@agfpd/iapeer 0.4.109 → 0.4.111

package/scripts/proof-install-signature.ts

@@ -0,0 +1,189 @@
+// Native artifact acceptance, NOT a host deploy. Run from the unpacked npm package:
+// bun scripts/proof-install-signature.ts [package-root]
+// Real CLI installer/compiler/codesign; launchd update seams are explicitly isolated.
+import { createHash } from 'crypto'
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs'
+import { homedir, tmpdir } from 'os'
+import { join, resolve } from 'path'
+import { spawnSync } from 'child_process'
+import { pathToFileURL } from 'url'
+
+if (process.platform !== 'darwin') throw new Error('native signature proof requires macOS')
+if (process.env.IAPEER_TEST_SANDBOX === '1') throw new Error('native proof must execute real codesign; run outside bun test')
+const identity = spawnSync('/usr/bin/security', ['find-identity', '-p', 'codesigning'], { encoding: 'utf8' })
+if (identity.status !== 0 || !identity.stdout.includes('"iapeer Local Codesign"')) {
+  throw new Error('proof requires the EXISTING local identity; it does not create one')
+}
+
+const pkg = resolve(process.argv[2] ?? join(import.meta.dir, '..'))
+const fromPackage = (path: string) => import(pathToFileURL(join(pkg, path)).href)
+const { installIapeer, rollbackIapeer, stampBinaryHealthy } = await fromPackage('src/install/index.ts')
+const { ensureExecutableSignature } = await fromPackage('src/install/signature.ts')
+const { updateIapeer } = await fromPackage('src/update/index.ts')
+const { installRuntimePackage } = await fromPackage('src/runtime/deploy.ts')
+const { updateRuntime } = await fromPackage('src/runtime/update.ts')
+const { writeRuntimeManifest, runtimeManifestPath } = await fromPackage('src/runtime/index.ts')
+const expectedVersion = JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8')).version
+const root = mkdtempSync(join(tmpdir(), 'iapeer-native-signature-'))
+const tools = join(root, 'tools')
+const faultyTools = join(root, 'faulty-tools')
+const tray = join(root, 'tray')
+for (const dir of [tools, faultyTools, tray, join(root, 'home')]) mkdirSync(dir, { recursive: true })
+const env = {
+  ...process.env,
+  HOME: join(root, 'home'),
+  IAPEER_ROOT: join(root, 'state'),
+  IAPEER_BIN_DIR: join(root, 'bin'),
+  IAPEER_LAUNCHAGENTS_DIR: join(root, 'LaunchAgents'),
+  IAPEER_SOCK_DIR: join(root, 'sockets'),
+  IAPEER_PROOF_SWIFTBAR_DIR: tray,
+  PATH: `${tools}:${process.env.PATH ?? ''}`,
+}
+// SwiftBar preferences are host-global even with HOME overridden. The stock install
+// discovers a pre-existing plugin dir through this isolated read-only defaults shim.
+writeFileSync(join(tools, 'defaults'), '#!/bin/sh\nif [ "$1" = read ]; then printf "%s\\n" "$IAPEER_PROOF_SWIFTBAR_DIR"; else echo "proof refuses defaults write" >&2; exit 71; fi\n', { mode: 0o755 })
+const quote = (s: string) => `'${s.replaceAll("'", "'\\''")}'`
+// A disposable HOME otherwise hides the existing login keychain from security.
+// Permit its read/sign operations on our staged files, but refuse identity imports.
+const hostHome = process.env.HOME || homedir()
+writeFileSync(join(tools, 'security'), `#!/bin/sh
+if [ "$1" != find-identity ]; then echo 'proof refuses keychain mutation' >&2; exit 71; fi
+export HOME=${quote(hostHome)}
+exec /usr/bin/security "$@"
+`, { mode: 0o755 })
+writeFileSync(join(tools, 'codesign'), `#!/bin/sh
+export HOME=${quote(hostHome)}
+exec /usr/bin/codesign "$@"
+`, { mode: 0o755 })
+// Fault only the compiler's OUTPUT, not signing or the installer. CLI execution is
+// forwarded to the real Bun; a build exits zero with a malformed staged Mach-O.
+writeFileSync(join(faultyTools, 'bun'), `#!/bin/sh
+if [ "$1" = build ]; then
+  while [ "$#" -gt 0 ]; do
+    if [ "$1" = --outfile ]; then shift; dd if="$IAPEER_BIN_DIR/iapeer" of="$1" bs=4096 count=1 2>/dev/null; chmod +x "$1"; exit 0; fi
+    shift
+  done
