@l22-io/orchard-mcp 0.3.2 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@l22-io/orchard-mcp",
-  "version": "0.3.2",
+  "version": "0.6.1",
   "description": "MCP server for Apple Calendar, Mail, Reminders, and Files on macOS using native EventKit",
   "publishConfig": {
     "access": "public"
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "npm run build:swift && npm run build:ts",
     "build:ts": "tsc && chmod 755 build/index.js",
-    "build:swift": "cd swift && swift build -c release -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __info_plist -Xlinker Sources/AppleBridge/Info.plist",
+    "build:swift": "cd swift && swift build -c release -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __info_plist -Xlinker Sources/AppleBridge/Info.plist && mkdir -p .build/AppleBridge.app/Contents/MacOS && cp .build/release/apple-bridge .build/AppleBridge.app/Contents/MacOS/apple-bridge && cp Sources/AppleBridge/Info.plist .build/AppleBridge.app/Contents/Info.plist && codesign --force --sign - .build/AppleBridge.app",
     "postinstall": "bash scripts/postinstall.sh",
     "prepublishOnly": "npm run build:ts && bash scripts/prepublish.sh",
     "dev": "tsc --watch",
@@ -33,7 +33,10 @@
     "build",
     "scripts/postinstall.sh",
     "swift/.build/AppleBridge.app",
-    "swift/Sources/AppleBridge/Info.plist"
+    "swift/.build/AppleBridge.app.sha256",
+    "swift/Package.swift",
+    "swift/Package.resolved",
+    "swift/Sources"
   ],
   "os": [
     "darwin"
@@ -51,15 +54,15 @@
   "author": "l22.io GmbH",
   "license": "MIT",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.24.0",
-    "zod": "^3.25.0"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.4.0"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.7.0"
+    "@types/node": "^25.0.0",
+    "tsx": "^4.21.0",
+    "typescript": "^6.0.0"
   }
 }

package/scripts/postinstall.sh

@@ -3,19 +3,88 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-APP_BUNDLE="$PROJECT_ROOT/swift/.build/AppleBridge.app"
+SWIFT_DIR="$PROJECT_ROOT/swift"
+APP_BUNDLE="$SWIFT_DIR/.build/AppleBridge.app"
+BRIDGE_BIN="$SWIFT_DIR/.build/release/apple-bridge"
+INFO_PLIST="$SWIFT_DIR/Sources/AppleBridge/Info.plist"
+SHASUM_FILE="$SWIFT_DIR/.build/AppleBridge.app.sha256"
+INNER_BIN="$APP_BUNDLE/Contents/MacOS/apple-bridge"
 
-# Skip on non-macOS (shouldn't happen due to os field, but be safe)
 if [ "$(uname)" != "Darwin" ]; then
     echo "[orchard-mcp] macOS required. Skipping postinstall."
     exit 0
 fi
 
