finish implementation for iOS

.env.example

@@ -1,16 +0,0 @@
-FASTLANE_SKIP_UPDATE_CHECK=1
-FASTLANE_HIDE_CHANGELOG=1
-FASTLANE_TEAM_ID=DQQH5H6GBD
-
-APP_STORE_CONNECT_KEY_ID=
-APP_STORE_CONNECT_ISSUER_ID=
-APP_STORE_CONNECT_KEY_CONTENT=
-
-MATCH_GIT_URL=
-MATCH_PASSWORD=
-MATCH_GIT_BASIC_AUTHORIZATION=
-MATCH_GIT_BRANCH=master
-
-ATTRACTOR_PROVISIONING_PROFILE_SPECIFIER=Attractor AppStore CI
-ATTRACTOR_VERSION_TAG=
-ATTRACTOR_BUILD_NUMBER=

.gitea/workflows/testflight.yml

@@ -1,45 +0,0 @@
-name: TestFlight
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - "release/ios/v*"
-      - "Attractor-*"
-
-jobs:
-  testflight:
-    runs-on: xcode
-    defaults:
-      run:
-        shell: bash
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.1.7"
-          bundler-cache: true
-
-      - name: Upload to TestFlight
-        env:
-          HOME: /var/lib/act_runner
-          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
-          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
-          APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
-          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
-          MATCH_GIT_URL: ${{ secrets.MATCH_GIT_URL }}
-          MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
-          ATTRACTOR_VERSION_TAG: ${{ github.ref_name }}
-          FASTLANE_SKIP_UPDATE_CHECK: "1"
-          FASTLANE_HIDE_CHANGELOG: "1"
-          FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
-        run: |
-          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
-          ruby --version
-          bundle exec fastlane ios beta

.gitignore

@@ -1,5 +0,0 @@
-.env
-.bundle/
-build/
-fastlane/README.md
-fastlane/report.xml

App/Supporting Files/Info.plist

@@ -34,8 +34,6 @@
 	</array>
 	<key>CFBundleVersion</key>
 	<string>$(CURRENT_PROJECT_VERSION)</string>
-	<key>ITSAppUsesNonExemptEncryption</key>
-	<false/>
 	<key>LSApplicationCategoryType</key>
 	<string>public.app-category.utilities</string>
 	<key>LSRequiresIPhoneOS</key>

App/Supporting Files/SBrowser.entitlements

@@ -2,8 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>com.apple.developer.web-browser</key>
-	<true/>
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
 	<key>com.apple.security.network.client</key>

App/Tabs/Tab.swift

@@ -19,6 +19,7 @@ class Tab: NSObject, SBRProcessBundleBridgeDelegate
     
     public var tabInfo: TabInfo {
         get {
+            updateMetadata()
             return _tabInfo
         }
     }
@@ -38,14 +39,18 @@ class Tab: NSObject, SBRProcessBundleBridgeDelegate
     }
     public var policyManager: ResourcePolicyManager
     
-    // Persisted snapshot of visible tab metadata; do not recompute on read.
+    private var _tabInfo: TabInfo = TabInfo()
-    var _tabInfo: TabInfo = TabInfo()
     
     private var loadedWebView: WKWebView? = nil
     public var title: String? { get { tabInfo.title } }
     public var url: URL? {
-        if let urlString = tabInfo.urlString { return URL(string: urlString) }
+        get {
-        return nil
+            if let urlString = tabInfo.urlString {
+                return URL(string: urlString)
+            }
+            
+            return nil
+        }
     }
     
     public var javaScriptEnabled: Bool = false {
@@ -105,10 +110,6 @@ class Tab: NSObject, SBRProcessBundleBridgeDelegate
         super.init()
         
         bridge.delegate = self
-
-        // Initialize snapshot metadata
-        _tabInfo.identifier = self.identifier
-        if let url { _tabInfo.urlString = url.absoluteString }
     }
     
     deinit {
@@ -116,8 +117,6 @@ class Tab: NSObject, SBRProcessBundleBridgeDelegate
     }
     
     func beginLoadingURL(_ url: URL) {
-        // Update snapshot immediately so UI keeps URL even if process jettisons.
-        _tabInfo.urlString = url.absoluteString
         let request = URLRequest(url: url)
         webView.load(request)
     }
@@ -151,4 +150,15 @@ class Tab: NSObject, SBRProcessBundleBridgeDelegate
                 .assign(to: \.favicon, on: self)
         }
     }
+    
+    private func updateMetadata() {
+        guard contentProcessTerminated == false else { return }
+        
+        _tabInfo = TabInfo(
+            title: loadedWebView?.title,
+            urlString: loadedWebView?.url?.absoluteString ?? self.homeURL?.absoluteString,
+            faviconData: self.favicon?.pngData(),
+            identifier: self.identifier
+        )
+    }
 }

