From 091d9df6f036f04c45f34f499914347c5a31bb55 Mon Sep 17 00:00:00 2001
From: "Adrian Alfred C. Bonpin" <adrianbonpin@gmail.com>
Date: Sat, 8 Aug 2026 13:29:31 +0800
Subject: [PATCH] fix/macos launch (#18)

* fix: macOS Finder launch (store path, ad-hoc signing, vendored openssl)

- Store::open was resolving 'gridline.db' relative to the working directory;
  Finder/LaunchServices launches run with cwd=/ so the .expect() panicked
  (exit 101, silent 'app does nothing') before Tauri ever started. Open the
  store under app.path().app_data_dir() in setup instead (same dir as the
  demo DB), creating the dir when needed.
- Add bundle.macOS.signingIdentity "-" + hardenedRuntime false so the
  bundler ad-hoc signs the whole bundle. Previously only the inner binary
  got Xcode 16's linker-signed signature, which macOS treats as unsigned:
  quarantined downloads showed 'damaged and can't be opened', and after
  quarantine removal LaunchServices silently refused to spawn it.
- ssh2 now builds OpenSSL vendored (feature vendored-openssl): the release
  binary previously carried an absolute LC_LOAD_DYLIB to the build machine's
  /opt/homebrew/opt/openssl@3/lib, which dyld aborted on (and hardened
  runtime library-validation rejected even when present).
- README: document the macOS first-launch paths (right-click Open / xattr
  for the damaged-error case, re-run after every upgrade).
- release.yml: update SIGNING STATUS comment to reflect ad-hoc signing.

* chore: bump 0.7.8 -> 0.7.9 (release prep)

- Version sync across package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json
- version.test.ts / bundle-config.test.ts / docs-coverage.test.ts expect 0.7.9
- README: both download tables -> v0.7.9 asset names; new v0.7.9 changelog entry;
  tag instructions -> v0.7.9; MAINTENANCE comment updated
- AGENTS.md maintenance note example -> v0.7.9
- ROADMAP: Shipped (0.7.9) section; Next up retitled (0.8.0) TBD
---
 .github/workflows/release.yml | 16 +++++++-----
 AGENTS.md                     |  2 +-
 README.md                     | 47 +++++++++++++++++++++--------------
 ROADMAP.md                    |  9 ++++++-
 package.json                  |  2 +-
 src-tauri/Cargo.lock          | 12 ++++++++-
 src-tauri/Cargo.toml          |  7 ++++--
 src-tauri/src/lib.rs          | 30 +++++++++++++++-------
 src-tauri/tauri.conf.json     |  6 ++++-
 src/lib/bundle-config.test.ts |  6 ++---
 src/lib/docs-coverage.test.ts | 14 +++++------
 src/lib/version.test.ts       |  4 +--
 12 files changed, 102 insertions(+), 53 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 10affa3..fabbf9f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,12 +7,16 @@ name: Release
 #   git checkout prod && git pull
 #   git tag v0.5.0 && git push origin v0.5.0
 #
-# SIGNING STATUS: builds are UNSIGNED for now (no code-signing certs yet —
-# see README "Download a release"). tauri-action automatically signs +
-# notarizes when the signing secrets are present, so the moment we add
-# APPLE_CERTIFICATE / APPLE_API_KEY / WINDOWS_CERTIFICATE (or Azure Trusted
-# Signing) to repo secrets, future builds are signed — no changes to this
-# file required.
+# SIGNING STATUS: macOS bundles are AD-HOC signed via tauri.conf.json
+# (bundle.macOS.signingIdentity: "-", hardenedRuntime: false). That replaces
+# the linker-only signature that made macOS report the app as "damaged" and
+# refuse Finder launches — users now get the standard "Open Anyway" prompt
+# (or run `xattr -dr com.apple.quarantine` for the damaged-error case, see
+# README). Still NOT Developer-ID signed / notarized (no certs yet).
+# tauri-action automatically signs + notarizes when the signing secrets are
+# present, so the moment we add APPLE_CERTIFICATE / APPLE_API_KEY /
+# WINDOWS_CERTIFICATE (or Azure Trusted Signing) to repo secrets, future
+# builds are properly signed — no changes to this file required.
 
