docs(mac): publish the macOS install instructions

.github/workflows/release-mac.yml

@@ -129,33 +129,57 @@ jobs:
             its embedding provider is doing, and open the dashboard. Everything
             runs on your machine.
 
-            ### Install
+            ### Install — fastest, no dialogs
 
-            1. Download the `.dmg` below and open it.
-            2. Drag **cix.app** onto **Applications**.
-            3. Open it from Applications.
+            macOS blocks this download twice: once for the disk image, once for
+            the app inside it. It only inspects files carrying a "downloaded
+            from the internet" mark, and the app inherits that mark from the
+            image at the moment you copy it out — so clearing it on the image
+            first means neither block ever happens:
+
+            ```bash
+            xattr -d com.apple.quarantine ~/Downloads/cix-*-arm64.dmg
+            ```
+
+            Then open the image and drag **cix.app** onto **Applications**.
+
+            Already dragged the app across and hit the block? Clear it in place
+            instead:
+
+            ```bash
+            xattr -dr com.apple.quarantine /Applications/cix.app
+            ```
+
+            `No such xattr` in either case just means it was already clear.
+
+            ### Or click through it
+
+            1. **Open the `.dmg`.** macOS says it "could not verify" the file.
+               Choose **Done** — never *Move to Bin*, which deletes the download.
+            2. **System Settings → Privacy & Security**, scroll to **Security**.
+               A line names the blocked file, with **Open Anyway** beside it.
+               Click it and confirm with Touch ID or your password.
+               That button appears only *after* step 1 — going there first shows
+               nothing.
+            3. **The image opens.** Drag **cix.app** onto **Applications**.
+            4. **Open cix from Applications.** Blocked again, for the app this
+               time — repeat step 2 for **cix.app**.
+
+            On macOS 15 and later the old right-click → Open shortcut works for
+            neither block. You do this once per installed version.
 
             On first launch the app downloads the server itself — `cix-server`,
             the `cix` CLI and a Metal-accelerated `llama-server`, about 40 MB —
             from the newest [server release](https://github.com/dvcdsys/code-index/releases?q=server%2Fv).
             That is the same build the Docker images are cut from, and it
             updates on its own schedule: a new server does not need a new app.
 
-            ### macOS will block it twice — this is expected
+            ### Why it is blocked at all
 
             cix is open source and is **not** signed with a paid Apple Developer
-            certificate, so it is not notarized. macOS refuses both the disk
-            image and the app inside it with "Apple could not verify…". Nothing
-            is wrong with the download — choose **Done**, never *Move to Bin*.
-
-            Clear each one the same way: **System Settings → Privacy & Security**,
-            scroll to **Security**, then **Open Anyway** next to the message.
-            Once for the `.dmg` when you open it, and once for **cix.app** the
-            first time you launch it — the app inherits the quarantine flag from
-            the image, so clearing the first does not clear the second.
-
-            On macOS 15 and later the old right-click → Open shortcut no longer
-            works for either. You do this once per installed version.
+            certificate, so macOS cannot verify it and treats the download as
+            unknown. Nothing is wrong with the file. Integrity is covered by the
+            checksum instead.
 
             ### Verify the download
 

site/src/docs/docs.jsx

@@ -3,7 +3,7 @@ import { CixAscii } from '../shared/ascii.jsx';
 import { Foot } from '../shared/foot.jsx';
 import { TeamDiagram } from '../shared/team-diagram.jsx';
 import {
-  SERVER_VERSION, CLI_VERSION, PLUGIN_VERSION, COWORK_PLUGIN_VERSION, GITHUB_URL,
+  SERVER_VERSION, CLI_VERSION, PLUGIN_VERSION, COWORK_PLUGIN_VERSION, MAC_APP_VERSION, GITHUB_URL,
 } from '../shared/versions.js';
 
 const TOC = [
@@ -103,6 +103,15 @@ git clone https://github.com/dvcdsys/code-index && cd code-index
 ./install-server.sh`}</CodeBlock>
             <p>At the end it prints the dashboard URL and your admin login (the password is temporary — you change it on first login), and offers to install the <code>cix</code> CLI and connect it to the new server — so <code>cix init</code> works immediately. Re-running after a <code>git pull</code> upgrades in place; <code>--uninstall</code> removes the server but keeps your data. Forgot the admin password later? <code>./server/scripts/reset-password.sh &lt;email&gt;</code> resets it offline. Details: <a href="https://github.com/dvcdsys/code-index/blob/main/doc/SETUP_MACOS_NATIVE.md">SETUP_MACOS_NATIVE.md</a>.</p>
 
+            <h3>macOS — the menu bar app</h3>
+            <p>On an Apple Silicon Mac there is a second way in: <b>cix.app</b>, a menu bar app that runs the server for you. It sets up an admin account on first launch, downloads the server itself (about 40&nbsp;MB, the same build the Docker images are cut from), and gives you start/stop, network access, launch-at-login and a password reset without a terminal. The server keeps running when you quit the app, and both halves update themselves. <a href={`${GITHUB_URL}/releases/tag/mac/v${MAC_APP_VERSION}`}>Download cix.app {MAC_APP_VERSION}</a> — macOS 13 or later, Apple Silicon only (upstream llama.cpp publishes no macOS x86_64 build).</p>
+
+            <p><b>macOS will block the download</b>, twice: once for the disk image, once for the app inside it. cix is open source and not signed with a paid Apple Developer certificate, so macOS cannot verify it — nothing is wrong with your download. The fastest way through is one command <i>before</i> you open the image, because the app inherits the download mark from the image at the moment you copy it out:</p>
+            <CodeBlock>{`xattr -d com.apple.quarantine ~/Downloads/cix-*-arm64.dmg`}</CodeBlock>
+            <p>Then open the image and drag <b>cix.app</b> onto <b>Applications</b> as usual — no dialogs. Already dragged it across and hit the block? Clear it in place instead: <code>xattr -dr com.apple.quarantine /Applications/cix.app</code>. (<code>No such xattr</code> in either case just means it was already clear.)</p>
+
+            <p>To click through it instead: open the <code>.dmg</code>, and when macOS says it "could not verify" the file choose <b>Done</b> — never <i>Move to Bin</i>, which deletes the download. Then go to <b>System Settings → Privacy &amp; Security</b>, scroll to <b>Security</b>, and click <b>Open Anyway</b> next to the blocked file. That button appears only <i>after</i> the failed attempt, so going there first shows nothing. Drag the app across, open it, and repeat for the app itself. On macOS 15 and later the old right-click → Open shortcut works for neither block. You do this once per version.</p>
+
             <h3>Manual setup (what the installer automates)</h3>
             <p><b>Docker (CPU):</b></p>
             <CodeBlock>{`git clone https://github.com/dvcdsys/code-index && cd code-index

site/src/shared/versions.js

@@ -1,8 +1,9 @@
 // Single source of truth for version strings shown on the site.
 // Bump on each release (see site/README.md). These are hand-maintained on
 // purpose: the site must never claim a version that is not actually tagged.
-export const SERVER_VERSION = '0.12.7';
+export const SERVER_VERSION = '0.12.9';
 export const CLI_VERSION = '0.10.2';
+export const MAC_APP_VERSION = '0.1.0';
 export const PLUGIN_VERSION = '0.4.0';
 export const COWORK_PLUGIN_VERSION = '0.1.1';