@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/resolve-icons.test.js

@@ -43,15 +43,15 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           fakePng(path.join(emDefaultsRoot, 'icons', 'windows', 'icon.png'));
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(out.macos.app).toBe(path.join(distRoot, 'config', 'icons', 'macos', 'icon.png'));
+          ctx.expect(out.mac.app).toBe(path.join(distRoot, 'config', 'icons', 'mac', 'icon.png'));
           ctx.expect(out.windows.app).toBe(path.join(distRoot, 'config', 'icons', 'windows', 'icon.png'));
-          ctx.expect(jetpack.exists(out.macos.app)).toBeTruthy();
+          ctx.expect(jetpack.exists(out.mac.app)).toBeTruthy();
           ctx.expect(jetpack.exists(out.windows.app)).toBeTruthy();
         } finally {
           fs.rmSync(root, { recursive: true, force: true });
@@ -63,15 +63,15 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
-          const consumerIcon = path.join(projectRoot, 'config', 'icons', 'macos', 'icon.png');
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
+          const consumerIcon = path.join(projectRoot, 'config', 'icons', 'mac', 'icon.png');
           fakePng(consumerIcon);
           fs.writeFileSync(consumerIcon, Buffer.from('consumer-bytes'));
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          const bytes = fs.readFileSync(out.macos.app);
+          const bytes = fs.readFileSync(out.mac.app);
           ctx.expect(bytes.toString()).toBe('consumer-bytes');
         } finally {
           fs.rmSync(root, { recursive: true, force: true });
@@ -84,7 +84,7 @@ module.exports = defineCases({
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
           // Bundled defaults exist for all three platforms — but consumer-global wins.
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           fakePng(path.join(emDefaultsRoot, 'icons', 'windows', 'icon.png'));
 
           // Consumer ships ONE file at the global path. All three platforms pick it up.
@@ -95,7 +95,7 @@ module.exports = defineCases({
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          for (const platform of ['macos', 'windows', 'linux']) {
+          for (const platform of ['mac', 'windows', 'linux']) {
             ctx.expect(out[platform].app).toBeDefined();
             const bytes = fs.readFileSync(out[platform].app);
             ctx.expect(bytes.toString()).toBe('global-bytes');
@@ -118,14 +118,14 @@ module.exports = defineCases({
           fs.writeFileSync(globalIcon, Buffer.from('global-bytes'));
 
           // Mac-specific override exists — should win for macOS.
-          const macIcon = path.join(projectRoot, 'config', 'icons', 'macos', 'icon.png');
+          const macIcon = path.join(projectRoot, 'config', 'icons', 'mac', 'icon.png');
           fakePng(macIcon);
           fs.writeFileSync(macIcon, Buffer.from('mac-specific-bytes'));
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(fs.readFileSync(out.macos.app).toString()).toBe('mac-specific-bytes');
+          ctx.expect(fs.readFileSync(out.mac.app).toString()).toBe('mac-specific-bytes');
           ctx.expect(fs.readFileSync(out.windows.app).toString()).toBe('global-bytes');
           ctx.expect(fs.readFileSync(out.linux.app).toString()).toBe('global-bytes');
         } finally {
@@ -200,37 +200,37 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           // Input source files at retina (native) size. @omega.js/desktop should emit both @1x + @2x in dist.
           // Tray input is `tray.png`; @omega.js/desktop renames the dist output to `trayTemplate.png` (macOS magic).
-          await realPng(path.join(emDefaultsRoot, 'icons', 'macos', 'tray.png'), 32, 32);
-          await realPng(path.join(emDefaultsRoot, 'icons', 'macos', 'dmg.png'), 1080, 760);
+          await realPng(path.join(emDefaultsRoot, 'icons', 'mac', 'tray.png'), 32, 32);
+          await realPng(path.join(emDefaultsRoot, 'icons', 'mac', 'dmg.png'), 1080, 760);
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
           // Both @1x and @2x slots populated.
-          ctx.expect(out.macos.tray).toBeDefined();
-          ctx.expect(out.macos.tray2x).toBeDefined();
-          ctx.expect(out.macos.dmg).toBeDefined();
-          ctx.expect(out.macos.dmg2x).toBeDefined();
+          ctx.expect(out.mac.tray).toBeDefined();
+          ctx.expect(out.mac.tray2x).toBeDefined();
+          ctx.expect(out.mac.dmg).toBeDefined();
+          ctx.expect(out.mac.dmg2x).toBeDefined();
           // app slot has no retina flag.
-          ctx.expect(out.macos.app2x).toBeUndefined();
+          ctx.expect(out.mac.app2x).toBeUndefined();
 
