feat(build): add macOS + Linux builds via 3-OS CI matrix

Previously Windows-only. Now electron-builder produces native artifacts
for all three platforms on every tagged release:

  Windows : .exe (NSIS installer)         — windows-latest
  macOS   : .dmg + .zip (x64 + arm64)     — macos-latest, unsigned
  Linux   : .AppImage + .deb (x64)        — ubuntu-latest

Release workflow restructured as a fail-fast: false matrix so a
platform-specific failure doesn't block the others. Each runner builds
+ publishes its own artifacts via electron-builder --publish always,
which also uploads the per-OS auto-update manifests (latest.yml,
latest-mac.yml, latest-linux.yml) the updater needs. The release job
then finalises the GitHub release with the auto-generated changelog
across all three artifact sets.

Renderer fixes for cross-platform compatibility:
- encryptionProfilePath: use forward slash (works on every OS) instead
  of the hardcoded Windows backslash
- legacy-whiteboard regex now matches both [\/]
- terminal preference default switched from hardcoded 'powershell.exe'
  to a defaultShellForPlatform() that picks zsh on macOS, bash on Linux
- F5 Run File uses `&&` on macOS/Linux (bash/zsh) and `;` on Windows
  (PowerShell) so the shell chain operator doesn't trip a parse error

Caveats documented in CLAUDE.md:
- macOS builds are unsigned; first launch requires right-click → Open.
- Icons still use the .ico for all platforms (mac/linux get an auto-
  converted lower-quality version); future work to add .icns + 512.png.
- Linux AppImage needs libfuse2 (CI installs it; end-users on Ubuntu
  24.04+ may need libfuse2t64).

Author: Yogesh Prajapati

.github/workflows/release.yml

@@ -11,16 +11,39 @@ permissions:
 
 jobs:
   # ───────────────────────────────────────────────────────────────────────────
-  # JOB 1 — BUILD
-  # Compiles the installer and the electron-updater manifest. Uploads them as
-  # workflow artifacts so the release job (and humans, if needed) can fetch
-  # them. We use `--publish always` so electron-builder also uploads the
-  # auto-updater files (latest.yml + *.blockmap) straight to the GitHub
-  # release — these MUST sit next to the .exe or auto-update can't find them.
+  # JOB 1 — BUILD (matrix across Windows + macOS + Linux)
+  # Each runner compiles its own native artifacts and publishes them to the
+  # GitHub release. electron-updater needs the per-platform manifest files
+  # (latest.yml, latest-mac.yml, latest-linux.yml) AND the artifacts to sit
+  # on the same release — `--publish always` handles both in one step.
   # ───────────────────────────────────────────────────────────────────────────
   build:
-    name: Build Windows Installer
-    runs-on: windows-latest
+    name: Build (${{ matrix.os }})
+    strategy:
+      fail-fast: false   # one platform's failure shouldn't block the others
+      matrix:
+        include:
+          - os: windows-latest
+            target_flag: --win nsis
+            artifact_glob: |
+              dist/*.exe
+              dist/latest.yml
+              dist/*.blockmap
+          - os: macos-latest
+            target_flag: --mac
+            artifact_glob: |
+              dist/*.dmg
+              dist/*.zip
+              dist/latest-mac.yml
+              dist/*.blockmap
+          - os: ubuntu-latest
+            target_flag: --linux
+            artifact_glob: |
+              dist/*.AppImage
+              dist/*.deb
+              dist/latest-linux.yml
+              dist/*.blockmap
+    runs-on: ${{ matrix.os }}
     outputs:
       version: ${{ steps.version.outputs.VERSION }}
 
@@ -34,22 +57,28 @@ jobs:
           node-version: '20'
           cache: 'npm'
 
+      # Linux-only: AppImage builds need libfuse2 on the GH runner image.
+      - name: Install libfuse2 (Linux only)
+        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install -y libfuse2
+
       - name: Install dependencies
         run: npm ci
 
-      - name: Build & publish installer (uploads .exe + latest.yml + .blockmap to GitHub release)
-        run: npm run build:wb && npx electron-builder --win nsis --publish always
+      - name: Build & publish installer (electron-builder publishes to GitHub release)
+        run: npm run build:wb && npx electron-builder ${{ matrix.target_flag }} --publish always
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Skip Mac code-signing in CI — we ship unsigned builds for now.
+          # Users on macOS will need to right-click → Open the first time.
+          CSC_IDENTITY_AUTO_DISCOVERY: false
 
