Prepare repository for public release

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,83 @@
+name: Bug report
+description: Report a reproducible IPAPatch-Lookin problem
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: checkboxes
+    id: authorization
+    attributes:
+      label: Responsible-use confirmation
+      options:
+        - label: I am testing an application I own or am authorized to inspect, and I will not attach an IPA, certificate, or provisioning profile.
+          required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: IPAPatch-Lookin version
+      description: Run `./ipapatch-lookin --version`.
+      placeholder: "0.4.2"
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include macOS, Xcode, Mac architecture, destination type, and iOS version.
+      placeholder: |
+        macOS: 15.x
+        Xcode: 16.x
+        Mac: Apple silicon
+        Destination: physical iPhone / iPad or Simulator
+        iOS: 18.x
+    validations:
+      required: true
+
+  - type: textarea
+    id: ipa_metadata
+    attributes:
+      label: IPA metadata
+      description: Paste only the app name, platform, architectures, and cryptid from `./ipapatch-lookin inspect App.ipa`. Remove private paths and identifiers.
+      render: text
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Run ...
+        2. Open ...
+        3. Select ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior and logs
+      description: Redact usernames, local paths, device identifiers, team IDs, bundle identifiers, tokens, and signing material. Do not upload an IPA.
+      render: text
+    validations:
+      required: true
+
+  - type: dropdown
+    id: reproducibility
+    attributes:
+      label: Reproducibility
+      options:
+        - Every time
+        - Sometimes
+        - Once
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation and troubleshooting
+    url: https://github.com/jacklv-coder/IPAPatch-Lookin#troubleshooting
+    about: Check the requirements, platform notes, and common failure explanations first.
+  - name: Security vulnerability
+    url: https://github.com/jacklv-coder/IPAPatch-Lookin/security/advisories/new
+    about: Report security issues privately instead of opening a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Suggest an improvement to an authorized inspection workflow
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope confirmation
+      options:
+        - label: This request supports legitimate development, testing, or authorized inspection.
+          required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What workflow is difficult today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Do not attach proprietary applications, IPA files, signing material, or other sensitive data.

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+## Summary
+
+- Describe the user-visible change.
+- Explain why it is needed.
+
+## Validation
+
+- [ ] `xcrun swift test`
+- [ ] `sh -n ipapatch-lookin Tools/patch.sh Tools/verify_patch.sh`
+- [ ] `plutil -lint IPAPatch.xcodeproj/project.pbxproj`
+- [ ] `git diff --check`
+
+## Safety and compatibility
+
+- [ ] No IPA, certificate, provisioning profile, device identifier, or other sensitive material is included.
+- [ ] Existing `run`, direct-IPA, and `deploy` behavior remains compatible, or the change is documented.
+- [ ] Documentation and tests are updated when user-facing behavior changes.

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Test and validate
+    runs-on: macos-15
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Show toolchain versions
+        run: |
+          xcodebuild -version
+          xcrun swift --version
+
+      - name: Run Swift tests
+        # Foundation Process tests can leave Swift Testing's parallel runner
+        # waiting during shutdown on GitHub-hosted macOS runners.
+        run: xcrun swift test --no-parallel
+
+      - name: Validate shell scripts
+        run: sh -n ipapatch-lookin Tools/patch.sh Tools/verify_patch.sh
+
+      - name: Validate Xcode project
+        run: plutil -lint IPAPatch.xcodeproj/project.pbxproj

CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## IPAPatch-Lookin 0.4.2 — 2026-08-20
+
+First packaged release of the current IPAPatch-Lookin workflow.
+
+### Highlights
+
+- generate or reuse an isolated Xcode project for each byte-distinct IPA;
+- accept `./ipapatch-lookin App.ipa` as the primary project-generation command;
+- validate IPA encryption state, Mach-O platform, and architecture before use;
+- inject the pinned LookinServer 1.2.8 package;
+- support physical-device and compatible Simulator workflows;
+- redirect declared App Groups into the patched app's sandbox;
+- provide bilingual documentation and actionable project-ready output; and
+- cover the CLI, project generator, command runner, and Mach-O handling with
+  automated tests.
+
+The repository's `1.0` and `1.0.1` tags are historical tags inherited from the
+upstream IPAPatch project. Current IPAPatch-Lookin releases use the
+`ipapatch-lookin-v<version>` tag prefix to avoid ambiguity.

CONTRIBUTING.md

@@ -0,0 +1,39 @@
+# Contributing to IPAPatch-Lookin
+
+Thanks for helping improve IPAPatch-Lookin. Contributions should support
+applications that contributors own or are authorized to inspect.
+
+Never commit or attach IPA files, proprietary application code, signing
+certificates, provisioning profiles, device identifiers, Apple team IDs, or
+other secrets. Use synthetic fixtures and redact local paths and identifiers
+from logs.
+
+## Development
+
+Requirements:
+
+- macOS 13 or newer;
+- Xcode with its command-line tools selected; and
+- Swift 5.9 or newer.
+
+Run the local validation suite before opening a pull request:
+
+```sh
+xcrun swift test
+sh -n ipapatch-lookin Tools/patch.sh Tools/verify_patch.sh
+plutil -lint IPAPatch.xcodeproj/project.pbxproj
+git diff --check
+```
+
+Tests that need an IPA must use an application you own or are authorized to
+inspect. Do not add that IPA to the repository, an issue, or a pull request.
+
+## Pull requests
+
+Keep each pull request focused. Describe the user-visible behavior, list the
+validation performed, and update both `README.md` and `README.zh-CN.md` when a
+workflow or requirement changes.
+
+Bug fixes should include a regression test when practical. Changes to project
+generation should verify both a newly created project and reuse of an existing
+project.

README.md

@@ -1,5 +1,9 @@
 # IPAPatch-Lookin
 
+[![CI](https://github.com/jacklv-coder/IPAPatch-Lookin/actions/workflows/ci.yml/badge.svg)](https://github.com/jacklv-coder/IPAPatch-Lookin/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/jacklv-coder/IPAPatch-Lookin?display_name=tag)](https://github.com/jacklv-coder/IPAPatch-Lookin/releases/latest)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
 <p align="right">
   <strong>English</strong> | <a href="README.zh-CN.md">简体中文</a>
 </p>
@@ -37,14 +41,21 @@ documentation is preserved in [README_UPSTREAM.md](README_UPSTREAM.md).
 
 ## Quick start
 
-Clone the repository and point it at a decrypted IPA:
+Clone the repository over SSH and point it at a decrypted IPA:
 
 ```sh
 git clone git@github.com:jacklv-coder/IPAPatch-Lookin.git
 cd IPAPatch-Lookin
 ./ipapatch-lookin ~/Downloads/YourApp.ipa
 ```
 
+If you have not configured a GitHub SSH key, use the public HTTPS clone URL
+instead:
+
+```sh
+git clone https://github.com/jacklv-coder/IPAPatch-Lookin.git
+```
+
 The command prints a path such as
 `Projects/YourApp-a1b2c3d4e5f6/IPAPatch.xcodeproj`. Then:
 

README.zh-CN.md

@@ -1,5 +1,9 @@
 # IPAPatch-Lookin
 
+[![CI](https://github.com/jacklv-coder/IPAPatch-Lookin/actions/workflows/ci.yml/badge.svg)](https://github.com/jacklv-coder/IPAPatch-Lookin/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/jacklv-coder/IPAPatch-Lookin?display_name=tag)](https://github.com/jacklv-coder/IPAPatch-Lookin/releases/latest)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
 <p align="right">
   <a href="README.md">English</a> | <strong>简体中文</strong>
 </p>
@@ -34,14 +38,20 @@ IPA 与 Mach-O 校验、适配现代签名流程的清理、自动 App Group 重
 
 ## 快速开始
 
-克隆仓库，并传入一个已解密的 IPA：
+通过 SSH 克隆仓库，并传入一个已解密的 IPA：
 
 ```sh
 git clone git@github.com:jacklv-coder/IPAPatch-Lookin.git
 cd IPAPatch-Lookin
 ./ipapatch-lookin ~/Downloads/YourApp.ipa
 ```
 
+如果尚未配置 GitHub SSH Key，也可以使用公开的 HTTPS 地址克隆：
+
+```sh
+git clone https://github.com/jacklv-coder/IPAPatch-Lookin.git
+```
+
 该命令会输出类似
 `Projects/YourApp-a1b2c3d4e5f6/IPAPatch.xcodeproj` 的路径。然后：
 

SECURITY.md

@@ -0,0 +1,21 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are made on the `main` branch and included in the newest GitHub
+Release. Older snapshots and the historical upstream tags are not supported.
+
+## Reporting a vulnerability
+
+Please use GitHub's private vulnerability reporting form:
+
+https://github.com/jacklv-coder/IPAPatch-Lookin/security/advisories/new
+
+Do not open a public issue for an undisclosed vulnerability. Do not attach an
+IPA, certificate, provisioning profile, device identifier, signing material,
+or proprietary application code. Provide the smallest synthetic reproduction
+possible and redact local paths, bundle identifiers, and Apple account data.
+
+The maintainer will acknowledge a report when it is reviewed, coordinate any
+needed reproduction privately, and publish remediation details after a fix is
+available.

Sources/IPAPatchLookinCore/CommandRunner.swift

@@ -76,6 +76,12 @@ public enum CommandRunner {
         process.standardInput = FileHandle.standardInput
 
         try process.run()
+        if captureOutput {
+            // Process duplicates these descriptors for the child. Close the
+            // parent's copies so the readers observe EOF when the child exits.
+            outputPipe.fileHandleForWriting.closeFile()
+            errorPipe.fileHandleForWriting.closeFile()
+        }
 
         let readGroup = DispatchGroup()
         let capturedOutput = CapturedData()