anyray-connect 0.11.165 → 0.11.166

package/dist/index.js

@@ -22,7 +22,7 @@ var BR="http://localhost:8787",Ga="anyray-placeholder",Ee=e=>{let t=e?.trim();re
   <key>NSHumanReadableCopyright</key><string>Othentic Labs LTD</string>
 </dict>
 </plist>
-`,cT="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister",lT=e=>{try{sT(cT,["-f",e],{stdio:"ignore",timeout:1e4})}catch{}},mw=async(e={})=>{if((e.os??uw())!=="darwin")return{ok:!0,messages:[]};let n=e.home??zu(),r=e.binaryPath??qn();if(Ue(r))return{ok:!1,messages:[`Skipped the Login Items identity app \u2014 anyray-connect is running from a temporary path (${r}).`]};if(es())return{ok:!1,messages:["Skipped the Login Items identity app \u2014 HOME is redirected away from the real account."]};let o=fw(n),a=fc(o,"Contents","MacOS"),s=fc(a,hw),i=e.version??"0.0.0";try{await pw(o,{recursive:!0,force:!0}),await nT(a,{recursive:!0}),await rT(fc(o,"Contents","Info.plist"),iT(i),"utf8");try{await oT(r,s)}catch{await aT(r,s)}return(e.register??lT)(o),{ok:!0,messages:[`Registered ${ts} as the Login Items identity.`]}}catch(c){return{ok:!1,messages:[`Could not write the Login Items identity app (${c?.name??"Error"}). Background items will show the signing certificate name instead.`]}}},yw=async(e={})=>{if((e.os??uw())!=="darwin")return{ok:!0,messages:[]};if(es())return{ok:!0,messages:[]};let n=fw(e.home??zu());try{return await pw(n,{recursive:!0,force:!0}),{ok:!0,messages:[`Removed ${ts}.app.`]}}catch(r){return{ok:!1,messages:[`Could not remove the Login Items identity app (${r?.name??"Error"}).`]}}};var Ae="0.11.165";var tn=(e=process.env)=>e.CODESPACES==="true"||e.CODESPACE_NAME?"codespaces":e.REMOTE_CONTAINERS==="true"||e.REMOTE_CONTAINERS_IPC||e.DEVCONTAINER?"devcontainer":e.SSH_CONNECTION||e.SSH_TTY?"ssh":null,$r=(e=process.env)=>tn(e)!==null,kn=e=>e==="codespaces"||e==="devcontainer",Oo=e=>{switch(e){case"codespaces":return"a GitHub Codespace";case"devcontainer":return"a dev container";case"ssh":return"an SSH session"}};var gw=()=>Br(wc(),".anyray","logs"),ep=()=>Br(gw(),"connect-refresh.log"),gc=1800,bc="ai.anyray.connect.refresh",os="anyray-refresh",np="\\AnyrayConnectKeyRefresh",Ac=bc,as=os,rs=np,fT=String(gc/60),rp=(e,t)=>{let n=pT(e,t,{stdio:"ignore"});return{ok:!n.error&&n.status===0}},op=()=>Br(wc(),"Library","LaunchAgents",`${Ac}.plist`),ap=()=>Br(wc(),".config","systemd","user"),ww=()=>Br(ap(),`${as}.service`),yc=()=>Br(ap(),`${as}.timer`),mc=e=>e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;"),Cc=()=>zn(jn),hT=(e=Cc())=>{let{command:t,args:n}=e,r=[t,...n].map(o=>`    <string>${mc(o)}</string>`).join(`
+`,cT="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister",lT=e=>{try{sT(cT,["-f",e],{stdio:"ignore",timeout:1e4})}catch{}},mw=async(e={})=>{if((e.os??uw())!=="darwin")return{ok:!0,messages:[]};let n=e.home??zu(),r=e.binaryPath??qn();if(Ue(r))return{ok:!1,messages:[`Skipped the Login Items identity app \u2014 anyray-connect is running from a temporary path (${r}).`]};if(es())return{ok:!1,messages:["Skipped the Login Items identity app \u2014 HOME is redirected away from the real account."]};let o=fw(n),a=fc(o,"Contents","MacOS"),s=fc(a,hw),i=e.version??"0.0.0";try{await pw(o,{recursive:!0,force:!0}),await nT(a,{recursive:!0}),await rT(fc(o,"Contents","Info.plist"),iT(i),"utf8");try{await oT(r,s)}catch{await aT(r,s)}return(e.register??lT)(o),{ok:!0,messages:[`Registered ${ts} as the Login Items identity.`]}}catch(c){return{ok:!1,messages:[`Could not write the Login Items identity app (${c?.name??"Error"}). Background items will show the signing certificate name instead.`]}}},yw=async(e={})=>{if((e.os??uw())!=="darwin")return{ok:!0,messages:[]};if(es())return{ok:!0,messages:[]};let n=fw(e.home??zu());try{return await pw(n,{recursive:!0,force:!0}),{ok:!0,messages:[`Removed ${ts}.app.`]}}catch(r){return{ok:!1,messages:[`Could not remove the Login Items identity app (${r?.name??"Error"}).`]}}};var Ae="0.11.166";var tn=(e=process.env)=>e.CODESPACES==="true"||e.CODESPACE_NAME?"codespaces":e.REMOTE_CONTAINERS==="true"||e.REMOTE_CONTAINERS_IPC||e.DEVCONTAINER?"devcontainer":e.SSH_CONNECTION||e.SSH_TTY?"ssh":null,$r=(e=process.env)=>tn(e)!==null,kn=e=>e==="codespaces"||e==="devcontainer",Oo=e=>{switch(e){case"codespaces":return"a GitHub Codespace";case"devcontainer":return"a dev container";case"ssh":return"an SSH session"}};var gw=()=>Br(wc(),".anyray","logs"),ep=()=>Br(gw(),"connect-refresh.log"),gc=1800,bc="ai.anyray.connect.refresh",os="anyray-refresh",np="\\AnyrayConnectKeyRefresh",Ac=bc,as=os,rs=np,fT=String(gc/60),rp=(e,t)=>{let n=pT(e,t,{stdio:"ignore"});return{ok:!n.error&&n.status===0}},op=()=>Br(wc(),"Library","LaunchAgents",`${Ac}.plist`),ap=()=>Br(wc(),".config","systemd","user"),ww=()=>Br(ap(),`${as}.service`),yc=()=>Br(ap(),`${as}.timer`),mc=e=>e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;"),Cc=()=>zn(jn),hT=(e=Cc())=>{let{command:t,args:n}=e,r=[t,...n].map(o=>`    <string>${mc(o)}</string>`).join(`
 `);return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">

