@omega.js/desktop 0.50.0 → 0.52.0

package/dist/commands/runner.js

@@ -14,18 +14,20 @@
 //                        the defaults — and the orgs it serves. How a value that
 //                        is already there gets changed.
 //   register-org <org>   Register the runner against one specific GH org.
-//   start                Bring EVERY registered org's runner online, detached,
-//                        in Startup-shortcut order. An org already alive is
-//                        named and skipped; the terminal is never taken over.
+//   start                The one command: installs a bare box, refreshes a stale
+//                        actions/runner download in place, registers any admin
+//                        org the box does not serve yet, then brings EVERY
+//                        registered org online, detached, in Startup-shortcut
+//                        order. An org already alive is named and skipped; the
+//                        terminal is never taken over.
 //   restart              stop, wait for every listener to go, then start.
 //   stop                 Kill every Runner.Listener.exe under RUNNER_HOME.
 //   status               Registered orgs, Startup shortcuts, live listeners.
 //   uninstall            Remove everything — legacy services and tasks, and the
 //                        electron-manager era's em-runner install, included.
-//   self-update          Force an immediate self-update of @omega.js/desktop (npm i -g @omega.js/desktop@latest).
 //   monitor              Tail the JSONL signing event log, pretty-printed.
 //
-// Every subcommand except `self-update` and `monitor` refuses on non-Windows
+// Every subcommand except `monitor` refuses on non-Windows
 // (set OMEGA_RUNNER_FORCE=1 to override — testing only).
 
 const path     = require('path');
@@ -35,7 +37,6 @@ const jetpack  = require('fs-jetpack');
 
 const Manager  = new (require('../build.js'));
 const logger   = Manager.logger('runner');
-const { safeInstall } = require('../utils/safe-install');
 
 const RUNNER_LABELS = ['self-hosted', 'windows', 'ev-token'];
 
@@ -57,6 +58,7 @@ function ghRunnerName(org) {
 // — is `<home>\.env`, read here before anything looks at process.env, so every
 // subcommand works from any directory (utils/runner-env.js).
 const { defaultRunnerHome, runnerEnvFile, runnerLogFile, loadRunnerEnv, ensureRunnerConfig, reconfigureRunnerEnv, runnerEnvReport, parseRunnerOrgs, sameRunnerOrgs, isTestRun, isScratchRunnerHome, assertTestSafeRunnerHome, runnerPrivateHome, ensureRunnerPrivateHome, ensureRunnerDirEnv } = require('../utils/runner-env.js');
+const { ensureRunnerJobGuard, jobGuardListFiles } = require('../utils/runner-job-guard.js');
 const attachLogFile = require('../utils/attach-log-file.js');
 const RUNNER_HOME = process.env.OMEGA_RUNNER_HOME || defaultRunnerHome();
 loadRunnerEnv({ home: RUNNER_HOME });
@@ -102,8 +104,8 @@ function orgRunnerDir(org, home) {
 }
 const ACTIONS_RUNNER_VERSION = '2.319.1';   // pinned; bump intentionally
 
-// The subcommands, and the two of them that run on any platform: self-update is
-// an npm install, monitor only reads a log file. Every other one is the box's.
+// The subcommands, and the one of them that runs on any platform: monitor only
+// reads a log file. Every other one is the box's.
 const SUBCOMMANDS = {
   'install':      install,
   'config':       configureRunner,
@@ -113,17 +115,16 @@ const SUBCOMMANDS = {
   'stop':         stopServices,
   'status':       statusServices,
   'uninstall':    uninstall,
-  'self-update':  selfUpdate,
   'monitor':      monitor,
 };
-const ANY_PLATFORM_SUBCOMMANDS = new Set(['self-update', 'monitor']);
+const ANY_PLATFORM_SUBCOMMANDS = new Set(['monitor']);
 
