v0.4.13: Unsandbox the GitHub zip build; codify release pipeline

v0.4.11/12 zips were accidentally built with the MAS sandbox profile
(no network entitlement) -> Check for Updates failed with hostname-not-
found. Restored the documented CODE_SIGN_ENTITLEMENTS="" pipeline as
scripts/build-release-zip.sh with a guard refusing sandboxed output.

Author: nvwalj

AIMemoryReader.xcodeproj/project.pbxproj

@@ -427,7 +427,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 0.4.12;
+				MARKETING_VERSION = 0.4.13;
 				PRODUCT_BUNDLE_IDENTIFIER = "com.aitools.ai-memory-reader";
 				PRODUCT_NAME = "AI Memory Reader";
 				SDKROOT = macosx;
@@ -451,7 +451,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.4.12;
+				MARKETING_VERSION = 0.4.13;
 				PRODUCT_BUNDLE_IDENTIFIER = "com.aitools.ai-memory-reader-ios";
 				PRODUCT_NAME = "AI Memory Reader";
 				SDKROOT = iphoneos;
@@ -596,7 +596,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.4.12;
+				MARKETING_VERSION = 0.4.13;
 				PRODUCT_BUNDLE_IDENTIFIER = "com.aitools.ai-memory-reader-ios";
 				PRODUCT_NAME = "AI Memory Reader";
 				SDKROOT = iphoneos;
@@ -621,7 +621,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 0.4.12;
+				MARKETING_VERSION = 0.4.13;
 				PRODUCT_BUNDLE_IDENTIFIER = "com.aitools.ai-memory-reader";
 				PRODUCT_NAME = "AI Memory Reader";
 				SDKROOT = macosx;

CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to AI Memory Reader. Full release notes and downloads:
 https://github.com/nvwalj/ai-memory-reader/releases
 
+## v0.4.13 — 2026-06-10
+
+**Fixed "Check for Updates" failing with a hostname error.**
+
+- The v0.4.11 and v0.4.12 GitHub zips were accidentally built with the Mac App
+  Store sandbox profile, which has no network permission — so the update
+  checker couldn't reach api.github.com and reported "A server with the
+  specified hostname could not be found." The GitHub build is now unsandboxed
+  again (as it was through v0.4.10), and the release pipeline is codified in
+  `scripts/build-release-zip.sh` with a guard that refuses sandboxed output.
+- Side benefit: the folder-context feature from v0.4.11/12 no longer needs any
+  grant prompt in this build — double-clicking a file shows its folder
+  immediately, for any readable folder.
+
 ## v0.4.12 — 2026-06-10
 
 **Fixed: folder context now works for folders AIMR couldn't already read.**

project.yml

@@ -31,7 +31,7 @@ targets:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: com.aitools.ai-memory-reader
         PRODUCT_NAME: AI Memory Reader
-        MARKETING_VERSION: "0.4.12"
+        MARKETING_VERSION: "0.4.13"
         CURRENT_PROJECT_VERSION: "13"
         INFOPLIST_KEY_LSApplicationCategoryType: public.app-category.developer-tools
         INFOPLIST_KEY_CFBundleDisplayName: AI Memory Reader
@@ -63,7 +63,7 @@ targets:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: com.aitools.ai-memory-reader-ios
         PRODUCT_NAME: AI Memory Reader
-        MARKETING_VERSION: "0.4.12"
+        MARKETING_VERSION: "0.4.13"
         CURRENT_PROJECT_VERSION: "11"
         INFOPLIST_KEY_UIApplicationSceneManifest_Generation: YES
         INFOPLIST_KEY_CFBundleDisplayName: AI Memory Reader

scripts/build-release-zip.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# Direct-distribution (GitHub zip) release build.
+#
+# IMPORTANT: pass CODE_SIGN_ENTITLEMENTS="" — the Release config's sandboxed
+# entitlements are for the Mac App Store submission only. The GitHub zip ships
+# UNSANDBOXED: the update checker needs network, and folder access must work
+# without grant prompts. v0.4.11/v0.4.12 were accidentally built sandboxed and
+# broke "Check for Updates" with a hostname-not-found error. Don't repeat that.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+VERSION=$(grep -m1 'MARKETING_VERSION' project.yml | sed 's/.*"\(.*\)"/\1/')
+xcodegen generate
+xcodebuild -project AIMemoryReader.xcodeproj -scheme AIMemoryReader \
+  -configuration Release -destination 'platform=macOS' \
+  ARCHS='arm64 x86_64' ONLY_ACTIVE_ARCH=NO \
+  CODE_SIGN_ENTITLEMENTS="" \
+  -derivedDataPath build/dd build | grep -E '^\*\*' || true
+
+APP="build/dd/Build/Products/Release/AI Memory Reader.app"
+# Guard: the GitHub zip must never be sandboxed.
+if codesign -d --entitlements - "$APP" 2>/dev/null | grep -q app-sandbox; then
+  echo "ERROR: build is sandboxed — wrong entitlements for the GitHub zip" >&2
+  exit 1
+fi
+
+mkdir -p build/release
+( cd "$(dirname "$APP")" && ditto -c -k --sequesterRsrc --keepParent "AI Memory Reader.app" \
+    "$OLDPWD/build/release/AIMemoryReader-v${VERSION}-universal.zip" )
+cp "build/release/AIMemoryReader-v${VERSION}-universal.zip" build/release/AIMemoryReader.zip
+echo "Built build/release/AIMemoryReader-v${VERSION}-universal.zip (+ AIMemoryReader.zip alias)"