package/native/macos/Sources/AnyrayDeviceProofMacOS/securityDeviceIdentity.swift

@@ -43,18 +43,40 @@ public struct SecurityDeviceIdentityStore {
         "ai.anyray.connect.device-identity.v1".utf8
     )
     public static let label = "Anyray Connect Device Identity v1"
+    // Not keychain-access-groups: that gets a Developer ID CLI AMFI-killed at launch.
+    public static let accessGroupEntitlement = "com.apple.security.application-groups"
 
     private let applicationTag: Data
     private let label: String
+    private let accessGroup: String?
 
     public init() {
-        applicationTag = Self.applicationTag
-        label = Self.label
+        self.init(
+            applicationTag: Self.applicationTag,
+            label: Self.label,
+            accessGroup: Self.entitledAccessGroup()
+        )
     }
 
-    init(applicationTag: Data, label: String) {
+    init(applicationTag: Data, label: String, accessGroup: String?) {
         self.applicationTag = applicationTag
         self.label = label
+        self.accessGroup = accessGroup
+    }
+
+    public static func entitledAccessGroup() -> String? {
+        guard let task = SecTaskCreateFromSelf(nil),
+              let groups = SecTaskCopyValueForEntitlement(
+                  task,
+                  accessGroupEntitlement as CFString,
+                  nil
+              ) as? [String],
+              let first = groups.first,
+              !first.isEmpty
+        else {
+            return nil
+        }
+        return first
     }
 