-      - name: Upload installer artifacts (for the release job)
+      - name: Upload platform artifacts (for the release job)
         uses: actions/upload-artifact@v4
         with:
-          name: installer
-          path: |
-            dist/*.exe
-            dist/latest.yml
-            dist/*.blockmap
+          name: dist-${{ matrix.os }}
+          path: ${{ matrix.artifact_glob }}
+          if-no-files-found: warn
 
       - name: Get version from tag
         id: version
@@ -58,22 +87,37 @@ jobs:
 
   # ───────────────────────────────────────────────────────────────────────────
   # JOB 2 — RELEASE
-  # Marks the GitHub release as Latest with auto-generated notes (changelog
-  # built from commits/PRs since the previous tag). softprops/action-gh-release
-  # upserts the release — if electron-builder already created one for this
-  # tag, this step just refines its title/notes and adds the same files.
+  # Marks the GitHub release as Latest with auto-generated notes. By this
+  # point all three platforms have already uploaded their artifacts via
+  # electron-builder --publish always; this step just finalises the title
+  # and changelog and ensures it's flipped to Latest.
   # ───────────────────────────────────────────────────────────────────────────
   release:
     name: Publish GitHub Release
     needs: build
     runs-on: ubuntu-latest
 
     steps:
-      - name: Download installer artifacts from build job
+      - name: Download Windows artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist-windows-latest
+          path: dist
+        continue-on-error: true
+
+      - name: Download macOS artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist-macos-latest
+          path: dist
+        continue-on-error: true
+
+      - name: Download Linux artifacts
         uses: actions/download-artifact@v4
         with:
-          name: installer
+          name: dist-ubuntu-latest
           path: dist
+        continue-on-error: true
 
       - name: Create / update GitHub Release
         uses: softprops/action-gh-release@v2
@@ -86,7 +130,13 @@ jobs:
           generate_release_notes: true
           files: |
             dist/*.exe
+            dist/*.dmg
+            dist/*.zip
+            dist/*.AppImage
+            dist/*.deb
             dist/latest.yml
+            dist/latest-mac.yml
+            dist/latest-linux.yml
             dist/*.blockmap
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CLAUDE.md

@@ -25,7 +25,8 @@ Located at `D:\NewNotepad`. GitHub: https://github.com/YogeshPraj/Note-
 | Bundler (iframe only) | esbuild 0.24 |
 | Security | `contextIsolation: true`, `nodeIntegration: false` |
 | Node bridge | `src/preload.js` → `window.electronAPI` |
-| Platform | Windows (primary), Node.js |
+| Platform | Windows, macOS, Linux (cross-platform builds via electron-builder matrix CI) |
+| Auto-update | electron-updater + GitHub provider (latest.yml / latest-mac.yml / latest-linux.yml on every release) |
 
 ---
 
@@ -264,15 +265,35 @@ npm start          # or double-click launch.bat
 ## How to Build
 
 ```bash
-npm run build      # electron-builder (needs electron-builder in devDeps)
+# Build for the current OS (auto-detects)
+npm run build
+
+# Or target a specific platform explicitly
+npm run build:win        # Windows: NSIS installer (.exe)
+npm run build:msi        # Windows: MSI installer
+npm run build:mac        # macOS: .dmg + .zip (x64 + arm64)
+npm run build:linux      # Linux: .AppImage + .deb (x64)
 ```
 
+**Cross-platform note:** electron-builder must be run on the target OS for native binaries (node-pty, native deps) to compile correctly. You can't build Mac artifacts on a Windows machine and vice-versa. The GitHub Actions workflow (`.github/workflows/release.yml`) handles this automatically via a 3-OS matrix on every tag push — each runner builds + publishes its own platform's artifacts to the same GitHub release.
+
+**Mac caveat:** builds are currently unsigned (no Apple Developer cert configured in CI). First-launch on macOS requires right-click → Open to bypass Gatekeeper.
+
+**Linux caveat:** AppImage builds need `libfuse2` on the build machine (CI installs it automatically). End-users on modern Ubuntu (24.04+) may need `sudo apt install libfuse2t64` to launch the AppImage.
+
 ---
 