 // The ones that CHANGE the machine: they register, deregister, download, delete,
-// kill listeners, rewrite the box's own configuration, or run a global npm
-// install. A test process may only point these at a scratch home
+// kill listeners, or rewrite the box's own configuration. A test process may
+// only point these at a scratch home
 // ([#337](https://github.com/Omega-JS-Stack/omega/issues/337) — the suite once
 // ran a real install against the box). `status` and `monitor` only read.
-const MUTATING_SUBCOMMANDS = new Set(['install', 'config', 'register-org', 'start', 'restart', 'stop', 'uninstall', 'self-update']);
+const MUTATING_SUBCOMMANDS = new Set(['install', 'config', 'register-org', 'start', 'restart', 'stop', 'uninstall']);
 
 module.exports = async function (options) {
   options = options || {};
@@ -260,7 +261,7 @@ async function install(options) {
   // admin orgs on a tick ran as NT AUTHORITY\NETWORK SERVICE in Session 0, so
   // the runners it spawned could not see the user's cert store and the Startup
   // shortcuts it wrote landed in the wrong profile. Adding a new org is a
-  // `mgr runner install` away; uninstall() still tears down any leftover
+  // `npx omega runner start` away; uninstall() still tears down any leftover
   // watcher service from an older install.
 
   // 5. Save install metadata.
@@ -303,7 +304,7 @@ async function install(options) {
     logger.log('');
     logger.log(`Bringing every registered runner (${succeeded.length}) online in the background. 'npx omega runner status' shows them, 'npx omega runner monitor' tails the log.`);
     logger.log('');
-    await startServices({ ...options, _home: home });
+    await startServices({ ...options, _home: home, _reconcileDone: true });
   }
 }
 
@@ -415,7 +416,7 @@ async function registerOrg(options) {
   const runnerDir   = orgRunnerDir(org, home);
   const templateDir = options._templateDir || path.join(home, '_template');
   if (!jetpack.exists(path.join(templateDir, 'config.cmd'))) {
-    throw new Error(`actions/runner template not found at ${templateDir}. Run 'npx omega runner install' first.`);
+    throw new Error(`actions/runner template not found at ${templateDir}. Run 'npx omega runner start' first.`);
   }
   if (jetpack.exists(runnerDir)) {
     logger.log(`  Removing stale actions-runner-${org.toLowerCase()}/ before re-clone…`);
@@ -480,9 +481,27 @@ async function registerOrg(options) {
   // runner's `<runner dir>\.env`, which the listener reads at startup and
   // applies to every job, so the detached spawn and the Startup shortcut both
   // get it from one write.
+  //
+  // The job guard travels the same way
+  // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): the hook the
+  // listener runs before a job's first step, refusing anything that is not a
+  // dispatch from a listed repo by a listed actor. The actor list starts as the
+  // `GH_TOKEN` user, which is this box owner's account and the account a
+  // `workflow_dispatch` from the deploy token carries (Ian 2026-09-13); a
+  // lookup that does not answer leaves the file for the operator rather than
+  // failing a registration over it.
   const privateHome = ensureRunnerPrivateHome(home, { logger });
-  ensureRunnerDirEnv(runnerDir, { HOME: privateHome.home });
+  let actor;
+  try {
+    const { data } = await octokit.rest.users.getAuthenticated();
+    actor = data.login;
+  } catch (e) {
+    logger.warn(`  Could not read the GH_TOKEN user for the job guard's actor list: ${e.message}`);
+  }
+  const guard = ensureRunnerJobGuard(home, { orgs: [org], actor, logger });
+  ensureRunnerDirEnv(runnerDir, { HOME: privateHome.home, ACTIONS_RUNNER_HOOK_JOB_STARTED: guard.hook });
   logger.log(`  HOME for ${org}: ${privateHome.home}`);
+  logger.log(`  Job guard for ${org}: ${guard.hook}`);
 
