@robsonai/emilyremote 0.3.0 → 0.4.1

package/README.md

@@ -1,125 +1,125 @@
-# EmilyRemote by RobsonAI
+# EmilyRemote 0.4.1
 
-EmilyRemote installs the RobsonAI EmilyRemote 0.3.0 host SDK from a bundled,
-verified Python wheel. The Python namespace is `emilyremote`, the Python
-distribution is `robsonai-emilyremote`, and the command is `emilyremote`.
-The requested npm publication target is **`@robsonai/emilyremote`**. The display
-name is **EmilyRemote**; npm package names use lowercase. Organization ownership
-and publication are pending verification. The examples below become public
-installation commands after publication.
+EmilyRemote lets an authorized controller assign work to a device without
+installing a Claude or Codex agent there. This package contains the compiled
+**device runtime** for Linux x64 and Apple Silicon Macs. It requires **Node.js 22
+or newer and npm**; a separate Python interpreter is not required.
 
-## Install and initialize
+## Supported systems
 
-Requires Node.js 18 or newer and Python 3.11 or newer with `venv` and `ensurepip`.
-The wrapper has no external Node dependencies. The SDK core has no external
-Python dependencies.
-
-```bash
-npm install -g @robsonai/emilyremote@0.3.0
-emilyremote setup --python python3
+| System | This release |
+| --- | --- |
+| Linux x64 servers, PCs and NUCs | Included; glibc 2.38 or newer required. |
+| Apple Silicon Macs, including M3 | Included; macOS 26.0 or newer required by the compiled dependencies. Tested on an M3 Max running macOS 27. |
+| Intel Macs | No qualified native build included. |
+| Raspberry Pi / Linux ARM | No native build included. |
+| Windows | No native build included. |
+| Android / iPhone | This npm package is not a mobile app. |
+| Arduino-class microcontrollers | Cannot run this host runtime; supported host-side serial/firmware workflows are a separate capability. |
+
+Use an arm64 Node.js 22+ installation on Apple Silicon. Running x64 Node under
+Rosetta selects the unbuilt Intel target. npm's OS/CPU filters cannot express
+every pair in this table; `emilyremote platforms` reports the exact runtime
+availability and setup rejects unbuilt pairs. Do not bypass those checks.
+
+## Install and check
+
+After installing Node.js and npm, run:
+
+```sh
+npm install -g @robsonai/emilyremote@0.4.1
+emilyremote setup
 emilyremote self-check
+emilyremote status
 ```
 
-Or use npx:
-
-```bash
-npx --yes --package=@robsonai/emilyremote@0.3.0 emilyremote setup --python python3
-npx --yes --package=@robsonai/emilyremote@0.3.0 emilyremote self-check
+Run setup as your normal user. Both `emilyremote` and `emilyremote-native` invoke
+the same launcher. Setup chooses the archive matching the host, verifies its
+pinned SHA-256 and complete inventory, and runs its native self-check before
+activation. It needs no network after npm installation. npm installation runs no
+lifecycle setup or native executable.
+
+**Setup installs the device runtime. It does not enroll a device, start a
+service, connect to Emily, install a model or change system packages.** A
+controller URL and appropriate device credentials/configuration are still
+required. This package does not provide an end-user Emily login, terminal chat,
+or automatic binding to the user's clone.
+
+For an existing deployment, use a separate prefix to preserve its current CLI:
+
+```sh
+umask 077
+install_root="$HOME/.local/share/robsonai/emilyremote-0.4.1"
+npm install --prefix "$install_root/npm" --ignore-scripts --no-audit --no-fund \
+  @robsonai/emilyremote@0.4.1
+"$install_root/npm/node_modules/.bin/emilyremote" setup --home "$install_root/state"
+"$install_root/npm/node_modules/.bin/emilyremote" --home "$install_root/state" self-check
 ```
 
-Installing the npm package runs no lifecycle hook. `setup` is an explicit action:
-it creates a private, versioned virtualenv and installs the bundled wheel using
-`pip --isolated --no-index --no-deps`. It checks the wheel SHA-256, installed
-metadata, every installed SDK Python file, and the SDK self-check before writing
-an atomic READY receipt. A failed attempt is retained for diagnosis and never
-published as a ready installation. A setup lock prevents simultaneous installers.
-If a process dies during setup, inspect the reported lock before removing it.
-
-Setup does not install system Python, Node, optional dependencies, operating
-system services, enroll a node, configure credentials, or start a worker.
-On Debian/Ubuntu, Python may require its matching `python3-venv` system package.
-The wrapper reports missing prerequisites and does not install them implicitly.
-
-## Isolated installation or local tarball
-
-```bash
-npm install --prefix ./npm-runtime --ignore-scripts --no-audit --no-fund ./robsonai-emilyremote-0.3.0.tgz
-./npm-runtime/node_modules/.bin/emilyremote setup --home ./emilyremote-state --python /usr/bin/python3
-./npm-runtime/node_modules/.bin/emilyremote --home ./emilyremote-state self-check
-./npm-runtime/node_modules/.bin/emilyremote --home ./emilyremote-state status
-```
-
-`--home` or `EMILYREMOTE_HOME` selects the installation directory. Otherwise the
-defaults are:
-
-| Platform | Default |
-| --- | --- |
-| Linux | `$XDG_DATA_HOME/robsonai/emilyremote`, otherwise `~/.local/share/robsonai/emilyremote` |
-| macOS | `~/Library/Application Support/RobsonAI/EmilyRemote` |
-| Windows | `%LOCALAPPDATA%\RobsonAI\EmilyRemote` |
-
-Choose a directory owned by your account with trusted parent directories.
-POSIX setup rejects writable shared ancestors, except root-owned sticky temporary
-directories, and rejects symlinked ancestors. Windows ACL behavior still needs
-native qualification; use the default per-user location.
-
-Use the same home for setup and subsequent commands. A new npm invocation can
-reuse the same verified runtime. `setup --python` accepts an executable path,
-including spaces, rather than a shell command. Windows setup also probes the
-`py -3` launcher when no executable is selected. PowerShell can invoke the npm
-generated `emilyremote.cmd` shim; use a Python executable path for `--python`.
-Only the `emilyremote` command is installed. The explicit npx `--package` form
-selects that command directly. For an unpublished local tarball, use
-`npx --offline --yes --package=./robsonai-emilyremote-0.3.0.tgz emilyremote --help`.
-
-## Upgrading from the earlier package
-
-The historical `@martinrobson/dialhome@0.2.0` distribution remains separate.
-Version 0.3.0 installs the fully renamed EmilyRemote package and command without
-adding a `dialhome` alias. Use `EMILYREMOTE_HOME` or the new default directory;
-`DIALHOME_HOME` is not read. Keep old installation files and operational state
-for reference until migration is verified. Create fresh runtime/node state and
-explicitly re-enroll as needed; do not assume old identity databases, receipt
-schemas, or running services migrate automatically. Installing this version
-does not remove the prior package or change its services.
-
-## SDK commands
-
-```bash
-emilyremote --home ./emilyremote-state node --config /absolute/path/node.json
+## Homes and upgrades
+
+The native default home is:
+
+- macOS: `~/Library/Application Support/RobsonAI/EmilyRemoteNative`
+- Linux: `~/.local/share/robsonai/emilyremote-native`, or
+  `$XDG_DATA_HOME/robsonai/emilyremote-native` when configured.
+
+`--home` or `EMILYREMOTE_NATIVE_HOME` selects another native location. Spaces in
+paths are supported. Apple's root-owned `/var`, `/tmp` and `/etc` aliases are
+recognized; arbitrary symlinks and unsafe ownership/permissions remain refused.
+
+A global npm upgrade replaces the `emilyremote` command. Updating npm alone does
+not activate a different native runtime: run setup to install the new bundled
+runtime. Native installation state is separate from the older Python-based
+0.3.0 home, and the earlier `EMILYREMOTE_HOME` variable is not read. No old
+service, controller role or enrollment configuration is migrated automatically.
+Setup refuses a home containing that older installation. Previously published
+versions are not removed or revoked by this release.
+
+## Device capabilities
+
+The runtime includes shell/file tasks, PTY, tunnels, serial and firmware helpers,
+configured local-agent activity, and signed update/supervisor machinery. Mac
+launchd integration has been exercised on the test Mac; ordinary setup does not
+start it. Operation needs your controller configuration and authorization. The
+runtime uses its process owner's OS permissions; it is not a sandbox.
+
+The package does not contain a hosted controller, Emily account credentials,
+model weights or the optional `pymavlink` dependency. Release tests use controlled
+fixtures and do not establish a live Emily-to-device task-and-recall loop or
+fleet-scale qualification.
+
+## Package and runtime integrity
+
+Each native archive contains compiled SDK modules and the needed runtime
+libraries, including CPython. It carries no SDK Python source or wheel. The
+small JavaScript installer is intentionally readable. Native binaries remain
+inspectable and can be reverse engineered.
+
+Setup uses a private archive snapshot, complete hashed inventory, exclusive
+lock and isolated release directory. It rejects unsafe paths, links, special
+files, unlisted payloads and source-bearing extensions. Every launch verifies
+the active inventory. The active pointer changes only after self-check succeeds;
+caught activation failures restore the previous pointer. Interrupted locks and
+failed artifacts remain for inspection.