 ## Known Issues / Future Work
 
-- [ ] No diff view / git integration in editor yet
-- [ ] No LSP server connections (only Monaco's built-in JS/TS IntelliSense)
+- [ ] macOS code-signing (currently shipping unsigned; Gatekeeper warning on first launch)
+- [ ] Linux icon assets (currently using `.ico` for all platforms; mac/linux fall back to a lower-quality conversion)
+- [ ] No Snap or Flatpak Linux targets yet (AppImage + .deb only)
+
+### Recently resolved (Session 8 — cross-platform builds)
+- ~~Windows-only builds~~ → electron-builder now produces `.exe` (Windows), `.dmg`/`.zip` (macOS x64+arm64), `.AppImage`/`.deb` (Linux x64). CI is a 3-OS matrix; tag push triggers parallel builds on `windows-latest`, `macos-latest`, `ubuntu-latest`. All artifacts plus `latest*.yml` updater manifests land on the same GitHub release.
+- ~~Hardcoded `\\` separators in renderer paths~~ → switched to `/` and `[\\/]` regex (works on every OS).
+- ~~`powershell.exe` hardcoded as terminal default~~ → `defaultShellForPlatform()` picks `powershell.exe` on Windows, `/bin/zsh` on macOS, `/bin/bash` on Linux.
+- ~~F5 Run File used PowerShell-specific `;` operator~~ → uses `&&` on macOS/Linux so bash/zsh parse cleanly.
 
 ### Recently resolved (Session 6)
 - ~~`node-pty` not installed~~ → `node-pty ^1.1.0` is in `dependencies`, ConPTY binary built, `main.js` uses it for true PTY with `proc.resize()` wired up.

package.json

@@ -9,9 +9,11 @@
     "build:wb": "node build-whiteboard.js",
     "build:wb:watch": "node build-whiteboard.js --watch",
     "postinstall": "node build-whiteboard.js",
-    "build": "npm run build:wb && electron-builder --win",
+    "build": "npm run build:wb && electron-builder",
     "build:win": "npm run build:wb && electron-builder --win nsis --publish never",
     "build:msi": "npm run build:wb && electron-builder --win msi --publish never",
+    "build:mac": "npm run build:wb && electron-builder --mac --publish never",
+    "build:linux": "npm run build:wb && electron-builder --linux --publish never",
     "build:dir": "npm run build:wb && electron-builder --dir"
   },
   "build": {
@@ -339,6 +341,36 @@
       "icon": "src/assets/icon.ico",
       "artifactName": "${productName}-Setup-${version}.${ext}"
     },
+    "mac": {
+      "target": [
+        { "target": "dmg", "arch": ["x64", "arm64"] },
+        { "target": "zip", "arch": ["x64", "arm64"] }
+      ],
+      "icon": "src/assets/icon.ico",
+      "category": "public.app-category.developer-tools",
+      "artifactName": "${productName}-${version}-${arch}.${ext}",
+      "hardenedRuntime": false,
+      "gatekeeperAssess": false,
+      "identity": null
+    },
+    "dmg": {
+      "title": "${productName} ${version}",
+      "icon": "src/assets/icon.ico",
+      "writeUpdateInfo": true,
+      "sign": false
+    },
+    "linux": {
+      "target": [
+        { "target": "AppImage", "arch": ["x64"] },
+        { "target": "deb",      "arch": ["x64"] }
+      ],
+      "icon": "src/assets/icon.ico",
+      "category": "Development",
+      "artifactName": "${productName}-${version}-${arch}.${ext}",
+      "synopsis": "Developer-focused text editor with IntelliSense, integrated terminal, and live preview",
+      "description": "Note++ is an Electron + Monaco editor aimed at developers — a modern alternative to Notepad++ with IntelliSense, integrated PowerShell/bash terminal, live HTML/Markdown/Mermaid preview, multi-tab editing, cloud session sync, encryption, integrated git, and a built-in whiteboard powered by Excalidraw.",
+      "maintainer": "Yogesh Prajapati"
+    },
     "nsis": {
       "oneClick": false,
       "allowToChangeInstallationDirectory": true,