 on:
   push:
diff --git a/AGENTS.md b/AGENTS.md
index 0ac162b..8e7c9fd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -166,7 +166,7 @@ Cut a release by tagging the **`prod`** branch once the PR is merged — `git ta
 **Before tagging**, keep everything in sync:
 - Version number across `package.json`, `src-tauri/Cargo.toml`, and `src-tauri/tauri.conf.json`
 - `src/lib/version.test.ts` and `src/lib/docs-coverage.test.ts` if they assert the version
-- **README download links are static (versioned)** — both download tables (top **Download** section + **Which file should I download?**) link directly to the release-tag assets (`releases/download/v0.7.8/<file>`). tauri-action uses default versioned asset names (`Gridline_<ver>_aarch64.dmg`, `Gridline-<ver>-1.x86_64.rpm`, etc.) — update BOTH tables to the new names on every release (see the MAINTENANCE comment in README.md).
+- **README download links are static (versioned)** — both download tables (top **Download** section + **Which file should I download?**) link directly to the release-tag assets (`releases/download/v0.7.9/<file>`). tauri-action uses default versioned asset names (`Gridline_<ver>_aarch64.dmg`, `Gridline-<ver>-1.x86_64.rpm`, etc.) — update BOTH tables to the new names on every release (see the MAINTENANCE comment in README.md).
 - **Bundled pg tools:** `tauri.conf.json` `bundle.resources` lists `resources/pg_tools/*`; the `release.yml` matrix builds/downloads + checksum-verifies the static binaries before the Tauri build step.
 
 ### Adding a Tauri Command
diff --git a/README.md b/README.md
index 9b279c8..f4878a3 100644
--- a/README.md
+++ b/README.md
@@ -30,21 +30,21 @@
 
 ## Download
 
-Grab the installer for your OS from the [latest release](https://github.com/AdrianBonpin/gridline/releases/latest) — the links below point at the current release (**v0.7.8**):
+Grab the installer for your OS from the [latest release](https://github.com/AdrianBonpin/gridline/releases/latest) — the links below point at the current release (**v0.7.9**):
 
 | OS                           | Architecture                 | Download                                                                                                                         |
 | :--------------------------- | :--------------------------- | :------------------------------------------------------------------------------------------------------------------------------- |
-| **macOS**                    | Apple Silicon (M1/M2/M3/M4…) | [Gridline_0.7.8_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_aarch64.dmg)       |
-| **macOS**                    | Intel                        | [Gridline_0.7.8_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_x64.dmg)               |
-| **Windows**                  | x64                          | [Gridline_0.7.8_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_x64-setup.exe)   |
-| **Debian / Ubuntu**          | amd64                        | [Gridline_0.7.8_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_amd64.deb)           |
-| **Fedora / RHEL / openSUSE** | x86_64                       | [Gridline-0.7.8-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline-0.7.8-1.x86_64.rpm)     |
-| **Other Linux**              | amd64                        | [Gridline_0.7.8_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_amd64.AppImage) |
+| **macOS**                    | Apple Silicon (M1/M2/M3/M4…) | [Gridline_0.7.9_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_aarch64.dmg)       |
+| **macOS**                    | Intel                        | [Gridline_0.7.9_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_x64.dmg)               |
+| **Windows**                  | x64                          | [Gridline_0.7.9_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_x64-setup.exe)   |
+| **Debian / Ubuntu**          | amd64                        | [Gridline_0.7.9_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_amd64.deb)           |
+| **Fedora / RHEL / openSUSE** | x86_64                       | [Gridline-0.7.9-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline-0.7.9-1.x86_64.rpm)     |
+| **Other Linux**              | amd64                        | [Gridline_0.7.9_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_amd64.AppImage) |
 
 > Not sure if your Mac is Intel or Apple Silicon? See [Which file should I download?](#which-file-should-i-download) below. All installers are **unsigned** — see the [notes](#which-file-should-i-download) on first-launch warnings.
 
