driven flow update-target (vN+1') (d4a4427)
• bump to 1.0.1 for the Sparkle in-place-update test (vN+1) (89ebd82)

Other Changes

• ci(sandbox): add arch input; default test builds to single-arch arm64 [build] (2a71784)
• ci(sandbox): notarize on push events too (unset input coerced to false) (e151c2e)
• ci(sandbox): derive Team ID from keychain cert if APPLE_IDENTITY lacks (TEAMID) (7e11f37)