Skip to content

TypeSafe Place 0.2.1 (River Oaks)

Latest
Latest

Choose a tag to compare

View all tags
@BunsDev BunsDev released this 16 Oct 01:55
· 1727 commits to main since this release
v0.2.1
This tag was signed with the committer’s verified signature.
BunsDev Val Alexander 👑
SSH Key Fingerprint: Apqee2EOZLXmfVUUy/QX1QLBn9g10SuzHbK5ARks19E
Verified
Learn about vigilant mode.
19d1125
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

TypeSafe Place 0.2.1 (River Oaks) for Apple Silicon Macs: the first build signed with a Developer ID certificate and notarized by Apple.

Changes

  • Signed and notarized.
    • The app is signed by Soul Protocol LLC (Developer ID, team 9LR8Z8UQ9X) with the hardened runtime, and Apple notarized it. macOS opens it without the unidentified-developer warning.
    • The notarization ticket is stapled, so the first launch does not need to reach Apple.
  • Fewer permissions. The app may use JIT, which V8 needs, and the microphone, which shared voice asks for only after you choose Unmute. It gets nothing else: no camera, location, Bluetooth, USB or printing.
  • Encrypted cookies. Your session cookie is now encrypted with a key in your Keychain. Cookies saved by 0.2.0 still work after the update, so you stay signed in.
  • Hosted game. The game itself is served from main and was already live before this release. Since 0.2.0 that includes:
    • players staying connected through server rotation (#447), with voice surviving that hand-over (#454);
    • IPIC theater and lounge improvements (#453, #465);
    • green roofs and live office outlooks (#449, #450);
    • a smoother office lift (#460);
    • the Studio House template and Garden Office fixes (#466, #452);
    • a clearer waitlist (#451), usernames with at least 4 letters (#458), and steadier avatars on iOS Safari (#436).

The full notes, with compatibility and rollback guidance, are in docs/releases/0.2.1.md.

Desktop installation

  1. Download TypeSafe-Place-0.2.1-macOS-arm64.zip.
  2. Unzip it.
  3. Move TypeSafe Place.app to Applications, replacing 0.2.0 if you have it.

The app needs an internet connection, GitHub sign-in through the system browser, and waitlist approval. The first time it saves your session, the app stores its cookie key in your login Keychain. macOS lets later updates signed by the same team use that key, as Chrome's updates do.

Rolling back to 0.2.0 signs you out: 0.2.0 cannot read the encrypted cookie store and clears it. Your preferences and window position are kept.

SHA-256: fa5e7e2cb2c92cf74ec07b784f07243bb14f6cdd57ab7e9c972c41467c1f270c

Verification

Release build. It ran in a clean, detached worktree at the tag commit 19d11250, with its own pnpm install:

  • pnpm run test:desktop: 76 of 76.
  • pnpm run desktop:package succeeds. desktop:package:check passes: the ASAR holds exactly the allowed desktop files, and the Electron fuses match, with cookie encryption on.
  • The desktop end-to-end test, using the loopback acceptance fixture, passed all 13 of its checks.

Signing and notarization (pnpm run desktop:sign):

  • Authority chain: Developer ID Application: Soul Protocol LLC (9LR8Z8UQ9X), then Developer ID Certification Authority, then Apple Root CA.
  • Hardened runtime and a secure timestamp. The entitlements are exactly com.apple.security.cs.allow-jit and com.apple.security.device.audio-input.
  • Apple notarization 055e4bd7-e036-4248-8a60-7e189fe692a0: Accepted, with no issues. The ticket is stapled and validates.
  • spctl accepts the app: "Notarized Developer ID". This was also checked on the app unzipped from this archive and marked as downloaded (quarantined).
  • A launch with a scratch profile started the app and its helpers and reached the sign-in step.

Not verified:

  • live authenticated play in the packaged app, which needs an approved account and an interactive sign-in;
  • human accessibility review;
  • quiet-machine shared/full browser and 60 Hz acceptance;
  • production migration acceptance;
  • Windows, Linux or native Unreal packages.

Delivery

Release #467 was merged as 19d112502a557b8b172e8449cac4d7bbe4510909 after all checks passed. That commit was the head of main when the build started and when it was signed. The tag v0.2.1 is signed and verified. The same PR resolved code-scanning alert #4 (a test that built code from a temporary path). CodeQL's analysis of this commit closed that alert, and the repository has no open code-scanning alerts. The release ledger, docs/superpowers/plans/2026-10-15-release-0.2.1.md, records the checks and the signing receipt.

Assets 4
Loading