+
+Mac binaries and dependencies have verified ad-hoc signatures; this is not
+Apple Developer ID signing or notarization. Mach-O architecture and deployment
+targets are checked, and the actual host macOS version must meet the manifest.
+The compiled Mac runtime includes a pinned public CA bundle for its default TLS
+context unless the operator supplies an explicit trust configuration. Explicit
+operator trust settings are preserved. Certificate and hostname verification
+remain enabled.
+
+An explicit local native archive requires a trusted external digest:
+
+```sh
+emilyremote setup --bundle /absolute/path/to/reviewed-native.tar.gz \
+  --sha256 THE_EXACT_EXTERNALLY_VERIFIED_SHA256 --home /your/private/native-home
 ```
 
-Arguments are passed directly without a shell, using isolated Python mode.
-The caller's ordinary OS environment remains available to the SDK; Python path
-injection and pip index environment variables are removed. `--` stops wrapper
-option parsing. Node shutdown signals are forwarded to the Python process.
-
-Only commands explicitly requested by the caller run. The SDK's shell capability
-uses that process owner's OS permissions; this wrapper is not a sandbox. The
-wrapper's `status` reports package readiness, not a running service or enrollment.
-
-## Supported scope and validation
-
-This package installs the Python host runtime on systems that can provide the
-prerequisites. Linux package installation and self-check are verified for this
-release. macOS and Windows paths and launcher handling are implemented but still
-require native qualification. Core installation
-does not include the optional `cryptography`, `pyserial`, or `pymavlink` packages,
-local model weights, Android APK, Arduino/ESP32 firmware, or a controller service.
-It makes no claim that Emily can dispatch a task until that integration is tested.
-
-## Draft publication procedure
-
-1. Verify the authenticated account has publish rights for the `robsonai`
-   organization and target `@robsonai/emilyremote@0.3.0`. Review licensing before
-   publishing; the package currently declares `UNLICENSED`.
-2. Run `npm test`, `npm pack --json`, and test installation of the resulting
-   tarball into a fresh prefix and fresh EmilyRemote home.
-3. Review the packed file list and provenance. It contains the SDK wheel and
-   wrapper, with no node credentials or private keys.
-4. From the verified package directory, use `npm publish --access public` only
-   after publication is authorized and the registry authentication is ready.
-5. Verify the registry tarball integrity and repeat installation using the public
-   package name. Do not describe the npm URL as live before that check succeeds.
-
-`PROVENANCE.json` records the release wheel identity and historical distribution.
+A hash verifies exact bytes, not the publisher. The npm-bundled hash is pinned in
+this installer. No separate release signature or automatic download/update
+endpoint is configured by setup. Native command arguments are passed without a
+shell, and Python-path/dynamic-loader injection variables are removed from child
+environments. Dependency inventories and notices are included in each archive.

package/RUNTIME_FORMAT.md

@@ -0,0 +1,87 @@
+# Native bundle contract — schema 1
+
+A `.tar.gz` archive in standard USTAR format contains regular files/directories,
+with no leading `./` root. Only relative paths are accepted. Links, PAX/GNU
+extensions, special files, duplicate names, unsafe modes and trailing nonzero
+content are rejected. Current limits: 256 MiB compressed, 512 MiB expanded,
+20,000 entries, 2 MiB release manifest.
+
+The root contains `emilyremote-runtime`, its dependency libraries and
+`native-release.json`. The executable receives normal SDK arguments directly;
+`emilyremote-runtime self-check` must emit JSON with `ok: true` and the exact
+runtime `version`. It must not require a separately installed Python interpreter.
+
+```json
+{
+  "schema": "emilyremote.native-release/1",
+  "version": "0.4.1",
+  "platform": "darwin",
+  "arch": "arm64",
+  "entrypoint": "emilyremote-runtime",
+  "build_manifest": "build-info.json",
+  "minimum_macos": "26.0.0",
+  "files": {
+    "emilyremote-runtime": {"sha256": "ACTUAL_EXECUTABLE_SHA256", "mode": 493},
+    "build-info.json": {"sha256": "ACTUAL_BUILD_MANIFEST_SHA256", "mode": 420}
+  }
+}
+```
+
+This example is illustrative, not a valid signed or hashed release. Mode values
+are JSON integers (493 = octal 0755, 420 = octal 0644). The example macOS minimum is illustrative, not a supported-OS promise. The
+actual minimum must come from all native build dependencies; Linux uses the
+optional `minimum_glibc` field instead. The file inventory must contain every
+regular archive file except `native-release.json` itself, including all library
+files and the build manifest. Directory entries must be parents of listed files.
+All hashes are lowercase SHA-256. ELF class, byte order and machine type must
+match the declared Linux target.
+
+The build manifest is hashed as an ordinary payload file. It should record
+version, target, compiler/toolchain identity and relevant reproducible build
+inputs without workstation paths, credentials, proprietary source, caches or
+unnecessary user information. Its public contents need a separate review; a
+correct digest does not make private information safe to publish.
+
+The default archive SHA-256 is pinned in the npm installer alongside its exact
+bundled file path. For an explicitly supplied local archive, its SHA-256 must be
+supplied through `setup --sha256`, with the file supplied through `--bundle`.
+Receipt fields retain that archive digest, release-manifest digest and
+build-manifest digest, and distinguish bundled from operator-supplied archives.
+There is no separate signed manifest or release key verification; no independent
+publisher-authentication claim is made.
+
+## macOS native extension
+
+For a Darwin bundle the manifest uses `platform: "darwin"`, `arch: "arm64"`
+and the exact release version `0.4.1`. It requires top-level
+`minimum_macos`, derived from the highest macOS deployment target across all
+native files. `minimum_glibc` is forbidden for Darwin. The build manifest records
+the same target/version, `minimum_macos`, and `signing_verified: true` only after
+actual code-signature checks pass.
+
+The entrypoint must be a thin little-endian 64-bit Mach-O executable with the
+matching generic CPU subtype. Load command bounds and macOS deployment metadata
+are validated before execution. Each Mach-O dependency must have the same CPU
+architecture and a minimum macOS version no higher than the manifest. Fat,
+32-bit, arm64e-only and non-macOS Apple binaries are not qualified by this
+release. On a real Mac the host product version is obtained using
+`/usr/bin/sw_vers -productVersion`, rather than comparing Darwin kernel versions.
+
+Native files may not use symbolic links inside the archive; packaging must
+materialize or otherwise safely arrange dependencies before the final inventory
+and signature verification. Required dependency notices remain ordinary hashed
+payload files. The npm build availability list must remain `unbuilt` until a
+real artifact has passed native execution and publication-content review.
+
+The development-only `validation/check-release.cjs` gate consumes
+`validation/native-qualification-darwin-arm64.json` with schema
+`emilyremote.native-qualification/1`, exact `version`, `target`,
+`bundle_sha256`, a detailed `evidence_path`, and checks marked `passed` for
+`compiled_self_check`, `fresh_npm_install`, `both_cli_aliases`,
+`without_host_python`, `source_and_secret_audit`, `dependency_notices`,
+`codesign_verified`, and `native_arm64_host`. Such a receipt is an evidence index,
+not a cryptographic attestation: a reviewer must examine the actual logs.
+
+Mach-O constants and layout are defined in Apple's published headers:
+- https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/loader.h
+- https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/machine.h

package/lib/cli.cjs

@@ -1,282 +1,440 @@
 'use strict';
 
+// Public JavaScript installation/launch plumbing. SDK implementation is compiled
+// in the separately inventoried vendor runtime, never shipped here as source.
 const fs = require('node:fs');
-const os = require('node:os');
 const path = require('node:path');
+const os = require('node:os');
 const crypto = require('node:crypto');
+const zlib = require('node:zlib');
 const { spawn, spawnSync } = require('node:child_process');
 
-const VERSION = '0.3.0';
-const WHEEL_SHA = 'e730b011b844dc70442fa793d29c98eb9df8dea5341ebbb49ba38fd73da0269e';
-const PACKAGE_ROOT = path.resolve(__dirname, '..');
-const WHEEL = path.join(PACKAGE_ROOT, 'vendor', 'robsonai_emilyremote-0.3.0-py3-none-any.whl');
-const VERIFY = path.join(PACKAGE_ROOT, 'scripts', 'verify_install.py');
+const VERSION = '0.4.1';
+const MAX_BUNDLE = 256 * 1024 * 1024;
+const MAX_EXPANDED = 512 * 1024 * 1024;
+const MANIFEST = 'native-release.json';
+const BUILDS = Object.freeze({ 'linux-x64': 'available', 'linux-arm64': 'unbuilt', 'darwin-x64': 'unbuilt', 'darwin-arm64': 'available', 'win32-x64': 'unbuilt', 'win32-arm64': 'unbuilt' });
+// A target is enabled only after its same-version runtime is built and qualified.
+// Never fill this map from a previous-version or different-platform archive.
