메뉴
Use when preparing mobile/desktop apps for App Store submission, before final release, or when user mentions App Store, production readiness, shipping, or needs comprehensive quality review for distribution
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | osx-review |
| description | Use when preparing mobile/desktop apps for App Store submission, before final release, or when user mentions App Store, production readiness, shipping, or needs comprehensive quality review for distribution |
Systematic code review process for applications targeting Apple App Store, Google Play, or desktop distribution. Identifies crash risks, security vulnerabilities, resource leaks, and compliance issues that cause rejection or poor user experience.
This skill now includes a mandatory cross-repo consistency pass for macOS app websites + README licensing language before release. This skill also enforces MimikaCODE production UX baselines (system logs, queue/history/models/settings/file-path surfaces) for both existing projects and newly created projects.
All macOS app projects must follow this structure under artifacts/code:
artifacts/code/<AppName>PRJ/<AppName>CODE - source code repositoryartifacts/code/<AppName>PRJ/<AppName>WEB - static website repository (moved from artifacts/all-web)For licensing and legal checks, always use these surfaces:
<AppName>CODE/README.md<AppName>CODE/flutter_app/ (legal screens + bundled app resources)<AppName>WEB/ (index.html, license.html, privacy.html, terms.html, privacy-consent.js)Do not create or update app sites in artifacts/all-web for these macOS apps.
For iOS/iPad submissions, enforce these before final sign-off:
bash ./skills/osx-ios/scripts/check_ios_dist.sh --app-root <APP_ROOT> and resolve all FAIL findingsReview ALL categories systematically. Do not skip any.
digraph review_flow {
rankdir=TB;
node [shape=box];
"Start Review" -> "1. Crash Prevention";
"1. Crash Prevention" -> "2. Resource Management";
"2. Resource Management" -> "3. Network & API";
"3. Network & API" -> "4. Security";
"4. Security" -> "5. Data Persistence";
"5. Data Persistence" -> "6. Platform Compliance";
"6. Platform Compliance" -> "7. Error Handling";
"7. Error Handling" -> "8. MCP Integration (macOS)";
"8. MCP Integration (macOS)" -> "9. Performance";
"9. Performance" -> "10. Product Information";
"10. Product Information" -> "Generate Report";
}
| Severity | Definition | Action |
|---|---|---|
| Critical | Will cause crashes, data loss, or rejection | Must fix before submission |
| High | Likely to cause issues under normal use | Should fix before submission |
| Medium | Edge cases, degraded experience | Fix in next release |
| Low | Code quality, best practices | Nice to have |
mounted before setState()StreamSubscription cancelled in dispose()Timer cancelled in dispose()AnimationController disposedTextEditingController disposedScrollController disposedFocusNode disposed!) without guaranteed non-null.elementAtOrNull()ColorScheme.fromSeed() with Material 3ThemeMode.system (respects OS preference)Future.doWhile() with mounted guardwithValues(alpha:)withOpacity() (use withValues(alpha:) instead)queued, processing, paused, cancelling, completed, failed, cancelled), queue position, and controls (pause, resume, cancel, delete)job_created, job_update, job_completed, job_failed, job_cancelled)Open Folder/Reveal in Finder action!) on optionals from external dataweak self in closures to prevent retain cyclesdeinit called (add print to verify during testing)fatalError() or preconditionFailure()!! on nullable external dataexcept: clauses (catch specific exceptions)Natasha and Suzan voices to detect runaway memory growth or unreleased buffers../ injection).app/Contents/... or mounted .dmg paths~/Library/Application Support/<App>, ~/Library/Caches/<App>, ~/Library/Logs/<App>)../)* in production)HUGGINGFACE_HUB_CACHE / HF_HOME / XDG_CACHE_HOME)scripts/build_dmg.sh)hdiutil fallback packages the DMG staging directory (not only the .app) so Applications symlink survives fallback buildsOpen Anyway path.dmg.sha256)LICENSE (source) and BINARY-LICENSE.txt (binary/EULA)Contents/Resources/LICENSE and Contents/Resources/BINARY-LICENSE.txtGET /api/health, GET /api/pdf/list, and direct GET /pdf/<bundled-file> after launch from /Applications/Applications and does not rely on source checkout pathsHF_HOME, HUGGINGFACE_HUB_CACHE, TRANSFORMERS_CACHE)Restart Server) and avoids shell-command instructionsbin/appctl):
appctl up - Start all servicesappctl down - Stop all servicesappctl status - Show running/stopped with colorsappctl logs - Tail log filesappctl clean - Clean logs and temp filesinstall.sh):
issues.sh):
Every macOS app MUST have a scripts/release.sh that automates the full release workflow. Manual releases are error-prone and forbidden.
