@omega.js/desktop 0.50.0 → 0.51.0

package/dist/commands/release.js

@@ -1,50 +1,64 @@
-// release — trigger the GitHub Actions Build & Release workflow + stream logs locally.
+// release: trigger the GitHub Actions Build & Release workflow, then follow the
+// run it started.
 //
 // Replaces the old "do it from my laptop" release flow with "let CI do it, but make it
 // feel local." User runs `npm run release` (or `npx omega release`) and gets:
-//   1. A workflow_dispatch POST to GH Actions on the brand's repo (owner/repo from the
-//      config, and the workflow file the scaffold actually wrote: see dispatchTarget).
-//   2. A few seconds of waiting while GH spins up the run.
-//   3. Live polling of every job's logs at 5s intervals, printing NEW lines as they
-//      arrive (job-prefixed) so it looks like streaming.
-//   4. Everything teed to <root>/logs/ci.log with ANSI codes preserved on stdout
-//      and stripped from the file (matches the dev/build log convention).
-//   5. Exit 0 on success, 1 on any job failure.
-//
-// Why poll instead of stream? GH Actions doesn't expose live stdout — logs are only
-// fetchable AFTER each STEP completes. So "streaming" is a polite fiction: every 5s
-// we re-fetch each job's logs and diff against what we already printed.
+//   1. The ONE deploy lane every target takes (`@omega.js/devkit/deploy`'s
+//      deployViaDispatch, #872, #915): the composed workflow files reach the
+//      default branch when they differ there (GitHub registers a workflow from
+//      that branch), the brand folder is force-pushed to `omega-deploy` (packed
+//      when it is linked), and the workflow is dispatched on that ref (the
+//      brand's own repo and the composed workflow name: devkit's
+//      dispatchTarget, #847).
+//   2. The ONE run follower every dispatched deploy uses
+//      (`@omega.js/devkit/deploy-follow`, [#873](https://github.com/Omega-JS-Stack/omega/issues/873)):
+//      it finds the run, polls it, prints each job's log with the job's name in
+//      front, and exits 1 on any conclusion but success. This file owned that
+//      follower alone until #873 gave the other three targets the same one.
+//   3. Everything teed to <root>/logs/deploy.log, the one name every target's
+//      deploy writes (docs/shared/logging.md), ANSI stripped from the file.
 
 const path     = require('path');
-const fs       = require('fs');
-const jetpack  = require('fs-jetpack');
 
-const { getOctokit } = require('../utils/github.js');
-const { dispatchRepo } = require('../vendor/devkit/deploy.js');
+const attachLogFile = require('../utils/attach-log-file.js');
+const { deployViaDispatch, dispatchTarget, laneLabel, resolveToken } = require('../vendor/devkit/deploy.js');
+const { followRun } = require('../vendor/devkit/deploy-follow.js');
+const { targetNameFromDir } = require('../vendor/config/index.js');
 const Manager = new (require('../build.js'));
 
 const logger = Manager.logger('release');
 
-const POLL_INTERVAL_MS = 5000;
-
 module.exports = async function release(options = {}) {
   const projectRoot = process.cwd();
-
-  if (!process.env.GH_TOKEN) {
-    throw new Error('GH_TOKEN not set in env. Set it in .env (or shell) so we can dispatch the workflow.');
-  }
-
-  // silent: true — suppress octokit's default console output for transient 404s
-  // (in-progress job logs return 404 until the step completes).
-  const octokit = getOctokit({ silent: true });
-  if (!octokit) {
-    throw new Error('Failed to create octokit (missing GH_TOKEN?).');
+  // The DRY RUN arrives here too ([#895](https://github.com/Omega-JS-Stack/omega/issues/895)):
+  // this verb is desktop's one dispatch call site, so the plan a preview prints
+  // is built by the very call a real run sends, threading the ref and the
+  // snapshot sha the same way.
+  const dryRun = !!(options.dryRun || options['dry-run']);
+
+  // The whole verb in one file, from its first line (#873), the token refusal
+  // below included: a caller that hands the writers back afterwards then pops
+  // THIS layer, never the one under it. A no-op when `omega deploy` delegated
+  // here and already attached this exact path.
+  const logPath = path.join(projectRoot, 'logs', 'deploy.log');
+  attachLogFile(logPath);
+
+  // The ONE token chain devkit resolves for every target, `GH_TOKEN` →
+  // `GITHUB_TOKEN` → `gh auth token`, and the very one the follower below is
+  // handed: testing the bare variable refused a machine signed in with `gh`
+  // and holding no variable at all, which is most of them. A dry run needs
+  // none: every step under it is a read or a plan.
+  if (!dryRun && !resolveToken()) {
+    throw new Error('No GitHub token: set GH_TOKEN in .env (or GITHUB_TOKEN in the shell), or sign in with `gh auth login`, so we can dispatch the workflow.');
   }
 