   // Write the .cmd shortcut in the user's Startup folder so Explorer auto-runs
   // it at every interactive logon (Session 1). No Task Scheduler, no admin
@@ -509,7 +528,8 @@ async function registerOrg(options) {
 // What `start` settles before it touches a listener: the box's required keys —
 // asked in a terminal and refused without one, exactly like install — and then
 // the orgs the .env names against the orgs this install actually registered.
-// start registers nothing; it names the command that would.
+// start only ever ADDS a named admin org (reconcileRunnerInstall); reshaping the
+// box to the list is install's, so the mismatch names it.
 async function startPreflight(options) {
   const { home, env = process.env, logger: log = logger, prompt, interactive } = options || {};
   await ensureRunnerConfig({ home, env, logger: log, prompt, interactive });
@@ -518,16 +538,27 @@ async function startPreflight(options) {
   // an install that predates it, or a runner dir whose `.env` was replaced, has
   // no HOME line, and the job it picks up then dies inside `actions/checkout`.
   // Every registered dir gets it here, before a single listener comes up.
+  //
+  // And the job guard with it
+  // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): a box that
+  // installed before the guard existed, or a runner dir whose `.env` lost the
+  // line, would otherwise come online signing for anything. The hook script is
+  // rewritten from this package, so a framework update reaches the box on the
+  // next start; the allow lists are the operator's and are only appended to,
+  // and this path asks GitHub nothing, so `start` still works offline.
   const privateHome = ensureRunnerPrivateHome(home, { logger: log });
-  for (const { org, dir } of listOrgRunnerDirs(home)) {
-    ensureRunnerDirEnv(dir, { HOME: privateHome.home });
+  const dirs = listOrgRunnerDirs(home);
+  const guard = ensureRunnerJobGuard(home, { orgs: dirs.map(({ org }) => org), logger: log });
+  for (const { org, dir } of dirs) {
+    ensureRunnerDirEnv(dir, { HOME: privateHome.home, ACTIONS_RUNNER_HOOK_JOB_STARTED: guard.hook });
     log.log(`HOME for ${org}: ${privateHome.home}`);
+    log.log(`Job guard for ${org}: ${guard.hook}`);
   }
 
   const named      = parseRunnerOrgs(env.OMEGA_RUNNER_ORGS);
   const registered = readConfig(home).registeredOrgs || [];
   if (named.length > 0 && !sameRunnerOrgs(named, registered)) {
-    log.warn(`OMEGA_RUNNER_ORGS names ${named.join(', ')} but this install registered ${registered.join(', ') || '(none)'}. Run \`npx omega runner install\` to apply.`);
+    log.warn(`OMEGA_RUNNER_ORGS names ${named.join(', ')} but this install registered ${registered.join(', ') || '(none)'}. \`start\` registers a named admin org it does not serve yet and keeps the rest; \`npx omega runner install\` reshapes the box to the list.`);
   }
 }
 