+  exit 72
+fi
+exec ${quote(process.execPath)} "$@"
+`, { mode: 0o755 })
+const faultyEnv = { ...env, PATH: `${faultyTools}:${env.PATH}` }
+const checks: string[] = []
+const check = (ok: boolean, label: string) => {
+  if (!ok) throw new Error(`FAIL: ${label}`)
+  checks.push(label)
+  console.log(`PASS: ${label}`)
+}
+const hash = (path: string) => createHash('sha256').update(readFileSync(path)).digest('hex')
+const installCli = (passedEnv = env) => {
+  const result = spawnSync('/bin/bash', [join(pkg, 'bin/iapeer'), 'install'], {
+    encoding: 'utf8', env: passedEnv, cwd: pkg, timeout: 180_000,
+  })
+  console.log(result.stdout)
+  if (result.stderr) console.log(result.stderr)
+  return result
+}
+const bin = join(env.IAPEER_BIN_DIR, 'iapeer')
+const execute = () => {
+  const result = spawnSync(bin, ['version'], { encoding: 'utf8', env, timeout: 30_000 })
+  check(result.status === 0 && result.stdout.trim() === expectedVersion, 'compiled binary executes expected version')
+}
+try {
+  let result = installCli()
+  check(result.status === 0 && result.stdout.includes('signing: signed'), 'stock CLI full-payload install succeeds with existing stable identity')
+  check(ensureExecutableSignature(bin, { env, repair: false }).state === 'verified', 'installed inode strictly verifies')
+  execute()
+  check(stampBinaryHealthy(env), 'isolated healthy stamp')
+  result = installCli()
+  check(result.status === 0, 'stock CLI reinstall succeeds')
+  check(stampBinaryHealthy(env), 'isolated healthy stamp after reinstall')
+  // Foundation has no runtime manifest; its binary/config pair is binary + daemon
+  // plist. Include rollback bytes and healthy stamp in every refusal comparison.
+  const paths = [bin, `${bin}.prev`, `${bin}.healthy`, join(env.IAPEER_LAUNCHAGENTS_DIR, 'com.agfpd.iapeer.plist')]
+  const snapshot = () => paths.map(hash)
+  const unchanged = (before: string[], label: string) => {
+    check(snapshot().every((v, i) => v === before[i]), label)
+    check(!existsSync(`${bin}.tmp`), 'rejected staged file removed')
+    execute()
+  }
+  const beforeRefusal = snapshot()
+  result = installCli(faultyEnv)
+  check(result.status !== null && result.status !== 0 && `${result.stdout}${result.stderr}`.includes('executable signature'), 'stock CLI rejects compiler output through REAL codesign')
+  unchanged(beforeRefusal, 'CLI refusal preserves binary/.prev/.healthy/daemon-plist byte-for-byte')
+
+  let restarted = 0
+  let recycled = 0
+  const update = (passedEnv: typeof env) => updateIapeer({
+    env: passedEnv, currentVersion: expectedVersion, force: true,
+    resolveVersion: () => expectedVersion,
+    runInstall: () => installCli(passedEnv).status === 0,
+    // No launchctl commands or real daemon health claims in native artifact proof.
+    restartDaemon: () => { restarted++; return { state: 'restarted' } },
+    waitHealthy: async () => ({ healthy: true }),
+    recycleInfraJobs: () => { recycled++; return [] },
+    stampHealthy: () => stampBinaryHealthy(env),
+  })
+  const failedUpdate = await update(faultyEnv)
+  check(failedUpdate.status === 'failed' && restarted === 0 && recycled === 0, 'update install refusal prevents ALL lifecycle activation calls')
+  unchanged(beforeRefusal, 'update refusal preserves binary/config/rollback pair')
+  const successfulUpdate = await update(env)
+  check(successfulUpdate.status === 'updated' && restarted === 1 && recycled === 1, 'real successful installer passes update activation gate (lifecycle seams isolated)')
+  check(ensureExecutableSignature(bin, { env, repair: false }).state === 'verified', 'updated inode strictly verifies')
+  execute()
+
+  const sameVersionEnv = { ...env, IAPEER_BIN_DIR: join(root, 'same-version-bin') }
+  mkdirSync(sameVersionEnv.IAPEER_BIN_DIR)
+  const sameVersionBin = join(sameVersionEnv.IAPEER_BIN_DIR, 'iapeer')
+  copyFileSync(bin, sameVersionBin)