App/Tabs/TabController.swift

@@ -49,28 +49,16 @@ class TabController
             tabs.append(tab)
         }
         
-        // Title observation: update snapshot and notify delegate.
+        // Title observation
         tab.titleObservation = tab.webView.observe(\.title, changeHandler: { [weak tab, weak self] (webView, change) in
-            guard let tab = tab else { return }
+            if let tab = tab, let self = self, let delegate = self.controllerDelegate {
-            if let newTitle = webView.title, !newTitle.isEmpty {
-                tab._tabInfo.title = newTitle
-            }
-            if let self = self, let delegate = self.controllerDelegate {
                 delegate.tabController(self, didUpdateTitle: webView.title ?? "", forTab: tab)
             }
         })
         
-        // URL observation: persist the latest URL in the snapshot.
-        tab.urlObservation = tab.webView.observe(\.url, changeHandler: { [weak tab] (webView, change) in
-            guard let tab = tab else { return }
-            tab._tabInfo.urlString = webView.url?.absoluteString ?? tab._tabInfo.urlString
-        })
-        
         // Favicon Observation
         tab.faviconObservation = tab.$favicon.receive(on: RunLoop.main).sink { [weak tab, weak self] val in
-            guard let tab = tab else { return }
+            if let tab = tab, let self = self, let delegate = self.controllerDelegate {
-            tab._tabInfo.faviconData = val?.pngData()
-            if let self = self, let delegate = self.controllerDelegate {
                 delegate.tabController(self, didUpdateFavicon: val, forTab: tab)
             }
         }

App/Web Process Bundle Bridge/SBRProcessBundleBridge.m

@@ -11,7 +11,6 @@
 #import "Hacks.h"
 
 #import <OSLog/OSLog.h>
-#import <stdatomic.h>
 
 #import <WebKit/_WKRemoteObjectInterface.h>
 #import <WebKit/_WKRemoteObjectRegistry.h>
@@ -20,28 +19,10 @@
 #import <WebKit/WKProcessPoolPrivate.h>
 #import <WebKit/WKWebViewPrivate.h>
 #import <WebKit/WKWebViewConfigurationPrivate.h>
-#import <WebKit/WKContentRuleListStore.h>
 
 #define WKUserStyleSheet id
 #define WKUserStyleSheetEncodedClassName "X1dLVXNlclN0eWxlU2hlZXQ="
 
-NSArray<NSString *> *CommonCDNList(void) {
-    static dispatch_once_t onceToken;
-    static NSArray<NSString *> *commonCDNList = nil;
-    dispatch_once(&onceToken, ^{
-        commonCDNList = @[
-            @"cdn.jsdelivr.net",
-             @"fsdn.net",
-             @"cdnjs.com",
-             @"osscdn.com",
-             @"code.jquery.com",
-             @"bootstrapcdn.com"
-        ];
-    });
-    
-    return commonCDNList;
-}
-
 @interface StyleSheet : NSObject <NSCopying>
 @property (nonatomic, readonly, copy) NSString *source;
 @property (nonatomic, readonly, copy) NSURL *baseURL;
@@ -50,9 +31,6 @@ NSArray<NSString *> *CommonCDNList(void) {
 - (instancetype)initWithSource:(NSString *)source forMainFrameOnly:(BOOL)forMainFrameOnly;
 @end
 
-// Note: We no longer proxy http/https via WKURLSchemeHandler; we use
-// WebKit content blocking rules instead.
-
 @interface WKUserContentController (Private)
 - (void)__addUserStyleSheet:(WKUserStyleSheet)userStyleSheet;
 - (void)__removeUserStyleSheet:(WKUserStyleSheet)userStyleSheet;
@@ -90,13 +68,6 @@ NSArray<NSString *> *CommonCDNList(void) {
 #define LOG_DEBUG(format, ...) os_log_debug(_log, format, ##__VA_ARGS__)
 #define LOG_ERROR(format, ...) os_log_error(_log, format, ##__VA_ARGS__)
 
-static os_log_t _log;
-
-__attribute__((constructor))
-static void initialize_log(void) {
-    _log = os_log_create("net.buzzert.attractor.webview", "bridge");
-}
-
 @interface NSURLResponse (BridgeAdditions)
 @property (nonatomic, readonly) BOOL isJavascriptResponse;
 @end
@@ -120,11 +91,13 @@ static void initialize_log(void) {
 
 @end
 
-@interface SBRProcessBundleBridge ()
+@interface SBRProcessBundleBridge () <WKURLSchemeHandler>
 
 @end
 
 @implementation SBRProcessBundleBridge {
+    os_log_t                _log;
+    
     WKWebView              *_webView;
     WKWebViewConfiguration *_webViewConfiguration;
     WKProcessPool          *_processPool;
@@ -134,21 +107,17 @@ static void initialize_log(void) {
     
     NSArray<WKUserScript *> *_userScripts;
     
+    dispatch_queue_t _dataTasksAccessQueue;
+    NSMutableDictionary<NSURLRequest *, NSURLSessionDataTask *> *_dataTasks;
+    
     // These come from settings. 
     WKUserStyleSheet   _customizedUserStylesheet;
     WKUserScript      *_customizedUserScript;
-
-    // Content blocking
-    WKContentRuleList *_activeScriptRuleList;
-    void *_urlKVOContext;
 }
 