scripts/release.sh) exists and is executablepubspec.yaml automatically (no hardcoded versions)--upload flag for GitHub release upload--sync-website flag for website download link updatesMAJOR.MINOR.PATCH (e.g., 1.0.0, 1.1.0, 2.0.0)pubspec.yaml for Flutter apps1.0.0+1 → 1.0.0+2)v{VERSION} (e.g., v1.0.0, v1.1.0)#!/usr/bin/env bash
# scripts/release.sh - Full Release Script
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
WEBSITE_DIR="$(dirname "$PROJECT_DIR")/${APP_NAME}WEB"
# Extract version from pubspec.yaml
VERSION=$(grep 'version:' "$PROJECT_DIR/pubspec.yaml" | head -1 | cut -d'+' -f1 | cut -d':' -f2 | xargs)
# Parse flags
UPLOAD_TO_GITHUB=false
SYNC_WEBSITE=false
for arg in "$@"; do
case $arg in
--upload) UPLOAD_TO_GITHUB=true ;;
--sync-website) SYNC_WEBSITE=true ;;
esac
done
# 1. Build DMG
"$SCRIPT_DIR/build_dmg.sh" || "$SCRIPT_DIR/build-dmg.sh"
# 2. Generate SHA256
DMG_PATH="$PROJECT_DIR/build/${APP_NAME}-${VERSION}.dmg"
shasum -a 256 "$DMG_PATH" > "$DMG_PATH.sha256"
# 3. Upload to GitHub (if --upload)
if [ "$UPLOAD_TO_GITHUB" = true ]; then
TAG="v$VERSION"
if ! gh release view "$TAG" &> /dev/null; then
gh release create "$TAG" --title "$APP_NAME $VERSION" --notes "Release notes..." --draft
fi
gh release upload "$TAG" "$DMG_PATH" "$DMG_PATH.sha256" --clobber
fi
# 4. Sync website (if --sync-website)
if [ "$SYNC_WEBSITE" = true ]; then
sed -i '' -E "s|/releases/download/v[0-9.]+/${APP_NAME}-[0-9.]+|/releases/download/v$VERSION/${APP_NAME}-$VERSION|g" "$WEBSITE_DIR/index.html"
cd "$WEBSITE_DIR"
git add index.html && git commit -m "Update to v$VERSION" && git push
fi
pubspec.yaml if needed./scripts/release.sh --upload --sync-websitecurl -I -L) and confirm HTTP 200/Applications, no pre-downloaded model cache assumptions)| Issue | Pattern | Fix |
|---|---|---|
| No release script | Manual DMG + upload | Create scripts/release.sh |
| Hardcoded version | VERSION="1.0.0" | Extract from pubspec.yaml |
| No --upload flag | Separate manual upload | Add GitHub release upload |
| No --sync-website | Manual website edit | Add website URL update |
| No checksum | DMG only | Generate .sha256 file |
| Empty release page | Tag exists but no assets | Enforce upload of full asset set in release.sh |
| Missing source/notes artifacts | DMG uploaded without source zip/release notes checksums | Upload source ZIP + notes + both SHA256 files |
| Non-direct download links | Website points to generic /releases page | Point website CTAs to /releases/download/<tag>/<asset>.dmg |
| No website commit | Website not updated | Auto-commit and push |
| Version reuse | Same tag twice | Always increment version |
macOS apps MUST expose full functionality via MCP (Model Context Protocol) tools to enable Claude integration. This ensures AI assistants can interact with the app programmatically.
