Ghost FTP 0.99.5 — macOS Command/Control shortcut isolation

Channel: Development Preview. This release may be published only if all exact-SHA CI gates and platform artifacts succeed. New release acceptance must not be claimed solely from a source commit.

Implemented

• Correct macOS primary modifier handling: application shortcuts use Command, while SSH terminal Control combinations no longer incorrectly trigger application actions such as the Command+K palette or Command+R window reload.
• Keep Windows/Linux application shortcuts on Control, distinguish Windows/Super keys, and preserve multi-modifier identity.
• Run executable platform-specific TypeScript key-combo regressions as part of the mandatory UI quality check.
• Synchronize Rust, Tauri, npm, Go, Android and updater version metadata without modifying profile, Keychain or bundle identifiers.

Installable macOS Preview without Apple Developer certificate

• For both Apple Silicon ARM64 and Intel x86_64, package a complete ad-hoc-signed Ghost FTP Desktop app inside a non-Developer-ID, unsigned, unnotarized DMG with a Finder Applications shortcut and bilingual installation instructions. Apple Developer Program credentials are not required.
• Preserve the existing ZIP alternatives. macOS CI mounts and verifies each disk image, checks its app signature and exact executable bytes, and writes a combined ZIP+DMG SHA-256 manifest.
• Canonical GitHub Release publication requires both installable DMGs and verifies SHA-256 before publishing. Missing packages fail the release process instead of being silently skipped.
• First launch is a per-application Gatekeeper decision: System Settings → Privacy & Security → Open Anyway. Do not remove quarantine attributes or disable Gatekeeper globally. See docs/guides/MACOS_INSTALLATION.md.
• These are public development Preview installers, not notarized or claimed physically validated on real Macs.

macOS distribution engineering

• Restore genuine AppKit traffic-light window buttons and macOS native titlebar overlay while preserving Windows/Linux custom window controls.
• Add a separate, manually approved Developer ID signing + Apple notarytool + stapling + Gatekeeper acceptance workflow for both architectures. It fails closed without owner-provided credentials and uploads notarized candidates, never automatically promotes a Preview to stable.
• Scope certificate and notary private key secrets to signing steps; static quality CI enforces that packaging cannot silently bypass signing.
• Record the required actual-machine tests in docs/qa/MACOS_PRODUCTION_RELEASE.md. Their outcomes remain pending.

Remaining macOS acceptance

• The separate ARM64 and Intel shared macOS apps are ad-hoc-signed Preview candidates, not notarized Developer ID consumer packages.
• Real macOS UI, native file-dialog permissions, Finder/Dock, accessibility, Apple Keychain prompts, SSH/TLS identity rejection, interruption, 4 GiB+ transfers, install/upgrade and legacy SwiftUI migration remain device-level QA requirements.
• Existing SwiftUI client and its profiles, credentials, update paths and all historical releases/tags remain untouched.