@seqyuan/annodex 0.1.54 → 0.1.55

package/lib/macos-codex-security.js

@@ -220,6 +220,51 @@ function looksLikeNativeCodexBinary(filePath) {
   return base === "codex" || base === "codex.exe";
 }
 
+/** Given a codex executable path (may be a JS shim), find the real native binary. */
+function resolveNativeBinaryFromShim(executablePath) {
+  if (!executablePath || !fs.existsSync(executablePath)) return null;
+  // If it's already a native binary (inside vendor/), return as-is
+  if (/vendor[/\\]/.test(executablePath)) return executablePath;
+
+  // Check if it's a JS shim (e.g. node_modules/.bin/codex)
+  try {
+    const content = fs.readFileSync(executablePath, "utf8").slice(0, 512);
+    if (content.includes("node") || content.includes("#!/")) {
+      // This is a shim/script — find the native binary nearby
+      const shimDir = path.dirname(executablePath);
+      const nodeModulesDir = path.join(shimDir, "..");
+
+      const platform = process.platform;
+      const arch = process.arch;
+      let pkgName;
+      let triple;
+      if (platform === "darwin") {
+        if (arch === "arm64") { pkgName = "codex-darwin-arm64"; triple = "aarch64-apple-darwin"; }
+        else if (arch === "x64") { pkgName = "codex-darwin-x64"; triple = "x86_64-apple-darwin"; }
+        else return null;
+      } else {
+        return null;
+      }
+      const binaryName = "codex";
+
+      const subPaths = [
+        path.join("vendor", triple, "bin", binaryName),
+        path.join("vendor", triple, "codex", binaryName),
+      ];
+      for (const sub of subPaths) {
+        const candidate = path.join(nodeModulesDir, "@openai", pkgName, sub);
+        if (fs.existsSync(candidate)) return candidate;
+      }
+      // Also try nested layout
+      for (const sub of subPaths) {
+        const candidate = path.join(nodeModulesDir, "@openai", "codex", "node_modules", "@openai", pkgName, sub);
+        if (fs.existsSync(candidate)) return candidate;
+      }
+    }
+  } catch { /* ignore */ }
+  return executablePath;
+}
+
 function repairMacOSCodexPaths(binaryPaths, { force = false, mode = "doctor" } = {}) {
   if (!isDarwin()) return [];
   const seen = new Set();
@@ -273,8 +318,22 @@ function prepareMacOSCodexForSpawn(executablePath, cwd) {
   if (!isDarwin()) return { quarantine: { cleared: 0, paths: [] }, repairs: [] };
 
   const quarantine = { cleared: 0, paths: [], skipped: true };
+  if (!executablePath) return { quarantine, repairs: [] };
+
+  // If the resolved executable is a JS shim (e.g. node_modules/.bin/codex),
+  // find and repair the underlying native binary instead.
+  // Spawning the shim causes Node to exec the native binary as a grandchild,
+  // which macOS Gatekeeper may kill even after ad-hoc signing of the shim itself.
+  const resolvedNative = resolveNativeBinaryFromShim(executablePath);
+  if (resolvedNative && resolvedNative !== executablePath) {
+    console.log(
+      `[codex-server] Resolved native codex binary from shim: ${executablePath} -> ${resolvedNative}`,
+    );
+    prepareMacOSCodexForSpawn(resolvedNative, cwd);
+    return { quarantine, repairs: [], shimResolved: resolvedNative };
+  }
 
-  if (!executablePath || !looksLikeNativeCodexBinary(executablePath)) {
+  if (!looksLikeNativeCodexBinary(executablePath)) {
     return { quarantine, repairs: [] };
   }
   if (isBinaryPrepared(executablePath) || preparingBinaries.has(executablePath)) {
@@ -312,5 +371,6 @@ module.exports = {
   needsRevokedCertRepair,
   clearMacOSQuarantine,
   repairMacOSCodexPaths,
+  resolveNativeBinaryFromShim,
   prepareMacOSCodexForSpawn,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seqyuan/annodex",
-  "version": "0.1.54",
+  "version": "0.1.55",
   "description": "AI-native bioinformatics workspace by Annoroad",
   "license": "MIT",
   "bin": {