local-operator-ui 0.29.5 → 0.29.7

package/out/main/index.js

@@ -2387,6 +2387,14 @@ const BUNDLED_PYTHON_LAYOUT = {
   checkoutSeedNames,
   machOMagics
 };
+const embeddedProvisioningProfilePath = "Contents/embedded.provisionprofile";
+const unrestrictedEntitlementKeys = ["com.apple.security.app-sandbox", "com.apple.security.application-groups", "com.apple.security.get-task-allow", "com.apple.security.inherit", "com.apple.security.print", "com.apple.security.smartcard"];
+const unrestrictedEntitlementPrefixes = ["com.apple.security.cs.", "com.apple.security.network.", "com.apple.security.files.", "com.apple.security.device.", "com.apple.security.personal-information.", "com.apple.security.assets.", "com.apple.security.automation."];
+const MACOS_ENTITLEMENT_POLICY = {
+  embeddedProvisioningProfilePath,
+  unrestrictedEntitlementKeys,
+  unrestrictedEntitlementPrefixes
+};
 const PENDING_INSTALL_MARKER_FILE = "pending-update-install.json";
 const INSTALL_DISK_SLACK_BYTES = 256 * 1024 * 1024;
 const DOWNLOAD_PAGE_URL = "https://local-operator.com/download";
@@ -2688,6 +2696,70 @@ function resolveStagedArtifactPath(input) {
   }
   return null;
 }
+const EMBEDDED_PROVISIONING_PROFILE_PATH = MACOS_ENTITLEMENT_POLICY.embeddedProvisioningProfilePath;
+function isProfileBackedEntitlement(key) {
+  if (MACOS_ENTITLEMENT_POLICY.unrestrictedEntitlementKeys.includes(key)) {
+    return false;
+  }
+  return !MACOS_ENTITLEMENT_POLICY.unrestrictedEntitlementPrefixes.some(
+    (prefix) => key.startsWith(prefix)
+  );
+}
+function profileBackedEntitlementKeys(plistText) {
+  const keys = [];
+  for (const match of String(plistText ?? "").matchAll(
+    /<key>([^<]+)<\/key>/g
+  )) {
+    const key = match[1];
+    if (isProfileBackedEntitlement(key) && !keys.includes(key)) keys.push(key);
+  }
+  return keys;
+}
+function zipListingHasEmbeddedProfile(listing) {
+  const suffix = `/${EMBEDDED_PROVISIONING_PROFILE_PATH}`;
+  return String(listing ?? "").split("\n").some((entry) => entry.trim().endsWith(suffix));
+}
+function zipMainExecutableEntry(listing) {
+  for (const raw of String(listing ?? "").split("\n")) {
+    const entry = raw.trim();
+    if (!entry || entry.endsWith("/")) continue;
+    if (/^[^/]+\.app\/Contents\/MacOS\/[^/]+$/.test(entry)) return entry;
+  }
+  return null;
+}
+function stagedSignatureBlock(facts) {
+  if (facts.entitlementsPlist == null) {
+    if (facts.embeddedProfile) return null;
+    return {
+      code: "artifact-cannot-launch",
+      heading: "The update couldn't be checked",
+      message: facts.version ? `The update to version ${facts.version} can't be checked for launch, so it wasn't installed.` : "The downloaded update can't be checked for launch, so it wasn't installed.",
+      remedy: {
+        text: "Check for updates again to re-download the release."
+      },
+      detail: `${facts.artifactName} carries no ${EMBEDDED_PROVISIONING_PROFILE_PATH} and its signature could not be read.`,
+      dismissLabel: "Not now"
+    };
+  }
+  const claimed = profileBackedEntitlementKeys(facts.entitlementsPlist);
+  if (claimed.length === 0) return null;
+  if (facts.embeddedProfile) return null;
+  return {
+    code: "artifact-cannot-launch",
+    message: facts.version ? `The update to version ${facts.version} can't be launched by macOS, so it wasn't installed.` : "The downloaded update can't be launched by macOS, so it wasn't installed.",
+    remedy: {
+      text: facts.version ? `Keep using this copy, and skip version ${facts.version} if you download one by hand — the next release will be offered here as usual.` : "Keep using this copy; the next release will be offered here as usual."