           // Tray output filename is trayTemplate.png (renamed for macOS auto-inversion magic).
-          ctx.expect(path.basename(out.macos.tray)).toBe('trayTemplate.png');
-          ctx.expect(path.basename(out.macos.tray2x)).toBe('trayTemplate@2x.png');
+          ctx.expect(path.basename(out.mac.tray)).toBe('trayTemplate.png');
+          ctx.expect(path.basename(out.mac.tray2x)).toBe('trayTemplate@2x.png');
 
           // @1x derived at half the @2x dimensions.
-          const tray1xMeta = await sharp(out.macos.tray).metadata();
-          const tray2xMeta = await sharp(out.macos.tray2x).metadata();
+          const tray1xMeta = await sharp(out.mac.tray).metadata();
+          const tray2xMeta = await sharp(out.mac.tray2x).metadata();
           ctx.expect(tray1xMeta.width).toBe(16);
           ctx.expect(tray1xMeta.height).toBe(16);
           ctx.expect(tray2xMeta.width).toBe(32);
           ctx.expect(tray2xMeta.height).toBe(32);
 
-          const dmg1xMeta = await sharp(out.macos.dmg).metadata();
-          const dmg2xMeta = await sharp(out.macos.dmg2x).metadata();
+          const dmg1xMeta = await sharp(out.mac.dmg).metadata();
+          const dmg2xMeta = await sharp(out.mac.dmg2x).metadata();
           ctx.expect(dmg1xMeta.width).toBe(540);
           ctx.expect(dmg1xMeta.height).toBe(380);
           ctx.expect(dmg2xMeta.width).toBe(1080);
@@ -245,20 +245,20 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
-          await realPng(path.join(emDefaultsRoot, 'icons', 'macos', 'tray.png'), 32, 32);
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
+          await realPng(path.join(emDefaultsRoot, 'icons', 'mac', 'tray.png'), 32, 32);
           // Consumer ships ONE file as `tray.png` (at @2x native size).
-          const consumerTray = path.join(projectRoot, 'config', 'icons', 'macos', 'tray.png');
+          const consumerTray = path.join(projectRoot, 'config', 'icons', 'mac', 'tray.png');
           await realPng(consumerTray, 32, 32);
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(out.macos.tray).toBeDefined();
-          ctx.expect(out.macos.tray2x).toBeDefined();
+          ctx.expect(out.mac.tray).toBeDefined();
+          ctx.expect(out.mac.tray2x).toBeDefined();
           // Output is still trayTemplate.png regardless of input name.
-          ctx.expect(path.basename(out.macos.tray)).toBe('trayTemplate.png');
-          const tray1xMeta = await sharp(out.macos.tray).metadata();
+          ctx.expect(path.basename(out.mac.tray)).toBe('trayTemplate.png');
+          const tray1xMeta = await sharp(out.mac.tray).metadata();
           ctx.expect(tray1xMeta.width).toBe(16);
         } finally {
           fs.rmSync(root, { recursive: true, force: true });
@@ -270,7 +270,7 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           fakePng(path.join(emDefaultsRoot, 'icons', 'windows', 'icon.png'));
 
           // Consumer ships ONE tray file under global/.
@@ -279,13 +279,13 @@ module.exports = defineCases({
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(out.macos.tray).toBeDefined();
-          ctx.expect(out.macos.tray2x).toBeDefined();
+          ctx.expect(out.mac.tray).toBeDefined();
+          ctx.expect(out.mac.tray2x).toBeDefined();
           ctx.expect(out.windows.tray).toBeDefined();
           ctx.expect(out.linux.tray).toBeDefined();
 
