@seqyuan/annodex 0.1.55 → 0.1.56

package/lib/macos-codex-security.js

@@ -101,11 +101,24 @@ function codesignVerify(binaryPath, { timeoutMs = 5_000 } = {}) {
 
 /** Fast spawn-path check — only detect revoked certs (not full strict verify). */
 function needsRepairBeforeSpawn(binaryPath) {
+  // Fast check: codesign --verify (catches stripped/malformed signatures).
   const result = spawnSync(CODESIGN, ["--verify", binaryPath], {
     encoding: "utf8",
     timeout: 3_000,
   });
-  return needsRevokedCertRepair(codesignOutput(result));
+  if (needsRevokedCertRepair(codesignOutput(result))) return true;
+
+  // codesign may say "valid on disk" while spctl detects revoked certs
+  // (CSSMERR_TP_CERT_REVOKED).  Only spctl checks Apple's revocation DB.
+  // Use a shorter timeout on the spawn path (doctor uses 10s).
+  // Treat spctl timeout as needing repair: a valid cert should return
+  // quickly; a slow response usually means the revocation check is
+  // happening against a revoked cert. Worst case: unnecessary ad-hoc
+  // re-sign, which is harmless.
+  const sp = spctlAssess(binaryPath, 5_000);
+  if (sp.revoked || sp.timedOut) return true;
+
+  return false;
 }
 
 function shouldRepairCodexBinary(binaryPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seqyuan/annodex",
-  "version": "0.1.55",
+  "version": "0.1.56",
   "description": "AI-native bioinformatics workspace by Annoroad",
   "license": "MIT",
   "bin": {