 <!--
-  MAINTENANCE: These links are STATIC (versioned) — they point at the v0.7.8
+  MAINTENANCE: These links are STATIC (versioned) — they point at the v0.7.9
   release assets, not at a moving "latest" target. On every new release,
   update BOTH tables here (Download + Which file should I download?) to the
   new version's asset names, which are tauri-action's default naming:
@@ -89,6 +89,8 @@ Gridline is built for developers and small teams who manage multiple database en
 <details>
 <summary>View the full changelog</summary>
 
+- **v0.7.9** — **macOS install/launch fixes**: the app's local store now opens under the OS app-data directory (a cwd-relative `gridline.db` made Finder-launched copies silently exit with a Rust panic before the UI started); macOS bundles are **ad-hoc signed at build time** (`signingIdentity "-"`), replacing the Xcode linker-only signature that macOS treated as unsigned ("damaged and can't be opened", silent Finder refusals) — users now get a standard one-time Gatekeeper prompt (see the [install notes](#installers-are-unsigned-for-now), incl. the `xattr` workaround); **OpenSSL is vendored** into the `ssh2` build so the release no longer depends on a Homebrew OpenSSL path; version bump.
+
 - **v0.7.8** — **SQLite `.dump` backup/restore** plus **backup / restore / sync for MySQL & SQLite** (mysqldump-based, system-first); **Excel (.xlsx) export** in the grid toolbar alongside CSV/JSON/SQL/Markdown; **cancel long-running queries** per connection; **settings export/import** (JSON); **Windows/Linux title bar fix** (macOS-only overlay drag strip); **SQLite table editor** (Create/Edit Table with SQLite-aware type mapping); version bump.
 
 - **v0.7.7** — PostgreSQL **roles & grants** management (create/edit/drop roles with attributes + a per-role privilege explorer across tables/sequences/routines/schemas/databases — collapsible grouped lists with GRANT/REVOKE staging) and **table maintenance** (VACUUM / ANALYZE / REINDEX from the table menu). **Create Table / Edit Table** visual editor: columns grid with type dropdowns and drag-to-reorder, single + composite primary keys, column-diff staging (ADD / DROP / RENAME COLUMN, ALTER TYPE, SET | DROP DEFAULT, SET | DROP NOT NULL — one statement per queue item), atomic column-reorder table rebuild (single transaction, preserves constraints/indexes/FKs/grants/sequences, fail-closed for triggers/RLS/inheritance/partitioning). **FK management** — multi-column composer with cross-schema references and ON DELETE/UPDATE, inlined into CREATE TABLE; **table options** (tablespace, row-level security); changes queue auto-refreshes the object tree after schema-modifying commits; version bump.
@@ -293,9 +295,16 @@ Pre-built installers for macOS, Windows, and Linux are published on the [Release
 
 #### Installers are unsigned (for now)
 
-Gridline is currently distributed **unsigned** — it doesn't pay for code-signing certificates yet. Your OS will warn you the first time you open it. This is expected — the app is safe, it just hasn't paid the signing fee:
+Gridline is currently distributed **unsigned** — it doesn't pay for code-signing certificates yet (macOS builds are *ad-hoc signed*, so they pass Apple Silicon's launch checks but aren't Developer-ID signed or notarized). Your OS will warn you the first time you open it. This is expected — the app is safe, it just hasn't paid the signing fee:
 
-- **macOS:** right-click the app → **Open** → **Open** (or System Settings → Privacy & Security → **Open Anyway**). Do this once per version.
+- **macOS:** if you see *"Gridline can't be opened because the developer cannot be verified"* (or the app simply won't open from Finder), right-click the app → **Open** → **Open** (or System Settings → Privacy & Security → **Open Anyway**). Do this once per version.
+- **macOS — "Gridline is damaged and can't be opened":** remove the quarantine flag macOS attaches to downloaded apps, then launch normally:
+
+  ```bash
+  xattr -dr com.apple.quarantine /Applications/Gridline.app
+  ```
+
+  You need to re-run this after **every upgrade** (each freshly-downloaded copy gets re-quarantined).
 - **Windows:** on the SmartScreen prompt, click **More info** → **Run anyway**.
 - **Linux:** no warning — install and run normally.
 