+  const sameVersion = () => updateIapeer({
+    env: sameVersionEnv, currentVersion: expectedVersion, resolveVersion: () => expectedVersion,
+    liveDaemonVersion: () => expectedVersion,
+  })
+  check((await sameVersion()).status === 'already-latest', 'same-version foundation update passes REAL verify-only gate')
+  writeFileSync(sameVersionBin, Buffer.from([0xcf, 0xfa, 0xed, 0xfe]))
+  const invalidBefore = hash(sameVersionBin)
+  const invalidSameVersion = await updateIapeer({
+    env: sameVersionEnv, currentVersion: expectedVersion, resolveVersion: () => expectedVersion,
+    liveDaemonVersion: () => '0.0.0',
+    restartDaemon: () => { throw new Error('unexpected stale-daemon activation') },
+  })
+  check(invalidSameVersion.status === 'failed' && invalidSameVersion.reason.includes('signature'), 'invalid same-version foundation cannot activate stale-daemon recovery')
+  check(hash(sameVersionBin) === invalidBefore, 'foundation verify-only gate leaves installed bytes unchanged')
+
+  const tiny = join(root, 'tiny.ts')
+  writeFileSync(tiny, 'console.log("tiny-signature-proof")\n')
+  const beforeTiny = snapshot()
+  let tinyError: unknown
+  try { installIapeer(tiny, env) } catch (e) { tinyError = e }
+  if (tinyError) {
+    console.log(`INFO: real tiny-source build rejected: ${String(tinyError)}`)
+    unchanged(beforeTiny, 'real tiny-source refusal preserves binary/config/rollback pair')
+  } else {
+    console.log('INFO: tiny-source output is signable on this compiler; restoring full CLI')
+    check(installCli().status === 0, 'restore full CLI after signable tiny-source build')
+    check(stampBinaryHealthy(env), 'restored healthy stamp')
+  }
+
+  // Secondary core gate: real installed launcher signature, no provisioning or
+  // restart. A custom manifest also exercises package resolution outside the map.
+  const launcher = join(env.IAPEER_BIN_DIR, 'proof-runtime')
+  copyFileSync(bin, launcher)
+  writeRuntimeManifest({ runtime: 'proof', package: '@proof/runtime', version: '1.0.0', peers: [] }, { env })
+  const unexpected = () => { throw new Error('unexpected runtime install/restart') }
+  const runtimeEnv = { ...env, PATH: `${env.IAPEER_BIN_DIR}:${env.PATH}` }
+  check(installRuntimePackage({ runtime: 'proof', env: runtimeEnv, runNpx: unexpected }).state === 'skipped', 'already-installed runtime passes REAL verify-only gate')
+  check((await updateRuntime({ runtime: 'proof', env: runtimeEnv, npmVersion: () => '1.0.0', restartPeer: unexpected, runNpx: unexpected })).state === 'already-latest', 'already-latest runtime passes REAL verify-only gate')
+  const manifestPath = runtimeManifestPath('proof', { env })
+  writeFileSync(launcher, Buffer.from([0xcf, 0xfa, 0xed, 0xfe]))
+  const rejectedPair = [hash(launcher), hash(manifestPath)]
+  check(installRuntimePackage({ runtime: 'proof', env: runtimeEnv, runNpx: unexpected }).state === 'failed', 'already-installed runtime rejects invalid launcher')
+  check((await updateRuntime({ runtime: 'proof', env: runtimeEnv, npmVersion: () => '1.0.0', restartPeer: unexpected, runNpx: unexpected })).state === 'install-failed', 'already-latest runtime rejects invalid launcher before restart')
+  check(hash(launcher) === rejectedPair[0] && hash(manifestPath) === rejectedPair[1], 'verify-only runtime gate preserves supplied binary/manifest without repair')
+
+  check(rollbackIapeer(env).status === 'rolled-back', 'isolated foundation rollback succeeds')
+  check(ensureExecutableSignature(bin, { env, repair: false }).state === 'verified', 'rollback inode strictly verifies')
+  execute()
+  console.log(JSON.stringify({ version: expectedVersion, bun: Bun.version, platform: process.platform, packageRoot: pkg, checks, lifecycle: 'injected: no live restart or daemon-health claim' }, null, 2))
+} finally {
+  rmSync(root, { recursive: true, force: true })
+}

