docs: document macOS menu bar app download and first-run TCC prompts

- Add RttysAgent.zip as the recommended macOS agent in the download table
- Explain signing/notarization and Sparkle auto-update in one paragraph
- Warn about first-run macOS privacy prompts for Documents/Desktop/Downloads
  and point to Full Disk Access as a one-shot alternative
- Mention agent-mac/ in the project structure

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: finch-xu

README.md

@@ -108,13 +108,18 @@ Go to the [Releases](https://github.com/finchxu/RemoteTTYs/releases) page and do
 
 | Platform | File |
 |----------|------|
-| macOS (Apple Silicon) | `rttys-agent-macOS-arm64` |
-| macOS (Intel) | `rttys-agent-macOS-x64` |
+| **macOS menu bar app (recommended)** ⭐ | `RttysAgent.zip` |
+| macOS CLI (Apple Silicon) | `rttys-agent-macOS-arm64` |
+| macOS CLI (Intel) | `rttys-agent-macOS-x64` |
 | Linux (x86_64) | `rttys-agent-Linux-x64` |
 | Linux (ARM64) | `rttys-agent-Linux-arm64` |
 | Windows (x86_64) | `rttys-agent-Windows-x64.exe` |
 
-**macOS / Linux:**
+**macOS menu bar app:** unzip and drag `RttysAgent.app` to `/Applications`. Launching it adds a menu bar icon with live connection status, log viewer, and a built-in config editor — no terminal commands needed. Universal binary (arm64 + x86_64), Developer ID signed, notarized, and self-updates via [Sparkle](https://sparkle-project.org/). If you install the app, skip sections 2–3 below and configure via the menu bar UI instead.
+
+> **First-run permission prompts:** The first time a terminal session reaches into a protected folder (e.g. `~/Documents`, `~/Desktop`, `~/Downloads`, or iCloud Drive), macOS will show a system dialog like *"RttysAgent would like to access files in your Documents folder"*. Click **Allow** — this is macOS's standard TCC privacy mechanism, not an issue with the app, and each folder only asks once. To grant access to everything up front, add RttysAgent under **System Settings → Privacy & Security → Full Disk Access**.
+
+**macOS / Linux CLI:**
 
 ```bash
 chmod +x rttys-agent-*
@@ -274,7 +279,8 @@ cd agent && go vet ./...
 
 ```
 remotettys/
-├── agent/              # Go — local agent binary
+├── agent/              # Go — local agent binary (cross-platform CLI)
+├── agent-mac/          # Swift — macOS menu bar app wrapping the Go agent
 ├── packages/
 │   ├── relay/          # TypeScript — WebSocket relay + REST API
 │   └── web/            # React + Vite — browser terminal UI

README.zh-CN.md

@@ -108,13 +108,18 @@ Agent 是一个单文件 Go 二进制，运行在你的本地机器上。
 
 | 平台 | 文件名 |
 |------|--------|
-| macOS (Apple Silicon) | `rttys-agent-macOS-arm64` |
-| macOS (Intel) | `rttys-agent-macOS-x64` |
+| **macOS 菜单栏应用（推荐）** ⭐ | `RttysAgent.zip` |
+| macOS CLI (Apple Silicon) | `rttys-agent-macOS-arm64` |
+| macOS CLI (Intel) | `rttys-agent-macOS-x64` |
 | Linux (x86_64) | `rttys-agent-Linux-x64` |
 | Linux (ARM64) | `rttys-agent-Linux-arm64` |
 | Windows (x86_64) | `rttys-agent-Windows-x64.exe` |
 
-**macOS / Linux：**
+**macOS 菜单栏应用：** 解压后把 `RttysAgent.app` 拖进 `/Applications`。启动后顶部菜单栏会出现状态图标，提供连接状态显示、日志查看和内置配置编辑器 — 全程无需终端命令。通用二进制（arm64 + x86_64），Developer ID 签名并经 Apple 公证，内置 [Sparkle](https://sparkle-project.org/) 自动更新。使用菜单栏应用时，下方第 2、3 步可跳过，直接在菜单栏 UI 中完成配置。
+
+> **首次使用权限提示：** 当终端会话首次访问 `~/Documents`、`~/Desktop`、`~/Downloads` 或 iCloud Drive 等受保护目录时，macOS 会弹出类似 *"RttysAgent 想访问您"文稿"文件夹中的文件"* 的系统提示。点击 **允许** 即可 — 这是 macOS 的 TCC 隐私保护机制，并非应用本身的问题，每个目录只会询问一次。若想一次性授权所有路径，可在 **系统设置 → 隐私与安全性 → 完全磁盘访问权限** 中添加 RttysAgent。
+
+**macOS / Linux CLI：**
 
 ```bash
 chmod +x rttys-agent-*
@@ -274,7 +279,8 @@ cd agent && go vet ./...
 
 ```
 remotettys/
-├── agent/              # Go — 本地 Agent 二进制
+├── agent/              # Go — 本地 Agent 二进制（跨平台 CLI）
+├── agent-mac/          # Swift — macOS 菜单栏应用，封装 Go Agent
 ├── packages/
 │   ├── relay/          # TypeScript — WebSocket 中继 + REST API
 │   └── web/            # React + Vite — 浏览器终端 UI