bin/<appname>_mcp_server.py or similarinitialize, tools/list, tools/call127.0.0.1:80XX)runs/logs/<appname>_mcp_server.log with rotation<APPNAME>_BACKEND_URL)MCP_TOOLS list contains all available toolsname, description, inputSchema<domain>_<action> pattern (e.g., tts_generate_kokoro)inputSchema is a valid JSON Schema with type: "object"inputSchema.required arrayhealth_check - Check if backend is running and healthy<domain>_status or system_info - Get system/service information<domain>_list_* - List available resources (voices, models, files, etc.)<domain>_<primary_action> - Core functionality (generate, process, create)MCP_TOOLS = [
{
"name": "app_speak",
"description": "Generate and play speech with specified text and voice.",
"inputSchema": {
"type": "object",
"properties": {
"text": {"type": "string", "description": "Text to speak"},
"speaker": {"type": "string", "description": "Voice/speaker name"},
"quality_mode": {
"type": "string",
"enum": ["fast", "balanced", "quality"],
"description": "Quality mode (fast=realtime)"
}
},
"required": ["text"]
}
},
{
"name": "app_speak_streaming",
"description": "Generate speech with sentence-by-sentence streaming.",
"inputSchema": {
"type": "object",
"properties": {
"text": {"type": "string", "description": "Text to speak (supports multiple sentences)"}
},
"required": ["text"]
}
},
{
"name": "app_status",
"description": "Check service status and available resources.",
"inputSchema": {"type": "object", "properties": {}}
}
]
GET /api/<domain>/status - Status checkGET /api/<domain>/<resources> - List resourcesPOST /api/<domain>/<action> - Perform actionsDELETE /api/<domain>/<resource>/<id> - Delete resources# Generate speech
curl -X POST http://localhost:8000/speak \
-H "Content-Type: application/json" \
-d '{"text": "Hello", "speaker": "default", "quality_mode": "balanced"}'
# Check status
curl http://localhost:8000/status
# List voices
curl http://localhost:8000/voices
class MCPHandler(BaseHTTPRequestHandler):
def do_POST(self):
# Parse JSON-RPC request
obj = json.loads(self.rfile.read(...))
method = obj.get("method")
params = obj.get("params") or {}
if method == "initialize":
# Return server info and capabilities
return {"protocolVersion": "...", "serverInfo": {...}, "capabilities": {...}}
if method in ("tools/list", "tools.list"):
return {"tools": MCP_TOOLS}
if method in ("tools/call", "tools.call"):
result = handle_tool_call(params.get("name"), params.get("arguments"))
return {"content": [{"type": "text", "text": result}]}
test_mcp_server.py){
"mcpServers": {
"<appname>": {
"command": "python3",
"args": ["/path/to/bin/<appname>_mcp_server.py", "--port", "80XX"],
"env": {
"<APPNAME>_BACKEND_URL": "http://localhost:8000"
}
}
}
}
Every macOS app with MCP integration MUST include a dedicated MCP management screen accessible from Settings or main navigation.
lib/pages/mcp_page.dart or lib/screens/mcp_screen.dart127.0.0.1:8087)quantum_run_benchmark)// lib/pages/mcp_page.dart
class McpPage extends StatefulWidget {
const McpPage({super.key});
@override
State<McpPage> createState() => _McpPageState();
}
class _McpPageState extends State<McpPage> {
bool _serverRunning = false;
List<Map<String, dynamic>> _tools = [];
@override
void initState() {
super.initState();
_loadMcpStatus();
_loadTools();
}
@override
Widget build(BuildContext context) {
return SingleChildScrollView(
padding: const EdgeInsets.all(24),
child: Column(
crossAxisAlignment: CrossAxisAlignment.start,
children: [
// Header
_buildHeader(),
const SizedBox(height: 24),
// Server Status Card
_buildServerStatusCard(),
const SizedBox(height: 24),
// Available Tools Card
_buildToolsCard(),
const SizedBox(height: 24),
// Configuration Card
_buildConfigCard(),
const SizedBox(height: 24),
// Claude Code Setup Card
_buildClaudeCodeSetupCard(),
],
),
);
}
Widget _buildServerStatusCard() {
return Card(
child: Padding(
padding: const EdgeInsets.all(16),
child: Column(
crossAxisAlignment: CrossAxisAlignment.start,
children: [
Row(
children: [
Icon(Icons.dns, color: Theme.of(context).colorScheme.primary),
const SizedBox(width: 12),
const Text('MCP Server Status', style: TextStyle(fontWeight: FontWeight.bold)),
const Spacer(),
Chip(
label: Text(_serverRunning ? 'Running' : 'Stopped'),
backgroundColor: _serverRunning ? Colors.green.shade100 : Colors.grey.shade200,
labelStyle: TextStyle(color: _serverRunning ? Colors.green.shade800 : Colors.grey.shade700),
),
],
),
const SizedBox(height: 16),
Text('Host: 127.0.0.1:8087'),