           // macOS @1x derived at half size from the global @2x source.
-          const macTrayMeta = await sharp(out.macos.tray).metadata();
+          const macTrayMeta = await sharp(out.mac.tray).metadata();
           ctx.expect(macTrayMeta.width).toBe(16);
         } finally {
           fs.rmSync(root, { recursive: true, force: true });

package/dist/test/suites/build/runner-job-guard.test.js

@@ -0,0 +1,182 @@
+// The self-hosted signer's job guard
+// ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): the hook the
+// runner runs before a job's first step, and the three files the runner install
+// writes beside the runner so it has an allow list to read.
+//
+// The hook is run here the way the runner runs it (a node process with the
+// job's environment and nothing else), because the EXIT CODE is the whole
+// mechanism: nonzero and the job dies with the script's output, before the
+// checkout, before npm, before signtool ever sees the token.
+//
+// Nothing in this file touches a real box: every write goes to a scratch home
+// under the OS temp dir, and no verb of `commands/runner.js` is called at all.
+
+const path = require('path');
+const fs   = require('fs');
+const os   = require('os');
+const { spawnSync } = require('child_process');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const guard = require('../../../utils/runner-job-guard.js');
+const hook  = require('../../../runner/job-started.js');
+const { ensureRunnerDirEnv } = require('../../../utils/runner-env.js');
+
+const scratchHome = () => fs.mkdtempSync(path.join(os.tmpdir(), 'omega-job-guard-'));
+
+// One job, as the runner delivers it: the three names the hook reads, and no
+// inherited GITHUB_* (a run of this suite inside a job carries its own).
+function runHook(hookPath, job) {
+  return spawnSync(process.execPath, [hookPath], {
+    env: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot || '', ...job },
+    encoding: 'utf8',
+  });
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'runner job guard (#875): the box refuses any job that is not a trusted dispatch',
+  tests: [
+    {
+      name: 'a dispatch from a listed repo by a listed actor is allowed, and every other job is refused with one line naming the check and the value',
+      run: (ctx) => {
+        const home = scratchHome();
+        const { hook: hookPath } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The passing case, on the ONE trusted event (#923).
+        const ok = runHook(hookPath, { GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' });
+        ctx.expect(ok.status).toBe(0);
+        ctx.expect(ok.stdout.trim()).toBe('Allowing this job: workflow_dispatch on Omega-JS-Stack/omega-omega by ianwieds.');
+
+        // Each failing check: nonzero, and ONE line carrying the env name that
+        // failed and the value seen.
+        const cases = [
+          [{ GITHUB_EVENT_NAME: 'pull_request', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_EVENT_NAME', 'pull_request'],
+          [{ GITHUB_EVENT_NAME: 'repository_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_EVENT_NAME', 'repository_dispatch'],
+          [{ GITHUB_EVENT_NAME: 'push', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_EVENT_NAME', 'push'],
+          [{ GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'someone-else/their-app', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_REPOSITORY', 'someone-else/their-app'],
+          [{ GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'mallory' }, 'GITHUB_ACTOR', 'mallory'],
+        ];
+
+        for (const [job, name, value] of cases) {
+          const refused = runHook(hookPath, job);
+          ctx.expect(refused.status).toBe(1);
+          ctx.expect(refused.stdout.trim().split('\n').length).toBe(1);
+          ctx.expect(refused.stdout).toContain(name);
+          ctx.expect(refused.stdout).toContain(value);
+        }
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'a job with no environment at all is refused, and so is one whose allow list is missing',
+      run: (ctx) => {
+        const home = scratchHome();
+        const { hook: hookPath, repos } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The runner always sets these; a hook run without them is a hook run
+        // that cannot answer the question, which is a refusal.
+        ctx.expect(runHook(hookPath, {}).status).toBe(1);
+
+        // An allow list that is not there allows nothing: the guard never opens
+        // the box up by failing to read its own configuration.
+        fs.rmSync(repos, { force: true });
+        const refused = runHook(hookPath, { GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' });
+        ctx.expect(refused.status).toBe(1);
+        ctx.expect(refused.stdout).toContain('allowed-repos.txt');
