A build-hygiene release. No behaviour changes — if you are on v1.2.0, Claw'd works exactly the same.
🔒 Build metadata is no longer embedded in the binary
A default SwiftPM release build writes the absolute build path into the executable — once per object file as an N_OSO debug stab, and once more as the Bundle.module fallback literal. On a stock macOS install that path starts with /Users/<account>/, so a release binary quietly carries whatever the build machine was called. For a project that ships unsigned specifically to avoid attaching an identity to the download, that was the wrong default.
run.sh now builds with --scratch-path outside $HOME and -Xswiftc -gnone. Measured on this tree, that takes the count from 77 to zero.
✅ And the check that should have caught it now does
scripts/make-dmg.sh had an "anonymity check" that ran codesign -dv and asserted an ad-hoc signature with no Team ID. That assertion was true on every build — it was just checking a different channel from the one that was open.
It now greps the raw bytes of the Mach-O and exits non-zero rather than producing an image. Two traps are written into it as comments, because both cost real time to find:
stringsmisses a path containing a non-ASCII character — the UTF-8 bytes split the run.- The compressed
.dmgshows nothing at all. The payload only exists once mounted.
🖼️ Demo reel cleaned up
A macOS notification belonging to an unrelated session had been captured into the README demo and was frozen into all 192 frames. Painted out per-frame using a fill sampled from the desktop beside it.
Install: open the DMG, drag to Applications, then right-click → Open the first time. Still ad-hoc signed, not notarized. 98 tests, zero dependencies, no network access.