+    },
+    // The facts a reader can check, and nothing else: which archive, which
+    // claim, which file macOS found missing. TN3125's rule (a restricted
+    // entitlement needs a profile) is what makes the refusal TRUE, but a
+    // reader who wants the rule wants Apple's document, and 250 characters of
+    // it in a mono column made the details block 44% of the panel (design
+    // round 1, D4). It belongs in this comment, not in the card.
+    detail: `${facts.artifactName} claims ${claimed.join(", ")} and carries no ${EMBEDDED_PROVISIONING_PROFILE_PATH}.`,
+    dismissLabel: "Not now"
+  };
+}
 function pendingInstallMarkerPath(dir) {
   return path$1.join(dir, PENDING_INSTALL_MARKER_FILE);
 }
@@ -2854,6 +2926,20 @@ function recordInstallFailure(dir, input) {
   fs.renameSync(temp, target2);
   return record;
 }
+function installAttemptSupersededBy(record, runningVersion) {
+  const standing = targetStanding(record.targetVersion, runningVersion);
+  return standing === "reached" || standing === "passed";
+}
+function clearLastInstallAttempt(dir) {
+  const path2 = lastInstallAttemptPath(dir);
+  if (!fs.existsSync(path2)) return false;
+  try {
+    fs.rmSync(path2, { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
 const VERSION_TRIPLE_REGEX = /^v?(\d+)\.(\d+)\.(\d+)/;
 function compareVersions(a, b) {
   const parse = (value) => {
@@ -2870,14 +2956,20 @@ function compareVersions(a, b) {
   }
   return 0;
 }
+function targetStanding(target2, runningVersion) {
+  if (target2 === runningVersion) return "reached";
+  const order = compareVersions(target2, runningVersion);
+  if (order === null) return "unorderable";
+  if (order < 0) return "passed";
+  if (order > 0) return "ahead";
+  return "same-triple";
+}
 function evaluatePendingInstall(input) {
   const { marker } = input;
   if (marker == null) return { kind: "none" };
-  if (marker.targetVersion === input.runningVersion) {
-    return { kind: "succeeded", marker };
-  }
-  const order = compareVersions(marker.targetVersion, input.runningVersion);
-  if (order !== null && order < 0) return { kind: "stale", marker };
+  const standing = targetStanding(marker.targetVersion, input.runningVersion);
+  if (standing === "reached") return { kind: "succeeded", marker };
+  if (standing === "passed") return { kind: "stale", marker };
   if (input.installInFlight === true) return { kind: "in-flight", marker };
   return { kind: "failed", marker };
 }
@@ -3700,6 +3792,23 @@ function generationInstallRoot(identity) {
     dir = parent;
   }
 }
+function installPointerPath(filePath) {
+  if (!filePath) return null;
+  const identity = readInstallIdentity(filePath);
+  const generation = generationInstallRoot(identity);
+  if (!generation) return filePath;
+  let resolved;
+  try {
+    resolved = fs.realpathSync(identity.realPath ?? filePath);
+  } catch {
+    return filePath;
+  }
+  const inside2 = path$1.relative(generation, resolved);
+  if (inside2 === "" || inside2.startsWith("..") || path$1.isAbsolute(inside2)) {
+    return filePath;
+  }
+  return path$1.join(path$1.dirname(path$1.dirname(generation)), "current", inside2);
+}
 function classifyGlobalInstall(identity) {
   if (!identity.path) return "global-unknown";
   if (identity.editable) return "editable";
@@ -9584,6 +9693,428 @@ class BackendInstaller {
     }
   }
 }
+const WEBAUTHN_GROUP_SUFFIX = ".webauthn";
+const WEBAUTHN_PROMPT_REASON = "use a passkey for $1";
+const WEBAUTHN_CHOOSER_TIMEOUT_MS = 6e4;
+const CODESIGN_TIMEOUT_MS = 5e3;
+function webauthnKeychainAccessGroup(teamIdentifier, bundleIdentifier) {
+  return `${teamIdentifier}.${bundleIdentifier}${WEBAUTHN_GROUP_SUFFIX}`;
+}
+function appBundlePathFromExecutable(execPath) {
+  const parts = execPath.split("/");