@@ -303,16 +312,16 @@ Code signing **will be added in the future** (Apple Developer Program + a Window
 
 #### Which file should I download?
 
-Each release contains **one file per platform** — you only need the one that matches your computer. The links below point at the current release (**v0.7.8**):
+Each release contains **one file per platform** — you only need the one that matches your computer. The links below point at the current release (**v0.7.9**):
 
 | Your system                            | Download this                                                                                                                    | Notes                                                            |
 | :------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------- |
-| macOS **Apple Silicon** (M1/M2/M3/M4…) | [Gridline_0.7.8_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_aarch64.dmg)       | `aarch64` = Apple's own chip                                     |
-| macOS **Intel**                        | [Gridline_0.7.8_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_x64.dmg)               | `x64` = Intel/AMD                                                |
-| **Windows** (most PCs)                 | [Gridline_0.7.8_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_x64-setup.exe)   | The `.msi` is an alternate installer (for enterprises/IT admins) |
-| **Debian / Ubuntu**                    | [Gridline_0.7.8_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_amd64.deb)           | Install: `sudo apt install ./Gridline_0.7.8_amd64.deb`           |
-| **Fedora / RHEL / openSUSE**           | [Gridline-0.7.8-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline-0.7.8-1.x86_64.rpm)     | Install: `sudo dnf install Gridline-0.7.8-1.x86_64.rpm`          |
-| **Any other Linux**                    | [Gridline_0.7.8_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.8/Gridline_0.7.8_amd64.AppImage) | Works on every distro: `chmod +x` the file, then double-click it |
+| macOS **Apple Silicon** (M1/M2/M3/M4…) | [Gridline_0.7.9_aarch64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_aarch64.dmg)       | `aarch64` = Apple's own chip                                     |
+| macOS **Intel**                        | [Gridline_0.7.9_x64.dmg](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_x64.dmg)               | `x64` = Intel/AMD                                                |
+| **Windows** (most PCs)                 | [Gridline_0.7.9_x64-setup.exe](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_x64-setup.exe)   | The `.msi` is an alternate installer (for enterprises/IT admins) |
+| **Debian / Ubuntu**                    | [Gridline_0.7.9_amd64.deb](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_amd64.deb)           | Install: `sudo apt install ./Gridline_0.7.9_amd64.deb`           |
+| **Fedora / RHEL / openSUSE**           | [Gridline-0.7.9-1.x86_64.rpm](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline-0.7.9-1.x86_64.rpm)     | Install: `sudo dnf install Gridline-0.7.9-1.x86_64.rpm`          |
+| **Any other Linux**                    | [Gridline_0.7.9_amd64.AppImage](https://github.com/AdrianBonpin/gridline/releases/download/v0.7.9/Gridline_0.7.9_amd64.AppImage) | Works on every distro: `chmod +x` the file, then double-click it |
 
 **Not sure if your Mac is Intel or Apple Silicon?** Click the **Apple menu** → **About This Mac**. If it shows "Apple M1/M2/M3/M4…" download the `aarch64` file; if it shows an Intel chip, download `x64`. Downloading the wrong one won't run.
 
@@ -322,8 +331,8 @@ Cutting a release is one command — CI builds everything. **Releases are cut fr
 
 ```bash
 git checkout prod && git pull
-git tag v0.7.8
-git push origin v0.7.8
+git tag v0.7.9
+git push origin v0.7.9
 ```
 
 GitHub Actions (`.github/workflows/release.yml`) builds installers for **Apple Silicon, Intel Macs, Windows, and Linux**, then opens a **draft release** on the [Releases](https://github.com/adrianbonpin/gridline/releases) page — review it and hit **Publish release**.
diff --git a/ROADMAP.md b/ROADMAP.md
index f498993..b0dfc73 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -6,7 +6,14 @@ This file is the **source of truth** for what Gridline is building. [AGENTS.md](
 
 ---
 
-## 🎯 Next up (0.7.9) — TBD
+## ✅ Shipped (0.7.9)
+
+- **macOS Finder launch fix** — the local store opens under the OS app-data directory instead of a cwd-relative `gridline.db` (Finder/LaunchServices launches run with cwd `/`, so the old path made the app silently exit with a Rust panic before the UI started).
+- **macOS ad-hoc code signing** — bundles are signed at build time (`bundle.macOS.signingIdentity "-"`, hardened runtime off), replacing the Xcode linker-only signature that macOS treated as unsigned ("damaged and can't be opened", silent Finder refusal). Users still get a one-time Gatekeeper prompt; README documents the `xattr -dr com.apple.quarantine` workaround.
+- **Vendored OpenSSL for `ssh2`** — the release binary no longer links an absolute Homebrew `/opt/homebrew/.../libssl.3.dylib` path (dyld aborted on machines without it).
+- **Version bump** 0.7.8 → **0.7.9**.
+
+## 🎯 Next up (0.8.0) — TBD
 
