local-operator-ui 0.19.3 → 0.19.4

package/out/main/index.js

@@ -1336,6 +1336,81 @@ function withPythonBytecodeCache(env, userDataDir) {
   if (existing && !insideAppBundle(existing)) return { ...env };
   return { ...env, PYTHONPYCACHEPREFIX: pythonBytecodeCacheDir(userDataDir) };
 }
+const BUNDLED_PYTHON_TREE_NAMES = ["python", "python_aarch64"];
+function bundledPythonTreePaths(resourcesPath) {
+  return BUNDLED_PYTHON_TREE_NAMES.map((name) => path.join(resourcesPath, name));
+}
+const FIND = "/usr/bin/find";
+const CHMOD = "/bin/chmod";
+const DIRECTORY_ACE = "everyone deny add_file,add_subdirectory";
+const BYTECODE_ACE = "everyone deny write,append";
+const MAX_FIND_OUTPUT_BYTES = 16 * 1024 * 1024;
+const PARTIAL_SEAL_NAMED = 3;
+function describePythonTreeSeal(seal) {
+  if (!seal.supported) {
+    return "Bundled interpreter bytecode seal is macOS-only (there is no code seal to protect elsewhere); the bytecode cache prefix still applies";
+  }
+  const trees = seal.sealed.join(", ") || "(none present)";
+  if (seal.failures.length === 0) {
+    return `Bundled interpreter trees sealed against bytecode writes: ${trees}; ${seal.directories} directory path(s) selected and now refusing new entries, ${seal.bytecodeFiles} bytecode file(s) selected and now refusing rewrites`;
+  }
+  const named = seal.failures.slice(0, PARTIAL_SEAL_NAMED).join("; ");
+  const rest = seal.failures.length - PARTIAL_SEAL_NAMED;
+  return `Bundled interpreter bytecode seal INCOMPLETE: ${trees}; ${seal.directories} directory path(s) and ${seal.bytecodeFiles} bytecode file(s) selected, ${seal.failures.length} refused and left with the access they had - bytecode writes into the bundle are not prevented on every path. First refusals: ${named}${rest > 0 ? ` (+${rest} more)` : ""}`;
+}
+function sealPythonInterpreterTrees(trees) {
+  const result = {
+    sealed: [],
+    directories: 0,
+    bytecodeFiles: 0,
+    failures: [],
+    supported: process.platform === "darwin"
+  };
+  if (!result.supported) return result;
+  for (const tree of trees) {
+    let root;
+    try {
+      root = fs.lstatSync(tree);
+    } catch {
+      continue;
+    }
+    if (!root.isDirectory()) continue;
+    result.sealed.push(tree);
+    result.directories += applyAce(
+      tree,
+      ["-type", "d"],
+      DIRECTORY_ACE,
+      result.failures
+    );
+    result.bytecodeFiles += applyAce(
+      tree,
+      ["-type", "f", "-name", "*.pyc"],
+      BYTECODE_ACE,
+      result.failures
+    );
+  }
+  return result;
+}
+function applyAce(tree, selector, ace, failures) {
+  const run = node_child_process.spawnSync(
+    FIND,
+    [tree, ...selector, "-exec", CHMOD, "+a", ace, "{}", "+", "-print0"],
+    { encoding: "buffer", maxBuffer: MAX_FIND_OUTPUT_BYTES }
+  );
+  if (run.error) {
+    failures.push(`${tree}: ${String(run.error)}`);
+    return 0;
+  }
+  for (const line of String(run.stderr).split("\n")) {
+    if (line.trim().length > 0) failures.push(line.trim());
+  }
+  if (run.status !== 0 && String(run.stderr).trim().length === 0) {
+    failures.push(`${tree}: ${FIND} exited ${run.status} with no explanation`);
+  }
+  let selected = 0;
+  for (const byte of run.stdout) if (byte === 0) selected += 1;
+  return selected;
+}
 var main = { exports: {} };
 const version = "16.5.0";
 const require$$4 = {
@@ -2878,9 +2953,15 @@ LOG_FILE="$APP_DATA_DIR/backend-install.log"
 # in-place update with -67028 errSecCSBadBundleFormat. A file codesign reports
 # as *added* can be deleted and the seal comes back; a *modified* one cannot,
 # which is why nothing may ship a .pyc at all. The app sets this variable when
-# it spawns us; defaulting it here means a standalone run of this script cannot
-# pollute the bundle either. $HOME is the right place for the same reason the
-# venv lives there: it is never inside the thing that gets signed and swapped.
+# it spawns us; defaulting it here keeps a standalone run of this script in
+# agreement with the app about where bytecode goes. It is not a complete answer:
+# the app does not spawn every python that runs this interpreter, and a python
+# started by something else - a shell, a CLI script, an agent - has no prefix at
+# all (measured: a venv over this tree wrote 25 .pyc into it that way). The half
+# that covers those is the app's seal on the tree itself
+# (src/main/python-bytecode-cache.ts), which a standalone run of this script does
+# not apply. $HOME is the right place for the cache for the same reason the venv
+# lives there: it is never inside the thing that gets signed and swapped.
 : "\${PYTHONPYCACHEPREFIX:=$APP_DATA_DIR/python-bytecode-cache}"
 export PYTHONPYCACHEPREFIX
 
@@ -3487,6 +3568,17 @@ class BackendInstaller {
       );
     }
     this.resourcesPath = process.env.NODE_ENV === "development" ? path.join(process.cwd(), "resources") : path.join(process.resourcesPath);
+    if (electron.app.isPackaged) {
+      const seal = sealPythonInterpreterTrees(
+        bundledPythonTreePaths(process.resourcesPath)
+      );
+      const message = describePythonTreeSeal(seal);
+      if (seal.supported && seal.failures.length > 0) {
+        logger.warn(message, LogFileType.INSTALLER);
+      } else {
+        logger.info(message, LogFileType.INSTALLER);
+      }
+    }
     this.pythonPath = this.findPython();
     logger.info(
       `Backend Installer initialized. Virtual environment path: ${this.venvPath}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-operator-ui",
-  "version": "0.19.3",
+  "version": "0.19.4",
   "productName": "Local Operator",
   "description": "User interface for AI agent assistants that run Python code safely on your device through an intuitive chat interface. Supports local and cloud LLM models with built-in security features.",
   "main": "./out/main/index.js",