package/src/cli/index.ts

@@ -26,7 +26,15 @@ import { cascadeTail, recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaem
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { ensureGlobalIapScaffold } from '../storage/index.ts'
 import { findPeer, readPeersIndex, removePeer, type PeerRecord } from '../registry/index.ts'
-import { compactDoneBaseline, isPeerLive, routeControl, routeSend, waitForCompactDone, type WakeFn } from '../transport/index.ts'
+import {
+  compactDoneBaseline,
+  isPeerLive,
+  purgeAttachmentInbox,
+  routeControl,
+  routeSend,
+  waitForCompactDone,
+  type WakeFn,
+} from '../transport/index.ts'
 import {
   attachPeer,
   clearIdleReaped,
@@ -888,6 +896,9 @@ export interface RemoveOutcome {
    *  personality inherits the dead namesake's parking (defect: stale .stopped →
    *  `mode=refused cause=stopped` on a freshly-created peer). */
   purgedState?: string[]
+  /** Recipient-owned IAP attachment inbox cleanup. Completed attachment copies
+   *  are state for the peer lifetime, so explicit peer removal owns their purge. */
+  attachmentInbox?: string
 }
 
 /**
@@ -1039,11 +1050,19 @@ export async function removePeerCli(
   // remove never half-purges a still-registered peer.
   const cfg = loadLifecycleConfig(env)
   const purgedState = peer.runtimes.flatMap(rt => purgeIdentityState(cfg, buildProcessAddress(rt, personality)))
+  let attachmentInbox: string | undefined
+  try {
+    const purged = purgeAttachmentInbox(personality, env)
+    if (purged.removed) attachmentInbox = `removed ${purged.path}`
+  } catch (e) {
+    attachmentInbox = `FAILED: ${e instanceof Error ? e.message : String(e)}`
+  }
   return {
     personality,
     action: 'removed',
     cwd: peer.cwd,
     purgedState,
+    ...(attachmentInbox ? { attachmentInbox } : {}),
     ...(plistTeardown ? { plistTeardown } : {}),
     ...(unprovisionOutcomes.length ? { unprovision: unprovisionOutcomes } : {}),
     ...(trustCleaned ? { codexTrust: trustCleaned } : {}),
@@ -1916,8 +1935,8 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
       case 'update-runtime': {
         // §(г) runtime-package update: version-gate (npm vs the manifest stamp) →
         // forced re-npx → idempotent re-provision (same path as install-runtime) →
-        // restart the runtime's peers via the regular stop/start. The core's own
-        // `update` stays foundation-only — this is the runtimes' counterpart.
+        // restart the runtime's peers via the regular stop/start. A bare `update`
+        // calls the same updater as its runtime cascade leg.
         const all = flags.all === true
         if (!all && !positionals[0]) return argErr(errOut, 'update-runtime needs a runtime or --all — usage: iapeer update-runtime <runtime> | --all')
         const { updateRuntime, updateAllRuntimes } = await import('../runtime/update.ts')
@@ -2280,6 +2299,9 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           if (o.purgedState?.length) {
             out(`lifecycle state purged: ${o.purgedState.join(', ')}\n`)
           }
+          if (o.attachmentInbox) {
+            out(`attachment inbox: ${o.attachmentInbox}\n`)
+          }
           // Deliberate: the registry reap never deletes user data — but SAY so, or
           // the default-location peers leave silent orphan folders.
           if (o.cwd && existsSync(o.cwd)) {

package/src/daemon/fleet.ts

@@ -658,7 +658,13 @@ export function buildFleetHandler(opts: FleetHandlerOptions = {}): FleetHandler
           return sendJson(res, 400, { error: e instanceof Error ? e.message : String(e) })
         }
         if (typeof body.personality !== 'string' || !body.personality || typeof body.message !== 'string' || !body.message) {
-          return sendJson(res, 400, { error: 'send needs {personality, message} (+ optional runtime/topic/from)' })
+          return sendJson(res, 400, { error: 'send needs {personality, message} (+ optional runtime/topic/attachments/from)' })
+        }
+        if (
+          body.attachments !== undefined &&
+          (!Array.isArray(body.attachments) || !body.attachments.every(item => typeof item === 'string'))
+        ) {
+          return sendJson(res, 400, { error: 'send attachments must be an array of absolute local source-file paths' })
         }
         let caller: ResolvedCaller
         try {
@@ -676,6 +682,7 @@ export function buildFleetHandler(opts: FleetHandlerOptions = {}): FleetHandler
             runtime: typeof body.runtime === 'string' ? body.runtime : undefined,
             message: body.message,
             topic: typeof body.topic === 'string' ? body.topic : undefined,
+            attachments: Array.isArray(body.attachments) ? body.attachments : undefined,
           },
           ctx.deps,
         )