+  const macOs = parts.lastIndexOf("MacOS");
+  if (macOs < 2 || parts[macOs - 1] !== "Contents") {
+    return execPath;
+  }
+  return parts.slice(0, macOs - 1).join("/") || "/";
+}
+const TEAM_IDENTIFIER_LINE = /^TeamIdentifier=(.*)$/m;
+const IDENTIFIER_LINE = /^Identifier=(.*)$/m;
+function parseTeamIdentifier(codesignVerboseOutput) {
+  const match = TEAM_IDENTIFIER_LINE.exec(codesignVerboseOutput);
+  const value = (match?.[1] ?? "").trim();
+  return value && value !== "not set" ? value : null;
+}
+function parseBundleIdentifier(codesignVerboseOutput) {
+  const match = IDENTIFIER_LINE.exec(codesignVerboseOutput);
+  const value = (match?.[1] ?? "").trim();
+  return value || null;
+}
+function parseKeychainAccessGroups(entitlementsPlist) {
+  const key = entitlementsPlist.indexOf("<key>keychain-access-groups</key>");
+  if (key === -1) return [];
+  const after = entitlementsPlist.slice(key);
+  const arrayStart = after.indexOf("<array>");
+  const arrayEnd = after.indexOf("</array>", arrayStart + 1);
+  if (arrayStart === -1 || arrayEnd === -1) return [];
+  const body = after.slice(arrayStart + "<array>".length, arrayEnd);
+  const groups = [];
+  const pattern = /<string>([^<]*)<\/string>/g;
+  let match = pattern.exec(body);
+  while (match !== null) {
+    const value = match[1].trim();
+    if (value) groups.push(value);
+    match = pattern.exec(body);
+  }
+  return groups;
+}
+function decideWebauthnGate(facts) {
+  if (facts.platform !== "darwin") {
+    return {
+      enabled: false,
+      group: null,
+      reason: "not darwin",
+      detail: `the platform authenticator is macOS only (platform ${facts.platform})`
+    };
+  }
+  if (!facts.packaged) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "unpackaged",
+      detail: "an unpackaged run has no signature to carry the entitlement, so there is no group to configure"
+    };
+  }
+  if (facts.unreadable) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "signature unreadable",
+      detail: facts.unreadable
+    };
+  }
+  if (!facts.bundleIdentifier) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "no bundle id",
+      detail: `codesign reported no Identifier for ${facts.bundlePath}`
+    };
+  }
+  if (!facts.teamIdentifier) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "no team id",
+      detail: `${facts.bundlePath} is not team-signed (an ad-hoc signature has no TeamIdentifier)`
+    };
+  }
+  const group = webauthnKeychainAccessGroup(
+    facts.teamIdentifier,
+    facts.bundleIdentifier
+  );
+  if (facts.keychainAccessGroups.length === 0) {
+    return {
+      enabled: false,
+      group,
+      reason: "entitlement absent",
+      detail: `the signature carries no keychain-access-groups entitlement, so ${group} cannot be used`
+    };
+  }
+  if (!facts.keychainAccessGroups.includes(group)) {
+    return {
+      enabled: false,
+      group,
+      reason: "entitlement mismatch",
+      detail: `the signature's keychain-access-groups are [${facts.keychainAccessGroups.join(", ")}] but the authenticator needs ${group}`
+    };
+  }
+  return {
+    enabled: true,
+    group,
+    reason: "enabled",
+    detail: `the signature carries ${group}`
+  };
+}
+const defaultCodesign = (file, args) => new Promise((resolve, reject) => {
+  node_child_process.execFile(
+    file,
+    args,
+    { timeout: CODESIGN_TIMEOUT_MS },
+    (error, stdout, stderr) => {
+      if (error) {
+        reject(
+          new Error(
+            `${error.message}${stderr ? ` (${String(stderr).trim()})` : ""}`
+          )
+        );
+        return;
+      }
+      resolve({ stdout: String(stdout), stderr: String(stderr) });
+    }
+  );
+});
+async function readAppSignature(options) {