+const BUNDLED = Object.freeze({ 'linux-x64': Object.freeze({
+  file: 'vendor/robsonai-emilyremote-native-0.4.1-linux-x64.tar.gz',
+  sha256: '306da696df794b9a0a97a856bd3373fe9d060da6e7215d40b5b2000b4c0452f8',
+}), 'darwin-arm64': Object.freeze({
+  file: 'vendor/robsonai-emilyremote-native-0.4.1-darwin-arm64.tar.gz',
+  sha256: '827043510d73113b288861838dc914df5f4442e7a8012538b096affaf3bf5e40',
+}) });
+const HELP = `EmilyRemote native runtime installer ${VERSION}
 
-const HELP = `EmilyRemote by RobsonAI ${VERSION}
-
-  emilyremote setup [--python PATH] [--home DIRECTORY]
-  emilyremote [--home DIRECTORY] <SDK command> [arguments...]
+  emilyremote setup [--home DIRECTORY]
+  emilyremote setup --bundle FILE.tar.gz --sha256 HEX [--home DIRECTORY]
   emilyremote status [--home DIRECTORY]
+  emilyremote platforms
+  emilyremote [--home DIRECTORY] <runtime command> [arguments...]
 
-Setup explicitly installs the bundled core SDK into your own versioned Python
-virtualenv. Python 3.11+ with venv/ensurepip is required. Installation is offline.
-Installing this npm package does not start setup, services, or enrollment.
-
-Examples:
-  emilyremote setup --python python3
-  emilyremote self-check
-  emilyremote node --config /path/to/node.json
+emilyremote-native is an alias for the same command and native installation.
 
---home overrides EMILYREMOTE_HOME and the platform's per-user data directory.
---python selects a Python executable only for setup. Use -- to stop wrapper
-option parsing. Other arguments pass directly to the SDK without a shell.
-Optional update/serial/vehicle dependencies are not bundled.
+Setup chooses the matching qualified native bundle and checks its pinned SHA-256.
+Only targets reported as available by 'emilyremote platforms' may be installed.
+An explicit local --bundle requires an externally supplied --sha256. No host
+Python interpreter, wheel, download host, or source fallback is used. Installing
+this npm package runs no lifecycle setup. Other platform builds are unavailable
+until built and qualified. The small public installer is readable JavaScript;
+compiled binaries can still be inspected and reverse engineered.
 `;
 
-function parseArgs(argv) {
-  let home, python;
-  const rest = [];
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === '--') { rest.push(...argv.slice(i + 1)); break; }
-    if (argv[i] === '--home' || argv[i] === '--python') {
-      const flag = argv[i];
-      if (!argv[i + 1] || argv[i + 1].startsWith('--')) throw new Error(`${flag} requires a value`);
-      if (flag === '--home') { if (home !== undefined) throw new Error('Duplicate --home'); home = argv[++i]; }
-      else { if (python !== undefined) throw new Error('Duplicate --python'); python = argv[++i]; }
-    } else rest.push(argv[i]);
+function hash(data) { return crypto.createHash('sha256').update(data).digest('hex'); }
+function sha(file) { return hash(fs.readFileSync(file)); }
+function exists(file) { try { fs.lstatSync(file); return true; } catch (error) { if (error.code === 'ENOENT') return false; throw error; } }
+function cleanEnv(source = process.env) {
+  const env = { ...source };
+  for (const key of Object.keys(env)) if (/^(PYTHON|PIP_|NODE_OPTIONS$|NODE_PATH$|LD_PRELOAD$|LD_LIBRARY_PATH$|DYLD_)/i.test(key)) delete env[key];
+  env.PYTHONDONTWRITEBYTECODE = '1';
+  return env;
+}
+function platformTarget(platform = process.platform, arch = process.arch) {
+  const target = `${platform}-${arch}`;
+  if (!Object.hasOwn(BUILDS, target)) throw new Error(`Unsupported native platform ${target}; no source fallback is available`);
+  return target;
+}
+function requireBuilt(target) {
+  if (BUILDS[target] !== 'available') throw new Error(`Native build ${target} is unavailable in this release. No matching qualified runtime is packaged; no source fallback is available`);
+}
+function resolveBundle(options, target = platformTarget(), packageRoot = path.resolve(__dirname, '..')) {
+  if (options.bundle !== undefined || options.sha256 !== undefined) {
+    if (!options.bundle || !/^[a-fA-F0-9]{64}$/.test(options.sha256 || '')) throw new Error('An explicit --bundle requires an explicit 64-character --sha256; both options must be provided together');
+    return { bundle: path.resolve(options.bundle), sha256: options.sha256.toLowerCase() };
   }
-  if (python !== undefined && rest[0] !== 'setup') throw new Error('--python is supported only for setup');
-  return { home, python, command: rest[0], args: rest.slice(1) };
+  const bundled = BUNDLED[target];
+  if (!bundled) throw new Error(`No bundled native runtime is available for ${target}; no source fallback is available`);
+  return { bundle: path.join(packageRoot, bundled.file), sha256: bundled.sha256 };
 }
-
 function defaultHome(env = process.env, platform = process.platform, userHome = os.homedir()) {
-  if (env.EMILYREMOTE_HOME) return path.resolve(env.EMILYREMOTE_HOME);
-  if (platform === 'win32') return path.join(env.LOCALAPPDATA || path.join(userHome, 'AppData', 'Local'), 'RobsonAI', 'EmilyRemote');
-  if (platform === 'darwin') return path.join(userHome, 'Library', 'Application Support', 'RobsonAI', 'EmilyRemote');
-  return path.join(env.XDG_DATA_HOME || path.join(userHome, '.local', 'share'), 'robsonai', 'emilyremote');
+  if (env.EMILYREMOTE_NATIVE_HOME) return path.resolve(env.EMILYREMOTE_NATIVE_HOME);
+  if (platform === 'win32') return path.join(env.LOCALAPPDATA || path.join(userHome, 'AppData', 'Local'), 'RobsonAI', 'EmilyRemoteNative');
+  if (platform === 'darwin') return path.join(userHome, 'Library', 'Application Support', 'RobsonAI', 'EmilyRemoteNative');
+  return path.join(env.XDG_DATA_HOME || path.join(userHome, '.local', 'share'), 'robsonai', 'emilyremote-native');
 }
-
-function sha(file) { return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); }
-function checkWheel() { if (sha(WHEEL) !== WHEEL_SHA) throw new Error('Bundled SDK wheel failed its SHA-256 check; reinstall this npm package'); }
-function pythonPath(runtime, platform = process.platform) { return path.join(runtime, platform === 'win32' ? 'Scripts' : 'bin', platform === 'win32' ? 'python.exe' : 'python'); }
-function cleanEnv(env = process.env) {
-  const copy = { ...env };
-  // SDK children retain normal OS environment, but never inherit Python path
-  // injection or pip index settings from the calling npm process.
-  for (const key of Object.keys(copy)) if (/^(PYTHON|PIP_)/i.test(key)) delete copy[key];
-  copy.PYTHONDONTWRITEBYTECODE = '1';
-  return copy;
+function canonicalPath(target, platform = process.platform, filesystem = fs) {
+  target = path.resolve(target);
+  // macOS ships these root-owned links. Resolve only these exact aliases;
+  // calling realpath on an arbitrary user path would conceal unsafe symlinks.
+  const match = platform === 'darwin' && target.match(/^\/(var|tmp|etc)(?=\/|$)/);
+  if (!match) return target;
+  const alias = `/${match[1]}`, parent = filesystem.lstatSync('/');
+  const link = filesystem.lstatSync(alias);
+  if (!link.isSymbolicLink()) return target;
+  const resolved = path.resolve('/', filesystem.readlinkSync(alias));
+  if (!parent.isDirectory() || parent.uid !== 0 || (parent.mode & 0o022) || link.uid !== 0 || resolved !== `/private/${match[1]}`) throw new Error(`Unsafe macOS system alias: ${alias}`);
+  return resolved + target.slice(alias.length);
 }
-function privateDir(directory) { fs.mkdirSync(directory, { recursive: true, mode: 0o700 }); }
-function checkHomeAncestors(home) {
-  // A private leaf is insufficient if another account can replace a parent.
-  // Root-owned sticky temporary directories protect an owned child from rename.