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'the allow list reads `owner/*` and single repos alike, case-insensitively, and comments and blanks are not entries',
+      run: (ctx) => {
+        const lists = { repos: ['Omega-JS-Stack/*', 'other-org/one-app'], actors: ['ianwieds'], reposFile: 'allowed-repos.txt', actorsFile: 'allowed-actors.txt' };
+        const dispatch = (repository) => hook.checkJob({ GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: repository, GITHUB_ACTOR: 'IanWieds' }, lists).allowed;
+
+        ctx.expect(dispatch('omega-js-stack/anything')).toBe(true);
+        ctx.expect(dispatch('other-org/one-app')).toBe(true);
+        ctx.expect(dispatch('other-org/another-app')).toBe(false);
+        // `owner/*` is one owner, never a prefix of another owner's name.
+        ctx.expect(dispatch('Omega-JS-Stack-evil/app')).toBe(false);
+
+        const home = scratchHome();
+        const file = path.join(home, 'allowed-repos.txt');
+        fs.writeFileSync(file, '# a comment\n\n  Omega-JS-Stack/omega-omega  # trailing\n');
+        ctx.expect(hook.readList(file)).toEqual(['Omega-JS-Stack/omega-omega']);
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'the setup writes the hook and both allow lists beside the runner, and rerunning writes the same bytes',
+      run: (ctx) => {
+        const home = scratchHome();
+        const first = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        ctx.expect(first.hook).toBe(path.join(home, 'job-started.js'));
+        ctx.expect(first.repos).toBe(path.join(home, 'allowed-repos.txt'));
+        ctx.expect(first.actors).toBe(path.join(home, 'allowed-actors.txt'));
+        ctx.expect(first.added.repos).toEqual(['Omega-JS-Stack/*']);
+        ctx.expect(first.added.actors).toEqual(['ianwieds']);
+
+        // The hook on the box is this package's file, so a framework update
+        // reaches the box on its next install or start.
+        ctx.expect(fs.readFileSync(first.hook, 'utf8')).toBe(fs.readFileSync(path.join(__dirname, '..', '..', '..', 'runner', 'job-started.js'), 'utf8'));
+
+        const bytes = () => [first.hook, first.repos, first.actors].map((file) => fs.readFileSync(file, 'utf8'));
+        const before = bytes();
+        const again = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+        ctx.expect(again.added).toEqual({ repos: [], actors: [] });
+        ctx.expect(bytes()).toEqual(before);
+
+        // A second org registered later gets its line; the first one is not
+        // duplicated and the file the operator reads keeps its header.
+        const third = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack', 'ITW-Creative-Works'], actor: 'ianwieds' });
+        ctx.expect(third.added.repos).toEqual(['ITW-Creative-Works/*']);
+        ctx.expect(hook.readList(third.repos)).toEqual(['Omega-JS-Stack/*', 'ITW-Creative-Works/*']);
+        ctx.expect(fs.readFileSync(third.repos, 'utf8').startsWith('# The repositories this box will sign for')).toBe(true);
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'an allow list narrowed by hand is never widened back by a later setup',
+      run: (ctx) => {
+        const home = scratchHome();
+        const { repos } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The operator narrows the org wildcard to the one repo that signs.
+        fs.writeFileSync(repos, '# mine\nOmega-JS-Stack/omega-omega\n');
+        const again = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        ctx.expect(again.added.repos).toEqual([]);
+        ctx.expect(hook.readList(repos)).toEqual(['Omega-JS-Stack/omega-omega']);
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: "the hook path reaches the listener through the runner dir's own .env, beside HOME",
+      run: (ctx) => {
+        const home = scratchHome();
+        const runnerDir = path.join(home, 'actions-runner-omega-js-stack');
+        const { hook: hookPath } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The file GitHub documents for runner env, which the listener reads at
+        // startup and applies to every job: the same one the private HOME
+        // travels in (#807), written once for both.
+        const file = ensureRunnerDirEnv(runnerDir, { HOME: path.join(home, 'home'), ACTIONS_RUNNER_HOOK_JOB_STARTED: hookPath });
+        const lines = fs.readFileSync(file, 'utf8').trim().split(/\r?\n/);
+
+        ctx.expect(lines).toContain(`ACTIONS_RUNNER_HOOK_JOB_STARTED=${hookPath}`);
+        ctx.expect(lines).toContain(`HOME=${path.join(home, 'home')}`);
+        // Bare, never quoted: the listener takes the rest of the line verbatim.
+        ctx.expect(fs.readFileSync(file, 'utf8')).not.toContain('"');
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+  ],
+});