 - (void)tearDown
 {
-    if (_webView) {
+    // This was used to unregister the delegate with the web process.
-        @try { [_webView removeObserver:self forKeyPath:@"URL" context:_urlKVOContext]; }
-        @catch (__unused NSException *ex) {}
-    }
 }
 
 - (instancetype)initWithWebViewConfiguration:(WKWebViewConfiguration *)webViewConfiguration
@@ -156,6 +125,8 @@ static void initialize_log(void) {
     self = [super init];
     if (self) {
         if (!webViewConfiguration) {
+            _log = os_log_create("net.buzzert.attractor.webview", "bridge");
+            
             webViewConfiguration = [[WKWebViewConfiguration alloc] init];
 
             // Set up process pool
@@ -164,7 +135,12 @@ static void initialize_log(void) {
             
             webViewConfiguration._waitsForPaintAfterViewDidMoveToWindow = NO;
             webViewConfiguration._applePayEnabled = YES;
-            // No http/https interception — rely on content blocking rules instead.
+            
+            _dataTasks = [NSMutableDictionary dictionary];
+            _dataTasksAccessQueue = dispatch_queue_create("net.buzzert.attractor.dataTasksAccess", DISPATCH_QUEUE_SERIAL);
+            
+            [webViewConfiguration setURLSchemeHandler:self forURLScheme:@"http"];
+            [webViewConfiguration setURLSchemeHandler:self forURLScheme:@"https"];
         }
         
         _webViewConfiguration = webViewConfiguration;
@@ -185,11 +161,6 @@ static void initialize_log(void) {
         }
         
         _webView = webView;
-        _urlKVOContext = &_urlKVOContext; // unique context pointer
-        [_webView addObserver:self forKeyPath:@"URL" options:(NSKeyValueObservingOptionNew) context:_urlKVOContext];
-
-        // Initialize content blocking rules for current host
-        [self rebuildContentBlockingRulesForCurrentHost];
     }
     
     return self;
@@ -252,18 +223,97 @@ static void initialize_log(void) {
     });
 }
 
+#pragma mark <WKURLSchemeHandler>
+
+- (void)webView:(WKWebView *)webView startURLSchemeTask:(id<WKURLSchemeTask>)urlSchemeTask
+{
+    NSString *hostOrigin = [[_webView URL] host];
+    NSURLRequest *request = [urlSchemeTask request];
+    
+    LOG_DEBUG("Start URL scheme task: request: %@", request);
+    
+    __weak __auto_type welf = self;
+    NSURLSessionDataTask *dataTask = [[NSURLSession sharedSession] dataTaskWithRequest:request completionHandler:^(NSData * _Nullable data, NSURLResponse * _Nullable response, NSError * _Nullable error)
+    {
+        if (!welf) return;
+        __strong __auto_type sself = welf;
+        
+        if (error != nil) {
+            [urlSchemeTask didFailWithError:error];
+        } else if ([response isKindOfClass:[NSHTTPURLResponse class]]) {
+            NSURL *requestURL = [request URL];
+            NSString *resourceOrigin = [requestURL host];
+            const __auto_type allowResource = ^{
+                os_log_debug(sself->_log, "Allowing resource: %@", requestURL.lastPathComponent);
+                [urlSchemeTask didReceiveResponse:response];
+                [urlSchemeTask didReceiveData:data];
+                [urlSchemeTask didFinish];
+                
+                [self webProcessDidAllowScriptWithOrigin:resourceOrigin];
+            };
+            
+            const __auto_type denyResource = ^{
+                os_log_debug(sself->_log, "Blocking resource: %@", requestURL.lastPathComponent);
+                NSHTTPURLResponse *altResponse = [[NSHTTPURLResponse alloc] initWithURL:requestURL
+                                                                               MIMEType:@"application/javascript"
+                                                                  expectedContentLength:0 textEncodingName:@"utf8"];
+                [urlSchemeTask didReceiveResponse:altResponse];
+                [urlSchemeTask didReceiveData:[NSData data]];
+                [urlSchemeTask didFinish];
+                
+                [self webProcessDidBlockScriptWithOrigin:resourceOrigin];
+            };
+            
+            // Check MIME type for JavaScript responses.
+            if ([response isJavascriptResponse] && ![sself allowAllScripts]) {
+                dispatch_async(sself->_dataTasksAccessQueue, ^{
+                    NSDictionary<NSString *, NSNumber *> *policyTypes = [sself->_policyDataSource scriptPolicyTypeByOrigin];
+                    NSNumber *policyType = [policyTypes objectForKey:hostOrigin];
+                    
+                    SBRScriptPolicy *policy = [[SBRScriptPolicy alloc] initWithSecurityOrigin:hostOrigin policyType:[policyType integerValue]];
+                    if ([policy allowsExternalJavaScriptResourceOrigin:resourceOrigin]) {
+                        allowResource();
+                    } else {
+                        denyResource();
+                    }
+                });
+            } else {
+                allowResource();
+            }
+        } else {
+            [urlSchemeTask didFailWithError:[NSError errorWithDomain:NSURLErrorDomain code:0 userInfo:nil]];
+        }
+        
+        [sself->_dataTasks removeObjectForKey:request];
+    }];
+    
+    [_dataTasks setObject:dataTask forKey:request];
+    [dataTask resume];
+}
+
+- (void)webView:(WKWebView *)webView stopURLSchemeTask:(id<WKURLSchemeTask>)urlSchemeTask
+{
+    NSURLRequest *request = [urlSchemeTask request];
+    NSURLSessionDataTask *dataTask = [_dataTasks objectForKey:request];
+    if (dataTask) {
+        if ([dataTask state] != NSURLSessionTaskStateCanceling) {
+            [dataTask cancel];
+        }
+        
+        [_dataTasks removeObjectForKey:request];
+    }
+}
+
 #pragma mark Actions
 