-  let current = path.dirname(path.resolve(home));
-  while (true) {
-    try {
-      const stat = fs.lstatSync(current);
-      if (stat.isSymbolicLink()) throw new Error(`EmilyRemote home requires real directory ancestors; resolve this symlink first: ${current}`);
-      if (!stat.isDirectory()) throw new Error(`EmilyRemote home ancestor is not a directory: ${current}`);
-      if (process.platform !== 'win32') {
-        if (![0, process.getuid()].includes(stat.uid)) throw new Error(`EmilyRemote home ancestor is not owned by this user or root: ${current}`);
-        const protectedTemporary = stat.uid === 0 && (stat.mode & 0o1000);
-        if ((stat.mode & 0o022) && !protectedTemporary) throw new Error(`EmilyRemote home ancestor is writable by other users: ${current}`);
-      }
-    } catch (error) { if (error.code !== 'ENOENT') throw error; }
-    const parent = path.dirname(current);
-    if (parent === current) break;
-    current = parent;
+function checkPath(target, { ownerLeaf = true, missing = true } = {}) {
+  target = canonicalPath(target);
+  const chain = [];
+  for (let current = target;; current = path.dirname(current)) { chain.unshift(current); if (path.dirname(current) === current) break; }
+  for (const current of chain) {
+    let stat;
+    try { stat = fs.lstatSync(current); } catch (error) { if (missing && error.code === 'ENOENT') continue; throw error; }
+    const leaf = current === target;
+    if (stat.isSymbolicLink()) throw new Error(`Symlink refused in native installation: ${current}`);
+    if (!leaf && !stat.isDirectory()) throw new Error(`Installation ancestor is not a directory: ${current}`);
+    if (process.platform === 'win32') throw new Error('Windows native installation is unbuilt; ACL qualification is required first');
+    const owners = leaf && ownerLeaf ? [process.getuid()] : [0, process.getuid()];
+    if (!owners.includes(stat.uid)) throw new Error(`Unsafe installation owner: ${current}`);
+    const stickyParent = !leaf && stat.isDirectory() && stat.uid === 0 && (stat.mode & 0o1000);
+    if ((stat.mode & 0o022) && !stickyParent) throw new Error(`Installation path is writable by other users: ${current}`);
+    if (leaf && !stat.isDirectory() && !stat.isFile()) throw new Error(`Unsupported installation file type: ${current}`);
   }
+  return target;
 }
-function checkHomePath(home, target) {
-  checkHomeAncestors(home);
-  const relative = path.relative(home, target);
-  if (relative.startsWith('..' + path.sep) || relative === '..' || path.isAbsolute(relative)) throw new Error('Path escapes EmilyRemote home');
-  let current = home;
-  for (const segment of ['', ...relative.split(path.sep).filter(Boolean)]) {
-    if (segment) current = path.join(current, segment);
-    try {
-      const stat = fs.lstatSync(current);
-      if (stat.isSymbolicLink()) throw new Error(`Symlink refused inside EmilyRemote home: ${current}`);
-      if (process.platform !== 'win32' && stat.uid !== process.getuid()) throw new Error(`EmilyRemote state must belong to the current user: ${current}`);
-      if (process.platform !== 'win32' && (stat.mode & 0o022)) throw new Error(`EmilyRemote state must not be writable by other users: ${current}`);
-    }
-    catch (error) { if (error.code !== 'ENOENT') throw error; }
+function ensureDir(directory) {
+  directory = checkPath(directory);
+  const pending = [];
+  for (let current = directory; !exists(current); current = path.dirname(current)) pending.unshift(current);
+  for (const current of pending) {
+    try { fs.mkdirSync(current, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+    checkPath(current, { missing: false });
   }
+  if (!fs.statSync(directory).isDirectory()) throw new Error(`Expected installation directory: ${directory}`);
+}
+function syncDir(directory) {
+  if (process.platform !== 'win32') { const fd = fs.openSync(directory, 'r'); try { fs.fsyncSync(fd); } finally { fs.closeSync(fd); } }
 }
-function homeDir(home, target) { checkHomePath(home, target); privateDir(target); }
-function writeJsonAtomic(destination, value) {
-  privateDir(path.dirname(destination));
-  const temp = `${destination}.${crypto.randomBytes(8).toString('hex')}.tmp`;
+function atomicWrite(file, bytes) {
+  file = checkPath(file); ensureDir(path.dirname(file));
+  const temporary = `${file}.${crypto.randomBytes(10).toString('hex')}.tmp`;
   let fd;
   try {
-    fd = fs.openSync(temp, 'wx', 0o600);
-    fs.writeFileSync(fd, JSON.stringify(value, null, 2) + '\n');
-    fs.fsyncSync(fd); fs.closeSync(fd); fd = undefined;
-    fs.renameSync(temp, destination);
-    if (process.platform !== 'win32') { const parent = fs.openSync(path.dirname(destination), 'r'); try { fs.fsyncSync(parent); } finally { fs.closeSync(parent); } }
-  } finally {
-    if (fd !== undefined) fs.closeSync(fd);
-    if (fs.existsSync(temp)) fs.unlinkSync(temp);
-  }
+    fd = fs.openSync(temporary, 'wx', 0o600); fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); fs.closeSync(fd); fd = undefined;
+    checkPath(file); fs.renameSync(temporary, file); syncDir(path.dirname(file));
+  } finally { if (fd !== undefined) fs.closeSync(fd); if (exists(temporary)) fs.unlinkSync(temporary); }
 }
+function writeJson(file, value) { atomicWrite(file, Buffer.from(JSON.stringify(value, null, 2) + '\n')); }
+function optionalBytes(file) { checkPath(file); return exists(file) ? fs.readFileSync(file) : null; }
+function restore(file, bytes) { if (bytes === null) { checkPath(file); if (exists(file)) fs.unlinkSync(file); syncDir(path.dirname(file)); } else atomicWrite(file, bytes); }
 
-function runChecked(executable, args, options = {}, runner = spawnSync) {
-  const result = runner(executable, args, { shell: false, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024,
-    timeout: 120000, windowsHide: true, env: cleanEnv(), ...options });
-  if (result.error) throw new Error(`Could not run ${path.basename(executable)}: ${result.error.code || result.error.message}`);
-  if (result.status !== 0) throw new Error(`Command failed (${result.status === null ? result.signal : result.status}): ${(result.stderr || result.stdout || '').trim().slice(-3000)}`);
-  return result.stdout || '';
+function snapshotBundle(source, destination, expectedSHA) {
+  if (!/^[a-fA-F0-9]{64}$/.test(expectedSHA || '')) throw new Error('An explicit 64-character --sha256 is required for the native bundle');
+  if (fs.lstatSync(source).isSymbolicLink()) throw new Error('Native bundle source must not be a symlink');
+  checkPath(destination); ensureDir(path.dirname(destination));
+  let input, output, created = false;
+  const digest = crypto.createHash('sha256'); let size = 0;
+  try {
+    input = fs.openSync(source, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0));
+    if (!fs.fstatSync(input).isFile()) throw new Error('Native bundle source must be a regular file');
+    output = fs.openSync(destination, 'wx', 0o600); created = true;
+    const chunk = Buffer.allocUnsafe(1024 * 1024);
+    for (;;) {
+      const count = fs.readSync(input, chunk, 0, chunk.length, null); if (!count) break;
+      size += count; if (size > MAX_BUNDLE) throw new Error('Native bundle exceeds the 256 MiB compressed size limit');
+      digest.update(chunk.subarray(0, count));
+      let written = 0; while (written < count) written += fs.writeSync(output, chunk, written, count - written);
+    }
+    fs.fsyncSync(output); fs.closeSync(output); output = undefined;
+    const actual = digest.digest('hex');
+    if (actual !== expectedSHA.toLowerCase()) throw new Error(`Native bundle SHA-256 mismatch: expected ${expectedSHA}, got ${actual}`);
+    fs.chmodSync(destination, 0o400);
+    return { path: destination, sha256: actual, bytes: size };
+  } catch (error) { if (output !== undefined) { fs.closeSync(output); output = undefined; } if (created && exists(destination)) fs.unlinkSync(destination); throw error; }
+  finally { if (input !== undefined) fs.closeSync(input); if (output !== undefined) fs.closeSync(output); }
+}
+function tarString(block, offset, length) { return block.subarray(offset, offset + length).toString('utf8').replace(/\0.*$/s, ''); }
+function tarOctal(block, offset, length) {
+  const value = tarString(block, offset, length).trim();
+  if (!/^[0-7]*$/.test(value)) throw new Error('Non-octal tar numeric field is unsupported');
+  const result = Number.parseInt(value || '0', 8);
+  if (!Number.isSafeInteger(result)) throw new Error('Unsafe tar numeric value');
+  return result;
+}
+function safeRelative(name) {
+  if (typeof name !== 'string' || !name || name.includes('\\') || name.includes(':') || name.startsWith('/') || /[\x00-\x1f\x7f]/.test(name)) throw new Error(`Unsafe native bundle path: ${JSON.stringify(name)}`);
+  const pieces = name.split('/');
+  if (pieces.some((part) => !part || part === '.' || part === '..')) throw new Error(`Unsafe native bundle path: ${name}`);
+  if (pieces.some((part) => part.startsWith('.'))) throw new Error(`Hidden path is not permitted in the native payload: ${name}`);
+  if (/\.(?:py|pyc|pyo|pyi|whl|map|c|cc|cpp|cxx|h|hpp|rs|go|java|js|mjs|cjs|ts|tsx)$/i.test(name)) throw new Error(`Source-bearing file is not permitted in the native payload: ${name}`);
