- Remove App Sandbox from Release entitlements (developer tool needs
filesystem access to ~/.claude/projects — same as VS Code, iTerm2)
- Explicitly set get-task-allow=false in entitlements for notarization
- Add path input field in header so users can type paths with hidden
folders (e.g. ~/.claude/projects) — press Enter or click arrow to scan
- Field pre-populated with ~/.claude/projects on launch
- Signed, notarized, stapled DMG