-  const { owner, repo, workflow: WORKFLOW_FILE } = dispatchTarget({ projectRoot, config: Manager.getConfig() });
-
-  // Discover ref (current branch or override via --ref).
-  const ref = options.ref || (await currentBranch(projectRoot)) || 'main';
+  // The CI dispatch address, from the config and the scaffold: the brand's own
+  // repo and the workflow file the target's ensure-target pass actually wrote
+  // (composed as `desktop-build.yml` at the brand root inside a monorepo, plain
+  // `build.yml` standalone). ONE helper for all four targets
+  // ([#847](https://github.com/Omega-JS-Stack/omega/issues/847)), where this
+  // file used to keep desktop's own copy of it.
+  const { owner, repo, workflow: WORKFLOW_FILE } = dispatchTarget({ projectRoot, config: Manager.getConfig(), workflow: 'build.yml' });
 
   // Optional --platforms / --platform flag forwarded as a workflow input. Accepts a
   // single value ('windows') or comma-separated list ('mac,linux'). Special value
@@ -53,234 +67,67 @@ module.exports = async function release(options = {}) {
   // workflows (without a `platforms` input declared) keep working unchanged.
   const platforms = options.platforms || options.platform || null;
 
-  const dispatchArgs = { owner, repo, workflow_id: WORKFLOW_FILE, ref };
-  if (platforms) dispatchArgs.inputs = { platforms: String(platforms) };
-
   const platformsLabel = platforms ? ` (platforms=${platforms})` : '';
-  logger.log(`Triggering ${owner}/${repo} workflow ${WORKFLOW_FILE} on ref=${ref}${platformsLabel}...`);
-
-  // 1. Mark a "before" timestamp so we can identify the new run we just dispatched.
-  const before = new Date();
-
-  // 2. Dispatch.
-  await octokit.rest.actions.createWorkflowDispatch(dispatchArgs);
-
-  // 3. Wait for the new run to appear (GH Actions takes a few seconds to register it).
-  const run = await waitForNewRun({ octokit, owner, repo, after: before, workflowFile: WORKFLOW_FILE });
-  if (!run) {
-    throw new Error('Workflow dispatch succeeded but no new run appeared after 60s. Check GitHub Actions UI.');
-  }
-
-  logger.log(`Run started: ${run.html_url}`);
-  require('../vendor/devkit/deploy-record.js').recordDeploy({ dir: projectRoot, target: 'desktop', detail: { method: 'release-dispatch' } });
-
-  // 4. Set up the CI log tee.
-  const logsDir = path.join(projectRoot, 'logs');
-  jetpack.dir(logsDir);
-  const ciLogPath = path.join(logsDir, 'ci.log');
-  // Truncate so each release run starts fresh.
-  fs.writeFileSync(ciLogPath, `# release run ${run.html_url}\n# started ${new Date().toISOString()}\n\n`);
-  const logFile = fs.createWriteStream(ciLogPath, { flags: 'a' });
-
-  // Spinner state. We tick every 250ms even between polls so the terminal feels alive.
-  // The spinner line uses \r to overwrite itself; before printing real content we clear
-  // the line, write content, then re-render the spinner. File output is unaffected.
-  const startedAt   = Date.now();
-  const isTty       = process.stdout.isTTY === true;
-  const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-  let spinnerFrame = 0;
-  let pollCount    = 0;
-  let latestState  = null;
-  let latestJobs   = [];
-
-  function clearSpinner() {
-    if (!isTty) return;
-    process.stdout.write('\r\x1b[2K');
-  }
-
-  function renderSpinner() {
-    if (!isTty || !latestState) return;
-    const frame   = SPINNER_FRAMES[spinnerFrame % SPINNER_FRAMES.length];
-    const elapsed = formatElapsed(Date.now() - startedAt);
-    const status  = `${latestState.status}${latestState.conclusion ? ` (${latestState.conclusion})` : ''}`;
-    const jobBits = latestJobs.map((j) => `${jobSymbol(j)} ${j.name}`).join(' ');
-    const line    = `${frame}  ${status} · ${elapsed} · ${pollCount} polls · ${jobBits}`;
-    // Truncate so we never wrap (which breaks the \r overwrite).
-    const cols    = process.stdout.columns || 120;
-    const safe    = line.length > cols - 1 ? line.slice(0, cols - 2) + '…' : line;
-    process.stdout.write(`\r${safe}`);
-  }
-
-  // Print line(s) to stdout AND tee to file. Clears spinner first; spinner re-renders next tick.
-  function print(line) {
-    clearSpinner();
-    process.stdout.write(line);
-    logFile.write(stripAnsi(line));
+  if (!dryRun) {
+    logger.log(`Triggering ${owner}/${repo} workflow ${WORKFLOW_FILE}${platformsLabel}...`);
   }
 