const SizedBox(height: 8),
Row(
children: [
FilledButton.icon(
onPressed: _toggleServer,
icon: Icon(_serverRunning ? Icons.stop : Icons.play_arrow),
label: Text(_serverRunning ? 'Stop Server' : 'Start Server'),
),
const SizedBox(width: 8),
OutlinedButton.icon(
onPressed: _testConnection,
icon: const Icon(Icons.refresh),
label: const Text('Test Connection'),
),
],
),
],
),
),
);
}
Widget _buildToolsCard() {
return Card(
child: Padding(
padding: const EdgeInsets.all(16),
child: Column(
crossAxisAlignment: CrossAxisAlignment.start,
children: [
Row(
children: [
Icon(Icons.build, color: Theme.of(context).colorScheme.primary),
const SizedBox(width: 12),
const Text('Available Tools', style: TextStyle(fontWeight: FontWeight.bold)),
const SizedBox(width: 8),
Chip(label: Text('${_tools.length} tools')),
],
),
const SizedBox(height: 16),
..._tools.map((tool) => ExpansionTile(
title: Text(tool['name']),
subtitle: Text(tool['description'], maxLines: 1, overflow: TextOverflow.ellipsis),
children: [
Padding(
padding: const EdgeInsets.all(16),
child: Column(
crossAxisAlignment: CrossAxisAlignment.start,
children: [
Text('Parameters:', style: TextStyle(fontWeight: FontWeight.bold)),
// Show inputSchema properties
],
),
),
],
)),
],
),
),
);
}
Widget _buildClaudeCodeSetupCard() {
final config = '''
{
"mcpServers": {
"appname": {
"command": "python3",
"args": ["/path/to/bin/appname_mcp_server.py"],
"env": {
"APPNAME_BACKEND_URL": "http://localhost:8000"
}
}
}
}''';
return Card(
child: Padding(
padding: const EdgeInsets.all(16),
child: Column(
crossAxisAlignment: CrossAxisAlignment.start,
children: [
Row(
children: [
Icon(Icons.terminal, color: Theme.of(context).colorScheme.primary),
const SizedBox(width: 12),
const Text('Claude Code Setup', style: TextStyle(fontWeight: FontWeight.bold)),
],
),
const SizedBox(height: 16),
const Text('Add this configuration to your Claude Code settings:'),
const SizedBox(height: 12),
Container(
padding: const EdgeInsets.all(12),
decoration: BoxDecoration(
color: Colors.grey.shade100,
borderRadius: BorderRadius.circular(8),
),
child: SelectableText(config, style: const TextStyle(fontFamily: 'monospace', fontSize: 12)),
),
const SizedBox(height: 12),
FilledButton.icon(
onPressed: () => Clipboard.setData(ClipboardData(text: config)),
icon: const Icon(Icons.copy),
label: const Text('Copy Configuration'),
),
],
),
),
);
}
}
| Issue | Pattern | Fix |
|---|---|---|
| Missing tools | No MCP server | Create bin/<appname>_mcp_server.py |
| No tool schemas | Tools missing inputSchema | Add JSON Schema for each tool |
| Backend not proxied | MCP calls backend directly | Use _call_backend() helper pattern |
| No error handling | Exceptions crash server | Wrap tool calls in try/except |
| No logging | Silent failures | Add rotating file logger |
| Hardcoded ports | Port conflicts | Make host/port configurable |
// lib/version.dart
const String appVersion = "2026.02.1";
const int buildNumber = 1;
const String versionName = "Initial Release";
String get versionString => "$appVersion (build $buildNumber)";
version.dart)LICENSE file present and referenced in README<AppName>WEB: index.html, license.html, privacy.html, terms.html<AppName>CODE/LICENSE for source code (BSL-style, parameterized)<AppName>CODE/BINARY-LICENSE.txt (or EULA-DMG.txt) for DMG/executable<AppName>CODE/LICENSE.md (or <AppName>CODE/docs/licensing.md) explaining source vs binary terms<AppName>CODE/README.md License section with links to LICENSE, BINARY-LICENSE.txt, and LICENSE.mdBINARY-LICENSE.txtContents/Resources/) and DMG root<AppName>WEB/license.html matches README and repo license files<AppName>WEB/license.html (not placeholders) and clearly state source + binary terms.Open Source, License) link to <AppName>WEB/license.html.<AppName>CODE/flutter_app legal screens; source + binary terms are discoverable in-app.Contents/Resources/LICENSE and Contents/Resources/BINARY-LICENSE.txt.<AppName>CODE: LICENSE + BINARY-LICENSE.txt + license overview doc (LICENSE.md or docs/licensing.md).<AppName>CODE/README.md top section and License section both link to the repo license files and website license page.License: Source code is licensed under Business Source License 1.1 (BSL-1.1), and binary distributions are licensed under the [APP_NAME] Binary Distribution License. See LICENSE, BINARY-LICENSE.txt, and the website License page.The codebase is cross-platform, but we currently provide macOS binaries only.we currently provide macOS binaries only. in README top block to the app website home page.Open Source labels in website hero/meta rows to license.html (not plain text).Lifetime Updates and avoid reintroducing it in future copy revisions.Download for macOS CTA on the left hero column before Get Started / View on GitHub style links.Download and hero Download CTA both point directly to the current DMG asset URL for the latest tag.