 - (void)policyDataSourceDidChange
 {
-    // Rebuild content blocking rules when policy changes.
+    // This was used when we had to signal the process bundle.
-    [self rebuildContentBlockingRulesForCurrentHost];
 }
 
 - (void)setAllowAllScripts:(BOOL)allowAllScripts
 {
     _allowAllScripts = allowAllScripts;
-    [self rebuildContentBlockingRulesForCurrentHost];
 }
 
 - (void)setDarkModeEnabled:(BOOL)darkModeEnabled
@@ -310,119 +360,4 @@ static void initialize_log(void) {
     }];
 }
 
-// MARK: - Content Blocking Rules
-
-- (void)observeValueForKeyPath:(NSString *)keyPath ofObject:(id)object change:(NSDictionary<NSKeyValueChangeKey,id> *)change context:(void *)context
-{
-    if (context == _urlKVOContext && [keyPath isEqualToString:@"URL"]) {
-        [self rebuildContentBlockingRulesForCurrentHost];
-        return;
-    }
-    [super observeValueForKeyPath:keyPath ofObject:object change:change context:context];
-}
-
-- (void)rebuildContentBlockingRulesForCurrentHost
-{
-    NSString *hostOrigin = _webView.URL.host;
-    if (!hostOrigin) {
-        // No page loaded yet; clear any existing rules
-        [self applyContentRuleListJSON:nil withName:nil];
-        return;
-    }
-
-    // Determine policy for this host
-    NSNumber *policyType = nil;
-    @synchronized (_policyDataSource) {
-        NSDictionary<NSString *, NSNumber *> *policyTypes = [_policyDataSource scriptPolicyTypeByOrigin];
-        policyType = [policyTypes objectForKey:hostOrigin] ?: @(0);
-    }
-
-    // Alpha=0 Bravo=1 Charlie=2 Delta=3 Echo=4
-    SBRScriptOriginPolicyType type = [policyType integerValue];
-    if (_allowAllScripts || type >= SBRScriptOriginPolicyTypeEcho) {
-        // Echo or shields down: no blocking
-        [self applyContentRuleListJSON:nil withName:nil];
-        return;
-    }
-
-    // Base trigger applies only to this page's domain
-    NSMutableArray *rules = [NSMutableArray array];
-    NSDictionary *baseScriptTrigger = @{
-        @"resource-type" : @[ @"script" ],
-        @"if-domain"     : @[ hostOrigin ]
-    };
-
-    if (type <= SBRScriptOriginPolicyTypeBravo) {
-        // Alpha or Bravo: block all external script subresources (inline JS is controlled via preferences elsewhere)
-        [rules addObject:@{ @"trigger": baseScriptTrigger, @"action": @{ @"type": @"block" } }];
-    } else {
-        // Charlie/Delta: block third-party scripts
-        NSMutableDictionary *trigger = [baseScriptTrigger mutableCopy];
-        trigger[@"load-type"] = @[ @"third-party" ];
-        [rules addObject:@{ @"trigger": trigger, @"action": @{ @"type": @"block" } }];
-        
-        if (type >= SBRScriptOriginPolicyTypeDelta) {
-            // Delta: add allowlist for common CDNs
-            for (NSString *cdn in CommonCDNList()) {
-                NSString *escaped = [NSRegularExpression escapedPatternForString:cdn];
-                NSString *pattern = [NSString stringWithFormat:@".*://([^.]*\\.)?%@/", escaped];
-                [rules addObject:@{
-                    @"trigger": @{
-                        @"url-filter": pattern,
-                        @"if-domain": @[ hostOrigin ],
-                        @"resource-type": @[ @"script" ]
-                    },
-                    @"action": @{ @"type": @"ignore-previous-rules" }
-                }];
-            }
-            
-            // Heuristic: allow cdn.<anything-with-family-name>/* where family name is the second-level label
-            NSArray<NSString *> *components = [hostOrigin componentsSeparatedByString:@"."];
-            if (components.count > 1) {
-                NSString *family = components[components.count - 2];
-                NSString *escapedFamily = [NSRegularExpression escapedPatternForString:family];
-                NSString *familyPattern = [NSString stringWithFormat:@".*://cdn\\.[^/]*%@[^/]*/", escapedFamily];
-                [rules addObject:@{
-                    @"trigger": @{
-                        @"url-filter": familyPattern,
-                        @"if-domain": @[ hostOrigin ],
-                        @"resource-type": @[ @"script" ]
-                    },
-                    @"action": @{ @"type": @"ignore-previous-rules" }
-                }];
-            }
-        }
-    }
-
-    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:rules options:0 error:nil];
-    NSString *json = [[NSString alloc] initWithData:jsonData encoding:NSUTF8StringEncoding];
-    NSString *name = [NSString stringWithFormat:@"net.buzzert.attractor.rules.%@", hostOrigin];
-    [self applyContentRuleListJSON:json withName:name];
-}
-
-- (void)applyContentRuleListJSON:(NSString *)json withName:(NSString *)name
-{
-    WKUserContentController *controller = [_webViewConfiguration userContentController];
-    if (_activeScriptRuleList) {
-        [controller removeContentRuleList:_activeScriptRuleList];
-        _activeScriptRuleList = nil;
-    }
-
-    if (!json || !name) { return; }
-
-    WKContentRuleListStore *store = [WKContentRuleListStore defaultStore];
-    [store compileContentRuleListForIdentifier:name encodedContentRuleList:json completionHandler:^(WKContentRuleList * _Nullable ruleList, NSError * _Nullable error) {
-        if (error) {
-            LOG_ERROR("Failed to compile content rule list: %@", error.localizedDescription);
-            return;
-        }
-        
-        dispatch_async(dispatch_get_main_queue(), ^{
-            self->_activeScriptRuleList = ruleList;
-            [controller addContentRuleList:ruleList];
-            LOG_DEBUG("Applied content rule list: %@", name);
-        });
-    }];
-}
-
 @end