-  // Tick the spinner ~4 times/sec so it animates between polls.
-  const spinnerTimer = isTty ? setInterval(() => {
-    spinnerFrame += 1;
-    renderSpinner();
-  }, 250) : null;
+  // 1. Mark a "before" timestamp so the follower identifies the run we just
+  // dispatched rather than the one before it.
+  const since = new Date();
 
-  // 5. Poll until completion. Track byte offsets per job so we only print new lines.
-  const printedByJob = new Map(); // jobId -> chars printed so far
-  let lastStatusLine = '';
-
-  try {
-    while (true) {
-      pollCount += 1;
-      const { data: state } = await octokit.rest.actions.getWorkflowRun({
-        owner, repo, run_id: run.id,
-      });
-
-      // Pull all jobs. Each job has steps; each step has a step-level status.
-      const { data: jobsResp } = await octokit.rest.actions.listJobsForWorkflowRun({
-        owner, repo, run_id: run.id, per_page: 100,
-      });
-      const jobs = jobsResp.jobs || [];
-      latestState = state;
-      latestJobs  = jobs;
-
-      // For each job, fetch its logs (only available once steps complete; for in-progress
-      // jobs, GH returns 404 or partial — we tolerate both).
-      for (const job of jobs) {
-        // Skip queued jobs entirely (no logs yet).
-        if (job.status === 'queued') continue;
-
-        let logsText = '';
-        try {
-          const { data } = await octokit.request('GET /repos/{owner}/{repo}/actions/jobs/{job_id}/logs', {
-            owner, repo, job_id: job.id,
-          });
-          // Octokit returns the raw text content here.
-          logsText = typeof data === 'string' ? data : Buffer.from(data || '').toString('utf8');
-        } catch (e) {
-          // 404 = logs not ready yet. Other errors we just skip until next tick.
-          continue;
-        }
-
-        const printed = printedByJob.get(job.id) || 0;
-        if (logsText.length > printed) {
-          const fresh = logsText.slice(printed);
-          // Prefix each line with the job name so interleaved output is readable.
-          const prefix = `[${job.name}] `;
-          for (const rawLine of fresh.split('\n')) {
-            if (!rawLine) continue;
-            print(`${prefix}${rawLine}\n`);
-          }
-          printedByJob.set(job.id, logsText.length);
-        }
-      }
-
-      // Print a one-line status banner if it changed (no spam — only on transition).
-      const banner = formatStatusBanner(state, jobs);
-      if (banner !== lastStatusLine) {
-        print(`\n${banner}\n`);
-        lastStatusLine = banner;
-      }
-
-      if (state.status === 'completed') {
-        clearSpinner();
-        logFile.end();
-        const success = state.conclusion === 'success';
-        const symbol  = success ? '✓' : '✗';
-        logger.log(`${symbol} Run ${state.conclusion} — ${state.html_url}`);
-        logger.log(`Logs: ${path.relative(projectRoot, ciLogPath)}`);
-        if (!success) {
-          process.exitCode = 1;
-          throw new Error(`Release run failed (conclusion=${state.conclusion}). See ${ciLogPath} or ${state.html_url}.`);
-        }
-        return;
-      }
-
-      await sleep(POLL_INTERVAL_MS);
-    }
-  } finally {
-    if (spinnerTimer) clearInterval(spinnerTimer);