-# Re-sign the .app bundle (ad-hoc signatures may not survive npm packaging)
-if [ -d "$APP_BUNDLE" ]; then
-    echo "[orchard-mcp] Codesigning AppleBridge.app..."
+build_from_source() {
+    echo "[orchard-mcp] Swift detected -- building apple-bridge from source."
+    (
+        cd "$SWIFT_DIR"
+        swift build -c release \
+            -Xlinker -sectcreate \
+            -Xlinker __TEXT \
+            -Xlinker __info_plist \
+            -Xlinker "$INFO_PLIST"
+    )
+    mkdir -p "$APP_BUNDLE/Contents/MacOS"
+    cp "$BRIDGE_BIN" "$INNER_BIN"
+    cp "$INFO_PLIST" "$APP_BUNDLE/Contents/Info.plist"
     codesign --force --sign - "$APP_BUNDLE" 2>/dev/null || true
-    echo "[orchard-mcp] Ready. Run 'orchard-mcp setup' to configure permissions."
-else
-    echo "[orchard-mcp] Warning: AppleBridge.app not found. Run 'orchard-mcp setup' to build it."
+    echo "[orchard-mcp] Built from source. Run 'orchard-mcp setup' to configure permissions."
+}
+
+verify_prebuilt() {
+    # Defence-in-depth for the prebuilt fallback: compare the binary's hash
+    # against the shipped manifest. This catches truncated/corrupted tarball
+    # extraction but does NOT defend against a coordinated tarball tamper
+    # (attacker would update both files). For a real chain of trust, install
+    # with `npm install --ignore-scripts` and build from source, or wait for
+    # a Developer ID signed release.
+    if [ ! -f "$SHASUM_FILE" ]; then
+        echo "[orchard-mcp] Warning: no checksum manifest shipped; skipping integrity check."
+        return 0
+    fi
+    if [ ! -f "$INNER_BIN" ]; then
+        return 1
+    fi
+    local expected actual
+    expected=$(awk '{print $1}' "$SHASUM_FILE")
+    actual=$(shasum -a 256 "$INNER_BIN" | awk '{print $1}')
+    if [ "$expected" != "$actual" ]; then
+        echo "[orchard-mcp] ERROR: Binary checksum mismatch."
+        echo "             expected: $expected"
+        echo "             actual:   $actual"
+        echo "             The prebuilt binary may be corrupted or tampered with."
+        echo "             Install Xcode Command Line Tools (xcode-select --install)"
+        echo "             and reinstall to build from source instead."
+        return 2
+    fi
+    echo "[orchard-mcp] Prebuilt binary checksum ok: $actual"
+    return 0
+}
+
+if command -v swift >/dev/null 2>&1; then
+    build_from_source
+    exit 0
 fi
+
+echo "[orchard-mcp] Swift not available -- using prebuilt binary."
+echo "             Install Xcode Command Line Tools for a higher-assurance"
+echo "             install that builds apple-bridge locally."
+
+if [ ! -d "$APP_BUNDLE" ]; then
+    echo "[orchard-mcp] Warning: AppleBridge.app not found and Swift is unavailable."
+    echo "             Install Xcode Command Line Tools and run 'orchard-mcp setup'."
+    exit 0
+fi
+
+set +e
+verify_prebuilt
+status=$?
+set -e
+if [ $status -eq 2 ]; then
+    exit 1
+fi
+
+echo "[orchard-mcp] Codesigning prebuilt AppleBridge.app..."
+codesign --force --sign - "$APP_BUNDLE" 2>/dev/null || true
+echo "[orchard-mcp] Ready. Run 'orchard-mcp setup' to configure permissions."

package/swift/.build/AppleBridge.app.sha256

@@ -0,0 +1 @@
+853d524532c723fcd5c9f0c00a5895e3b384653a6d0b3e39c85e655bb4034602  apple-bridge

package/swift/Package.resolved

@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "swift-argument-parser",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-argument-parser.git",
+      "state" : {
+        "revision" : "626b5b7b2f45e1b0b1c6f4a309296d1d21d7311b",
+        "version" : "1.7.1"
+      }
+    }
+  ],
+  "version" : 2
+}

package/swift/Package.swift

@@ -0,0 +1,28 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+    name: "apple-bridge",
+    platforms: [
+        .macOS(.v14)
+    ],
+    dependencies: [
+        .package(url: "https://github.com/apple/swift-argument-parser.git", from: "1.7.1")
+    ],
+    targets: [
+        .executableTarget(
+            name: "apple-bridge",
+            dependencies: [
+                .product(name: "ArgumentParser", package: "swift-argument-parser")
+            ],
+            path: "Sources/AppleBridge",
+            exclude: ["Info.plist"],
+            linkerSettings: [
+                .linkedFramework("EventKit"),
+                .linkedFramework("Foundation"),
+                .linkedFramework("PDFKit"),
+                .linkedFramework("Vision")
+            ]
+        )
+    ]
+)