package/dist/test/suites/build/runner.test.js

@@ -1155,11 +1155,23 @@ module.exports = defineCases({
           jetpack.write(path.join(home, 'actions-runner-foo', 'config.cmd'), 'rem foo');
           jetpack.write(path.join(home, '_template', 'config.cmd'), 'rem template');
 
+          // The job guard's allow lists are configuration too
+          // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): a list
+          // narrowed by hand outlives an uninstall exactly as the `.env` does.
+          // The hook SCRIPT is install state, and the next install writes it back.
+          jetpack.write(path.join(home, 'allowed-repos.txt'), 'Omega-JS-Stack/omega-omega\n');
+          jetpack.write(path.join(home, 'allowed-actors.txt'), 'ianwieds\n');
+          jetpack.write(path.join(home, 'job-started.js'), '// stale copy');
+
           await runner.removeRunnerHomeWithRetry(new Set(), home);
 
-          ctx.expect(jetpack.list(home).sort()).toEqual(['.env', 'logs']);
+          ctx.expect(jetpack.list(home).sort()).toEqual(['.env', 'allowed-actors.txt', 'allowed-repos.txt', 'logs']);
           ctx.expect(jetpack.read(path.join(home, '.env'))).toBe('WIN_CSC_KEY_PASSWORD=keep-me');
           ctx.expect(jetpack.read(runnerEnv.runnerLogFile(home))).toBe('# omega log\n');
+          ctx.expect(jetpack.read(path.join(home, 'allowed-repos.txt'))).toBe('Omega-JS-Stack/omega-omega\n');
+
+          jetpack.remove(path.join(home, 'allowed-repos.txt'));
+          jetpack.remove(path.join(home, 'allowed-actors.txt'));
 
           // A kept org dir (its deregistration failed) survives beside them.
           jetpack.write(path.join(home, 'actions-runner-bar', 'config.cmd'), 'rem bar');
@@ -2584,10 +2596,21 @@ module.exports = defineCases({
           });
 
           ctx.expect(fs.readFileSync(path.join(home, 'home', '.gitconfig'), 'utf8')).toBe('[core]\n\tautocrlf = false\n');
+          // The job guard is healed on the same pass
+          // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): a box
+          // that installed before it would otherwise come online signing for
+          // anything. Both lines, in one `<runner dir>\.env`.
+          const hook = path.join(home, 'job-started.js');
+          ctx.expect(jetpack.exists(hook)).toBe('file');
           for (const org of orgs) {
-            ctx.expect(fs.readFileSync(path.join(home, `actions-runner-${org}`, '.env'), 'utf8')).toBe(`HOME=${path.join(home, 'home')}\n`);
+            ctx.expect(fs.readFileSync(path.join(home, `actions-runner-${org}`, '.env'), 'utf8')).toBe(`HOME=${path.join(home, 'home')}\nACTIONS_RUNNER_HOOK_JOB_STARTED=${hook}\n`);
             ctx.expect(logged.join('\n')).toContain(`HOME for ${org}: ${path.join(home, 'home')}`);
+            ctx.expect(logged.join('\n')).toContain(`Job guard for ${org}: ${hook}`);
           }
+          // `start` asks GitHub nothing, so the actor list is the operator's to
+          // fill: the file is there with its header, and an empty list refuses.
+          ctx.expect(jetpack.exists(path.join(home, 'allowed-repos.txt'))).toBe('file');
+          ctx.expect(jetpack.exists(path.join(home, 'allowed-actors.txt'))).toBe('file');
         } finally {
           if (origForce === undefined) delete process.env.OMEGA_RUNNER_FORCE; else process.env.OMEGA_RUNNER_FORCE = origForce;
           for (const file of shortcuts) jetpack.remove(file);

package/dist/test/suites/build/sentry.test.js

@@ -63,15 +63,20 @@ module.exports = defineCases({
       // in the sibling `package` key.
       name: 'the bundle bake folds the app version into the config the renderer hands the client',
       run: (ctx) => {
-        const { composeBuildConfig } = require(path.join(FRAMEWORK_ROOT, 'src', 'gulp', 'tasks', 'bundle.js'));
+        const { composeBuildConfig, buildFacts } = require(path.join(FRAMEWORK_ROOT, 'src', 'gulp', 'tasks', 'bundle.js'));
 