 Scope to be determined.
 
diff --git a/package.json b/package.json
index 063c4e3..8641829 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
     "name": "gridline",
     "private": true,
-    "version": "0.7.8",
+    "version": "0.7.9",
     "description": "An open-source, high-performance database GUI client for PostgreSQL and beyond",
     "type": "module",
     "scripts": {
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index c746540..761f8e7 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -1783,7 +1783,7 @@ dependencies = [
 
 [[package]]
 name = "gridline"
-version = "0.7.8"
+version = "0.7.9"
 dependencies = [
  "chrono",
  "deadpool-postgres",
@@ -3047,6 +3047,15 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.117"
@@ -3055,6 +3064,7 @@ checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 2cf235b..e022f85 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "gridline"
-version = "0.7.8"
+version = "0.7.9"
 description = "An open-source, high-performance database GUI client for PostgreSQL and beyond"
 authors = ["you"]
 edition = "2021"
@@ -34,7 +34,10 @@ tokio-postgres = { version = "0.7", features = ["with-chrono-0_4", "with-uuid-1"
 sqlx = { version = "0.8", features = ["runtime-tokio", "mysql", "tls-rustls", "json"] }
 redis = { version = "0.27", features = ["tokio-comp"] }
 # async-ssh2 is not available at v0.4; using synchronous ssh2 via tokio::task::spawn_blocking per plan's fallback
-ssh2 = { version = "0.9" }
+# vendored-openssl: link OpenSSL statically so the release binary has NO
+# runtime dependency on the build machine's Homebrew openssl (@/opt/homebrew
+# absolute LC_LOAD_DYLIB — dyld aborts on user machines without it).
+ssh2 = { version = "0.9", features = ["vendored-openssl"] }
 deadpool-postgres = { version = "0.14" }
 indexmap = { version = "2", features = ["serde"] }
 tauri-plugin-keyring-store = { version = "0.2.0", default-features = false }
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 4a7a89d..6ec4e2d 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -38,21 +38,33 @@ pub fn run() {
     // another provider is already installed).
     let _ = rustls::crypto::ring::default_provider().install_default();
 
-    let store = Store::open("gridline.db").expect("failed to open db");
-    let store_ref = StdMutex::new(store);
-
     tauri::Builder::default()
         .plugin(tauri_plugin_opener::init())
         .plugin(tauri_plugin_fs::init())
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_keyring_store::init())
-        .manage(AppState {
-            db_store: store_ref,
-            pool_manager: tokio::sync::Mutex::new(ConnectionPoolManager::new()),
-            ssh_manager: StdMutex::new(SshTunnelManager::new(Arc::new(Ssh2Backend))),
-            cancel_registry: crate::cancel::CancelRegistry::default(),
-        })
         .setup(move |app| {
+            // Open the local store under the OS app-data directory. When the
+            // app is launched from Finder/LaunchServices the working directory
+            // is `/`, so a relative "gridline.db" path panics ("failed to
+            // open db", exit 101) before the UI ever starts. The demo DB uses
+            // the same directory (see commands/demo.rs).
+            let data_dir = app
+                .path()
+                .app_data_dir()
+                .map_err(|e| format!("failed to resolve app data dir: {e}"))?;
+            std::fs::create_dir_all(&data_dir)
+                .map_err(|e| format!("failed to create app data dir: {e}"))?;
+            let store =
+                Store::open(&data_dir.join("gridline.db").to_string_lossy()).expect("failed to open db");
+
+            app.manage(AppState {
+                db_store: StdMutex::new(store),
+                pool_manager: tokio::sync::Mutex::new(ConnectionPoolManager::new()),
+                ssh_manager: StdMutex::new(SshTunnelManager::new(Arc::new(Ssh2Backend))),
+                cancel_registry: crate::cancel::CancelRegistry::default(),
+            });
+
             let state = app.state::<AppState>();
             demo::ensure_demo_db(app.handle(), &state.db_store)
                 .map_err(|e| {
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 908e7fa..f54b51e 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Gridline",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "identifier": "com.adrianbonpin.gridline",
   "build": {
     "beforeDevCommand": "bun run dev",
@@ -27,6 +27,10 @@
     "active": true,
     "targets": "all",
     "resources": ["resources/pg_tools/*", "resources/mysql_tools/*"],
+    "macOS": {
+      "signingIdentity": "-",
+      "hardenedRuntime": false
+    },
     "icon": [
       "icons/32x32.png",
       "icons/128x128.png",
diff --git a/src/lib/bundle-config.test.ts b/src/lib/bundle-config.test.ts
index daed514..3cee74e 100644
--- a/src/lib/bundle-config.test.ts
+++ b/src/lib/bundle-config.test.ts
@@ -1,11 +1,11 @@
 import { describe, it, expect } from "vitest";
 import tauriConf from "../../src-tauri/tauri.conf.json";
 