-    clearSpinner();
-  }
-};
-
-// The CI dispatch address, from the config and the scaffold: the brand's APP
-// repo (`@omega.js/devkit/deploy`'s dispatchRepo, the one call web and the
-// extension deploy verbs make too) and the workflow file the target's
-// ensure-target pass actually wrote (composed as `desktop-build.yml` at the
-// brand root inside a monorepo, plain `build.yml` standalone:
-// `@omega.js/devkit/ci-workflows` owns that name for all four frameworks).
-// Never the git remote: a brand nested in another repo would dispatch on the
-// enclosing one, which for the playground is the framework monorepo itself.
-// Exported for tests.
-function dispatchTarget({ projectRoot, config }) {
-  const { composedWorkflowName } = require('../vendor/devkit/ci-workflows.js');
-  const { resolveSeedMode } = require('../vendor/config/index.js');
-  const { owner, repo } = dispatchRepo(config);
-
-  return {
+  // 2. Deliver the brand and dispatch, through the ONE lane (#872, #915): the
+  // composed workflows to the repo's default branch when they differ, the brand
+  // folder to `omega-deploy`, which is the ref this dispatches. An explicit
+  // `--ref` still wins.
+  const { plan, lane, sha } = await deployViaDispatch({
+    workflow: WORKFLOW_FILE,
     owner,
     repo,
-    workflow: composedWorkflowName({
-      targetDir: projectRoot,
-      brandRoot: resolveSeedMode(projectRoot).brandRoot,
-      workflow: 'build.yml',
-    }),
-  };
-}
-
-function formatElapsed(ms) {
-  const totalSec = Math.floor(ms / 1000);
-  const m = Math.floor(totalSec / 60);
-  const s = totalSec % 60;
-  return m > 0 ? `${m}m ${String(s).padStart(2, '0')}s` : `${s}s`;
-}
-
-function jobSymbol(j) {
-  if (j.status === 'completed') return j.conclusion === 'success' ? '✓' : '✗';
-  if (j.status === 'in_progress') return '…';
-  if (j.status === 'queued') return '·';
-  return '?';
-}
-
-async function waitForNewRun({ octokit, owner, repo, after, workflowFile }) {
-  const deadline = Date.now() + 60_000;
-  while (Date.now() < deadline) {
-    const { data } = await octokit.rest.actions.listWorkflowRuns({
-      owner, repo, workflow_id: workflowFile, per_page: 5, event: 'workflow_dispatch',
-    });
-    const runs = data.workflow_runs || [];
-    // The newest run created strictly after our dispatch timestamp.
-    const fresh = runs.find((r) => new Date(r.created_at).getTime() >= after.getTime() - 1000);
-    if (fresh) return fresh;
-    await sleep(2000);
+    dir: projectRoot,
+    ref: options.ref,
+    inputs: platforms ? { platforms: String(platforms) } : undefined,
+    // The brand root's one snapshot for the whole fan-out, when a brand-root
+    // deploy spawned this verb (#901): the push is done, so this run
+    // dispatches against that sha instead of pushing over it. Nobody types it.
+    snapshot: options.snapshot,
+    dryRun,
+    logger,
+  });
+
+  // The plan IS the dry run: what would be sent, and nothing sent.
+  if (dryRun) {
+    logger.log(`DRY RUN (${laneLabel(lane)}), would send:`);
+    logger.log(`  ${plan.method} ${plan.url}`);
+    logger.log(`  body: ${JSON.stringify(plan.body)}`);
+    logger.log(`  then watch: ${plan.runsUrl}`);
+    return;
   }
-  return null;
-}
 