+  const bundlePath = appBundlePathFromExecutable(options.execPath);
+  const base = {
+    platform: options.platform,
+    packaged: options.packaged,
+    bundlePath,
+    bundleIdentifier: null,
+    teamIdentifier: null,
+    keychainAccessGroups: [],
+    unreadable: null
+  };
+  if (options.platform !== "darwin" || !options.packaged) return base;
+  const run = options.run ?? defaultCodesign;
+  try {
+    const verbose = await run("/usr/bin/codesign", [
+      "-dv",
+      "--verbose=4",
+      bundlePath
+    ]);
+    base.bundleIdentifier = parseBundleIdentifier(verbose.stdout);
+    base.teamIdentifier = parseTeamIdentifier(verbose.stdout);
+  } catch (error) {
+    return { ...base, unreadable: `codesign -dv failed: ${messageOf$1(error)}` };
+  }
+  try {
+    const entitlements = await run("/usr/bin/codesign", [
+      "-d",
+      "--entitlements",
+      "-",
+      "--xml",
+      bundlePath
+    ]);
+    base.keychainAccessGroups = parseKeychainAccessGroups(entitlements.stdout);
+  } catch (error) {
+    return {
+      ...base,
+      unreadable: `codesign -d --entitlements failed: ${messageOf$1(error)}`
+    };
+  }
+  return base;
+}
+function messageOf$1(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+let ownSignature = null;
+function ownAppSignature() {
+  ownSignature ??= readAppSignature({
+    platform: process.platform,
+    packaged: electron.app.isPackaged,
+    execPath: process.execPath
+  });
+  return ownSignature;
+}
+async function installWebauthn(options) {
+  const facts = await (options.facts ?? ownAppSignature)();
+  const gate = decideWebauthnGate(facts);
+  if (!gate.enabled || !gate.group) {
+    options.log(
+      `[webauthn] Touch ID passkeys are off: ${gate.reason} — ${gate.detail}`
+    );
+    return { gate, configured: false };
+  }
+  const configure = options.configure ?? ((value) => electron.app.configureWebAuthn(value));
+  try {
+    configure({
+      touchID: {
+        keychainAccessGroup: gate.group,
+        promptReason: WEBAUTHN_PROMPT_REASON
+      }
+    });
+  } catch (error) {
+    options.log(
+      `[webauthn] Touch ID passkeys are off: configureWebAuthn failed — ${messageOf$1(error)}`
+    );
+    return { gate: { ...gate, enabled: false }, configured: false };
+  }
+  options.log(
+    `[webauthn] Touch ID platform authenticator enabled (${gate.group}); credentials are device-bound and never leave this Mac`
+  );
+  return { gate, configured: true };
+}
+class WebauthnChooser {
+  constructor(options) {
+    this.options = options;
+  }
+  pending = /* @__PURE__ */ new Map();
+  counter = 0;
+  /** Handle the Session event. `accounts` is Electron's own array. */
+  handle(details, callback) {
+    const answer = onceAnswer(callback);
+    try {
+      this.prepare(details, answer);
+    } catch (error) {
+      this.options.log(
+        `[webauthn] a passkey request could not be prepared (${String(
+          error
+        )}); cancelling it`
+      );
+      answer(null);
+    }
+  }
+  /** The pre-timer half of `handle`: everything that can still throw. */
+  prepare(details, answer) {
+    const relyingPartyId = typeof details.relyingPartyId === "string" ? details.relyingPartyId : "";
+    const accounts = Array.isArray(details.accounts) ? details.accounts.filter(
+      (account) => typeof account === "object" && account !== null
+    ).map((account) => toAccountView(account)) : [];
+    if (accounts.length === 0) {
+      this.options.log(
+        `[webauthn] ${relyingPartyId || "a site"} asked for a passkey with no account to choose; cancelling the request`
+      );
+      answer(null);
+      return;
+    }
+    const requestId2 = this.options.nextRequestId ? this.options.nextRequestId() : `webauthn-${++this.counter}-${Date.now().toString(36)}`;