+  return name;
 }
-function discoverPython(selected, runner = spawnSync) {
-  const candidates = selected ? [{ executable: selected, prefix: [] }] : process.platform === 'win32'
-    ? [{ executable: 'py', prefix: ['-3'] }, { executable: 'python', prefix: [] }]
-    : [{ executable: 'python3', prefix: [] }, { executable: 'python', prefix: [] }];
-  const problems = [];
-  for (const candidate of candidates) {
-    try {
-      const output = runChecked(candidate.executable, [...candidate.prefix, '-I', '-B', '-c',
-        'import json,sys; print(json.dumps({"version":list(sys.version_info[:3]),"executable":sys.executable}))'], { timeout: 15000 }, runner);
-      const info = JSON.parse(output);
-      if (info.version[0] !== 3 || info.version[1] < 11) throw new Error(`Python ${info.version.join('.')} is too old`);
-      if (!path.isAbsolute(info.executable)) throw new Error('Python did not report an absolute executable path');
-      return info;
-    } catch (error) { problems.push(`${candidate.executable}: ${error.message}`); }
+function parseTar(gzip) {
+  if (gzip.length > MAX_BUNDLE) throw new Error('Native bundle exceeds compressed size limit');
+  const data = zlib.gunzipSync(gzip, { maxOutputLength: MAX_EXPANDED });
+  const entries = new Map(); let offset = 0, ended = false;
+  while (offset + 512 <= data.length) {
+    const header = data.subarray(offset, offset + 512); offset += 512;
+    if (header.every((byte) => byte === 0)) { ended = true; break; }
+    if (entries.size >= 20000) throw new Error('Native bundle contains too many entries');
+    const expected = tarOctal(header, 148, 8);
+    let actual = 0; for (let index = 0; index < 512; index++) actual += index >= 148 && index < 156 ? 32 : header[index];
+    if (actual !== expected) throw new Error('Native tar header checksum mismatch');
+    const magic = tarString(header, 257, 6); if (magic !== 'ustar') throw new Error('Native bundle requires standard USTAR format');
+    const prefix = tarString(header, 345, 155);
+    const raw = `${prefix ? prefix + '/' : ''}${tarString(header, 0, 100)}`;
+    const type = header[156] === 0 ? '0' : String.fromCharCode(header[156]);
+    if (!['0', '5'].includes(type)) throw new Error('Native bundle links, PAX extensions and special files are forbidden');
+    const name = safeRelative(type === '5' ? raw.replace(/\/$/, '') : raw);
+    if (entries.has(name)) throw new Error(`Duplicate native bundle path: ${name}`);
+    const mode = tarOctal(header, 100, 8);
+    if (mode & 0o7022) throw new Error(`Unsafe native file mode: ${name}`);
+    if (type === '0' && !(mode & 0o400)) throw new Error(`Native file is not readable by its owner: ${name}`);
+    const size = tarOctal(header, 124, 12);
+    if (type === '5' && size !== 0) throw new Error('Native tar directory contains data');
+    if (offset + size > data.length) throw new Error('Truncated native tar member');
+    entries.set(name, { name, type, mode, data: data.subarray(offset, offset + size) });
+    offset += Math.ceil(size / 512) * 512;
   }
-  throw new Error(`Python 3.11+ is required. Install it with venv/ensurepip support, then run emilyremote setup --python /absolute/path/to/python. ${problems.join('; ')}`);
+  if (!ended || data.subarray(offset).some((byte) => byte !== 0)) throw new Error('Native tar archive has missing end markers or trailing content');
+  return entries;
 }
-
-function receiptPath(home) { return path.join(home, 'receipts', `${VERSION}.json`); }
-function readReceipt(home) {
-  const file = receiptPath(home);
-  checkHomePath(home, file);
-  if (!fs.existsSync(file)) throw new Error('SDK is not installed here. Run emilyremote setup first');
-  const receipt = JSON.parse(fs.readFileSync(file, 'utf8'));
-  if (receipt.state !== 'READY' || receipt.version !== VERSION || receipt.wheel_sha256 !== WHEEL_SHA) throw new Error('Installation receipt is not READY for this SDK version; run emilyremote setup');
-  if (typeof receipt.runtime_relative !== 'string' || path.isAbsolute(receipt.runtime_relative)) throw new Error('Invalid runtime path in installation receipt');
-  const root = path.resolve(home, 'runtimes', VERSION);
-  const runtime = path.resolve(home, receipt.runtime_relative);
-  if (!runtime.startsWith(root + path.sep) || runtime === root) throw new Error('Runtime path escapes the versioned installation directory');
-  checkHomePath(home, runtime);
-  if (!fs.existsSync(runtime) || !fs.realpathSync(runtime).startsWith(fs.realpathSync(root) + path.sep)) throw new Error('Runtime directory is missing or escapes its installation');
-  return { receipt, runtime };
+function versionParts(value) {
+  if (typeof value !== 'string' || !/^\d+\.\d+(?:\.\d+)?$/.test(value)) throw new Error(`Invalid macOS version: ${JSON.stringify(value)}`);
+  const result = value.split('.').map(Number);
+  if (result.some((part) => !Number.isSafeInteger(part) || part > 65535) || result[0] < 10) throw new Error('Invalid macOS version components');
+  while (result.length < 3) result.push(0);
+  return result;
 }
-function verifyInstalled(runtime, runner = spawnSync) {
-  checkWheel();
-  return JSON.parse(runChecked(pythonPath(runtime), ['-I', '-B', VERIFY, '--wheel', WHEEL, '--runtime', runtime], { timeout: 30000 }, runner));
+function compareVersions(left, right) {
+  const a = versionParts(left), b = versionParts(right);
+  for (let index = 0; index < 3; index++) if (a[index] !== b[index]) return Math.sign(a[index] - b[index]);
+  return 0;
 }
-
-async function setup(home, selectedPython, { runner = spawnSync, log = console.log } = {}) {
-  checkWheel();
-  homeDir(home, home);
-  const lock = path.join(home, '.setup-lock');
-  checkHomePath(home, lock);
-  try { fs.mkdirSync(lock, { mode: 0o700 }); } catch (error) {
-    if (error.code === 'EEXIST') throw new Error(`Setup is already running or was interrupted. Inspect ${lock} before removing that lock and trying again`);
-    throw error;
+function hostMacosVersion(runner = spawnSync) {
+  const result = runner('/usr/bin/sw_vers', ['-productVersion'], { shell: false, encoding: 'utf8', timeout: 5000, maxBuffer: 16384, env: { ...cleanEnv(), SYSTEM_VERSION_COMPAT: '0' } });
+  if (result.error || result.status !== 0) throw new Error('Cannot determine macOS product version; native runtime was not executed');
+  const version = String(result.stdout).trim();
+  versionParts(version);
+  return version;
+}
+function verifyMachO(data, arch, executable = true) {
+  const cpu = { arm64: 0x0100000c, x64: 0x01000007 }[arch];
+  if (!cpu || data.length < 32 || data.readUInt32LE(0) !== 0xfeedfacf || data.readUInt32LE(4) !== cpu) throw new Error('Native entrypoint is not the expected thin 64-bit Mach-O architecture');
+  const subtype = data.readUInt32LE(8) & 0x00ffffff;
+  if (subtype !== (arch === 'arm64' ? 0 : 3)) throw new Error('Specialized Mach-O CPU subtypes are not qualified');
+  const type = data.readUInt32LE(12);
+  if (executable ? type !== 2 : ![2, 6, 8].includes(type)) throw new Error('Unexpected Mach-O file type');
+  const count = data.readUInt32LE(16), size = data.readUInt32LE(20), end = 32 + size;
+  if (!count || count > 65536 || size < count * 8 || end > data.length) throw new Error('Invalid Mach-O load command table');
+  let offset = 32, minimum;
+  const unpack = (packed) => `${packed >>> 16}.${(packed >>> 8) & 0xff}.${packed & 0xff}`;
+  for (let index = 0; index < count; index++) {
+    if (offset + 8 > end) throw new Error('Truncated Mach-O load command');
+    const command = data.readUInt32LE(offset), length = data.readUInt32LE(offset + 4);
+    if (length < 8 || length % 8 || offset + length > end) throw new Error('Invalid Mach-O load command size');
+    let required;
+    if (command === 0x32) {
+      if (length < 24 || data.readUInt32LE(offset + 8) !== 1 || length !== 24 + 8 * data.readUInt32LE(offset + 20)) throw new Error('Mach-O LC_BUILD_VERSION must describe macOS');
+      required = unpack(data.readUInt32LE(offset + 12));
+    } else if (command === 0x24) {
+      if (length !== 16) throw new Error('Invalid Mach-O macOS version command');
+      required = unpack(data.readUInt32LE(offset + 8));
+    } else if ([0x25, 0x2f, 0x30].includes(command)) {
+      throw new Error('Mach-O runtime targets a non-macOS Apple platform');
+    }
+    if (required) {
+      versionParts(required);
+      if (minimum !== undefined) throw new Error('Duplicate Mach-O deployment target commands');
+      minimum = required;
+    }
+    offset += length;
   }
-  let runtime;
-  try {
-    writeJsonAtomic(path.join(lock, 'owner.json'), { pid: process.pid, started_at: new Date().toISOString() });
-    try {
-      const existing = readReceipt(home);
-      verifyInstalled(existing.runtime, runner);
-      log(JSON.stringify({ state: 'READY', already_installed: true, version: VERSION, runtime: existing.runtime, receipt: receiptPath(home) }));
-      return 0;
-    } catch (error) {
-      if (fs.existsSync(receiptPath(home))) {
-        checkHomePath(home, receiptPath(home));
-        log(`Existing installation needs repair: ${error.message}`);
-        // A failed replacement must never leave an invalid READY receipt.