-function formatStatusBanner(run, jobs) {
-  const parts = jobs.map((j) => `${jobSymbol(j)} ${j.name}`);
-  return `── ${run.status}${run.conclusion ? ` (${run.conclusion})` : ''} ── ${parts.join('  |  ')}`;
-}
+  logger.log(`Dispatched ${WORKFLOW_FILE} (${laneLabel(lane, sha)}): CI builds, signs, and publishes the release artifacts.`);
+  // The ONE runs-url formula is the plan's (`buildDispatch`), the same line
+  // backend, web and the extension print: rebuilt by hand here, it was a second
+  // copy of an address the dispatch already answered.
+  logger.log(`Watch: ${plan.runsUrl}`);
 
-async function currentBranch(projectRoot) {
-  try {
-    const { execute } = require('node-powertools');
-    const out = await execute('git rev-parse --abbrev-ref HEAD', { cwd: projectRoot, log: false });
-    return String(out || '').trim();
-  } catch (e) {
-    return null;
-  }
-}
+  require('../vendor/devkit/deploy-record.js').recordDeploy({ dir: projectRoot, target: targetNameFromDir(projectRoot) || 'desktop', detail: { method: 'release-dispatch' } });
 
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
+  // 3. Follow the run to its verdict: the jobs' logs stream in here, and a red
+  // run throws, so this verb exits 1 on anything but success (#873). The run
+  // also has to be building the tree this deploy pushed (#902): on the push
+  // lane there is no sha and the check is off, because that lane's run head is
+  // the developer's own commit.
+  const { conclusion } = await followRun({
+    owner,
+    repo,
+    workflow: WORKFLOW_FILE,
+    since,
+    headSha: sha,
+    token: resolveToken(),
+    logger,
+  });
 
-function stripAnsi(s) {
-  // Minimal ANSI stripper — handles CSI sequences (colors, cursor moves).
-  return String(s).replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
-}
+  logger.log(`Logs: ${path.relative(projectRoot, logPath)}`);
 
-// Exported for tests + `omega deploy`, which prints the exact dispatch this
-// sends before delegating here.
-module.exports.dispatchTarget = dispatchTarget;
+  return conclusion;
+};

package/dist/commands/runner.js

@@ -57,6 +57,7 @@ function ghRunnerName(org) {
 // — is `<home>\.env`, read here before anything looks at process.env, so every
 // subcommand works from any directory (utils/runner-env.js).
 const { defaultRunnerHome, runnerEnvFile, runnerLogFile, loadRunnerEnv, ensureRunnerConfig, reconfigureRunnerEnv, runnerEnvReport, parseRunnerOrgs, sameRunnerOrgs, isTestRun, isScratchRunnerHome, assertTestSafeRunnerHome, runnerPrivateHome, ensureRunnerPrivateHome, ensureRunnerDirEnv } = require('../utils/runner-env.js');
+const { ensureRunnerJobGuard, jobGuardListFiles } = require('../utils/runner-job-guard.js');
 const attachLogFile = require('../utils/attach-log-file.js');
 const RUNNER_HOME = process.env.OMEGA_RUNNER_HOME || defaultRunnerHome();
 loadRunnerEnv({ home: RUNNER_HOME });
@@ -480,9 +481,27 @@ async function registerOrg(options) {
   // runner's `<runner dir>\.env`, which the listener reads at startup and
   // applies to every job, so the detached spawn and the Startup shortcut both
   // get it from one write.
+  //
+  // The job guard travels the same way
+  // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): the hook the
+  // listener runs before a job's first step, refusing anything that is not a
+  // dispatch from a listed repo by a listed actor. The actor list starts as the
+  // `GH_TOKEN` user, which is this box owner's account and the account a
+  // `workflow_dispatch` from the deploy token carries (Ian 2026-09-13); a
+  // lookup that does not answer leaves the file for the operator rather than
+  // failing a registration over it.
   const privateHome = ensureRunnerPrivateHome(home, { logger });
-  ensureRunnerDirEnv(runnerDir, { HOME: privateHome.home });
+  let actor;
+  try {
+    const { data } = await octokit.rest.users.getAuthenticated();
+    actor = data.login;
+  } catch (e) {
+    logger.warn(`  Could not read the GH_TOKEN user for the job guard's actor list: ${e.message}`);
+  }
+  const guard = ensureRunnerJobGuard(home, { orgs: [org], actor, logger });
+  ensureRunnerDirEnv(runnerDir, { HOME: privateHome.home, ACTIONS_RUNNER_HOOK_JOB_STARTED: guard.hook });
   logger.log(`  HOME for ${org}: ${privateHome.home}`);
+  logger.log(`  Job guard for ${org}: ${guard.hook}`);
 