Gemfile

@@ -1,3 +0,0 @@
-source "https://rubygems.org"
-
-gem "fastlane"

Gemfile.lock

@@ -1,231 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    CFPropertyList (3.0.9)
-    abbrev (0.1.2)
-    addressable (2.9.0)
-      public_suffix (>= 2.0.2, < 8.0)
-    artifactory (3.0.17)
-    atomos (0.1.3)
-    aws-eventstream (1.3.2)
-    aws-partitions (1.1109.0)
-    aws-sdk-core (3.224.1)
-      aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.992.0)
-      aws-sigv4 (~> 1.9)
-      base64
-      jmespath (~> 1, >= 1.6.1)
-      logger
-    aws-sdk-kms (1.101.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
-      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.188.0)
-      aws-sdk-core (~> 3, >= 3.224.1)
-      aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.11.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-    babosa (1.0.4)
-    base64 (0.2.0)
-    claide (1.1.0)
-    colored (1.2)
-    colored2 (3.1.2)
-    commander (4.6.0)
-      highline (~> 2.0.0)
-    csv (3.3.5)
-    declarative (0.0.20)
-    digest-crc (0.7.0)
-      rake (>= 12.0.0, < 14.0.0)
-    domain_name (0.5.20190701)
-      unf (>= 0.0.5, < 1.0.0)
-    dotenv (2.8.1)
-    emoji_regex (3.2.3)
-    excon (0.109.0)
-    faraday (1.10.6)
-      faraday-em_http (~> 1.0)
-      faraday-em_synchrony (~> 1.0)
-      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0)
-      faraday-multipart (~> 1.0)
-      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.0)
-      faraday-patron (~> 1.0)
-      faraday-rack (~> 1.0)
-      faraday-retry (~> 1.0)
-      ruby2_keywords (>= 0.0.4)
-    faraday-cookie_jar (0.0.8)
-      faraday (>= 0.8.0)
-      http-cookie (>= 1.0.0)
-    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.1)
-    faraday-excon (1.1.0)
-    faraday-httpclient (1.0.1)
-    faraday-multipart (1.2.0)
-      multipart-post (~> 2.0)
-    faraday-net_http (1.0.2)
-    faraday-net_http_persistent (1.2.0)
-    faraday-patron (1.0.0)
-    faraday-rack (1.0.0)
-    faraday-retry (1.0.4)
-    faraday_middleware (1.2.1)
-      faraday (~> 1.0)
-    fastimage (2.4.1)
-    fastlane (2.230.0)
-      CFPropertyList (>= 2.3, < 4.0.0)
-      abbrev (~> 0.1.2)
-      addressable (>= 2.8, < 3.0.0)
-      artifactory (~> 3.0)
-      aws-sdk-s3 (~> 1.0)
-      babosa (>= 1.0.3, < 2.0.0)
-      base64 (~> 0.2.0)
-      bundler (>= 1.12.0, < 3.0.0)
-      colored (~> 1.2)
-      commander (~> 4.6)
-      csv (~> 3.3)
-      dotenv (>= 2.1.1, < 3.0.0)
-      emoji_regex (>= 0.1, < 4.0)
-      excon (>= 0.71.0, < 1.0.0)
-      faraday (~> 1.0)
-      faraday-cookie_jar (~> 0.0.6)
-      faraday_middleware (~> 1.0)
-      fastimage (>= 2.1.0, < 3.0.0)
-      fastlane-sirp (>= 1.0.0)
-      gh_inspector (>= 1.1.2, < 2.0.0)
-      google-apis-androidpublisher_v3 (~> 0.3)
-      google-apis-playcustomapp_v1 (~> 0.1)
-      google-cloud-env (>= 1.6.0, < 2.0.0)
-      google-cloud-storage (~> 1.31)
-      highline (~> 2.0)
-      http-cookie (~> 1.0.5)
-      json (< 3.0.0)
-      jwt (>= 2.1.0, < 3)
-      logger (>= 1.6, < 2.0)
-      mini_magick (>= 4.9.4, < 5.0.0)
-      multipart-post (>= 2.0.0, < 3.0.0)
-      mutex_m (~> 0.3.0)
-      naturally (~> 2.2)
-      nkf (~> 0.2.0)
-      optparse (>= 0.1.1, < 1.0.0)
-      plist (>= 3.1.0, < 4.0.0)
-      rubyzip (>= 2.0.0, < 3.0.0)