<AppName>WEB uses the same wording pattern (only app name varies).<AppName>CODE/LICENSE, <AppName>CODE/BINARY-LICENSE.txt, and <AppName>WEB/license.html all exist and are mutually consistent.<AppName>CODE and <AppName>WEB when worktrees are already dirty.README.md and website Supported Models tables fully synchronized with the app's runtime model registry (include aliases, quantized variants, and namespace-specific surfaces like CosyVoice/Supertonic when present).backend/data/pregenerated (no missing demos).<AppName>WEB includes a GDPR consent popup script at <AppName>WEB/privacy-consent.js.privacy-consent.js is loaded on all public pages (minimum): index.html, license.html, privacy.html, terms.html.Accept and Reject (no single-button consent).localStorage with app-specific keys (do not reuse another app's key names).privacy.html and terms.html.<AppName>WEB site lacks this popup behavior.git shortlog -sne --allgit log --all --format='%H%x09%an%x09%ae'Co-authored-by.mailmap canonical mappings to the project owner identity..mailmap update to confirm consolidation./contributors API or GitHub UI) before attempting history rewrite.Applications drag target are visible/Applications and launch from there (do not validate only from mounted DMG)lsof -iTCP:<port> -sTCP:LISTEN shows nothing for the app backend)Export Diagnostic Logs action from Settings (downloads a ZIP bundle from backend logs)Pro/Licensing surface with Buy License CTA.days left countdown (e.g., You have X days left in your trial) for paid apps.Enter License action and transitions to an activated/Pro state after successful key entry.Polar.sh and LemonSqueezy.Buy with Polar, Buy with LemonSqueezy or equivalent).license_provider=polar|lemonsqueezy, activation timestamp).not downloaded/downloading/ready/error)queued, processing, paused, cancelling, completed, failed, cancelled) and controls (pause, resume, cancel, delete)Qneura.ai is clickable and opens the official website (https://qneura.ai or https://qneura.ai/apps.html).<AppName>CODE/assets/ (e.g., app_icon_source.png at 1024x1024)<AppName>CODE/flutter_app/macos/Runner/Assets.xcassets/AppIcon.appiconset/ is generated from that canonical source<repo>/assets/app_icon_source.png and regenerate icon set from it.<repo>/macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_{16,32,64,128,256,512,1024}.pngflutter_app/, apply the same rule under:
<repo>/flutter_app/macos/Runner/Assets.xcassets/AppIcon.appiconset/"A new Flutter project." in release app metadata.Use these templates when creating legal pages for App Store submission. Replace bracketed placeholders.
# Terms of Service
Last updated: [MONTH YYYY]
## 1. Acceptance of Terms
By accessing or using [APP_NAME] (the "Service"), you agree to be bound by these Terms of Service. If you do not agree to these terms, do not use the Service. Additional guidelines or rules may apply to specific features and are incorporated by reference.
## 2. Description of Service
[APP_NAME] is a [SHORT DESCRIPTION]. The Service allows users to [CORE FEATURES]. Some features may rely on on-device AI models and optional plugins.
## 3. User Conduct
You agree to use the Service only for lawful purposes and in compliance with applicable laws and regulations. You are prohibited from using the Service to impersonate others without consent, to create deceptive or harmful content, or to violate intellectual property rights.
## 4. Intellectual Property
The Service and its original content (excluding user-provided content) are the exclusive property of QNeura.ai and its licensors. You retain ownership of your content. Nothing in these terms grants you the right to use QNeura.ai trademarks or branding without permission.
## 5. AI Features Disclaimer
AI-generated outputs may be inaccurate, imperfect, or unsuitable for critical use cases. You should verify important information using original sources.
## 6. Disclaimer of Warranties
The Service is provided on an "AS IS" and "AS AVAILABLE" basis. QNeura.ai makes no warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and noninfringement.