-        const packaged = composeBuildConfig({ brand: { id: 'paperloom' } }, null, { version: '3.1.4' });
+        const pkg = { version: '3.1.4' };
+        const mode = { environment: 'production', build: true, publish: false };
+        const packaged = composeBuildConfig({ brand: { id: 'paperloom' } }, buildFacts({ pkg, mode, dev: null }));
         ctx.expect(packaged.version).toBe('3.1.4');
         ctx.expect(packaged.brand.id).toBe('paperloom');
         ctx.expect(packaged.dev).toBeUndefined();
 
         // A dev build carries the resolved local-stack map beside it (#300).
-        const local = composeBuildConfig({ brand: { id: 'paperloom' } }, { ports: { auth: 9099 } }, { version: '3.1.4' });
+        const local = composeBuildConfig(
+          { brand: { id: 'paperloom' } },
+          buildFacts({ pkg, mode: { ...mode, environment: 'development', build: false }, dev: { ports: { auth: 9099 } } }),
+        );
         ctx.expect(local.version).toBe('3.1.4');
         ctx.expect(local.dev.ports.auth).toBe(9099);
       },

package/dist/test/suites/build/setup-scripts.test.js

@@ -72,6 +72,9 @@ module.exports = defineCases({
             const written = JSON.parse(contents);
             ctx.expect(written.scripts.build).toBe('omega build');
             ctx.expect(written.private).toBe(true);
+            // Every OMEGA target states its license when it states none of its
+            // own (#884): npm's word for closed-source commercial code
+            ctx.expect(written.license).toBe('UNLICENSED');
             ctx.expect(written.main).toBe('dist/main.bundle.js');
             ctx.expect(contents).toContain('\n  "name": "staged-app"');
           });