@@ -544,6 +575,92 @@ function runnerStartupTargets(home) {
   });
 }
 
+// What `start` settles between the preflight and the spawns
+// ([#937](https://github.com/Omega-JS-Stack/omega/issues/937)), so a box never
+// needs a second verb to catch up:
+//  1. a stale actions/runner download is refreshed IN PLACE: the template is
+//     re-downloaded and laid over each org dir whose listener is down. The
+//     registration (`.runner`, `.credentials`, `.env`) is never in the
+//     template, so it survives the copy. A live listener holds its binaries
+//     open, so that org is skipped and named with `restart`, and the new
+//     version is recorded only once every org dir took it. No teardown. A
+//     download or a copy that fails is one warn and a skipped refresh, never
+//     a failed start: the next start tries again.
+//  2. an admin org the box does not serve yet (OMEGA_RUNNER_ORGS honoured) is
+//     registered, Startup shortcut and all. The only step that needs GitHub,
+//     so discovery that fails is one line and the box still comes online.
+//     GH_TOKEN is never missing here: it is a required key, and the preflight
+//     refuses a box without one. Orgs registered outside the filter stay;
+//     reshaping the box to the list is install's.
+//
+// `_download`, `_discoverOrgs` and `_registerOrg` are the tests' seams, the way
+// `_spawn` is. Registration is not home-scoped (it acts on GitHub with the real
+// token, whatever scratch home a case made), so a test run that has not
+// injected both GitHub seams skips the org check instead of reaching it.
+async function reconcileRunnerInstall(options) {
+  const home        = options._home;
+  const env         = options._env;
+  const log         = options._logger;
+  const listen      = options._listeners;
+  const download    = options._download || downloadActionsRunner;
+  const templateDir = path.join(home, '_template');
+
+  const installed = readConfig(home).actionsRunnerVersion;
+  if (installed !== ACTIONS_RUNNER_VERSION) {
+    log.log(`actions/runner ${installed || '(unrecorded)'} is installed and ${ACTIONS_RUNNER_VERSION} is pinned: refreshing in place.`);
+    let downloaded = true;
+    try {
+      await download(templateDir, home);
+    } catch (e) {
+      log.warn(`✗ actions/runner ${ACTIONS_RUNNER_VERSION} download failed (${e.message}): refresh skipped until the next start.`);
+      downloaded = false;
+    }
+    if (downloaded) {
+      let skipped = 0;
+      for (const { org, dir } of listOrgRunnerDirs(home)) {
+        if (listen(dir).length > 0) {
+          log.warn(`· ${org} is running, so its actions/runner files are locked and were not refreshed. Run \`npx omega runner restart\` to refresh it.`);
+          skipped++;
+          continue;
+        }
+        try {
+          jetpack.copy(templateDir, dir, { overwrite: true });
+          log.log(`✓ ${org} refreshed to actions/runner ${ACTIONS_RUNNER_VERSION}`);
+        } catch (e) {
+          log.warn(`✗ ${org} was not refreshed (${e.message}): the next start tries again.`);
+          skipped++;
+        }
+      }
+      if (skipped === 0) saveConfig({ actionsRunnerVersion: ACTIONS_RUNNER_VERSION }, home);
+    }
+  }
+
+  if (isTestRun() && !(options._discoverOrgs && options._registerOrg)) {
+    log.log('Org check skipped: a test run never asks GitHub unless both _discoverOrgs and _registerOrg are injected.');
+    return;
+  }
+  const discover = options._discoverOrgs || discoverAdminOrgs;
+  const register = options._registerOrg || registerOrg;
+  let adminOrgs;
+  try {
+    adminOrgs = await discover();
+  } catch (e) {
+    log.warn(`Org check skipped: could not list your admin orgs (${e.message}).`);
+    return;
+  }
+  const { orgs } = selectRunnerOrgs(adminOrgs, env.OMEGA_RUNNER_ORGS);
+  const served   = new Set((readConfig(home).registeredOrgs || []).map((org) => org.toLowerCase()));
+  for (const org of orgs.filter((o) => !served.has(o.toLowerCase()))) {
+    log.log(`Registering ${org}: an admin org this box does not serve yet.`);
+    try {
+      await register({ ...options, _: ['runner', 'register-org', org], _templateDir: templateDir });
+    } catch (e) {
+      log.warn(`✗ register ${org}: ${e.message}`);
+      process.exitCode = 1;
+    }
+  }
+}
+