-      security (= 0.1.5)
-      simctl (~> 1.6.3)
-      terminal-notifier (>= 2.0.0, < 3.0.0)
-      terminal-table (~> 3)
-      tty-screen (>= 0.6.3, < 1.0.0)
-      tty-spinner (>= 0.8.0, < 1.0.0)
-      word_wrap (~> 1.0.0)
-      xcodeproj (>= 1.13.0, < 2.0.0)
-      xcpretty (~> 0.4.1)
-      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
-    fastlane-sirp (1.1.0)
-    gh_inspector (1.1.3)
-    google-apis-androidpublisher_v3 (0.54.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-core (0.11.3)
-      addressable (~> 2.5, >= 2.5.1)
-      googleauth (>= 0.16.2, < 2.a)
-      httpclient (>= 2.8.1, < 3.a)
-      mini_mime (~> 1.0)
-      representable (~> 3.0)
-      retriable (>= 2.0, < 4.a)
-      rexml
-    google-apis-iamcredentials_v1 (0.17.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-playcustomapp_v1 (0.13.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-storage_v1 (0.29.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-cloud-core (1.6.1)
-      google-cloud-env (>= 1.0, < 3.a)
-      google-cloud-errors (~> 1.0)
-    google-cloud-env (1.6.0)
-      faraday (>= 0.17.3, < 3.0)
-    google-cloud-errors (1.3.1)
-    google-cloud-storage (1.45.0)
-      addressable (~> 2.8)
-      digest-crc (~> 0.4)
-      google-apis-iamcredentials_v1 (~> 0.1)
-      google-apis-storage_v1 (~> 0.29.0)
-      google-cloud-core (~> 1.6)
-      googleauth (>= 0.16.2, < 2.a)
-      mini_mime (~> 1.0)
-    googleauth (1.8.1)
-      faraday (>= 0.17.3, < 3.a)
-      jwt (>= 1.4, < 3.0)
-      multi_json (~> 1.11)
-      os (>= 0.9, < 2.0)
-      signet (>= 0.16, < 2.a)
-    highline (2.0.3)
-    http-cookie (1.0.8)
-      domain_name (~> 0.5)
-    httpclient (2.9.0)
-      mutex_m
-    jmespath (1.6.2)
-    json (2.7.6)
-    jwt (2.10.3)
-      base64
-    logger (1.7.0)
-    mini_magick (4.13.2)
-    mini_mime (1.1.5)
-    multi_json (1.15.0)
-    multipart-post (2.4.1)
-    mutex_m (0.3.0)
-    nanaimo (0.4.0)
-    naturally (2.3.0)
-    nkf (0.2.0)
-    optparse (0.8.1)
-    os (1.1.4)
-    plist (3.7.2)
-    public_suffix (5.1.1)
-    rake (13.4.2)
-    representable (3.2.0)
-      declarative (< 0.1.0)
-      trailblazer-option (>= 0.1.1, < 0.2.0)
-      uber (< 0.2.0)
-    retriable (3.8.0)
-    rexml (3.4.4)
-    rouge (3.28.0)
-    ruby2_keywords (0.0.5)
-    rubyzip (2.4.1)
-    security (0.1.5)
-    signet (0.18.0)
-      addressable (~> 2.8)
-      faraday (>= 0.17.5, < 3.a)
-      jwt (>= 1.5, < 3.0)
-      multi_json (~> 1.10)
-    simctl (1.6.10)
-      CFPropertyList
-      naturally
-    terminal-notifier (2.0.0)
-    terminal-table (3.0.2)
-      unicode-display_width (>= 1.1.1, < 3)
-    trailblazer-option (0.1.2)
-    tty-cursor (0.7.1)
-    tty-screen (0.8.2)
-    tty-spinner (0.9.3)
-      tty-cursor (~> 0.7)
-    uber (0.1.0)
-    unf (0.2.0)
-    unicode-display_width (2.6.0)
-    word_wrap (1.0.0)
-    xcodeproj (1.27.0)
-      CFPropertyList (>= 2.3.3, < 4.0)
-      atomos (~> 0.1.3)
-      claide (>= 1.0.2, < 2.0)
-      colored2 (~> 3.1)
-      nanaimo (~> 0.4.0)
-      rexml (>= 3.3.6, < 4.0)
-    xcpretty (0.4.1)
-      rouge (~> 3.28.0)
-    xcpretty-travis-formatter (1.0.1)
-      xcpretty (~> 0.2, >= 0.0.7)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  fastlane
-
-BUNDLED WITH
-   2.5.23