   // Write the .cmd shortcut in the user's Startup folder so Explorer auto-runs
   // it at every interactive logon (Session 1). No Task Scheduler, no admin
@@ -518,10 +537,21 @@ async function startPreflight(options) {
   // an install that predates it, or a runner dir whose `.env` was replaced, has
   // no HOME line, and the job it picks up then dies inside `actions/checkout`.
   // Every registered dir gets it here, before a single listener comes up.
+  //
+  // And the job guard with it
+  // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): a box that
+  // installed before the guard existed, or a runner dir whose `.env` lost the
+  // line, would otherwise come online signing for anything. The hook script is
+  // rewritten from this package, so a framework update reaches the box on the
+  // next start; the allow lists are the operator's and are only appended to,
+  // and this path asks GitHub nothing, so `start` still works offline.
   const privateHome = ensureRunnerPrivateHome(home, { logger: log });
-  for (const { org, dir } of listOrgRunnerDirs(home)) {
-    ensureRunnerDirEnv(dir, { HOME: privateHome.home });
+  const dirs = listOrgRunnerDirs(home);
+  const guard = ensureRunnerJobGuard(home, { orgs: dirs.map(({ org }) => org), logger: log });
+  for (const { org, dir } of dirs) {
+    ensureRunnerDirEnv(dir, { HOME: privateHome.home, ACTIONS_RUNNER_HOOK_JOB_STARTED: guard.hook });
     log.log(`HOME for ${org}: ${privateHome.home}`);
+    log.log(`Job guard for ${org}: ${guard.hook}`);
   }
 
   const named      = parseRunnerOrgs(env.OMEGA_RUNNER_ORGS);
@@ -966,7 +996,13 @@ async function removeRunnerHomeWithRetry(keepDirs, home) {
   // open by the tee while the removal runs.
   const envFile = runnerEnvFile(root);
   const logsDir = path.dirname(runnerLogFile(root));
-  const keep = new Set([...(keepDirs || []), envFile, logsDir]);
+  // The job guard's two allow lists are configuration too
+  // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): a list an
+  // operator narrowed by hand outlives an uninstall exactly as the `.env` does.
+  // The hook SCRIPT is install state and goes with the rest; the next install
+  // writes it back from the package.
+  const guardLists = jobGuardListFiles(root);
+  const keep = new Set([...(keepDirs || []), envFile, logsDir, ...guardLists]);
   const targets = (jetpack.list(root) || [])
     .map((name) => path.join(root, name))
     .filter((entry) => !keep.has(entry));
@@ -974,7 +1010,8 @@ async function removeRunnerHomeWithRetry(keepDirs, home) {
   // Nothing kept survives on disk: the home itself goes too.
   const kept = [...(keepDirs || [])].length > 0
             || jetpack.exists(envFile) === 'file'
-            || jetpack.exists(logsDir) === 'dir';
+            || jetpack.exists(logsDir) === 'dir'
+            || guardLists.some((file) => jetpack.exists(file) === 'file');
   if (!kept) targets.push(root);
 
   for (const target of targets) {

package/dist/commands/sign-windows.js

@@ -1,6 +1,6 @@
 // Strategy-aware Windows code signer.
 //
-// Reads strategy from config platforms.win.signing.strategy:
+// Reads strategy from config platforms.windows.signing.strategy:
 //   self-hosted — sign with signtool against an EV USB token (typically on a self-hosted runner)
 //   cloud       — shell out to a cloud signing provider's CLI (Azure / SSL.com / DigiCert)
 //   local       — no-op (developer signs manually on their own Windows box)
@@ -33,6 +33,8 @@ runnerEnv.loadRunnerEnv();
 const attachLogFile = require('../utils/attach-log-file.js');
 
 const { startAutoUnlock } = require('../lib/sign-helpers/auto-unlock.js');
+const { assertConsoleUnlocked } = require('../lib/sign-helpers/console-lock.js');
+const { execWithLimit } = require('../lib/sign-helpers/exec-with-limit.js');
 const { writeUpdateInfo } = require('../lib/sign-helpers/update-info.js');
 const signEvents = require('../lib/sign-helpers/sign-events.js');
 