 // Every registered org, brought online detached, in Startup-shortcut order.
 //
 // A box registers one runner per org, and `start` used to bring up exactly ONE
@@ -559,7 +676,15 @@ function runnerStartupTargets(home) {
 // `_spawn` and `_listeners` are injected by the tests, the same way `_home` and
 // `_logger` are: neither cmd.exe nor the process scan exists off Windows.
 // `_preflightDone` is `restart`'s: it settles the box config BEFORE it kills
-// anything, so the walk must not run a second time here.
+// anything, so the walk must not run a second time here. The reconcile is NOT
+// gated on it: after restart's stop is exactly when nothing is locked.
+// `_reconcileDone` is install's alone: it just downloaded and registered, so the
+// reconcile is skipped there.
+//
+// A bare box (no template to clone from) is handed to install, `_install` in
+// the tests, which ends by calling this function again with the template in
+// place. A test run without `_install` refuses: the real install downloads,
+// discovers and registers against GitHub, and no scratch home scopes that.
 async function startServices(options) {
   options = options || {};
   ensureWindows();
@@ -567,8 +692,23 @@ async function startServices(options) {
   const log     = options._logger || logger;
   const spawnIt = options._spawn || spawnRunnerDetached;
   const listen  = options._listeners || listRunnerListenerProcessesUnder;
+  if (!jetpack.exists(path.join(home, '_template', 'config.cmd'))) {
+    if (isTestRun() && !options._install) {
+      throw new Error(
+        `Refusing to install onto the bare runner home ${home}: this is a test run `
+        + '(OMEGA_TEST_RUNNER / OMEGA_TEST_MODE) and the call did not inject `_install`. The real install '
+        + 'downloads actions/runner and registers every admin org against GitHub with GH_TOKEN.',
+      );
+    }
+    log.log(`No runner install under ${home}: running the full install.`);
+    return (options._install || install)(options);
+  }
+  const env = options._env || process.env;
   if (!options._preflightDone) {
-    await startPreflight({ home, env: options._env || process.env, logger: log, prompt: options._prompt, interactive: options._interactive });
+    await startPreflight({ home, env, logger: log, prompt: options._prompt, interactive: options._interactive });
+  }
+  if (!options._reconcileDone) {
+    await reconcileRunnerInstall({ ...options, _home: home, _env: env, _logger: log, _listeners: listen });
   }
   const targets = runnerStartupTargets(home);
   if (targets.length === 0) {
@@ -732,7 +872,7 @@ async function statusServices(options) {
   logger.log('');
   const report = orgRunnerReport({ home });
   if (report.length === 0) {
-    logger.warn('No orgs registered. Run `npx omega runner install`.');
+    logger.warn('No orgs registered. Run `npx omega runner start`.');
   } else {
     logger.log(`Per-org runner state (${report.length}):`);
     for (const { state, lines } of report) {
@@ -966,7 +1106,13 @@ async function removeRunnerHomeWithRetry(keepDirs, home) {
   // open by the tee while the removal runs.
   const envFile = runnerEnvFile(root);
   const logsDir = path.dirname(runnerLogFile(root));
-  const keep = new Set([...(keepDirs || []), envFile, logsDir]);
+  // The job guard's two allow lists are configuration too
+  // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): a list an
+  // operator narrowed by hand outlives an uninstall exactly as the `.env` does.
+  // The hook SCRIPT is install state and goes with the rest; the next install
+  // writes it back from the package.
+  const guardLists = jobGuardListFiles(root);
+  const keep = new Set([...(keepDirs || []), envFile, logsDir, ...guardLists]);
   const targets = (jetpack.list(root) || [])
     .map((name) => path.join(root, name))
     .filter((entry) => !keep.has(entry));
@@ -974,7 +1120,8 @@ async function removeRunnerHomeWithRetry(keepDirs, home) {
   // Nothing kept survives on disk: the home itself goes too.
   const kept = [...(keepDirs || [])].length > 0
             || jetpack.exists(envFile) === 'file'
-            || jetpack.exists(logsDir) === 'dir';
+            || jetpack.exists(logsDir) === 'dir'
+            || guardLists.some((file) => jetpack.exists(file) === 'file');
   if (!kept) targets.push(root);
 
