feat(widget): add macOS desktop widget

Ship a native WidgetKit extension (routing mode, TUN and system proxy
toggles) as part of every macOS build. The extension talks to the Rust
backend over an App Group Unix socket with mutual code-signing checks,
reuses the backend i18n catalogs, and stays inert on macOS < 14.

A beforeBundle hook builds, localizes and pre-signs the extension before
Tauri signs the host; pnpm build resolves a single local signing identity
automatically and CI keeps using its injected credentials. An Xcode
style-preview host is included for iterating on the widget layout. The
i18n cleanup scanner now also scans Swift sources so widget-only keys
are not flagged unused.

Signed-off-by: Tunglies <77394545+Tunglies@users.noreply.github.com>

scripts/build.mjs

@@ -0,0 +1,62 @@
+import { spawnSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+const root = join(import.meta.dirname, '..')
+
+const forward = () => {
+  const tauri = spawnSync(
+    'pnpm',
+    ['exec', 'tauri', 'build', ...process.argv.slice(2)],
+    {
+      cwd: root,
+      stdio: 'inherit',
+      env: {
+        ...process.env,
+        NODE_OPTIONS: process.env.NODE_OPTIONS || '--max-old-space-size=4096',
+      },
+      shell: process.platform === 'win32',
+    },
+  )
+  process.exit(tauri.status ?? 1)
+}
+
+if (process.platform !== 'darwin') forward()
+
+if (process.env.CLASH_VERGE_WIDGET === '0') {
+  console.warn(
+    'CLASH_VERGE_WIDGET=0: building without the desktop widget extension.',
+  )
+  process.env.APPLE_SIGNING_IDENTITY = '-'
+  forward()
+}
+
+const run = (command, args) => {
+  const result = spawnSync(command, args, { encoding: 'utf8' })
+  if (result.error) return ''
+  return result.stdout
+}
+
+let identity = process.env.APPLE_SIGNING_IDENTITY
+if (!identity) {
+  const mac = JSON.parse(
+    readFileSync(join(root, 'src-tauri/tauri.macos.conf.json'), 'utf8'),
+  )
+  identity = mac.bundle?.macOS?.signingIdentity || undefined
+}
+if (!identity) {
+  const identities = [
+    ...run('security', ['find-identity', '-v', '-p', 'codesigning']).matchAll(
+      /\b([A-F0-9]{40}) "([^"]+)"/g,
+    ),
+  ]
+  if (identities.length === 1) identity = identities[0][2]
+}
+if (!identity) {
+  console.error(
+    'macOS packaging needs the widget extension signed with the host: set APPLE_SIGNING_IDENTITY to a valid certificate, or export CLASH_VERGE_WIDGET=0 to build without the widget.',
+  )
+  process.exit(1)
+}
+process.env.APPLE_SIGNING_IDENTITY = identity
+forward()

scripts/cleanup-unused-i18n.mjs

@@ -49,7 +49,7 @@ const FRONTEND_EXTENSIONS = new Set([
   '.vue',
   '.json',
 ])
-const BACKEND_EXTENSIONS = new Set(['.rs'])
+const BACKEND_EXTENSIONS = new Set(['.rs', '.swift'])
 
 const TS_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'])