drafted 1.22.3 → 1.22.4

package/install-mcp.sh

@@ -712,6 +712,9 @@ retire_legacy_updater() {
 # Returns 0 ONLY when a valid Drafted.app is present afterward, so the caller can safely
 # retire the legacy updater. Returns 1 when no new bundle is available yet — the caller then
 # falls back to building the legacy Swift updater, so users are never left without a tray.
+# Developer ID Application: Beoflow B.V. (2D9Q24N9UQ) — the identity desktop/RELEASE.md signs with.
+DESKTOP_SIGNING_REQUIREMENT='anchor apple generic and certificate leaf[subject.OU] = "2D9Q24N9UQ"'
+
 install_desktop_app() {
   local install_dir app_bundle app_exe uid plist tmp tarball url
   install_dir="/Applications"
@@ -729,9 +732,18 @@ install_desktop_app() {
     url="${DRAFTED_DESKTOP_URL:-$INSTALL_SERVER/desktop/Drafted-macos.tar.gz}"
     tmp="$(mktemp -d)"
     tarball="$tmp/Drafted-macos.tar.gz"
-    if curl -fsSL --max-time 120 "$url" -o "$tarball" >/dev/null 2>&1; then
-      rm -rf "$app_bundle" >/dev/null 2>&1 || true
-      tar -xzf "$tarball" -C "$install_dir" >/dev/null 2>&1 || true
+    if curl -fsSL --max-time 120 "$url" -o "$tarball" >/dev/null 2>&1 \
+      && mkdir -p "$tmp/x" && tar -xzf "$tarball" -C "$tmp/x" >/dev/null 2>&1; then
+      # Quarantine is stripped below, so Gatekeeper never checks this bundle: check it
+      # here. It must carry an intact Developer ID signature from OUR team; a tampered
+      # or re-signed (e.g. ad-hoc) bundle is refused and the installed app is kept
+      # (audit 2026-10-13).
+      if codesign --verify --deep --strict -R="$DESKTOP_SIGNING_REQUIREMENT" "$tmp/x/Drafted.app" >/dev/null 2>&1; then
+        rm -rf "$app_bundle" >/dev/null 2>&1 || true
+        mv "$tmp/x/Drafted.app" "$app_bundle" >/dev/null 2>&1 || true
+      else
+        echo -e "    ${YELLOW}Desktop app download failed its signature check; not installing it.${RESET}"
+      fi
     fi
     rm -rf "$tmp" >/dev/null 2>&1 || true
   fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.22.3",
+  "version": "1.22.4",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [