Swift macOS DMG: classic drag-to-Applications layout (#5440)

## Summary
- switch DMG icon layout to match Finder-style drag/install UX
(Applications on left, app on right)
- remove `--skip-jenkins` so `create-dmg` applies background and icon
positioning in CI
- update DMG background arrow to a black left-pointing arrow

## Why
This makes the install action visually obvious in the DMG window and
matches the requested style.

Author: kodjima33

codemagic.yaml

@@ -2155,6 +2155,9 @@ workflows:
 
           # Write runtime .env from OMI_DESKTOP_APP_ENV secret (base64-encoded .env.app contents)
           echo "$OMI_DESKTOP_APP_ENV" | base64 --decode > "$APP_BUNDLE/Contents/Resources/.env"
+          # Never ship shared Anthropic API keys inside production app bundles.
+          # Anthropic access must come from backend or user OAuth mode.
+          sed -i '' '/^ANTHROPIC_API_KEY=/d' "$APP_BUNDLE/Contents/Resources/.env"
           echo "App bundle created: $APP_BUNDLE"
 
       - name: Sign app
@@ -2300,11 +2303,10 @@ workflows:
             --window-pos 200 120 \
             --window-size 610 365 \
             --icon-size 80 \
-            --icon "$APP_NAME.app" 155 175 \
+            --icon "$APP_NAME.app" 455 175 \
             --hide-extension "$APP_NAME.app" \
-            --app-drop-link 455 175 \
+            --app-drop-link 155 175 \
             --no-internet-enable \
-            --skip-jenkins \
             $BG_ARGS \
             "$DMG_PATH" \
             "$STAGING_DIR/$APP_NAME.app"

desktop/Desktop/Sources/AppState.swift

@@ -391,9 +391,11 @@ class AppState: ObservableObject {
     }
 
     private func loadEnvironment() {
+        let bundledEnvPath = Bundle.main.path(forResource: ".env", ofType: nil)
+
         // Try to load from .env file in various locations
         let envPaths = [
-            Bundle.main.path(forResource: ".env", ofType: nil),
+            bundledEnvPath,
             FileManager.default.currentDirectoryPath + "/.env",
             NSHomeDirectory() + "/.hartford.env",
             NSHomeDirectory() + "/.omi.env",
@@ -411,6 +413,10 @@ class AppState: ObservableObject {
                         let key = String(parts[0]).trimmingCharacters(in: .whitespaces)
                         // Skip comments
                         guard !key.hasPrefix("#") else { continue }
+                        if shouldSkipBundledAnthropicKey(key: key, sourcePath: path, bundledEnvPath: bundledEnvPath) {
+                            log("  Skipped ANTHROPIC_API_KEY from bundled .env (prod safety)")
+                            continue
+                        }
                         let value = String(parts[1]).trimmingCharacters(in: .whitespaces)
                             .trimmingCharacters(in: CharacterSet(charactersIn: "\"'"))
                         setenv(key, value, 1)
@@ -432,6 +438,14 @@ class AppState: ObservableObject {
         }
     }
 
+    private func shouldSkipBundledAnthropicKey(key: String, sourcePath: String, bundledEnvPath: String?) -> Bool {
+        guard key == "ANTHROPIC_API_KEY" else { return false }
+        guard let bundledEnvPath, sourcePath == bundledEnvPath else { return false }
+        let bundleId = Bundle.main.bundleIdentifier ?? ""
+        let isProductionBundle = bundleId == "com.omi.computer-macos"
+        return isProductionBundle
+    }
+
     func openScreenRecordingPreferences() {
         ScreenCaptureService.openScreenRecordingPreferences()
     }

desktop/Desktop/Sources/ProactiveAssistants/ProactiveAssistantsPlugin.swift

@@ -126,8 +126,9 @@ public class ProactiveAssistantsPlugin: NSObject {
     // MARK: - Environment Loading
 
     private func loadEnvironment() {
+        let bundledEnvPath = Bundle.main.path(forResource: ".env", ofType: nil)
         let envPaths = [
-            Bundle.main.path(forResource: ".env", ofType: nil),
+            bundledEnvPath,
             FileManager.default.currentDirectoryPath + "/.env",
             NSHomeDirectory() + "/.omi.env",
             NSHomeDirectory() + "/.hartford.env"
@@ -139,6 +140,9 @@ public class ProactiveAssistantsPlugin: NSObject {
                     let parts = line.split(separator: "=", maxSplits: 1)
                     if parts.count == 2 {
                         let key = String(parts[0]).trimmingCharacters(in: .whitespaces)
+                        if shouldSkipBundledAnthropicKey(key: key, sourcePath: path, bundledEnvPath: bundledEnvPath) {
+                            continue
+                        }
                         let value = String(parts[1]).trimmingCharacters(in: .whitespaces)
                             .trimmingCharacters(in: CharacterSet(charactersIn: "\"'"))
                         setenv(key, value, 1)
@@ -150,6 +154,13 @@ public class ProactiveAssistantsPlugin: NSObject {
         }
     }
 
+    private func shouldSkipBundledAnthropicKey(key: String, sourcePath: String, bundledEnvPath: String?) -> Bool {
+        guard key == "ANTHROPIC_API_KEY" else { return false }
+        guard let bundledEnvPath, sourcePath == bundledEnvPath else { return false }
+        let bundleId = Bundle.main.bundleIdentifier ?? ""
+        return bundleId == "com.omi.computer-macos"
+    }
+
     // MARK: - Assistant Management
 
     private func enableAssistant(identifier: String, enabled: Bool) {