@@ -140,9 +142,9 @@ async function runSignCommand(options) {
   }
 
   if (strategy === 'cloud') {
-    const provider = config.platforms?.win?.signing?.cloud?.provider;
+    const provider = config.platforms?.windows?.signing?.cloud?.provider;
     if (!provider) {
-      throw new Error('strategy=cloud but no provider set (config platforms.win.signing.cloud.provider).');
+      throw new Error('strategy=cloud but no provider set (config platforms.windows.signing.cloud.provider).');
     }
     await signWithCloudProvider(provider, targets, inDir, outDir);
     return;
@@ -261,9 +263,17 @@ function buildVerifyCommand({ signtool, outPath }) {
 const SIGN_ATTEMPTS       = 3;
 const SIGN_RETRY_DELAY_MS = 5000;
 
-// node-powertools' `execute` with `log: false` — what this file passes — rejects
-// with `new Error(stderr || 'Command failed with exit code N')`, and the sign
-// command ends in `2>&1` (it runs through a shell), so BOTH of signtool's
+// A healthy sign takes ~18s (the timestamp round trip is most of it). One that
+// is still running minutes later is waiting on something that will never come:
+// a PIN typed at a locked console, a dialog nobody can see. Every attempt gets
+// this hard limit, after which the signtool process tree is terminated and the
+// attempt fails with a message that says so, instead of holding the job until
+// GitHub's six-hour default cancels it ([#864](https://github.com/Omega-JS-Stack/omega/issues/864)).
+const SIGN_TIME_LIMIT_MS  = 3 * 60 * 1000;
+
+// node-powertools' `execute` with `log: false` — what execWithLimit passes —
+// rejects with `new Error(stderr || 'Command failed with exit code N')`, and the
+// sign command ends in `2>&1` (it runs through a shell), so BOTH of signtool's
 // streams reach `e.message` and this is classifying on signtool's own words.
 //
 // Failures signtool NAMES as permanent. Retrying a wrong PIN walks the EV token
@@ -298,7 +308,7 @@ async function signWithRetry(cmd, options) {
     file,
     attempts    = SIGN_ATTEMPTS,
     delayMs     = SIGN_RETRY_DELAY_MS,
-    exec        = (c) => execute(c, { log: false }),
+    exec        = (c) => execWithLimit(c, { limitMs: SIGN_TIME_LIMIT_MS, label: 'signtool' }),
     sleep       = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     emit        = signEvents.emit,
     startUnlock = () => ({ stop: () => {} }),
@@ -334,7 +344,17 @@ async function signWithRetry(cmd, options) {
   throw new Error(`signWithRetry exhausted ${attempts} attempts without a verdict`);
 }
 
-async function signWithSigntool(targets, inDir, outDir) {
+// The signing loop. Both of its shell-outs and every line it prints sit behind
+// one seam (`deps.exec` runs signtool, `deps.logger` prints), so the ORDER that
+// makes the proof line true (sign, verify, THEN the line) is provable without a
+// Windows box. Production passes neither: the real signtool and the real logger
+// are the defaults, and the deliberate end-to-end sign is sign-windows-e2e.
+async function signWithSigntool(targets, inDir, outDir, deps) {
+  deps = deps || {};
+  const exec = deps.exec;
+  const runVerify = exec || ((command) => execute(command, { log: false }));
+  const log = deps.logger || logger;
+
   const projectRoot = process.cwd();
   const { tokenRef, password, useThumbprint, signtool, timestampUrl } = resolveSigntoolEnv();
 
@@ -343,6 +363,11 @@ async function signWithSigntool(targets, inDir, outDir) {
   // update mechanism (not electron-updater) and don't need a yml.
   const signedExes = [];
 