-        fs.renameSync(receiptPath(home), path.join(home, 'receipts', `${VERSION}-invalidated-${Date.now()}-${crypto.randomBytes(4).toString('hex')}.json`));
+  if (offset !== end || minimum === undefined) throw new Error('Mach-O load commands do not identify a macOS deployment target');
+  return { minimum_macos: minimum };
+}
+function verifyManifest(entries, target = platformTarget(), expectedVersion = VERSION, host = {}) {
+  const entry = entries.get(MANIFEST);
+  if (!entry || entry.type !== '0' || entry.data.length > 2 * 1024 * 1024) throw new Error('Native release manifest is missing or too large');
+  let manifest; try { manifest = JSON.parse(entry.data.toString('utf8')); } catch { throw new Error('Native release manifest is not valid JSON'); }
+  if (manifest.schema !== 'emilyremote.native-release/1' || manifest.version !== expectedVersion) throw new Error('Native manifest schema/version does not match the expected release');
+  if (`${manifest.platform}-${manifest.arch}` !== target) throw new Error(`Native bundle platform does not match host ${target}`);
+  if (manifest.entrypoint !== 'emilyremote-runtime') throw new Error('Unexpected native runtime entrypoint');
+  if (!manifest.files || Array.isArray(manifest.files) || typeof manifest.files !== 'object') throw new Error('Native manifest requires a file inventory');
+  if (Object.hasOwn(manifest.files, MANIFEST)) throw new Error('Manifest must not recursively inventory itself');
+  if (typeof manifest.build_manifest !== 'string' || !Object.hasOwn(manifest.files, manifest.build_manifest)) throw new Error('Native build manifest must be present in the hashed inventory');
+  for (const [name, expected] of Object.entries(manifest.files)) {
+    safeRelative(name);
+    const file = entries.get(name);
+    if (!file || file.type !== '0') throw new Error(`Native manifest file missing: ${name}`);
+    if (!expected || !/^[a-f0-9]{64}$/.test(expected.sha256 || '') || !Number.isInteger(expected.mode)) throw new Error(`Invalid native inventory entry: ${name}`);
+    if (expected.mode !== file.mode || (expected.mode & 0o7022)) throw new Error(`Native inventory mode mismatch: ${name}`);
+    if (hash(file.data) !== expected.sha256) throw new Error(`Native inventory SHA-256 mismatch: ${name}`);
+  }
+  for (const [name, file] of entries) {
+    if (file.type === '0' && name !== MANIFEST && !Object.hasOwn(manifest.files, name)) throw new Error(`Unlisted native payload file: ${name}`);
+    if (file.type === '5' && !Object.keys(manifest.files).some((item) => item.startsWith(name + '/'))) throw new Error(`Unlisted native payload directory: ${name}`);
+  }
+  const executable = entries.get(manifest.entrypoint);
+  if (!executable || !(executable.mode & 0o100)) throw new Error('Native entrypoint is missing or not executable');
+  if (manifest.platform === 'linux' && (executable.data.length < 20 || !executable.data.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])) || executable.data[4] !== 2 || executable.data[5] !== 1 || executable.data.readUInt16LE(18) !== (manifest.arch === 'x64' ? 62 : 183))) throw new Error('Native entrypoint is not the expected ELF architecture');
+  if (manifest.platform === 'darwin') {
+    const native = verifyMachO(executable.data, manifest.arch);
+    versionParts(manifest.minimum_macos);
+    if (manifest.minimum_glibc !== undefined) throw new Error('A macOS runtime cannot require glibc');
+    if (compareVersions(manifest.minimum_macos, native.minimum_macos) < 0) throw new Error('Manifest understates the Mach-O minimum macOS version');
+    // Validate every Mach-O dependency, including a higher deployment target.
+    for (const file of entries.values()) {
+      if (file.type !== '0') continue;
+      if (file.data.length < 4) {
+        if (/\.(?:dylib|so)$/.test(file.name)) throw new Error(`Unsupported Mach-O dependency format: ${file.name}`);
+        continue;
+      }
+      const magic = file.data.readUInt32LE(0);
+      if (magic === 0xfeedfacf) {
+        const dependency = verifyMachO(file.data, manifest.arch, file.name === manifest.entrypoint);
+        if (compareVersions(manifest.minimum_macos, dependency.minimum_macos) < 0) throw new Error(`Manifest understates dependency minimum macOS version: ${file.name}`);
+      } else if (/\.(?:dylib|so)$/.test(file.name) || [0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca, 0xfeedface, 0xcefaedfe, 0xcffaedfe].includes(magic)) {
+        throw new Error(`Unsupported Mach-O dependency format: ${file.name}`);
       }
     }
-    const python = discoverPython(selectedPython, runner);
-    const attempt = `${Date.now()}-${crypto.randomBytes(6).toString('hex')}`;
-    runtime = path.join(home, 'runtimes', VERSION, attempt);
-    homeDir(home, path.dirname(runtime));
-    checkHomePath(home, runtime);
-    const temporary = path.join(home, 'tmp', attempt);
-    homeDir(home, temporary);
-    const environment = { ...cleanEnv(), TMPDIR: temporary, TMP: temporary, TEMP: temporary,
-      // pip compares against Python's os.devnull exactly; Node's Windows
-      // spelling (\\\\.\\nul) differs from Python's "nul".
-      PIP_CONFIG_FILE: process.platform === 'win32' ? 'nul' : '/dev/null' };
-    log(`Installing EmilyRemote ${VERSION} offline into ${runtime}`);
-    try {
-      runChecked(python.executable, ['-I', '-B', '-m', 'venv', runtime], { env: environment }, runner);
-    } catch (error) {
-      throw new Error(`Unable to create the private virtualenv. Python must include venv and ensurepip (on Debian/Ubuntu the matching python3-venv package). No system packages were installed. ${error.message}`);
+    if (compareVersions(host.macosVersion ?? hostMacosVersion(), manifest.minimum_macos) < 0) throw new Error(`Native bundle requires macOS >=${manifest.minimum_macos}`);
+  } else if (manifest.minimum_macos !== undefined) throw new Error('Only a macOS runtime may declare minimum_macos');
+  if (manifest.minimum_glibc) {
+    const glibc = host.glibcVersion ?? process.report?.getReport().header.glibcVersionRuntime;
+    const parts = (text) => String(text).split('.').map(Number);
+    if (!/^\d+\.\d+$/.test(manifest.minimum_glibc) || !glibc || !/^\d+\.\d+$/.test(glibc)) throw new Error('This native bundle requires a compatible glibc host');
+    const required = parts(manifest.minimum_glibc), actual = parts(glibc);
+    if (actual[0] < required[0] || (actual[0] === required[0] && actual[1] < required[1])) throw new Error(`Native bundle requires glibc >=${manifest.minimum_glibc}`);
+  }
+  return { manifest, manifest_sha256: hash(entry.data), build_manifest_sha256: manifest.files[manifest.build_manifest].sha256 };
+}
+function extract(entries, root) {
+  ensureDir(root);
+  for (const [name, item] of entries) {
+    const destination = path.join(root, ...name.split('/'));
+    checkPath(destination);
+    if (item.type === '5') ensureDir(destination);
+    else { ensureDir(path.dirname(destination)); const fd = fs.openSync(destination, 'wx', item.mode); try { fs.writeFileSync(fd, item.data); fs.fsyncSync(fd); } finally { fs.closeSync(fd); } fs.chmodSync(destination, item.mode); }
+  }
+  syncDir(root);
+}
+function installedEntries(root) {
+  checkPath(root, { missing: false }); const entries = new Map(); let total = 0;
+  function visit(directory) {
+    for (const name of fs.readdirSync(directory)) {
+      const file = path.join(directory, name); checkPath(file, { missing: false });
+      const info = fs.lstatSync(file); const relative = path.relative(root, file).split(path.sep).join('/'); safeRelative(relative);
+      if (entries.size >= 20000) throw new Error('Installed runtime contains too many files');
+      if (info.isDirectory()) { entries.set(relative, { name: relative, type: '5', mode: info.mode & 0o777, data: Buffer.alloc(0) }); visit(file); }
+      else if (info.isFile()) { total += info.size; if (total > MAX_EXPANDED) throw new Error('Installed runtime exceeds the expanded size limit'); entries.set(relative, { name: relative, type: '0', mode: info.mode & 0o7777, data: fs.readFileSync(file) }); }
+      else throw new Error(`Unsupported installed native file: ${relative}`);
     }
-    const executable = pythonPath(runtime);
-    const pipReport = path.join(home, 'receipts', `${attempt}-pip.json`);
-    homeDir(home, path.dirname(pipReport));
-    checkHomePath(home, pipReport);
-    const pipOutput = runChecked(executable, ['-I', '-B', '-m', 'pip', '--isolated', 'install',
-      '--no-index', '--no-deps', '--no-compile', '--no-cache-dir', '--disable-pip-version-check',
-      '--report', pipReport, WHEEL], { env: environment }, runner);
