Kingfisher 1.1.2

Kingfisher 1.1.2

Released 2026-09-13. A maintenance release on 1.1.1 that brings the public
Mac application back to the same source revision as the web application:
1.1.1 (build 494, 6df79f8) predated the fixes made while certifying
Phase 49 and the update-experience work of Phase 50. The 1.1.1 bytes are
untouched; 1.1.2 is a new release that Kingfisher → Check for Updates…
offers to an installed 1.1.1.

Surface	Address
Web app	https://kingfisher-roan.vercel.app/
Landing page	https://kingfisher-chess.vercel.app/
macOS	Kingfisher-1.1.2-arm64.dmg on the v1.1.2 release
Data mirror	https://github.com/mardakurt/kingfisher-data

Apple Silicon (arm64), macOS 13 (Ventura) or later — the floor of the
Electron 44 runtime the application is built on. Signed with a Developer ID
certificate and notarised by Apple, ticket stapled to the disk image and the
application.

What changed since 1.1.1

The user-facing list is the 1.1.2 entry in
CHANGELOG.md. In short:

• No more Touch ID or password prompt on every update. The macOS
  dialog Kingfisher is trying to add a new helper tool fired on every
  Install Update because Squirrel.Mac always tries to install itself as
  a privileged helper (Squirrel/Squirrel.Mac#192, #247). Kingfisher now
  writes SquirrelMacEnableDirectContentsWrite as the string "TRUE"
  in its own defaults domain on first launch — ShipIt compares with
  isEqualToString:, so a boolean written with defaults write -bool
  silently fails — and the update engine writes the bundle directly. The
  first launch after a fresh install may still prompt once; every update
  after that is silent. SHA-512 verification, Developer ID signing and
  notarisation are unchanged.
• Release notes appear inline in the update dialog. The
  Check-for-Updates window renders the GitHub release body between the
  headline and the footnote. Headings, lists, paragraphs, bold, italic and
  inline code are supported; there is no HTML pass-through and no
  string-to-DOM sink, so a hostile release body cannot run in the dialog.
• A quiet background check on launch. Five seconds after start-up the
  application asks the release feed once; if a newer release exists, the
  Kingfisher menu's Check for Updates… item re-labels itself to An
  Update Is Available… (or Update Ready to Install… once downloaded).
  No badge, no banner, no notification, no further polling; the explicit
  click is unchanged.
• Send feedback sends. Every in-application Send since the dialog
  shipped failed with Illegal invocation before the request left the
  browser; the direct route worked, which is what the smoke tests had
  exercised. The request now leaves the page, carries the fill-time
  stamp the route requires, and attaches the current position when the
  switch is on. e2e/feedback.spec.ts drives the real dialog.
• The three web fixes that 1.1.1 lacked: a PGN worker no longer loads
  another worker's module after a cached navigation; a shortcut can be
  rebound in Safari; one prepared position is singular.

Installing and updating

Same as 1.1.1: download Kingfisher-1.1.2-arm64.dmg, open it, drag
Kingfisher to Applications, double-click. An installed 1.1.1 is offered
1.1.2 through Kingfisher → Check for Updates…; Install Update replaces
the bundle in place and reopens the new version with the work intact. The
first such update may show the helper-tool prompt once (the flag is set on
1.1.1's next launch, not retroactively); after that they are silent.

Verification

The exact bytes the landing offers — size, SHA-256, build number and
commit — are in src/release/macos-download.json; npm run desktop:public:verify -- --landing --full downloads them from GitHub and
checks the hash, the signature and the stapled ticket. The commands run
for this release and their results are recorded in
docs/reports/phase-50-handover.md.