+  // The PIN is typed into the Token Logon dialog on the interactive desktop.
+  // Behind a lock screen it never arrives and signtool waits forever, so a
+  // locked console is refused before the first call (console-lock.js).
+  if (useThumbprint && password) await assertConsoleUnlocked();
+
   for (const target of targets) {
     const rel = path.relative(inDir, target);
     const outPath = path.join(outDir, rel);
@@ -353,7 +378,7 @@ async function signWithSigntool(targets, inDir, outDir) {
 
     const cmd = buildSignCommand({ signtool, tokenRef, password, timestampUrl, outPath });
 
-    logger.log(`Signing ${path.relative(projectRoot, outPath)}${useThumbprint ? ' (thumbprint mode)' : ''}...`);
+    log.log(`Signing ${path.relative(projectRoot, outPath)}${useThumbprint ? ' (thumbprint mode)' : ''}...`);
 
     const fileBytes = (() => { try { return fs.statSync(outPath).size; } catch (_) { return null; } })();
     signEvents.emit('sign-start', {
@@ -370,6 +395,7 @@ async function signWithSigntool(targets, inDir, outDir) {
     try {
       await signWithRetry(cmd, {
         file: path.basename(outPath),
+        exec,
         startUnlock: () => (useThumbprint ? startAutoUnlock({ password, logger }) : { stop: () => {} }),
       });
     } catch (e) {
@@ -385,7 +411,7 @@ async function signWithSigntool(targets, inDir, outDir) {
     // Verify is a local check with no third party in it — one shot.
     const verifyCmd = buildVerifyCommand({ signtool, outPath });
     try {
-      await execute(verifyCmd, { log: false });
+      await runVerify(verifyCmd);
     } catch (e) {
       signEvents.emit('sign-fail', {
         file: path.basename(outPath),
@@ -399,7 +425,11 @@ async function signWithSigntool(targets, inDir, outDir) {
       file: path.basename(outPath),
       duration_ms: Date.now() - fileStart,
     });
-    logger.log(logger.format.green(`✓ Signed: ${path.relative(projectRoot, outPath)}`));
+    // The proof line, in the mac lane's shape (hooks/notarize.js): the verify
+    // above aborts the job on a failure, so this line names the check that ran
+    // rather than claiming a signature nobody checked
+    // ([#918](https://github.com/Omega-JS-Stack/omega/issues/918)).
+    log.log(`Signed and verified: signtool verify /pa accepts ${path.basename(outPath)}.`);
 
     if (outPath.toLowerCase().endsWith('.exe')) {
       signedExes.push({ filePath: outPath, urlName: path.basename(outPath) });
@@ -414,9 +444,9 @@ async function signWithSigntool(targets, inDir, outDir) {
     const pkg = Manager.getPackage('project') || {};
     const version = pkg.version;
     if (!version) {
-      logger.warn('Could not determine version from package.json — skipping latest.yml generation.');
+      log.warn('Could not determine version from package.json; skipping latest.yml generation.');
     } else {
-      logger.log(`Generating Windows auto-updater feed (latest.yml) for ${signedExes.length} installer(s)...`);
+      log.log(`Generating Windows auto-updater feed (latest.yml) for ${signedExes.length} installer(s)...`);
       try {
         await writeUpdateInfo({
           signedExes,
@@ -428,8 +458,8 @@ async function signWithSigntool(targets, inDir, outDir) {
         // Don't fail the whole sign step if yml generation hits something unexpected —
         // the signed exe is still valid + uploadable. But this IS a real problem
         // because auto-updates won't work, so log loudly.
-        logger.error(`latest.yml generation failed: ${e.message}`);
-        logger.error('  Signed binary is OK but Windows auto-updater will not see this release.');
+        log.error(`latest.yml generation failed: ${e.message}`);
+        log.error('  Signed binary is OK but Windows auto-updater will not see this release.');
       }
     }
   }
@@ -554,6 +584,7 @@ module.exports.signWithRetry          = signWithRetry;
 module.exports.isTransientSignFailure = isTransientSignFailure;
 module.exports.SIGN_ATTEMPTS          = SIGN_ATTEMPTS;
 module.exports.SIGN_RETRY_DELAY_MS    = SIGN_RETRY_DELAY_MS;
+module.exports.SIGN_TIME_LIMIT_MS     = SIGN_TIME_LIMIT_MS;
 
 // Exports for the Windows-gated end-to-end suite — the halves that shell out to
 // signtool for real. They only run where signtool and the EV token are