   for (const target of targets) {
@@ -1124,19 +1271,6 @@ function identifyHandleHolders(targetPath) {
   }
 }
 
-// ─── self-update ────────────────────────────────────────────────────────────────
-async function selfUpdate() {
-  const { execute } = require('node-powertools');
-  logger.log('Updating @omega.js/desktop to latest…');
-  try {
-    const out = await safeInstall('npm i -g @omega.js/desktop@latest');
-    logger.log(out);
-    logger.log('✓ @omega.js/desktop updated.');
-  } catch (e) {
-    logger.warn(`Self-update failed: ${e.message}`);
-  }
-}
-
 // ─── helpers ────────────────────────────────────────────────────────────────────
 
 const WATCHER_SERVICE_NAME = 'omega-runner-watcher';
@@ -1534,8 +1668,8 @@ function listLegacyRunnerStartupShortcuts(startupDir) {
 // wrapper that blocks for the lifetime of the listener with cwd = runnerDir;
 // a long-lived cmd.exe holding cwd inside RUNNER_HOME blocks every later
 // uninstall with EPERM. Bypassing run.cmd loses its self-update relaunch
-// path, but `mgr runner install` refreshing the runner binary is the
-// preferred update mechanism in @omega.js/desktop anyway.
+// path, but `npx omega runner start` refreshing the runner binary in place
+// is the update mechanism in @omega.js/desktop anyway.
 //
 // Detached + windowsHide + ignored stdio = no console window flashes during
 // install and the listener survives the install command's exit. UAC-
@@ -1696,7 +1830,7 @@ async function monitor(options) {
   // exactly which orgs the monitor will pick up signing events from.
   const report = orgRunnerReport({ home });
   if (report.length === 0) {
-    logger.log('(no orgs registered yet — run `npx omega runner install` first)');
+    logger.log('(no orgs registered yet: run `npx omega runner start` first)');
   } else {
     logger.log(`Monitoring signing requests across ${report.length} org(s):`);
     for (const { state, lines } of report) {

package/dist/commands/sign-windows.js

@@ -1,6 +1,6 @@
 // Strategy-aware Windows code signer.
 //
-// Reads strategy from config platforms.win.signing.strategy:
+// Reads strategy from config platforms.windows.signing.strategy:
 //   self-hosted — sign with signtool against an EV USB token (typically on a self-hosted runner)
 //   cloud       — shell out to a cloud signing provider's CLI (Azure / SSL.com / DigiCert)
 //   local       — no-op (developer signs manually on their own Windows box)
@@ -33,6 +33,8 @@ runnerEnv.loadRunnerEnv();
 const attachLogFile = require('../utils/attach-log-file.js');
 
 const { startAutoUnlock } = require('../lib/sign-helpers/auto-unlock.js');
+const { assertConsoleUnlocked } = require('../lib/sign-helpers/console-lock.js');
+const { execWithLimit } = require('../lib/sign-helpers/exec-with-limit.js');
 const { writeUpdateInfo } = require('../lib/sign-helpers/update-info.js');
 const signEvents = require('../lib/sign-helpers/sign-events.js');
 
@@ -140,9 +142,9 @@ async function runSignCommand(options) {
   }
 
   if (strategy === 'cloud') {
-    const provider = config.platforms?.win?.signing?.cloud?.provider;
+    const provider = config.platforms?.windows?.signing?.cloud?.provider;
     if (!provider) {
-      throw new Error('strategy=cloud but no provider set (config platforms.win.signing.cloud.provider).');
+      throw new Error('strategy=cloud but no provider set (config platforms.windows.signing.cloud.provider).');
     }
     await signWithCloudProvider(provider, targets, inDir, outDir);
     return;
@@ -261,9 +263,17 @@ function buildVerifyCommand({ signtool, outPath }) {
 const SIGN_ATTEMPTS       = 3;
 const SIGN_RETRY_DELAY_MS = 5000;
 