package/src/daemon/index.ts

@@ -163,7 +163,7 @@ export function listTools(): unknown[] {
           topic: { type: 'string', description: 'Optional short topic for threading related peer messages.', maxLength: MAX_TOPIC_LEN },
           attachments: {
             type: 'array',
-            description: 'Optional absolute local file paths. IAP delivers them as a separate <attachments> field, not as part of message text.',
+            description: 'Optional absolute local source-file paths. Before accepting the send, IAP copies each regular file into durable recipient-owned state and puts the copy paths in the separate <attachments> field; the sources may be deleted immediately after success.',
             maxItems: MAX_ATTACHMENTS,
             items: { type: 'string' },
           },

package/src/install/index.ts

@@ -20,6 +20,9 @@ import { basename, join, relative, sep } from 'path'
 import { spawnSync } from 'child_process'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { signInstalledBinary, type SigningOutcome } from './signing.ts'
+import { ensureExecutableSignature } from './signature.ts'
+export { ensureExecutableSignature } from './signature.ts'
+export type { ExecutableSignatureOptions, ExecutableSignatureOutcome, SignatureRunner } from './signature.ts'
 
 /** The stable host-wide install path of the `iapeer` binary. Standard user-bin (no
  *  admin, not tied to a node/bun version), ON $PATH. The launchd plists reference
@@ -42,8 +45,8 @@ export interface InstallResult {
   prevKept?: { reason: string }
   /** Bytes of the installed binary. */
   size?: number
-  /** Stable-identity re-sign outcome (TCC grants survive updates). Soft: a signing
-   *  hiccup never fails the install — the binary works ad-hoc-signed. */
+  /** Stable-identity re-sign outcome (TCC grants survive updates). Soft failure
+   *  is allowed only when the separate executable-signature gate succeeds. */
   signing?: SigningOutcome
 }
 
@@ -132,16 +135,38 @@ function assertInstallSandboxIsolated(binPath: string, env: NodeJS.ProcessEnv):
   }
 }
 