src/renderer.js

@@ -1134,11 +1134,13 @@ async function closeTab(id) {
       if (r.response === 2) return;
       if (r.response === 0) {
         // Legacy auto-backed whiteboards (pre-v1.5.x sessions) live under
-        // %AppData%\notepp\Whiteboards\ — for those, force Save As so the
-        // user picks a real location rather than silently writing back to
-        // the hidden AppData copy.
+        // the per-user app data folder (Windows: %AppData%\notepp\Whiteboards,
+        // macOS: ~/Library/Application Support/notepp/Whiteboards,
+        // Linux: ~/.config/notepp/Whiteboards). For those, force Save As so
+        // the user picks a real location rather than silently writing back
+        // to the hidden app-data copy.
         const isLegacyAutoBacking =
-          tab.filePath && /\\Whiteboards\\whiteboard-\d+\.json$/i.test(tab.filePath);
+          tab.filePath && /[\\/]Whiteboards[\\/]whiteboard-\d+\.json$/i.test(tab.filePath);
         const ok = await saveTabFile(tab, /* forceAs */ isLegacyAutoBacking);
         if (!ok) return;
       }
@@ -1983,9 +1985,12 @@ async function runCurrentFile() {
   // it a beat before typing into the PTY on first launch.
   await new Promise(r => setTimeout(r, 80));
 
-  // PowerShell: cd to the file's folder, then run. `;` chains regardless of
-  // exit code so we always see the result. CR (\r) submits the line.
-  const line = `cd "${cwd}"; ${cmd}\r`;
+  // Sniff the host OS so we use the right shell-chain operator. PowerShell
+  // (Windows default) accepts both `;` and `&&`; bash/zsh (macOS + Linux)
+  // require `&&`. Sending the wrong one wedges the prompt with a parse error.
+  const isWin = /windows/i.test(navigator.userAgent || '');
+  const chain = isWin ? ';' : '&&';
+  const line = `cd "${cwd}" ${chain} ${cmd}\r`;
   await window.electronAPI.terminalInput(terminalId, line);
 }
 
@@ -4671,18 +4676,29 @@ async function saveBackupPrefs(settings) {
 }
 
 // ===== Terminal Preferences =====
+// Pick the sensible per-OS default shell. The renderer doesn't know its
+// platform directly, so we sniff via navigator.userAgent (Electron exposes
+// the host OS there). Wrong-OS guess is harmless — main.js falls back to
+// its own platform-aware getShell() anyway.
+function defaultShellForPlatform() {
+  const ua = (navigator.userAgent || '').toLowerCase();
+  if (ua.includes('windows')) return 'powershell.exe';
+  if (ua.includes('mac'))     return '/bin/zsh';
+  return '/bin/bash';
+}
+
 async function loadTerminalPrefs() {
   const s = await window.electronAPI.readSettings();
   const t = s.terminal || {};
   const shellEl    = document.getElementById('pref-shell');
   const fontSizeEl = document.getElementById('pref-term-fontsize');
-  if (shellEl)    shellEl.value    = t.shell    || 'powershell.exe';
+  if (shellEl)    shellEl.value    = t.shell    || defaultShellForPlatform();
   if (fontSizeEl) fontSizeEl.value = t.fontSize || 13;
 }
 
 async function saveTerminalPrefs(settings) {
   settings.terminal = {
-    shell:    document.getElementById('pref-shell')?.value?.trim()        || 'powershell.exe',
+    shell:    document.getElementById('pref-shell')?.value?.trim()        || defaultShellForPlatform(),
     fontSize: parseInt(document.getElementById('pref-term-fontsize')?.value || '13'),
   };
 }
@@ -5330,7 +5346,9 @@ async function initGitIntegration() {
 
 async function encryptionProfilePath() {
   const userData = await window.electronAPI.getUserDataPath();
-  return userData + '\\encryption\\profile.json';
+  // Forward slashes work on Windows, macOS, and Linux. Node's fs APIs in
+  // the main process normalise both separators correctly.
+  return userData + '/encryption/profile.json';
 }
 
 // Read profile.json from disk into `appEnc.profile`. Returns the parsed profile,