package/dist/test/suites/build/sign-windows.test.js

@@ -14,7 +14,7 @@ module.exports = defineCases({
   description: 'sign-windows — signtool command construction + retry policy',
   tests: [
     {
-      name: 'this suite can never sign for real: every signWithRetry call injects its exec',
+      name: 'this suite can never sign for real: every call that reaches signtool injects its exec',
       run: (ctx) => {
         // The box runs this lane too. `signWithRetry` shells out to signtool by
         // DEFAULT, so a case that forgets `exec:` would drive the real EV token
@@ -22,13 +22,17 @@ module.exports = defineCases({
         // lives in sign-windows-e2e.test.js, gated. This pins the invariant.
         const fs = require('fs');
         const source = fs.readFileSync(__filename, 'utf8');
-        // The needle is assembled so this case's own text is not one of its hits.
-        const calls = source.split(`signWithRetry${'('}`).slice(1);
-        ctx.expect(calls.length).toBeGreaterThan(0);
-        for (const call of calls) {
-          const body = call.slice(0, call.indexOf('});'));
-          if (!body.includes('exec:')) {
-            throw new Error(`a signWithRetry call in this suite does not inject exec — it would run the real signtool:\n${body.slice(0, 200)}`);
+        // Both entry points reach signtool: the retry wrapper directly, and the
+        // signing loop through it plus its own verify call.
+        for (const entry of ['signWithRetry', 'signWithSigntool']) {
+          // The needle is assembled so this case's own text is not one of its hits.
+          const calls = source.split(`${entry}${'('}`).slice(1);
+          ctx.expect(calls.length).toBeGreaterThan(0);
+          for (const call of calls) {
+            const body = call.slice(0, call.indexOf('});'));
+            if (!body.includes('exec:')) {
+              throw new Error(`a ${entry} call in this suite does not inject exec, it would run the real signtool:\n${body.slice(0, 200)}`);
+            }
           }
         }
       },
@@ -143,6 +147,59 @@ module.exports = defineCases({
           .toBe('"signtool" verify /pa "C:\\out\\App.exe"');
       },
     },
+    {
+      name: 'a signed artifact prints the proof line in the mac shape, after verify passes (#918)',
+      run: async (ctx) => {
+        // The mac lane ends with `Stapled and verified: ...` (hooks/notarize.js).
+        // Windows runs the same kind of proof (`signtool verify /pa`, a failure
+        // aborts the job), so it says so in the same shape, naming the check it
+        // ran. Driven here through the injected signtool: the ORDER (sign, then
+        // verify, THEN the line) is what makes the line true.
+        const os = require('os');
+        const jetpack = require('fs-jetpack');
+
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'omega-sign-proof-'));
+        const inDir = path.join(tmp, 'release');
+        const outDir = path.join(inDir, 'signed');
+        const target = path.join(inDir, 'App-windows.msi');
+        // .msi on purpose: it needs no latest.yml, so the loop is the whole test.
+        jetpack.write(target, 'unsigned bytes');
+
+        const commands = [];
+        const lines = [];
+        const fakeLogger = {
+          log:   (m) => lines.push(String(m)),
+          warn:  (m) => lines.push(String(m)),
+          error: (m) => lines.push(String(m)),
+        };
+
+        const origToken = process.env.WIN_EV_TOKEN_PATH;
+        const origPassword = process.env.WIN_CSC_KEY_PASSWORD;
+        try {
+          // Thumbprint mode with no PIN: SafeNet owns it, so no console-lock check.
+          process.env.WIN_EV_TOKEN_PATH = 'f'.repeat(40);
+          delete process.env.WIN_CSC_KEY_PASSWORD;
+
+          await signWindows.signWithSigntool([target], inDir, outDir, {
+            exec:   (cmd) => { commands.push(cmd); return Promise.resolve('Successfully signed'); },
+            logger: fakeLogger,
+          });
+        } finally {
+          if (origToken === undefined) delete process.env.WIN_EV_TOKEN_PATH; else process.env.WIN_EV_TOKEN_PATH = origToken;
+          if (origPassword === undefined) delete process.env.WIN_CSC_KEY_PASSWORD; else process.env.WIN_CSC_KEY_PASSWORD = origPassword;
+          jetpack.remove(tmp);
+        }
+
+        ctx.expect(commands.length).toBe(2);
+        ctx.expect(commands[0]).toContain(' sign /sha1 ');
+        ctx.expect(commands[1]).toContain('verify /pa');
+        // The proof line is the LAST thing this file's turn prints, and it names
+        // the check as well as the artifact: mac punctuation, basename, period.
+        ctx.expect(lines[lines.length - 1]).toBe('Signed and verified: signtool verify /pa accepts App-windows.msi.');
+        // The old line claimed only a signature, which is what sent the owner asking.
+        ctx.expect(lines.some((line) => line.includes('Signed: '))).toBe(false);
+      },
+    },
     {
       name: 'WIN_EV_TOKEN_PATH is the ONE cert-reference key — WIN_CSC_LINK is not read',
       run: (ctx) => {
@@ -309,5 +366,32 @@ module.exports = defineCases({
         ctx.expect(signWindows.isTransientSignFailure(new Error('The specified network password is not correct'))).toBe(false);
       },
     },
+    {
+      name: 'a terminated attempt reads as transient, so the next one gets a fresh PIN watcher',
+      run: async (ctx) => {
+        // The wording is execWithLimit's (exec-with-limit.test.js proves the
+        // mechanism); here it only matters that nothing classifies it as final.
+        const limitError = new Error('signtool produced no verdict within 180s and was terminated');
+        ctx.expect(signWindows.isTransientSignFailure(limitError)).toBe(true);
+        ctx.expect(signWindows.SIGN_TIME_LIMIT_MS).toBe(3 * 60 * 1000);
+
+        let watchers = 0;
+        let calls = 0;
+        let threw;
+        try {
+          await signWindows.signWithRetry('signtool sign ...', {
+            file:  'App.exe',
+            exec:  () => { calls += 1; throw limitError; },
+            sleep: () => Promise.resolve(),
+            emit:  () => {},
+            startUnlock: () => { watchers += 1; return { stop: () => {} }; },
+          });
+        } catch (e) { threw = e; }
+
+        ctx.expect(calls).toBe(3);
+        ctx.expect(watchers).toBe(3);
+        ctx.expect(threw.message).toMatch(/no verdict within 180s/);
+      },
+    },
   ],
 });

