chore: fix presign mcp script for macos universal build

Author: aavshr

scripts/presign-mcp.mjs

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
-// Ad-hoc signs `set-mcp` before the macOS bundler seals the app (`build.beforeBundleCommand`).
-// The bundler signs `Contents/MacOS/set` first, which codesign resolves to the bundle itself,
-// sealing an unsigned `set-mcp` beside it and failing. On arm64 the linker ad-hoc signs everything
-// so it passed; a universal `lipo` output has no signature.
+// Prepares `set-mcp` before the macOS bundler seals the app (`build.beforeBundleCommand`).
+//
+// Universal builds: `tauri build --target universal-apple-darwin` compiles both slices but `lipo`s
+// only the app binary, so the bundler then asks for `universal-apple-darwin/release/set-mcp`,
+// which nothing made. This script makes it from the two slices.
+//
+// Signing: the bundler signs `Contents/MacOS/set` first, which codesign resolves to the bundle
+// itself, sealing an unsigned `set-mcp` beside it and failing. On arm64 the linker ad-hoc signs
+// everything so it passed; a `lipo` output has no signature.
 
 import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync } from "node:fs";
@@ -21,7 +26,29 @@ if (!existsSync(targetDir)) {
   process.exit(0);
 }
 
-// `target/release/` without `--target`, `target/<triple>/release/` with it.
+// The universal app binary is the sign that this is a universal build; the slices are then
+// guaranteed to exist because Tauri just built them.
+const universalDir = join(targetDir, "universal-apple-darwin", "release");
+const slices = ["aarch64-apple-darwin", "x86_64-apple-darwin"].map((triple) =>
+  join(targetDir, triple, "release", "set-mcp"),
+);
+if (existsSync(join(universalDir, "set"))) {
+  const missing = slices.filter((slice) => !existsSync(slice));
+  if (missing.length > 0) {
+    console.error(
+      `::error::presign-mcp: universal build, but set-mcp slice missing: ${missing.join(", ")}`,
+    );
+    process.exit(1);
+  }
+  const universal = join(universalDir, "set-mcp");
+  execFileSync("lipo", ["-create", "-output", universal, ...slices], {
+    stdio: "inherit",
+  });
+  console.log(`presign-mcp: lipo'd ${universal}`);
+}
+
+// `target/release/` without `--target`, `target/<triple>/release/` with it (including the
+// universal one made above, which is the copy the bundler ships).
 const candidates = [join(targetDir, "release", "set-mcp")];
 for (const entry of readdirSync(targetDir, { withFileTypes: true })) {
   if (entry.isDirectory() && entry.name.endsWith("-apple-darwin")) {