## 7. Limitation of Liability
In no event shall QNeura.ai be liable for any damages (including, without limitation, damages for loss of data or profit, or due to business interruption) arising out of the use or inability to use the Service.
## 8. Changes to Terms
QNeura.ai reserves the right, at its sole discretion, to modify or replace these Terms at any time. Continued use of the Service after changes constitutes acceptance of the updated terms.
## 9. Contact Us
If you have questions about these Terms, contact us at solomon@qneura.ai or https://qneura.ai/apps.html.
## 10. External Content Sources
The Service may provide access to or include third-party models, datasets, or libraries. These contents are provided by their respective sources and are subject to their own licenses. You are responsible for ensuring your use complies with applicable laws and third-party terms.
## 11. Apple Standard EULA
If the app is distributed through the Apple App Store, the Apple Standard EULA applies: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/.
## 12. Paid Features
If paid features are offered, purchases are processed by the storefront or payment provider and are governed by their terms. Subscription management and cancellations are handled through your account with that provider.
# Privacy Policy
Last updated: [MONTH YYYY]
## 1. Introduction
[APP_NAME] ("we," "our," or "us") respects your privacy and is committed to protecting it. This Privacy Policy explains how we handle information when you use the app.
## 2. Information Collection
The app is designed to be local-first. We do not collect personal information by default. We do not track usage behavior or sell data to third parties. Your content remains on your device unless you choose to share it.
## 3. On-Device Processing
AI features run locally using on-device models. Your content is processed entirely on your device and is not sent to external servers for processing.
## 4. Data Storage
Files you import or generate are stored locally in locations you select. You control when and how to delete or share this data.
## 5. Third-Party Services
The app may utilize system-level services provided by your operating system. Optional update or license checks may transmit basic app and device metadata (such as version and OS information), but no user content is transmitted. If third-party services are enabled in future releases, this policy will be updated accordingly.
## 6. Data Security
Since data stays on your device, its security depends on your device security settings. We recommend using passcodes or biometrics where available.
## 7. Children's Privacy
The Service does not address anyone under the age of 13. We do not knowingly collect personal information from children under 13.
## 8. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy and updating the "Last updated" date.
## 9. Contact Us
If you have any questions about this Privacy Policy, contact us at solomon@qneura.ai or https://qneura.ai/apps.html.
Business Source License 1.1
Parameters
Licensor: [COMPANY_NAME]
Licensed Work: [APP_NAME] Source Code
Additional Use Grant: [Production use allowed / see BINARY-LICENSE.txt for binary terms]
Change Date: [YYYY-MM-DD]
Change License: [GPL-2.0-or-later or compatible license]
Terms
The Licensor hereby grants you the right to copy, modify, create derivative
works, redistribute, and make non-production use of the Licensed Work. The
Licensor may make an Additional Use Grant, above, permitting limited
production use.
Effective on the Change Date, or the fourth anniversary of the first publicly
available distribution of a specific version of the Licensed Work under this
License, whichever comes first, the Licensor hereby grants you rights under
the terms of the Change License, and the rights granted in the paragraph
above terminate.
If your use of the Licensed Work does not comply with the requirements
currently in effect as described in this License, you must purchase a
commercial license from the Licensor, its affiliated entities, or authorized
resellers, or you must refrain from using the Licensed Work.
All copies of the original and modified Licensed Work, and derivative works
of the Licensed Work, are subject to this License. This License applies
separately for each version of the Licensed Work and the Change Date may vary
for each version of the Licensed Work released by Licensor.
You must conspicuously display this License on each original or modified copy
of the Licensed Work. If you receive the Licensed Work in original or
modified form from a third party, the terms and conditions set forth in this
License apply to your use of that work.
Any use of the Licensed Work in violation of this License will automatically
terminate your rights under this License for the current and all other
versions of the Licensed Work.
This License does not grant you any right in any trademark or logo of
Licensor or its affiliates (provided that you may use a trademark or logo of
Licensor as expressly required by this License).
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
TITLE.
MariaDB hereby grants you permission to use this License's text to license
your works, and to refer to it using the trademark "Business Source License",
as long as you comply with the Covenants of Licensor below.
Covenants of Licensor
In consideration of the right to use this License's text and the "Business
Source License" name and trademark, Licensor covenants to MariaDB, and to all
other recipients of the licensed work to be provided by Licensor:
1. To specify as the Change License the GPL Version 2.0 or any later version,
or a license that is compatible with GPL Version 2.0 or a later version,
where "compatible" means that software provided under the Change License can
be included in a program with software provided under GPL Version 2.0 or a
later version. Licensor may specify additional Change Licenses without
limitation.