package/dist/test/suites/build/test-stealth.test.js

@@ -2,13 +2,15 @@
 // invisible and non-intrusive". Consumed by window-manager (stealth surfacing),
 // main.js (macOS app-activation suppression), and the test harness.
 //
-// Build layer runs in plain Node, so the env-var contract (OMEGA_TEST_MODE /
+// Build layer runs in plain Node, so the env-var contract (OMEGA_ENVIRONMENT,
+// the ONE environment input since
+// [#817](https://github.com/Omega-JS-Stack/omega/issues/817), plus
 // OMEGA_TEST_SHOW) is exercised directly with save/restore around each case.
 
 const isTestStealth = require('../../../utils/test-stealth.js');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 
-// Run fn with OMEGA_TEST_MODE / OMEGA_TEST_SHOW set to the given values (undefined = unset),
+// Run fn with OMEGA_ENVIRONMENT / OMEGA_TEST_SHOW set to the given values (undefined = unset),
 // restoring the real environment afterwards so other build suites are unaffected.
 function withEnv(vars, fn) {
   const saved = {};
@@ -41,7 +43,7 @@ module.exports = defineCases({
     {
       name: 'true in testing mode without OMEGA_TEST_SHOW',
       run: (ctx) => {
-        withEnv({ OMEGA_TEST_MODE: 'true', OMEGA_TEST_SHOW: undefined }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: 'testing', OMEGA_TEST_SHOW: undefined }, () => {
           ctx.expect(isTestStealth()).toBe(true);
         });
       },
@@ -49,7 +51,7 @@ module.exports = defineCases({
     {
       name: 'OMEGA_TEST_SHOW=1 opts out even in testing mode',
       run: (ctx) => {
-        withEnv({ OMEGA_TEST_MODE: 'true', OMEGA_TEST_SHOW: '1' }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: 'testing', OMEGA_TEST_SHOW: '1' }, () => {
           ctx.expect(isTestStealth()).toBe(false);
         });
       },
@@ -57,24 +59,28 @@ module.exports = defineCases({
     {
       name: 'false outside testing mode regardless of OMEGA_TEST_SHOW',
       run: (ctx) => {
-        withEnv({ OMEGA_TEST_MODE: undefined, OMEGA_TEST_SHOW: undefined, OMEGA_BUILD_MODE: undefined, NODE_ENV: 'development' }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: 'development', OMEGA_TEST_SHOW: undefined }, () => {
+          ctx.expect(isTestStealth()).toBe(false);
+        });
+        withEnv({ OMEGA_ENVIRONMENT: 'production', OMEGA_TEST_SHOW: '1' }, () => {
           ctx.expect(isTestStealth()).toBe(false);
         });
       },
     },
     {
-      name: 'a provided manager is authoritative over the env fallback',
+      name: 'a provided manager answers from the config IT was baked with',
       run: (ctx) => {
-        // Build-time Manager carries the same mode-helpers mixin as the runtime
-        // Managers — config.em.environment overrides the env detection.
+        // The build-time Manager carries the same mixin as the runtime Managers,
+        // and since #817 they all read the ONE input: the process variable, or
+        // the baked `config.environment` when the process has none.
         const Manager = require('../../../build.js');
-        withEnv({ OMEGA_TEST_MODE: undefined, OMEGA_TEST_SHOW: undefined }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: undefined, OMEGA_TEST_SHOW: undefined }, () => {
           const testing = new Manager();
-          testing.config = { em: { environment: 'testing' } };
+          testing.config = { environment: 'testing' };
           ctx.expect(isTestStealth(testing)).toBe(true);
 
           const production = new Manager();
-          production.config = { em: { environment: 'production' } };
+          production.config = { environment: 'production' };
           ctx.expect(isTestStealth(production)).toBe(false);
         });
       },