     public func loadOrCreate() throws -> SecurityDeviceIdentityKey {
@@ -103,7 +125,7 @@ public struct SecurityDeviceIdentityStore {
     private func findPrivateKey() throws -> SecKey? {
         let authenticationContext = LAContext()
         authenticationContext.interactionNotAllowed = true
-        let query: [CFString: Any] = [
+        var query: [CFString: Any] = [
             kSecClass: kSecClassKey,
             kSecAttrApplicationTag: applicationTag,
             kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
@@ -114,6 +136,7 @@ public struct SecurityDeviceIdentityStore {
             kSecUseDataProtectionKeychain: true,
             kSecUseAuthenticationContext: authenticationContext,
         ]
+        if let accessGroup { query[kSecAttrAccessGroup] = accessGroup }
         var result: CFTypeRef?
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound { return nil }
@@ -127,7 +150,7 @@ public struct SecurityDeviceIdentityStore {
     }
 
     private func createPrivateKey(accessible: CFString) throws -> SecKey {
-        let privateAttributes: [CFString: Any] = [
+        var privateAttributes: [CFString: Any] = [
             kSecAttrIsPermanent: true,
             kSecAttrApplicationTag: applicationTag,
             kSecAttrLabel: label,
@@ -135,6 +158,7 @@ public struct SecurityDeviceIdentityStore {
             kSecAttrAccessible: accessible,
             kSecAttrSynchronizable: false,
         ]
+        if let accessGroup { privateAttributes[kSecAttrAccessGroup] = accessGroup }
         let attributes: [CFString: Any] = [
             kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
             kSecAttrKeySizeInBits: 256,

package/native/macos/Tests/AnyrayDeviceProofMacOSTests/securityDeviceIdentityTests.swift

@@ -9,11 +9,9 @@ import Testing
 struct SecurityDeviceIdentityTests {
     @Test
     func permanentKeySignsReloadsAndCannotBeExported() throws {
-        // SwiftPM's ad-hoc test host has no Keychain access group. The signed
-        // release helper does; run the real integration assertions whenever the
-        // host carries that entitlement, instead of weakening production to the
-        // legacy Keychain (which ignores kSecAttrIsExtractable=false).
-        guard hasKeychainAccessGroup() else { return }
+        // Only a signed host has an app group; never fall back to the legacy keychain.
+        guard let accessGroup = SecurityDeviceIdentityStore.entitledAccessGroup()
+        else { return }
 
         let suffix = UUID().uuidString.lowercased()
         let tag = Data("ai.anyray.connect.device-identity.test.\(suffix)".utf8)
@@ -22,7 +20,8 @@ struct SecurityDeviceIdentityTests {
 
         let store = SecurityDeviceIdentityStore(
             applicationTag: tag,
-            label: label
+            label: label,
+            accessGroup: accessGroup
         )
         let first = try store.loadOrCreate()
         let message = Data("{\"issuedAt\":\"fresh\",\"nonce\":\"test\"}".utf8)
@@ -45,6 +44,12 @@ struct SecurityDeviceIdentityTests {
         )
     }
 
+    @Test
+    func unsignedHostHasNoEntitledAccessGroup() {
+        guard !hostIsSignedWithAppGroup() else { return }
+        #expect(SecurityDeviceIdentityStore.entitledAccessGroup() == nil)
+    }
+
     private func keyQuery(tag: Data) -> [CFString: Any] {
         [
             kSecClass: kSecClassKey,
@@ -76,11 +81,11 @@ struct SecurityDeviceIdentityTests {
         _ = SecItemDelete(keyQuery(tag: tag) as CFDictionary)
     }
 
-    private func hasKeychainAccessGroup() -> Bool {
+    private func hostIsSignedWithAppGroup() -> Bool {
         guard let task = SecTaskCreateFromSelf(nil),
               let groups = SecTaskCopyValueForEntitlement(
                   task,
-                  "keychain-access-groups" as CFString,
+                  SecurityDeviceIdentityStore.accessGroupEntitlement as CFString,
                   nil
               ) as? [String]
         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anyray-connect",
-  "version": "0.11.165",
+  "version": "0.11.166",
   "description": "Anyray connect \u2014 points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.",
   "type": "module",
   "bin": {