2. To either: (a) specify an additional grant of rights to use that does not
impose any additional restriction on the right granted in this License, as
the Additional Use Grant; or (b) insert the text "None".
3. To specify a Change Date.
4. Not to modify this License in any other way.
Binary Distribution License
This Binary Distribution License ("License") governs use of the compiled
binary distribution for [APP_NAME] (the "Binary"), including DMG, EXE, and
app bundles.
1. License Grant
You may install and use the Binary for personal or internal business use.
2. Restrictions
You may not sell, rent, sublicense, or redistribute the Binary.
You may not use the Binary for any commercial offering or for third-party
hosting/managed service.
3. Source Code
Source code is licensed separately under the Business Source License 1.1.
See [SOURCE_LICENSE_FILE] for details.
4. No Warranty
THE BINARY IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
5. Limitation of Liability
IN NO EVENT SHALL [COMPANY_NAME] BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
LIABILITY ARISING FROM THE USE OF THE BINARY.
6. Contact
If you need commercial binary distribution rights, contact [CONTACT_EMAIL].
# Licensing Overview
Last updated: [MONTH YYYY]
## Summary
[APP_NAME] is source-available under a BSL-style license. Source code use is
allowed, while binary distribution has stricter terms.
## Source Code License (BSL 1.1)
- **License:** Business Source License 1.1
- **Scope:** Source code only
- **File:** `LICENSE`
- **Notes:** [Short description of permitted use and change date]
## Binary Distribution License
- **License:** Binary Distribution License (EULA)
- **Scope:** DMG/EXE/app bundles and any compiled binaries
- **File:** `BINARY-LICENSE.txt`
- **Key restriction:** No commercial use or redistribution of the Binary
## What You Can Do
- Clone and modify the source code
- Build binaries for personal or internal use
- Use the source code in production (as permitted by BSL parameters)
## What You Cannot Do
- Sell or redistribute the official binary distribution
- Offer the binary as part of a commercial service without a license
## Need Commercial Rights?
Contact [CONTACT_EMAIL] for commercial binary licensing.
## License
- Source code: Business Source License 1.1 (`LICENSE`)
- Binary distribution: Binary Distribution License (`BINARY-LICENSE.txt`)
- Overview: `LICENSE.md`
Generate report with this structure:
# Code Review Report - App Store Readiness
## Executive Summary
- Total issues: X (Critical: N, High: N, Medium: N, Low: N)
- Recommendation: [Ready / Needs Work / Not Ready]
## Critical Issues (Must Fix)
### Issue 1.1: [Title]
**File:** path/to/file.dart
**Lines:** XX-YY
**Severity:** Critical
**Description:** What's wrong
**Current Code:** `code snippet`
**Recommended Fix:** `fixed code`
## High Issues (Should Fix)
[Same format]
## Medium Issues (Address Soon)
[Same format]
## Low Issues (Nice to Have)
[Same format]
## Positive Observations
[What's done well]
## Recommendations
[Prioritized action items]
| Issue | Pattern | Fix |
|---|---|---|
| Timer leak | Timer.periodic without cancel | Cancel in dispose() |
| Stream leak | .listen() without cancel | Store subscription, cancel in dispose() |
| setState after dispose | Async callback calls setState | Check mounted first |
| Hardcoded strings | 'http://localhost' | Use environment config |
| Issue | Pattern | Fix |
|---|---|---|
| CORS open | allow_origins=["*"] | Whitelist specific origins |
| No timeout | Default connection timeout | Set explicit timeouts |
| Thread unsafe DB | check_same_thread=False | Add connection locking |
| Swallowed exceptions | except: pass | Log or handle specifically |
| Issue | Pattern | Fix |
|---|---|---|
| Retain cycle | self in closure | Use [weak self] |
| Force unwrap | value! | Use guard let or if let |
| Main thread UI | Background queue UI update | DispatchQueue.main.async |
| Issue | Pattern | Fix |
|---|---|---|
| Missing version | No version display | Add to About/Settings page |
| Missing privacy | No privacy policy | Add in-app privacy page + App Store link |
| Wrong author | Generic or missing author | Set to Qneura.ai with link |
| No legal pages | Missing ToS/License | Add accessible legal section |
| No accessibility | VoiceOver not tested | Test with screen reader, fix labels |
| Issue | Pattern | Fix |
|---|---|---|
| No control script | Manual process start/stop | Add bin/appctl with up/down/status |