-    fs.writeFileSync(path.join(home, 'receipts', `${attempt}-install.log`), pipOutput, { mode: 0o600 });
-    const verification = verifyInstalled(runtime, runner);
-    const selfCheck = JSON.parse(runChecked(executable, ['-I', '-B', '-m', 'emilyremote', 'self-check'], { env: environment }, runner));
-    if (selfCheck.ok !== true || selfCheck.version !== VERSION) throw new Error('Installed SDK self-check did not pass');
-    const receipt = { schema: 'emilyremote.npm-installation/1', state: 'READY', version: VERSION,
-      installed_at: new Date().toISOString(), wheel_sha256: WHEEL_SHA,
-      runtime_relative: path.relative(home, runtime), python: python.version, verification, self_check: selfCheck,
-      pip_report_relative: path.relative(home, pipReport),
-      scope: 'Core package installed only; no service, enrollment, task dispatch, or optional dependencies' };
-    writeJsonAtomic(receiptPath(home), receipt);
-    log(JSON.stringify({ state: 'READY', version: VERSION, runtime, receipt: receiptPath(home) }));
+  }
+  visit(root); return entries;
+}
+function verifyInstalled(home) {
+  home = checkPath(home);
+  const activePath = path.join(home, 'native', 'active.json'); checkPath(activePath, { missing: false });
+  const active = JSON.parse(fs.readFileSync(activePath, 'utf8'));
+  if (active.schema !== 'emilyremote.native-installation/1' || active.state !== 'READY' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(active.version || '')) throw new Error('Native installation is not READY with an exact version');
+  const target = platformTarget(); requireBuilt(target);
+  if (active.target !== target || !/^[a-f0-9]{64}$/.test(active.bundle_sha256 || '')) throw new Error('Native installation identity is invalid');
+  if (typeof active.runtime_relative !== 'string' || path.isAbsolute(active.runtime_relative)) throw new Error('Invalid native runtime path');
+  const root = path.resolve(home, active.runtime_relative); const base = path.join(path.resolve(home), 'native', 'releases') + path.sep;
+  if (!root.startsWith(base) || !root.endsWith(path.sep + 'runtime')) throw new Error('Native runtime path escapes its installation');
+  const verified = verifyManifest(installedEntries(root), target, active.version);
+  if (verified.manifest_sha256 !== active.manifest_sha256 || verified.build_manifest_sha256 !== active.build_manifest_sha256) throw new Error('Installed native manifest identity changed');
+  return { active, root, ...verified };
+}
+function selfCheck(runtime, runner) {
+  const result = runner(path.join(runtime, 'emilyremote-runtime'), ['self-check'], { shell: false, encoding: 'utf8', timeout: 60000, maxBuffer: 2 * 1024 * 1024, env: cleanEnv(), cwd: runtime, windowsHide: true });
+  if (result.error || result.status !== 0) throw new Error(`Native runtime self-check failed: ${result.error?.message || String(result.stderr || result.stdout || result.signal || result.status).slice(-2000)}`);
+  let info; try { info = JSON.parse(result.stdout); } catch { throw new Error('Native self-check did not return JSON'); }
+  if (info.ok !== true || info.version !== VERSION) throw new Error('Native self-check version/readiness mismatch');
+  return info;
+}
+async function setup(home, options, { runner = spawnSync, log = console.log } = {}) {
+  const target = platformTarget(); requireBuilt(target); home = checkPath(home);
+  const selectedBundle = resolveBundle(options, target);
+  checkPath(home);
+  for (const legacy of ['active.json', 'receipts', 'runtimes']) {
+    const legacyPath = path.join(home, legacy); checkPath(legacyPath);
+    if (exists(legacyPath)) throw new Error('This directory contains an existing non-native installation; choose a separate EmilyRemoteNative home');
+  }
+  const base = path.join(home, 'native'); checkPath(base);
+  for (const leaf of ['active.json', '.install-lock', 'releases']) checkPath(path.join(base, leaf));
+  ensureDir(base); const lock = path.join(base, '.install-lock');
+  try { fs.mkdirSync(lock, { mode: 0o700 }); } catch (error) { if (error.code === 'EEXIST') throw new Error(`A native installer is running or was interrupted: inspect ${lock}; no lock was removed`); throw error; }
+  const token = crypto.randomBytes(16).toString('hex'); let attempt, activeChanged = false, oldActive;
+  try {
+    writeJson(path.join(lock, 'owner.json'), { pid: process.pid, token, started_at: new Date().toISOString() });
+    const activePath = path.join(base, 'active.json'); oldActive = optionalBytes(activePath);
+    if (oldActive !== null) verifyInstalled(home);
+    attempt = path.join(base, 'releases', crypto.randomUUID()); ensureDir(attempt);
+    const snapshot = snapshotBundle(selectedBundle.bundle, path.join(attempt, 'bundle.tar.gz'), selectedBundle.sha256);
+    const entries = parseTar(fs.readFileSync(snapshot.path)); const verified = verifyManifest(entries, target);
+    const runtime = path.join(attempt, 'runtime'); extract(entries, runtime);
+    const self_check = selfCheck(runtime, runner);
+    const reverified = verifyManifest(installedEntries(runtime), target);
+    if (reverified.manifest_sha256 !== verified.manifest_sha256) throw new Error('Runtime changed its manifest during self-check');
+    const active = { schema: 'emilyremote.native-installation/1', state: 'READY', version: VERSION, target,
+      runtime_relative: path.relative(home, runtime), bundle_sha256: snapshot.sha256, bundle_bytes: snapshot.bytes,
+      manifest_sha256: verified.manifest_sha256, build_manifest_sha256: verified.build_manifest_sha256,
+      installed_at: new Date().toISOString(), self_check,
+      trust: options.bundle !== undefined ? 'Operator-supplied archive SHA-256; no publisher signature was verified' : 'Bundled archive SHA-256 pinned in the npm installer; no separate publisher signature was verified',
+      bundle_source: options.bundle !== undefined ? 'operator-supplied' : 'npm-bundled', service_started: false, enrolled: false };
+    writeJson(path.join(attempt, 'receipt.json'), active);
+    activeChanged = true; writeJson(activePath, active);
+    log(JSON.stringify({ state: 'READY', version: VERSION, runtime, bundle_sha256: active.bundle_sha256, active: activePath }));
     return 0;
   } catch (error) {
-    if (runtime) {
-      const failure = path.join(home, 'receipts', `${path.basename(runtime)}-failed.json`);
-      try {
-        checkHomePath(home, failure);
-        writeJsonAtomic(failure, { state: 'FAILED', version: VERSION, runtime_relative: path.relative(home, runtime),
-          failed_at: new Date().toISOString(), error: error.message,
-          note: 'This attempt was not published as a READY installation. Partial files retained for diagnosis.' });
-      } catch (_) { /* Preserve the original error; never write through an unsafe path. */ }
-    }
+    if (activeChanged) restore(path.join(base, 'active.json'), oldActive);
+    if (attempt) { try { writeJson(path.join(attempt, 'failure.json'), { state: 'FAILED', error: error.message, previous_active_preserved: oldActive !== null, at: new Date().toISOString() }); } catch { /* Preserve original failure. */ } }
     throw error;
   } finally {
-    fs.rmSync(lock, { recursive: true, force: true });
+    const ownerPath = path.join(lock, 'owner.json'); checkPath(ownerPath);
+    if (exists(ownerPath)) { const owner = JSON.parse(fs.readFileSync(ownerPath)); if (owner.token !== token) throw new Error('Native installer lock ownership changed; not removing it'); fs.unlinkSync(ownerPath); }
+    fs.rmdirSync(lock); syncDir(base);
   }
 }
-
-function delegate(runtime, args, spawner = spawn) {
+function parseArgs(argv) {
+  const result = { args: [] };
+  for (let index = 0; index < argv.length; index++) {
+    if (argv[index] === '--') { result.args.push(...argv.slice(index + 1)); break; }
+    if (['--home', '--bundle', '--sha256'].includes(argv[index])) {
+      const key = argv[index].slice(2); if (!argv[index + 1] || argv[index + 1].startsWith('--') || result[key] !== undefined) throw new Error(`Invalid or duplicate --${key}`);
+      result[key] = argv[++index];
+    } else result.args.push(argv[index]);
+  }
+  result.command = result.args.shift();
+  if ((result.bundle || result.sha256) && result.command !== 'setup') throw new Error('--bundle and --sha256 are setup-only options');
+  return result;
+}
+function delegate(executable, args) {
   return new Promise((resolve, reject) => {
-    const child = spawner(pythonPath(runtime), ['-I', '-B', '-m', 'emilyremote', ...args],
-      { shell: false, stdio: 'inherit', env: cleanEnv(), windowsHide: true });
-    const forward = (signal) => { try { child.kill(signal); } catch (_) {} };
-    const onInt = () => forward('SIGINT');
