feat(desktop): terminal installer for macOS without gatekeeper warning

[DevFlex-AI]

Issue for this PR

Closes #128

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Browser-downloaded builds of the desktop app show "Apple could not verify Bolt is free of malware" because they are ad-hoc signed, not notarized, and notarization requires a paid Apple Developer ID. The Gatekeeper dialog is driven by the com.apple.quarantine xattr that browsers attach to downloads; curl attaches nothing, so a terminal install shows no dialog at all.

This adds an install-desktop script at the repo root (sibling of the CLI install script, same conventions) so macOS users can run:

curl -fsSL https://raw.githubusercontent.com/bolt-builder/bolt-cli/dev/install-desktop | bash

It detects Apple Silicon vs Intel, downloads bolt-desktop-mac-{arm64,x64}.app.tar.gz from the latest release (or --version x.y.z), refuses to replace a running app, installs to /Applications/Bolt.app, and strips any quarantine attribute defensively:

rm -rf "/Applications/$APP.app"
mv "$TMP/$APP.app" "/Applications/$APP.app"
xattr -rd com.apple.quarantine "/Applications/$APP.app" 2>/dev/null || true

How did you verify your code works?

bash -n passes; the releases/latest/download/bolt-desktop-mac-arm64.app.tar.gz URL resolves 200; downloaded the real v1.20.2 asset and confirmed the archive contains Bolt.app/ at its root, matching the script's expectation. Full end-to-end install needs a macOS machine, which this sandbox is not; the download and extraction logic mirrors the asset layout exactly.

Screenshots / recordings

Not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
bolt-cli-app	Ready	Preview	Aug 1, 2026 9:15pm

[coderabbitai]

Warning

Review limit reached

@DevFlex-AI, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1bd7af5a-41ef-42a3-b8b0-e86177d6cc7a

📥 Commits

Reviewing files that changed from the base of the PR and between acc53bd and f42a4a2.

📒 Files selected for processing (1)

• install-desktop

---

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in acc53bd...f42a4a2 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 1, 2026 9:14p.m.	Review ↗
Shell		Aug 1, 2026 9:14p.m.	Review ↗
Secrets		Aug 1, 2026 9:14p.m.	Review ↗
Docker		Aug 1, 2026 9:14p.m.	Review ↗
Python		Aug 1, 2026 9:14p.m.	Review ↗
CSS		Aug 1, 2026 9:14p.m.	Review ↗
Rust		Aug 1, 2026 9:14p.m.	Review ↗
Ruby		Aug 1, 2026 9:14p.m.	Review ↗
Swift		Aug 1, 2026 9:14p.m.	Review ↗
PHP		Aug 1, 2026 9:14p.m.	Review ↗
Lua		Aug 1, 2026 9:14p.m.	Review ↗
Java		Aug 1, 2026 9:14p.m.	Review ↗
Go		Aug 1, 2026 9:14p.m.	Review ↗
C & C++		Aug 1, 2026 9:14p.m.	Review ↗
Ansible		Aug 1, 2026 9:14p.m.	Review ↗
Apex		Aug 1, 2026 9:14p.m.	Review ↗
Elixir		Aug 1, 2026 9:14p.m.	Review ↗
Groovy		Aug 1, 2026 9:14p.m.	Review ↗
Objective-C		Aug 1, 2026 9:14p.m.	Review ↗
PowerShell		Aug 1, 2026 9:14p.m.	Review ↗
Terraform		Aug 1, 2026 9:14p.m.	Review ↗
VB.NET		Aug 1, 2026 9:14p.m.	Review ↗
SQL		Aug 1, 2026 9:14p.m.	Review ↗
Scala		Aug 1, 2026 9:14p.m.	Review ↗
Perl		Aug 1, 2026 9:14p.m.	Review ↗
Kotlin		Aug 1, 2026 9:14p.m.	Review ↗
Helm		Aug 1, 2026 9:14p.m.	Review ↗
Erlang		Aug 1, 2026 9:14p.m.	Review ↗
Dart		Aug 1, 2026 9:14p.m.	Review ↗
C#		Aug 1, 2026 9:14p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.