fix: generate .env file with proper config in CI and improve DMG layout

- Generate complete .env file with all required environment variables
- Read sensitive values (ENCRYPTION_KEY, TG_APP_ID, TG_APP_HASH) from secrets
- Add /Applications symlink to DMG for drag-to-Install hint
- Add window layout settings for better DMG appearance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/build.yml

@@ -102,9 +102,55 @@ jobs:
       - name: Create .env file
         working-directory: ./lumis/apps/web
         run: |
-          cp .env.example .env
-          # Remove POSTGRES_URL to skip database migration in CI
-          grep -v '^POSTGRES_URL=' .env > .env.tmp && mv .env.tmp .env
+          cat > .env << 'EOF'
+          ENCRYPTION_KEY=${{ secrets.ENCRYPTION_KEY }}
+
+          # Cloud API Configuration for Tauri Desktop App
+          CLOUD_API_URL=https://app.uselumis.ai
+          NEXT_PUBLIC_CLOUD_API_URL=https://app.uselumis.ai
+
+          # Local development URL (for Tauri mode)
+          NEXT_PUBLIC_APP_URL=http://localhost:3415
+
+          LLM_BASE_URL=https://openrouter.ai/api/v1
+          LLM_MODEL=google/gemini-3-flash-preview
+          LLM_REASONING_MODEL=google/gemini-3-flash-preview
+          LLM_VISION_LANGUAGE_MODEL=google/gemini-3-flash-preview
+          LLM_IMAGE_MODEL=openai/gpt-5-image
+
+          LLM_EMBEDDING_MODEL=qwen/qwen3-embedding-4b
+          LLM_EMBEDDING_BASE_URL=https://openrouter.ai/api/v1
+
+          TELEGRAM_MODE=pooling
+          # Telegram App Id and Hash. Reference: https://my.telegram.org/
+          TG_APP_ID=${{ secrets.TG_APP_ID }}
+          TG_APP_HASH=${{ secrets.TG_APP_HASH }}
+
+          # Roles
+          ROLE_DETECTION_ENABLED=1
+          ROLE_OVERLAY_ANALYST_JOURNALIST=1
+          ROLE_OVERLAY_COMMUNITY_MANAGER=1
+          ROLE_OVERLAY_CUSTOMER_SUCCESS=1
+          ROLE_OVERLAY_EXECUTIVE=1
+          ROLE_OVERLAY_FREELANCER=1
+          ROLE_OVERLAY_INDIE_FOUNDER=1
+          ROLE_OVERLAY_INVESTOR_ADVISOR=1
+          ROLE_OVERLAY_REMOTE_WORKER=1
+          ROLE_OVERLAY_SALES_BIZDEV=1
+
+          CLAUDE_CODE_TMPDIR=$HOME/.cache/lumis-tmp
+
+          ANTHROPIC_BASE_URL=http://localhost:3415/api/ai
+          API_TIMEOUT_MS=3000000
+          CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
+          IS_TAURI=true
+
+          # iMessage Backend Mode
+          IMESSAGE_BACKEND_MODE=sdk
+          NEXT_PUBLIC_IMESSAGE_BACKEND_MODE=sdk
+
+          CLAUDE_DISABLE_URL_SAFETY_CHECK=true
+          EOF
 
       - name: Import Apple Certificate and Intermediate Certificates
         env:
@@ -212,9 +258,26 @@ jobs:
           APP_BUNDLE="./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app"
           DMG_PATH="./lumis/apps/web/src-tauri/target/release/bundle/dmg/Lumis_0.3.0_aarch64.dmg"
 
-          # Create DMG from the signed app bundle using hdiutil
-          # Use UDZO (compressed) format to match Tauri behavior
-          hdiutil create -volname "Lumis" -fs HFS+ -srcfolder "$APP_BUNDLE" -format UDZO "$DMG_PATH"
+          # Create a temporary directory for DMG contents
+          TEMP_DMG_DIR=$(mktemp -d)
+          cp -R "$APP_BUNDLE" "$TEMP_DMG_DIR/"
+
+          # Create symlink to /Applications (shows as "Applications" folder in DMG)
+          ln -s /Applications "$TEMP_DMG_DIR/Applications"
+
+          # Create DMG from the temp directory with proper layout
+          # This creates a DMG with the app on the left and Applications folder on the right
+          hdiutil create -volname "Lumis" \
+            -fs HFS+ \
+            -srcfolder "$TEMP_DMG_DIR" \
+            -format UDZO \
+            -layout SPUD \
+            -window-pos 100 100 \
+            -window-size 600 400 \
+            "$DMG_PATH"
+
+          # Clean up temp directory
+          rm -rf "$TEMP_DMG_DIR"
 
           echo "✅ DMG created from signed app bundle"
 
@@ -375,9 +438,55 @@ jobs:
       - name: Create .env file
         working-directory: ./lumis/apps/web
         run: |
-          cp .env.example .env
-          # Remove POSTGRES_URL to skip database migration in CI
-          grep -v '^POSTGRES_URL=' .env > .env.tmp && mv .env.tmp .env
+          cat > .env << 'EOF'
+          ENCRYPTION_KEY=${{ secrets.ENCRYPTION_KEY }}
+
+          # Cloud API Configuration for Tauri Desktop App
+          CLOUD_API_URL=https://app.uselumis.ai
+          NEXT_PUBLIC_CLOUD_API_URL=https://app.uselumis.ai
+
+          # Local development URL (for Tauri mode)
+          NEXT_PUBLIC_APP_URL=http://localhost:3415
+
+          LLM_BASE_URL=https://openrouter.ai/api/v1
+          LLM_MODEL=google/gemini-3-flash-preview
+          LLM_REASONING_MODEL=google/gemini-3-flash-preview
+          LLM_VISION_LANGUAGE_MODEL=google/gemini-3-flash-preview
+          LLM_IMAGE_MODEL=openai/gpt-5-image
+
+          LLM_EMBEDDING_MODEL=qwen/qwen3-embedding-4b
+          LLM_EMBEDDING_BASE_URL=https://openrouter.ai/api/v1
+
+          TELEGRAM_MODE=pooling
+          # Telegram App Id and Hash. Reference: https://my.telegram.org/
+          TG_APP_ID=${{ secrets.TG_APP_ID }}
+          TG_APP_HASH=${{ secrets.TG_APP_HASH }}
+
+          # Roles
+          ROLE_DETECTION_ENABLED=1
+          ROLE_OVERLAY_ANALYST_JOURNALIST=1
+          ROLE_OVERLAY_COMMUNITY_MANAGER=1
+          ROLE_OVERLAY_CUSTOMER_SUCCESS=1
+          ROLE_OVERLAY_EXECUTIVE=1
+          ROLE_OVERLAY_FREELANCER=1
+          ROLE_OVERLAY_INDIE_FOUNDER=1
+          ROLE_OVERLAY_INVESTOR_ADVISOR=1
+          ROLE_OVERLAY_REMOTE_WORKER=1
+          ROLE_OVERLAY_SALES_BIZDEV=1
+
+          CLAUDE_CODE_TMPDIR=$HOME/.cache/lumis-tmp
+
+          ANTHROPIC_BASE_URL=http://localhost:3415/api/ai
+          API_TIMEOUT_MS=3000000
+          CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
+          IS_TAURI=true
+
+          # iMessage Backend Mode
+          IMESSAGE_BACKEND_MODE=sdk
+          NEXT_PUBLIC_IMESSAGE_BACKEND_MODE=sdk
+
+          CLAUDE_DISABLE_URL_SAFETY_CHECK=true
+          EOF
 
       - name: Install Linux build dependencies
         run: |