README.md

@@ -26,10 +26,3 @@ Attractor operates in five "security modes":
 - Custom redirect rules
 - Catalyst and iPadOS support
 
-## Deployment
-
-TestFlight deployment is handled by Fastlane and the Gitea workflow at `.gitea/workflows/testflight.yml`.
-
-Required Gitea secrets match the local `.env.example`: `APP_STORE_CONNECT_KEY_ID`, `APP_STORE_CONNECT_ISSUER_ID`, `APP_STORE_CONNECT_KEY_CONTENT`, `MATCH_GIT_URL`, `MATCH_PASSWORD`, and `MATCH_GIT_BASIC_AUTHORIZATION`.
-
-Push a tag like `release/ios/v4.2` or `Attractor-4.2` to build and upload to TestFlight. To prepare signing assets locally, run `bundle exec fastlane ios setup_signing`; to upload manually, run `bundle exec fastlane ios beta`.

SBrowser.xcodeproj/project.pbxproj

@@ -790,7 +790,7 @@
 				CODE_SIGN_ENTITLEMENTS = "App/Supporting Files/SBrowser.entitlements";
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 6;
+				CURRENT_PROJECT_VERSION = 5;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3SJALV9BQ7;
 				INFOPLIST_FILE = "App/Supporting Files/Info.plist";
@@ -801,7 +801,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 4.1;
+				MARKETING_VERSION = 4.0;
 				PRODUCT_BUNDLE_IDENTIFIER = net.buzzert.attractor;
 				PRODUCT_NAME = Attractor;
 				PROVISIONING_PROFILE_SPECIFIER = "";
@@ -825,7 +825,7 @@
 				CODE_SIGN_ENTITLEMENTS = "App/Supporting Files/SBrowser.entitlements";
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 6;
+				CURRENT_PROJECT_VERSION = 5;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3SJALV9BQ7;
 				INFOPLIST_FILE = "App/Supporting Files/Info.plist";
@@ -836,7 +836,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 4.1;
+				MARKETING_VERSION = 4.0;
 				PRODUCT_BUNDLE_IDENTIFIER = net.buzzert.attractor;
 				PRODUCT_NAME = Attractor;
 				PROVISIONING_PROFILE_SPECIFIER = "";