-export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = process.env): InstallResult {
+/** Hermetic install seams. Paths remain resolved from the caller's env. */
+export interface InstallIapeerDeps {
+  build?: (entry: string, tmp: string) => void
+  signStable?: typeof signInstalledBinary
+  verifySignature?: typeof ensureExecutableSignature
+}
+
+export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = process.env, deps: InstallIapeerDeps = {}): InstallResult {
   const binPath = iapeerBinPath(env)
   assertInstallSandboxIsolated(binPath, env)
   mkdirSync(join(binPath, '..'), { recursive: true })
   const tmp = `${binPath}.tmp`
-  const build = spawnSync('bun', ['build', '--compile', cliEntrypoint, '--outfile', tmp], {
-    encoding: 'utf8',
-  })
-  if (build.status !== 0 || !existsSync(tmp)) {
-    throw new Error(`iapeer build failed: ${(build.stderr ?? '').trim() || `exit ${build.status}`}`)
+  let signing: SigningOutcome
+  try {
+    if (deps.build) {
+      deps.build(cliEntrypoint, tmp)
+    } else {
+      const build = spawnSync('bun', ['build', '--compile', cliEntrypoint, '--outfile', tmp], {
+        encoding: 'utf8',
+      })
+      if (build.status !== 0 || !existsSync(tmp)) {
+        throw new Error(`iapeer build failed: ${(build.stderr ?? '').trim() || `exit ${build.status}`}`)
+      }
+    }
+    // Sign the STAGED inode, then verify before ANY activation/.prev/stamp change.
+    // Stable TCC signing remains soft; invalid executable signatures are hard.
+    signing = (deps.signStable ?? signInstalledBinary)(tmp, env)
+    const verifySignature = deps.verifySignature ?? ensureExecutableSignature
+    verifySignature(tmp, { env })
+  } catch (e) {
+    rmSync(tmp, { force: true })
+    throw e
   }
   let prevPath: string | undefined
   let prevKept: InstallResult['prevKept']
@@ -168,9 +193,7 @@ export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = pr
   } catch {
     /* absent — fine */
   }
-  // Stable-identity re-sign (TCC grants survive updates). AFTER the rename: the
-  // signature belongs to the final inode at the final path. Soft-fail by design.
-  const signing = signInstalledBinary(binPath, env)
+  // rename preserves the already-verified inode and its stable requirement.
   let size: number | undefined
   try {
     size = statSync(binPath).size
@@ -257,7 +280,7 @@ export interface RollbackResult {
  * rename over the binary), so the binary is never absent. The CALLER restarts the
  * daemon afterwards (cycleDaemon) — rollback only swaps the bytes. Sandbox-guarded.
  */
-export function rollbackIapeer(env: NodeJS.ProcessEnv = process.env): RollbackResult {
+export function rollbackIapeer(env: NodeJS.ProcessEnv = process.env, deps: Pick<InstallIapeerDeps, 'signStable' | 'verifySignature'> = {}): RollbackResult {
   const binPath = iapeerBinPath(env)
   assertInstallSandboxIsolated(binPath, env)
   const prev = iapeerPrevBinPath(env)
@@ -267,13 +290,15 @@ export function rollbackIapeer(env: NodeJS.ProcessEnv = process.env): RollbackRe
   const tmp = `${binPath}.rollback.tmp`
   try {
     copyFileSync(prev, tmp)
+    // Same staged gate as install: never publish an invalid rollback target.
+    const signStable = deps.signStable ?? signInstalledBinary
+    const verifySignature = deps.verifySignature ?? ensureExecutableSignature
+    signStable(tmp, env)
+    verifySignature(tmp, { env })
     renameSync(tmp, binPath)
-    // Keep the stable requirement on the restored bytes too (a .prev taken before
-    // the signing era is ad-hoc — re-signing it heals that). Soft by design.
-    signInstalledBinary(binPath, env)
   } catch (e) {
     try {
-      if (existsSync(tmp)) renameSync(tmp, `${tmp}.discard`) // never leave a half-written tmp on the path
+      rmSync(tmp, { force: true })
     } catch {
       /* best-effort */
     }