| No installer | Complex setup steps | Add install.sh with dependency checks |
| No diagnostics | Hard to debug issues | Add issues.sh with system info + logs |
| No DMG script | Manual DMG creation | Add scripts/build_dmg.sh |
| No release script | Manual GitHub uploads | Add scripts/release.sh with --upload --sync-website |
| Hardcoded version | Version not from pubspec | Extract version from pubspec.yaml |
| No website sync | Manual download link edits | Add --sync-website flag to release script |
| Version reuse | Same tag released twice | Always increment version before release |
| No SHA256 checksum | DMG without verification | Generate .sha256 alongside DMG |
| Deprecated Flutter API | withOpacity() usage | Replace with withValues(alpha:) |
| No dark mode | Only light theme | Add ThemeMode.system support |
| Issue | Pattern | Fix |
|---|---|---|
| No MCP server | App not Claude-accessible | Add bin/<app>_mcp_server.py |
| Missing tool schemas | inputSchema undefined | Add JSON Schema with properties/required |
| No health_check tool | Can't verify backend | Add health_check MCP tool |
| Hardcoded backend URL | Can't configure | Use env var (e.g., APP_BACKEND_URL) |
| No MCP tests | Integration untested | Add test_mcp_server.py |
| HTTP/MCP mismatch | Tools don't match API | Ensure 1:1 parity between MCP tools and HTTP endpoints |
| No logging | Silent MCP failures | Add rotating file handler to runs/logs/ |
| Port conflicts | Multiple apps clash | Make --host/--port configurable |
| No MCP UI screen | Users can't manage MCP | Add lib/pages/mcp_page.dart |
| No tool discovery UI | Users can't see available tools | Add expandable tool list in MCP screen |
| No Claude Code setup helper | Complex manual config | Add copy-to-clipboard config generator |
| No MCP server status | Users can't verify MCP | Add status indicator with start/stop controls |
After review, offer to fix issues:
localhost or 127.0.0.1 hardcoded (except for bundled backend)allow_origins=["*"] in CORScheck_same_thread=False without locking! in Dart, !! in Kotlin, ! in Swift)Timer.periodic without corresponding cancelsetState without mounted check in asyncexcept: or catch (e) {} that swallows errorsLICENSE or BINARY-LICENSE.txt<AppName>CODE/README.md license links or mismatch with <AppName>WEB/license.htmlprivacy-consent.js) on any app website page.app/Contents or mounted .dmgApplications drag targethdiutil fallback packages only .app instead of DMG staging folder~/.cache/huggingface/hub in bundled build without app-scoped overridebin/appctl control scriptinstall.sh installer scriptissues.sh diagnostic scriptExport Diagnostic Logs action in SettingsBuy License CTAwithOpacity() instead of withValues(alpha:)bin/*_mcp_server.py)lib/pages/mcp_page.dart)scripts/release.sh for automated releases--upload flag for GitHub upload--sync-website flag for website updatespubspec.yamlReproduce, diagnose, fix, verify, commit, and push changes for GitHub issue reports and bug tickets. Use when the user provides a GitHub issue URL/number, asks to reproduce a reported crash or workflow failure, wants a blocker-first debugging workflow, or needs issue-linked commit/push notes after a verified fix.
Use when auditing Apple-platform app projects for release infrastructure and distribution compliance. Covers macOS DMG readiness and iOS/iPad App Store Connect release gates via companion checks.
Use when conducting deep code review for production blockers including API mismatches, memory leaks, busy wait loops, and UI workflow failures. Apply before release to catch runtime bugs that static analysis misses.
Use when adding login/authentication to a Flutter macOS app (desktop) using Auth0. Includes Auth0 tenant setup, macOS callback configuration, Flutter login UI and AuthService, secure token storage, logout, and a backend JWT verification example.
Use when preparing iOS and iPadOS apps for TestFlight or App Store release, including signing, archive/IPA export, App Store Connect metadata, privacy/compliance checks, and final distribution readiness.
Build, verify, and package Flutter desktop apps for Windows into a distributable executable bundle (EXE plus required DLL/data dependencies, optional installer-ready artifacts). Use when a user asks to generate a Windows Flutter executable, ship a Windows desktop release, include runtime dependencies, or troubleshoot missing DLL/runtime issues in Windows Flutter distribution.