-    const onTerm = () => forward('SIGTERM');
-    process.on('SIGINT', onInt); process.on('SIGTERM', onTerm);
-    const cleanup = () => { process.off('SIGINT', onInt); process.off('SIGTERM', onTerm); };
-    child.once('error', (error) => { cleanup(); reject(new Error(`Unable to launch installed SDK: ${error.message}`)); });
+    const child = spawn(executable, args, { shell: false, stdio: 'inherit', env: cleanEnv(), windowsHide: true });
+    const interrupt = () => child.kill('SIGINT'); const terminate = () => child.kill('SIGTERM');
+    process.on('SIGINT', interrupt); process.on('SIGTERM', terminate);
+    const cleanup = () => { process.off('SIGINT', interrupt); process.off('SIGTERM', terminate); };
+    child.once('error', (error) => { cleanup(); reject(error); });
     child.once('exit', (code, signal) => { cleanup(); resolve(code === null ? signal === 'SIGINT' ? 130 : 143 : code); });
   });
 }
-
 async function main(argv = process.argv.slice(2)) {
+  if (Number(process.versions.node.split('.')[0]) < 22) throw new Error('This native installer requires Node.js 22 or newer; no runtimes were changed');
   const parsed = parseArgs(argv);
   if (!parsed.command || ['--help', '-h', 'help'].includes(parsed.command)) { console.log(HELP); return 0; }
   if (parsed.command === '--version') { console.log(VERSION); return 0; }
+  if (parsed.command === 'platforms') { console.log(JSON.stringify(BUILDS, null, 2)); return 0; }
   const home = path.resolve(parsed.home || defaultHome());
-  if (parsed.command === 'setup') {
-    if (parsed.args.includes('--help') || parsed.args.includes('-h')) { console.log(HELP); return 0; }
-    if (parsed.args.length) throw new Error('Unknown setup arguments; use emilyremote setup --help');
-    return setup(home, parsed.python);
-  }
-  const installed = readReceipt(home);
-  const verification = verifyInstalled(installed.runtime);
-  if (parsed.command === 'status') {
-    if (parsed.args.length) throw new Error('status does not accept SDK arguments');
-    console.log(JSON.stringify({ state: 'READY', version: VERSION, runtime: installed.runtime,
-      receipt: receiptPath(home), verification, service_started_by_wrapper: false }, null, 2));
-    return 0;
-  }
-  return delegate(installed.runtime, [parsed.command, ...parsed.args]);
+  if (parsed.command === 'setup') { if (parsed.args.length) throw new Error('Unknown setup arguments; use --help'); return setup(home, parsed); }
+  const installed = verifyInstalled(home);
+  if (parsed.command === 'status') { console.log(JSON.stringify({ ...installed.active, installer_version: VERSION, runtime: installed.root }, null, 2)); return 0; }
+  return delegate(path.join(installed.root, installed.manifest.entrypoint), [parsed.command, ...parsed.args]);
 }
-
-module.exports = { main, parseArgs, defaultHome, cleanEnv, checkHomeAncestors, checkHomePath, runChecked, discoverPython, readReceipt,
-  verifyInstalled, setup, delegate, pythonPath, VERSION, WHEEL_SHA, WHEEL, receiptPath };
+module.exports = { VERSION, BUILDS, BUNDLED, main, parseArgs, platformTarget, requireBuilt, resolveBundle, cleanEnv, defaultHome, canonicalPath, checkPath, atomicWrite, snapshotBundle, parseTar, verifyMachO, compareVersions, hostMacosVersion, verifyManifest, verifyInstalled, setup };

package/package.json

@@ -1,13 +1,38 @@
 {
   "name": "@robsonai/emilyremote",
-  "version": "0.3.0",
-  "description": "EmilyRemote by RobsonAI: explicit offline installer and command wrapper for the EmilyRemote host SDK",
+  "version": "0.4.1",
+  "description": "RobsonAI EmilyRemote compiled device runtime for Linux x64 and Apple Silicon macOS",
   "license": "UNLICENSED",
-  "engines": {"node": ">=18"},
-  "bin": {"emilyremote": "bin/emilyremote.cjs"},
-  "files": ["bin/", "lib/", "scripts/", "vendor/", "README.md", "PROVENANCE.json"],
-  "scripts": {"test": "node --test test/*.test.cjs"},
-  "publishConfig": {"access": "public"},
-  "keywords": ["emilyremote", "robsonai", "edge", "sdk"],
-  "author": "RobsonAI"
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "emilyremote": "bin/emilyremote-native.cjs",
+    "emilyremote-native": "bin/emilyremote-native.cjs"
+  },
+  "files": [
+    "bin/emilyremote-native.cjs",
+    "lib/cli.cjs",
+    "README.md",
+    "RUNTIME_FORMAT.md",
+    "vendor/robsonai-emilyremote-native-0.4.1-linux-x64.tar.gz",
+    "vendor/robsonai-emilyremote-native-0.4.1-darwin-arm64.tar.gz"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.cjs",
+    "check-release": "node validation/check-release.cjs"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "author": "RobsonAI",
+  "os": [
+    "linux",
+    "darwin"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ]
 }

package/PROVENANCE.json

@@ -1,18 +0,0 @@
-{
-  "schema": "emilyremote.npm-provenance/1",
-  "display_name": "EmilyRemote",
-  "npm_package_name": "@robsonai/emilyremote",
-  "npm_name_status": "requested organization target; robsonai organization ownership and publication are pending verification",
-  "primary_command": "emilyremote",
-  "prior_distribution": {
-    "name": "@martinrobson/dialhome@0.2.0",
-    "status": "published; anonymous version metadata and tarball verified",
-    "tarball_sha256": "dfd56b3bd0f8e57b07559bf43551c05c58957732cd69e70c37a5fbbf86506326"
-  },
-  "sdk_version": "0.3.0",
-  "wheel": "vendor/robsonai_emilyremote-0.3.0-py3-none-any.whl",
-  "wheel_sha256": "e730b011b844dc70442fa793d29c98eb9df8dea5341ebbb49ba38fd73da0269e",
-  "source_changes": "Version 0.3.0 uses the emilyremote Python namespace and robsonai-emilyremote distribution, with release security fixes. Prior release test results do not certify this build.",
-  "scope": "Host Python runtime only; optional dependencies, Android APK, and microcontroller firmware are not installed by this npm wrapper",
-  "sdk_source": "RobsonAI EmilyRemote 0.3.0 release source, rebuilt after namespace and security changes"
-}

package/scripts/verify_install.py

@@ -1,48 +0,0 @@
-"""Read-only installed-wheel verification. Invoked with isolated Python -I -B."""
-import argparse
-import hashlib
-import importlib.metadata
-import importlib.util
-import json
-import os
-from pathlib import Path
-import sys
-import zipfile
-
-EXPECTED_SHA = "e730b011b844dc70442fa793d29c98eb9df8dea5341ebbb49ba38fd73da0269e"
-parser = argparse.ArgumentParser()
-parser.add_argument("--wheel", required=True)
-parser.add_argument("--runtime", required=True)
-args = parser.parse_args()
-assert sys.version_info >= (3, 11), "Python 3.11+ is required"
-wheel = Path(args.wheel)
-assert hashlib.sha256(wheel.read_bytes()).hexdigest() == EXPECTED_SHA, "Bundled wheel mismatch"
-runtime = Path(args.runtime).resolve()
-assert Path(sys.prefix).resolve() == runtime, "Python is not running in the selected virtualenv"
-assert sys.prefix != sys.base_prefix, "Global Python is not an isolated runtime"
-assert importlib.metadata.version("robsonai-emilyremote") == "0.3.0", "Installed metadata version mismatch"
-spec = importlib.util.find_spec("emilyremote")
-assert spec and spec.origin and spec.origin.endswith("__init__.py"), "SDK did not resolve to Python source"
-package = Path(spec.origin).resolve().parent
-assert runtime in package.parents, "SDK import came from outside its virtualenv"
-hashes = {}
-with zipfile.ZipFile(wheel) as archive:
-    for name in archive.namelist():
-        if not name.startswith("emilyremote/") or not name.endswith(".py"):
-            continue
-        relative = name[len("emilyremote/"):]
-        actual = package / relative
-        assert package in actual.resolve().parents, "Source path escapes installed SDK"
-        expected = hashlib.sha256(archive.read(name)).hexdigest()
-        assert hashlib.sha256(actual.read_bytes()).hexdigest() == expected, "Installed source mismatch: " + name
-        hashes[name] = expected
-actual_names = {"emilyremote/" + p.relative_to(package).as_posix() for p in package.rglob("*.py")}
-assert actual_names == set(hashes), "Installed SDK source set differs from the wheel"
-all_files = {"emilyremote/" + p.relative_to(package).as_posix() for p in package.rglob("*") if p.is_file()}
-assert all_files == set(hashes), "Unexpected installed SDK files (including bytecode or native modules)"
-import emilyremote
-assert emilyremote.__version__ == "0.3.0", "Runtime version mismatch"
-print(json.dumps({"ok": True, "version": emilyremote.__version__, "python": sys.version.split()[0],
-                  "executable": sys.executable, "runtime": str(runtime), "package": str(package),
-                  "wheel_sha256": EXPECTED_SHA, "source_hashes": hashes,
-                  "uid": os.getuid() if hasattr(os, "getuid") else None}, sort_keys=True))