package/src/install/signature.ts

@@ -0,0 +1,94 @@
+// Lightweight package-facing activation gate. No keychain/TCC identity creation:
+// preserve a valid signature; repair only a trusted, installer-owned staged file.
+import { closeSync, fstatSync, openSync, readSync } from 'fs'
+import { spawnSync } from 'child_process'
+
+export interface SignatureRunner {
+  (command: string, args: string[], env: NodeJS.ProcessEnv): {
+    status: number | null
+    stdout?: string
+    stderr?: string
+  }
+}
+
+export interface ExecutableSignatureOptions {
+  env?: NodeJS.ProcessEnv
+  /** Default true for staged build artifacts. Use false for installed binaries. */
+  repair?: boolean
+  /** Test seams: injected runners may run under the sandbox; real codesign cannot. */
+  run?: SignatureRunner
+  platform?: NodeJS.Platform
+}
+
+export interface ExecutableSignatureOutcome {
+  state: 'verified' | 'repaired' | 'skipped-platform' | 'skipped-non-macho' | 'skipped-sandbox'
+}
+
+const MACH_O_MAGIC = new Set([
+  0xfeedface, 0xcefaedfe, 0xfeedfacf, 0xcffaedfe, // thin, 32/64-bit, either endianness
+  0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca, // universal, 32/64-bit
+])
+
+function executableKind(path: string): 'macho' | 'script' | 'unknown' {
+  const fd = openSync(path, 'r') // missing/unreadable artifact is a hard failure
+  try {
+    const magic = Buffer.alloc(4)
+    const length = readSync(fd, magic, 0, 4, 0)
+    if (length === 4 && MACH_O_MAGIC.has(magic.readUInt32BE(0))) {
+      const value = magic.readUInt32BE(0)
+      const headerSize = value === 0xfeedface || value === 0xcefaedfe ? 28
+        : value === 0xfeedfacf || value === 0xcffaedfe ? 32 : 8
+      // codesign can sign a magic-only stub as generic data using xattrs. That
+      // success is not evidence of a Mach-O executable: require its full header.
+      return fstatSync(fd).size >= headerSize ? 'macho' : 'unknown'
+    }
+    if (length >= 2 && magic[0] === 0x23 && magic[1] === 0x21) return 'script'
+    return 'unknown'
+  } finally {
+    closeSync(fd)
+  }
+}
+
+const defaultRunner: SignatureRunner = (command, args, env) => {
+  const r = spawnSync(command, args, { encoding: 'utf8', env, timeout: 30_000 })
+  return { status: r.error ? null : r.status, stdout: r.stdout ?? '', stderr: r.error?.message ?? r.stderr ?? '' }
+}
+
+/**
+ * macOS: strict verify → (if invalid and repair allowed) ad-hoc sign → strict verify.
+ * Throws on failure. Call AFTER compile/copy/chmod and BEFORE rename/manifest.
+ * Valid certificate-backed signatures stay byte-identical. Repair establishes
+ * signature validity, not provenance: never use it to trust arbitrary modified code.
+ */
+export function ensureExecutableSignature(
+  path: string,
+  opts: ExecutableSignatureOptions = {},
+): ExecutableSignatureOutcome {
+  if ((opts.platform ?? process.platform) !== 'darwin') return { state: 'skipped-platform' }
+  const env = opts.env ?? process.env
+  // Both flags count, so a caller cannot accidentally re-enable real commands by
+  // passing a sparse env. DI tests use their own runner, never the production one.
+  if (!opts.run && (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1')) {
+    return { state: 'skipped-sandbox' }
+  }
+  const kind = executableKind(path)
+  if (kind === 'script') return { state: 'skipped-non-macho' }
+  if (kind === 'unknown') throw new Error(`executable signature verification failed for ${path}: not a Mach-O executable or shebang launcher`)
+  const run = opts.run ?? defaultRunner
+  const verify = (): ReturnType<SignatureRunner> => run('/usr/bin/codesign', ['--verify', '--deep', '--strict', path], env)
+  const fail = (step: string, result: ReturnType<SignatureRunner>): never => {
+    const detail = result.stderr?.trim() || result.stdout?.trim() || `exit ${result.status}`
+    throw new Error(`executable signature ${step} failed for ${path}: ${detail}`)
+  }
+  const initial = verify()
+  if (initial.status === 0) return { state: 'verified' }
+  // A timeout/spawn error/signal is not evidence of an invalid signature. Do not
+  // rewrite code when the verification tool itself could not run to completion.
+  if (initial.status === null) fail('verification', initial)
+  if (opts.repair === false) fail('verification', initial)
+  const signed = run('/usr/bin/codesign', ['--force', '--sign', '-', path], env)
+  if (signed.status !== 0) fail('repair', signed)
+  const final = verify()
+  if (final.status !== 0) fail('verification after repair', final)
+  return { state: 'repaired' }
+}

package/src/install/signing.ts

@@ -16,9 +16,9 @@
 // bytes. Trust of the cert chain is NOT needed: codesign signs with an untrusted
 // (CSSMERR_TP_NOT_TRUSTED) identity fine, and TCC matches the requirement.
 //
-// Failure policy: SOFT. The binary works ad-hoc-signed exactly as before; a
-// signing hiccup must never break install/update. It is reported loud (the
-// operator learns TCC prompts will re-appear) but the install succeeds.
+// Stable-identity failure policy: SOFT. Executable signature validity is a
+// separate HARD gate (signature.ts) before activation; invalid Bun linker
+// signatures cannot be assumed runnable after a stable-signing failure.
 
 import { mkdtempSync, rmSync } from 'fs'
 import { tmpdir } from 'os'
@@ -63,7 +63,7 @@ export interface SigningOutcome {
     | 'signed' // re-signed with the existing identity
     | 'signed-new-identity' // identity created this run (the ONE install-time event), then signed
     | 'skipped-sandbox' // tests never touch the real keychain
-    | 'failed-soft' // signing failed — binary stays ad-hoc (works; TCC prompts return)
+    | 'failed-soft' // stable signing failed; the activation gate still decides executability
   detail?: string
 }
 
@@ -113,7 +113,7 @@ function createIdentity(run: SigningRunner): { ok: boolean; detail?: string } {
 