-// node-powertools' `execute` with `log: false` — what this file passes — rejects
-// with `new Error(stderr || 'Command failed with exit code N')`, and the sign
-// command ends in `2>&1` (it runs through a shell), so BOTH of signtool's
+// A healthy sign takes ~18s (the timestamp round trip is most of it). One that
+// is still running minutes later is waiting on something that will never come:
+// a PIN typed at a locked console, a dialog nobody can see. Every attempt gets
+// this hard limit, after which the signtool process tree is terminated and the
+// attempt fails with a message that says so, instead of holding the job until
+// GitHub's six-hour default cancels it ([#864](https://github.com/Omega-JS-Stack/omega/issues/864)).
+const SIGN_TIME_LIMIT_MS  = 3 * 60 * 1000;
+
+// node-powertools' `execute` with `log: false` — what execWithLimit passes —
+// rejects with `new Error(stderr || 'Command failed with exit code N')`, and the
+// sign command ends in `2>&1` (it runs through a shell), so BOTH of signtool's
 // streams reach `e.message` and this is classifying on signtool's own words.
 //
 // Failures signtool NAMES as permanent. Retrying a wrong PIN walks the EV token
@@ -298,7 +308,7 @@ async function signWithRetry(cmd, options) {
     file,
     attempts    = SIGN_ATTEMPTS,
     delayMs     = SIGN_RETRY_DELAY_MS,
-    exec        = (c) => execute(c, { log: false }),
+    exec        = (c) => execWithLimit(c, { limitMs: SIGN_TIME_LIMIT_MS, label: 'signtool' }),
     sleep       = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     emit        = signEvents.emit,
     startUnlock = () => ({ stop: () => {} }),
@@ -334,7 +344,17 @@ async function signWithRetry(cmd, options) {
   throw new Error(`signWithRetry exhausted ${attempts} attempts without a verdict`);
 }
 
-async function signWithSigntool(targets, inDir, outDir) {
+// The signing loop. Both of its shell-outs and every line it prints sit behind
+// one seam (`deps.exec` runs signtool, `deps.logger` prints), so the ORDER that
+// makes the proof line true (sign, verify, THEN the line) is provable without a
+// Windows box. Production passes neither: the real signtool and the real logger
+// are the defaults, and the deliberate end-to-end sign is sign-windows-e2e.
+async function signWithSigntool(targets, inDir, outDir, deps) {
+  deps = deps || {};
+  const exec = deps.exec;
+  const runVerify = exec || ((command) => execute(command, { log: false }));
+  const log = deps.logger || logger;
+
   const projectRoot = process.cwd();
   const { tokenRef, password, useThumbprint, signtool, timestampUrl } = resolveSigntoolEnv();
 
@@ -343,6 +363,11 @@ async function signWithSigntool(targets, inDir, outDir) {
   // update mechanism (not electron-updater) and don't need a yml.
   const signedExes = [];
 
+  // The PIN is typed into the Token Logon dialog on the interactive desktop.
+  // Behind a lock screen it never arrives and signtool waits forever, so a
+  // locked console is refused before the first call (console-lock.js).
+  if (useThumbprint && password) await assertConsoleUnlocked();
+
   for (const target of targets) {
     const rel = path.relative(inDir, target);
     const outPath = path.join(outDir, rel);
@@ -353,7 +378,7 @@ async function signWithSigntool(targets, inDir, outDir) {
 
     const cmd = buildSignCommand({ signtool, tokenRef, password, timestampUrl, outPath });
 
-    logger.log(`Signing ${path.relative(projectRoot, outPath)}${useThumbprint ? ' (thumbprint mode)' : ''}...`);
+    log.log(`Signing ${path.relative(projectRoot, outPath)}${useThumbprint ? ' (thumbprint mode)' : ''}...`);
 
