Add macOS MCP support and refresh the operations UI - #12

The downloadable macOS app now includes MCP and a Settings → MCP → Connect Codex workflow. Users install the app, click once, and ask Codex to use the tools in natural language. Ping, DNS, and TCP diagnostics are enabled in the initial GUI configuration; Codex starts the bundled helper on demand, including after NETworkManager closes.

• Bundle Contents/Helpers/NMCP and its reference data in arm64, x86_64, and Universal app packages, with explicit nested signing. Support both Xcode resource bundles and flat SwiftPM resource directories when signing. Resolve resources from the enclosing app so moved installations do not depend on a source checkout or Swift toolchain.
• Register, update, refresh, and remove the connection through Codex's own CLI using argument arrays. Discover the desktop app automatically or select it in a file dialog. Refuse persistent registration from DMG/App Translocation paths and verify removal ownership and postconditions.
• Provide four local tools (network_interfaces, subnet_info, port_lookup, mac_vendor_lookup) and three network tools (ping, dns_lookup, tcp_probe), plus usage and server resources, using official MCP Swift SDK 0.12.1 over stdio. Validate inputs, bound network concurrency and timeouts, and cancel pending work on EOF.
• Keep blocking diagnostic I/O on Dispatch workers so constrained Swift cooperative executors remain responsive. Preserve damaged settings without recursive singleton initialization.
• Document the GUI setup in Chinese and English. Extend CI and the DMG lifecycle checks to run the actual packaged helper after relocation while source/build reads and developer-tool invocations are blocked.

Validation on arm64 with Swift 6.4.2:

• GUI Debug and Release builds, NMTest including isolated GUI connection-model process checks, and NMCheck passed.
• Real-process stdio/launcher checks passed in Debug and Release under LIBDISPATCH_COOPERATIVE_POOL_STRICT=1.
• The final bundled Release app passed the complete seven-tool stdio suite after relocation to a path with spaces, with the source checkout and original build inaccessible. GUI/helper architectures matched; original and relocated signatures verified.
• Both native SwiftPM flat resource directories and Swift Build/Xcode resource bundles passed the relocated packaged-helper suite. App resources are resolved without depending on a helper executable URL or Foundation bundle metadata.
• The DMG passed mount/install, packaged MCP checks, GUI launch, replacement upgrade, repeat MCP/GUI checks, and uninstall.
• The installed app's Settings button successfully updated a real Codex registration to its bundled helper with network diagnostics enabled. Separately, a temporary Codex home verified real CLI add/list/update/remove and preservation of an unrelated server.
• Shell/Python syntax and git diff --check passed. Network probes used loopback fixtures.

GitHub Actions for the previous PR head (8a7a04ba0c2ff526284b728bf9f4b555a159ab78) passed on macOS 15 Intel (x86_64) and macOS 26 (arm64):

• PR workflow 42385368576
• Push workflow 42385364361

Both runs passed the GUI build/core/protocol checks, actual stdio MCP tests, app/DMG signature and image verification, relocated packaged-helper checks, and DMG install/upgrade/uninstall checks. Checkout and artifact actions now use their Node.js 24 releases; the macOS 15 Intel job has no runner-capacity notice, while GitHub may still show its informational capacity notice on the macOS 26 arm64 job.

Download preview app/DMG artifacts from the push run:

• macOS 15 Intel runner artifact
• macOS 26 Apple Silicon runner artifact

Extract the downloaded artifact and install using its DMG to preserve executable permissions. Open Settings → MCP → Connect Codex, then start a new Codex chat. These are ad-hoc preview builds. The tag-only Developer ID signing/notarization workflow is not exercised by this branch; no signed/notarized Release or macOS 14 runtime verification is claimed.

macOS operations UI refresh (2026-11-08)

• Move global tool search into the native window toolbar, retain the ⌘K shortcut, add a direct Settings button, and keep all existing sidebar tool routes and actions.
• Refresh the operations overview hierarchy and make metric tiles fill responsive one-, two-, or three-column layouts.
• Add macos/docs/ui-dashboard-mockup.png with its editable SVG source. The mockup uses documentation-only example networks and is not a capture of local network data.
• Local validation for commit 0944345: Release app and MCP helper build, GUI launch, NMTest, NMCheck, code-signature verification, and Info.plist lint passed. SwiftPM still prints missing Command Line Tools search-path warnings on the local host.
• GitHub Actions for commit 0944345 passed on macOS 15 Intel and macOS 26 Apple Silicon. The push workflow and PR workflow both passed the GUI/core/protocol checks, MCP stdio and relocation tests, app/DMG verification, and DMG install/upgrade/uninstall checks. The tag-only notarization workflow was skipped for this branch.
• Push workflow · PR workflow
• Latest ad-hoc preview downloads: macOS 15 Intel app and DMG · macOS 26 Apple Silicon app and DMG