-describe("tauri bundle config (v0.7.8)", () => {
+describe("tauri bundle config (v0.7.9)", () => {
   it("declares bundled pg_tools resources", () => {
     expect(tauriConf.bundle.resources).toContain("resources/pg_tools/*");
   });
-  it("version is 0.7.8", () => {
-    expect(tauriConf.version).toBe("0.7.8");
+  it("version is 0.7.9", () => {
+    expect(tauriConf.version).toBe("0.7.9");
   });
 });
\ No newline at end of file
diff --git a/src/lib/docs-coverage.test.ts b/src/lib/docs-coverage.test.ts
index 7ac8608..107fe9f 100644
--- a/src/lib/docs-coverage.test.ts
+++ b/src/lib/docs-coverage.test.ts
@@ -4,7 +4,7 @@ import { describe, it, expect } from "vitest";
 import agents from "../../AGENTS.md?raw";
 import readme from "../../README.md?raw";
 
-describe("v0.7.8 docs coverage", () => {
+describe("v0.7.9 docs coverage", () => {
   it("AGENTS.md marks inline cell editing complete", () => {
     expect(agents).toContain("Inline cell editing");
     expect(agents).toMatch(/Inline cell editing \| ✅/);
@@ -24,8 +24,8 @@ describe("v0.7.8 docs coverage", () => {
     expect(agents).toMatch(/Connection status indicator on cards \| ✅/);
     expect(agents).toMatch(/Move-to-folder bulk action \| ✅/);
   });
-  it("README declares v0.7.8", () => {
-    expect(readme).toContain("0.7.8");
+  it("README declares v0.7.9", () => {
+    expect(readme).toContain("0.7.9");
   });
   it("AGENTS.md marks schema CRUD complete", () => {
     expect(agents).toMatch(/Schema CRUD \| ✅/);
@@ -64,9 +64,9 @@ describe("v0.7.8 docs coverage", () => {
     expect(agents).toMatch(/Cancel long-running queries \| ✅/);
     expect(agents).toMatch(/Settings export\/import \| ✅/);
   });
-  it("README links to v0.7.8 assets in both download tables", () => {
-    expect(readme).toContain("releases/download/v0.7.8/");
-    expect(readme).toContain("Gridline_0.7.8_aarch64.dmg");
-    expect(readme).toContain("Gridline-0.7.8-1.x86_64.rpm");
+  it("README links to v0.7.9 assets in both download tables", () => {
+    expect(readme).toContain("releases/download/v0.7.9/");
+    expect(readme).toContain("Gridline_0.7.9_aarch64.dmg");
+    expect(readme).toContain("Gridline-0.7.9-1.x86_64.rpm");
   });
 });
\ No newline at end of file
diff --git a/src/lib/version.test.ts b/src/lib/version.test.ts
index cde0d48..9abcd90 100644
--- a/src/lib/version.test.ts
+++ b/src/lib/version.test.ts
@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest";
 import pkg from "../../package.json";
 
 describe("version", () => {
-  it("declares v0.7.8 across the app shell", () => {
-    expect(pkg.version).toBe("0.7.8");
+  it("declares v0.7.9 across the app shell", () => {
+    expect(pkg.version).toBe("0.7.9");
   });
 });
\ No newline at end of file