     const fileBytes = (() => { try { return fs.statSync(outPath).size; } catch (_) { return null; } })();
     signEvents.emit('sign-start', {
@@ -370,6 +395,7 @@ async function signWithSigntool(targets, inDir, outDir) {
     try {
       await signWithRetry(cmd, {
         file: path.basename(outPath),
+        exec,
         startUnlock: () => (useThumbprint ? startAutoUnlock({ password, logger }) : { stop: () => {} }),
       });
     } catch (e) {
@@ -385,7 +411,7 @@ async function signWithSigntool(targets, inDir, outDir) {
     // Verify is a local check with no third party in it — one shot.
     const verifyCmd = buildVerifyCommand({ signtool, outPath });
     try {
-      await execute(verifyCmd, { log: false });
+      await runVerify(verifyCmd);
     } catch (e) {
       signEvents.emit('sign-fail', {
         file: path.basename(outPath),
@@ -399,7 +425,11 @@ async function signWithSigntool(targets, inDir, outDir) {
       file: path.basename(outPath),
       duration_ms: Date.now() - fileStart,
     });
-    logger.log(logger.format.green(`✓ Signed: ${path.relative(projectRoot, outPath)}`));
+    // The proof line, in the mac lane's shape (hooks/notarize.js): the verify
+    // above aborts the job on a failure, so this line names the check that ran
+    // rather than claiming a signature nobody checked
+    // ([#918](https://github.com/Omega-JS-Stack/omega/issues/918)).
+    log.log(`Signed and verified: signtool verify /pa accepts ${path.basename(outPath)}.`);
 
     if (outPath.toLowerCase().endsWith('.exe')) {
       signedExes.push({ filePath: outPath, urlName: path.basename(outPath) });
@@ -414,9 +444,9 @@ async function signWithSigntool(targets, inDir, outDir) {
     const pkg = Manager.getPackage('project') || {};
     const version = pkg.version;
     if (!version) {
-      logger.warn('Could not determine version from package.json — skipping latest.yml generation.');
+      log.warn('Could not determine version from package.json; skipping latest.yml generation.');
     } else {
-      logger.log(`Generating Windows auto-updater feed (latest.yml) for ${signedExes.length} installer(s)...`);
+      log.log(`Generating Windows auto-updater feed (latest.yml) for ${signedExes.length} installer(s)...`);
       try {
         await writeUpdateInfo({
           signedExes,
@@ -428,8 +458,8 @@ async function signWithSigntool(targets, inDir, outDir) {
         // Don't fail the whole sign step if yml generation hits something unexpected —
         // the signed exe is still valid + uploadable. But this IS a real problem
         // because auto-updates won't work, so log loudly.
-        logger.error(`latest.yml generation failed: ${e.message}`);
-        logger.error('  Signed binary is OK but Windows auto-updater will not see this release.');
+        log.error(`latest.yml generation failed: ${e.message}`);
+        log.error('  Signed binary is OK but Windows auto-updater will not see this release.');
       }
     }
   }
@@ -554,6 +584,7 @@ module.exports.signWithRetry          = signWithRetry;
 module.exports.isTransientSignFailure = isTransientSignFailure;
 module.exports.SIGN_ATTEMPTS          = SIGN_ATTEMPTS;
 module.exports.SIGN_RETRY_DELAY_MS    = SIGN_RETRY_DELAY_MS;
+module.exports.SIGN_TIME_LIMIT_MS     = SIGN_TIME_LIMIT_MS;
 
 // Exports for the Windows-gated end-to-end suite — the halves that shell out to
 // signtool for real. They only run where signtool and the EV token are

package/dist/commands/test.js

@@ -13,9 +13,10 @@ module.exports = async function (options) {
   // This process is a TEST RUN, and everything it spawns inherits that. The box's
   // mutating verbs read it and refuse to touch a real runner home
   // ([#337](https://github.com/Omega-JS-Stack/omega/issues/337): a suite once ran
-  // a real `runner install` on the signing box). Deliberately NOT the canonical
-  // OMEGA_TEST_MODE, which means "the app under test runs in testing mode" and
-  // would change what the boot lane's production build compiles.
+  // a real `runner install` on the signing box). Deliberately a marker about THIS
+  // process, never a word about the app under test: the environment the thing
+  // being tested RUNS in is `OMEGA_ENVIRONMENT`, and the runners name it on their
+  // own children alone (#925).
   process.env.OMEGA_TEST_RUNNER = '1';
 
   // Tee all test output to <projectRoot>/logs/test.log (ANSI-stripped) — mirrors