fastlane/Fastfile

@@ -1,186 +0,0 @@
-require "shellwords"
-require "xcodeproj"
-
-default_platform(:ios)
-
-APP_IDENTIFIER = "net.buzzert.attractor"
-SCHEME = "Attractor"
-TARGET_NAME = "App"
-TEAM_ID = ENV["FASTLANE_TEAM_ID"].to_s.strip.empty? ? "DQQH5H6GBD" : ENV["FASTLANE_TEAM_ID"]
-PROFILE_NAME = ENV["ATTRACTOR_PROVISIONING_PROFILE_SPECIFIER"].to_s.strip.empty? ? "Attractor AppStore CI" : ENV["ATTRACTOR_PROVISIONING_PROFILE_SPECIFIER"]
-CI_KEYCHAIN_NAME = "attractor_ci_keychain"
-CI_KEYCHAIN_PASSWORD = "attractor-ci-keychain-password"
-CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
-PROJECT_FILE = File.expand_path("../SBrowser.xcodeproj", __dir__)
-
-def present?(value)
-  !value.to_s.strip.empty?
-end
-
-def ci?
-  present?(ENV["CI"])
-end
-
-def version_from_tag(tag)
-  patterns = [
-    %r{\Arelease/ios/v(\d+(?:\.\d+){1,2})\z},
-    %r{\AAttractor-(\d+(?:\.\d+){1,2})\z},
-    %r{\Av(\d+(?:\.\d+){1,2})\z}
-  ]
-
-  patterns.each do |pattern|
-    match = tag.to_s.match(pattern)
-    return match[1] if match
-  end
-
-  nil
-end
-
-def release_version
-  candidates = [
-    ENV["ATTRACTOR_VERSION_TAG"],
-    ENV["GITHUB_REF_NAME"],
-    ENV["GITHUB_REF"].to_s.sub(%r{\Arefs/tags/}, "")
-  ]
-
-  candidates.each do |tag|
-    version = version_from_tag(tag)
-    return version if version
-  end
-
-  latest_tag = sh("git describe --tags --abbrev=0").strip
-  version = version_from_tag(latest_tag)
-  return version if version
-
-  candidates << latest_tag
-  UI.user_error!("Release tag must look like release/ios/v4.1, Attractor-4.1, or v4.1; got #{candidates.compact.inspect}")
-end
-
-# App Store Connect requires CFBundleVersion to be unique and strictly
-# increasing app-wide. Attractor already has historical builds, so use a UTC
-# timestamp by default instead of assuming a fresh CI run number is high enough.
-def build_number
-  value = ENV["ATTRACTOR_BUILD_NUMBER"]
-  value = Time.now.utc.strftime("%Y%m%d%H%M%S") unless present?(value)
-
-  unless value.to_s.match?(/\A\d+\z/)
-    UI.user_error!("Build number must be numeric; got #{value.inspect}")
-  end
-
-  value.to_s
-end
-
-def stamp_project_versions(version:, build:)
-  project = Xcodeproj::Project.open(PROJECT_FILE)
-  target = project.targets.find { |candidate| candidate.name == TARGET_NAME }
-  UI.user_error!("Could not find target #{TARGET_NAME.inspect} in #{PROJECT_FILE}") unless target
-
-  target.build_configurations.each do |configuration|
-    configuration.build_settings["MARKETING_VERSION"] = version
-    configuration.build_settings["CURRENT_PROJECT_VERSION"] = build
-  end
-
-  project.save
-end
-
-platform :ios do
-  private_lane :app_store_api_key do
-    app_store_connect_api_key(
-      key_id: ENV.fetch("APP_STORE_CONNECT_KEY_ID"),
-      issuer_id: ENV.fetch("APP_STORE_CONNECT_ISSUER_ID"),
-      key_content: ENV.fetch("APP_STORE_CONNECT_KEY_CONTENT"),
-      is_key_content_base64: true
-    )
-  end
-
-  # CI signs headlessly, so match needs a fresh unlocked keychain to import
-  # into. codesign resolves identities through the user keychain search
-  # list (first match wins; the --keychain flag does not restrict the
-  # lookup), and other projects' keychains on this runner hold the same
-  # identity but are usually locked — so ours must come first. delete_keychain
-  # in the beta lane's ensure removes both the keychain and its search-list
-  # entry, which also keeps our (later locked) copy from shadowing those
-  # other projects.
-  private_lane :prepare_ci_keychain do
-    next unless ci?
-
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
-    create_keychain(
-      name: CI_KEYCHAIN_NAME,
-      password: CI_KEYCHAIN_PASSWORD,
-      unlock: true,
-      timeout: 3600,
-      add_to_search_list: false
-    )
-
-    others = sh("security list-keychains -d user", log: false)
-      .scan(/"([^"]+)"/)
-      .flatten
-      .reject { |path| path.include?(CI_KEYCHAIN_NAME) }
-    sh("security list-keychains -d user -s #{([CI_KEYCHAIN_DB_PATH] + others).shelljoin}")
-
-    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
-    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
-  end
-
-  private_lane :sync_signing do |options|
-    match(
-      type: "appstore",
-      readonly: options.fetch(:readonly),
-      app_identifier: APP_IDENTIFIER,
-      team_id: TEAM_ID,
-      profile_name: PROFILE_NAME,
-      git_url: ENV.fetch("MATCH_GIT_URL"),
-      git_branch: ENV.fetch("MATCH_GIT_BRANCH", "master"),
-      git_full_name: "Attractor Release Bot",
-      git_user_email: "james.magahern@me.com",
-      api_key: options.fetch(:api_key)
-    )
-  end
-
-  desc "Create or update match signing assets"
-  lane :setup_signing do
-    sync_signing(api_key: app_store_api_key, readonly: false)
-  end
-
-  desc "Build and upload to TestFlight"
-  lane :beta do
-    prepare_ci_keychain
-
-    api_key = app_store_api_key
-    version = release_version
-    build = build_number
-
-    stamp_project_versions(version: version, build: build)
-
-    sync_signing(api_key: api_key, readonly: true)
-
-    build_app(
-      project: PROJECT_FILE,
-      scheme: SCHEME,
-      destination: "generic/platform=iOS",
-      export_method: "app-store",
-      codesigning_identity: "Apple Distribution",
-      xcargs: [
-        "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-        "CODE_SIGN_STYLE=Manual",
-        "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-        "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-      ].join(" "),
-      export_options: {
-        signingStyle: "manual",
-        teamID: TEAM_ID,
-        provisioningProfiles: {
-          APP_IDENTIFIER => PROFILE_NAME
-        }
-      }
-    )
-
-    upload_to_testflight(
-      api_key: api_key,
-      skip_waiting_for_build_processing: true
-    )
-  ensure
-    delete_keychain(name: CI_KEYCHAIN_NAME) if ci? && File.file?(CI_KEYCHAIN_DB_PATH)
-  end
-end

justfile

@@ -1,18 +0,0 @@
-simulator := "platform=iOS Simulator,name=iPhone 17e,OS=latest"
-derived_data := "build/DerivedData"
-
-default:
-  @just build
-
-build:
-  if command -v xcbeautify >/dev/null 2>&1; then \
-    xcodebuild -project SBrowser.xcodeproj -scheme Attractor -destination '{{simulator}}' | xcbeautify; \
-  else \
-    xcodebuild -project SBrowser.xcodeproj -scheme Attractor -destination '{{simulator}}'; \
-  fi
-
-beta:
-  bundle exec fastlane ios beta
-
-setup-signing:
-  bundle exec fastlane ios setup_signing

mise.toml

@@ -1,4 +0,0 @@
-[tools]
-just = "latest"
-ruby = "3.1.7"
-xcbeautify = "latest"