 /**
  * Re-sign the installed binary with the stable local identity (creating the
- * identity on first use). Called by installIapeer after the atomic rename —
+ * identity on first use). Called by installIapeer BEFORE the atomic rename —
  * i.e. on EVERY install/update path, so the designated requirement (and with it
  * every TCC grant) stays constant while the bytes change.
  */
@@ -131,7 +131,7 @@ export function signInstalledBinary(
   if (!identityPresent(run)) {
     const c = createIdentity(run)
     if (!c.ok) {
-      return { state: 'failed-soft', detail: `${c.detail} — binary stays ad-hoc-signed (works, but TCC prompts will re-appear after updates)` }
+      return { state: 'failed-soft', detail: `${c.detail} — stable TCC signing unavailable; executable signature must pass the activation gate (TCC prompts may re-appear after updates)` }
     }
     created = true
   }
@@ -139,7 +139,7 @@ export function signInstalledBinary(
   if (sign.status !== 0) {
     return {
       state: 'failed-soft',
-      detail: `codesign failed: ${sign.stderr.trim().split('\n')[0] ?? `exit ${sign.status}`} — binary stays ad-hoc-signed (works, but TCC prompts will re-appear after updates)`,
+      detail: `codesign failed: ${sign.stderr.trim().split('\n')[0] ?? `exit ${sign.status}`} — stable TCC signing unavailable; executable signature must pass the activation gate (TCC prompts may re-appear after updates)`,
     }
   }
   return created ? { state: 'signed-new-identity' } : { state: 'signed' }

package/src/launch/adapters/claude.ts

@@ -366,6 +366,13 @@ export const claudeAdapter: RuntimeAdapter = {
     if (pane.includes('Resume from summary') || pane.includes('Bypass Permissions mode')) {
       return /❯\s*2\./.test(pane) ? ['Enter'] : ['Down']
     }
+    // Folder-trust: older claude defaulted the cursor to "1. Yes, proceed", but 2.1.30x
+    // renders "❯ No, exit" / "Yes, I trust this folder" with the DEFAULT on exit — a bare
+    // Enter cleanly exits the peer (live: claude-boris child-exit 5s after first wake,
+    // 2026-10-17). Same discipline as Bypass: Enter only once the cursor is SEEN on Yes.
+    if (pane.includes('trust this folder') && /No,\s*exit/.test(pane)) {
+      return /❯\s*(?:\d\.\s*)?Yes\b/.test(pane) ? ['Enter'] : ['Down']
+    }
     if (
       pane.includes('trust this folder') ||
       pane.includes('Allow external CLAUDE.md file imports?') ||

package/src/launch/launchdRun.ts

@@ -162,7 +162,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     interrupt = null
   }
   // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher —
-  // kill the supervisor daemon (killPtyHost: SIGTERM → it SIGKILLs the child + cleans up sock/pid/serve)
+  // kill the supervisor daemon (SIGTERM → hard teardown of its PTY-owned tree + sock/pid/serve cleanup)
   // so the detached child does not outlive bootout holding stale in-memory state. A NATURAL death
   // (stop=false) skips this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
   if (stop) killPtyHost(identity, env)

package/src/launch/ptyHost.ts

@@ -45,7 +45,7 @@ export function hostSessionAlive(identity: string, env: NodeJS.ProcessEnv = proc
   return hostDaemonAlive(hostRunDir(env), identity)
 }
 
-/** Reap a hosted session: SIGTERM the supervisor daemon (its shutdown SIGKILLs the child + cleans up).
+/** Reap a hosted session: SIGTERM the supervisor daemon (hard-kills its PTY-owned tree + cleans up).
  *  env sandboxes the run-dir: a test with an injected root must NEVER SIGTERM a real fleet peer. */
 export function killPtyHost(identity: string, env: NodeJS.ProcessEnv = process.env): void {
   killSupervisorSession(hostRunDir(env), identity)

package/src/lifecycle/index.ts

@@ -1257,7 +1257,7 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
 // ─────────────────────────────────────────────────────────────────────────────
 
 export function killSession(_sock: string, identity: string, env: NodeJS.ProcessEnv = process.env): void {
-  // pty-only: SIGTERM the supervisor daemon — its shutdown SIGKILLs the child and removes the
+  // pty-only: SIGTERM the supervisor daemon — its shutdown kills the PTY-owned tree and removes the
   // sock/pid/serve-spec/markers. Idempotent if the session is already gone. (`_sock` retained for
   // call-site compatibility; no tmux sockets exist.) env sandboxes the run-dir — a test with an
   // injected root must NEVER SIGTERM a real fleet peer's supervisor.