+    const source = this.options.describeSource?.(details.frame) ?? {
+      tabId: null,
+      pageTitle: null
+    };
+    const timer = setTimeout(
+      () => this.expire(requestId2),
+      this.options.timeoutMs ?? WEBAUTHN_CHOOSER_TIMEOUT_MS
+    );
+    timer.unref?.();
+    const request = {
+      requestId: requestId2,
+      relyingPartyId,
+      accounts,
+      tabId: source.tabId,
+      pageTitle: source.pageTitle
+    };
+    this.options.log(
+      `[webauthn] ${relyingPartyId || "a site"} matched ${accounts.length} passkeys; asking the user which one to use (${requestId2})`
+    );
+    this.options.notify(request);
+    this.pending.set(requestId2, {
+      requestId: requestId2,
+      relyingPartyId,
+      accounts,
+      tabId: source.tabId,
+      pageTitle: source.pageTitle,
+      answer,
+      timer
+    });
+  }
+  /**
+   * Answer a surfaced chooser. Returns whether a pending request was settled.
+   *
+   * A `credentialId` that is not one of the offered accounts is treated as a
+   * dismissal rather than passed through: Electron would cancel the request
+   * anyway, and doing it here keeps the log honest about what happened.
+   */
+  respond(requestId2, credentialId) {
+    const entry = this.pending.get(requestId2);
+    if (!entry) {
+      this.options.log(
+        `[webauthn] ignored a choice for an unknown or already-answered request (${requestId2})`
+      );
+      return false;
+    }
+    if (credentialId !== null && !entry.accounts.some((a) => a.credentialId === credentialId)) {
+      this.options.log(
+        `[webauthn] a choice for ${entry.relyingPartyId} named a credential that was not offered; cancelling the request`
+      );
+      this.settle(entry, null, "credential-not-offered");
+      return true;
+    }
+    if (credentialId === null) {
+      this.options.log(
+        `[webauthn] the passkey choice for ${entry.relyingPartyId} was dismissed; cancelling the request`
+      );
+      this.settle(entry, null, "dismissed");
+      return true;
+    }
+    const chosen = entry.accounts.find((a) => a.credentialId === credentialId);
+    this.options.log(
+      `[webauthn] the user chose ${labelOf(chosen)} for ${entry.relyingPartyId}`
+    );
+    this.settle(entry, credentialId, "chosen");
+    return true;
+  }
+  /** Ids still waiting for an answer. Read by tests and by nothing else. */
+  pendingRequestIds() {
+    return [...this.pending.keys()];
+  }
+  /**
+   * Every request still waiting, OLDEST FIRST.
+   *
+   * This is what a surface that mounts late reads instead of a request it never
+   * received (UX round 1, U2: the request was raised while the browser route was
+   * not mounted, so the push had nowhere to go). Order is the map's own insertion
+   * order, which is why it is stated: the renderer offers the oldest request and
+   * names the rest rather than silently replacing one with the next.
+   */
+  pendingRequests() {
+    return [...this.pending.keys()].map((requestId2) => this.view(requestId2));
+  }
+  /** Cancel everything still pending. Called when the host stops, because a
+   * callback left behind would keep the page's promise pending in a window
+   * that is going away. */
+  dispose() {
+    for (const entry of [...this.pending.values()]) {
+      this.options.log(
+        `[webauthn] the passkey request from ${entry.relyingPartyId} was cancelled: the browser host stopped`
+      );
+      this.settle(entry, null, "host-stopped");
+    }
+  }
+  expire(requestId2) {
+    const entry = this.pending.get(requestId2);
+    if (!entry) return;
+    this.options.log(
+      `[webauthn] nobody chose a passkey for ${entry.relyingPartyId} within ${Math.round((this.options.timeoutMs ?? WEBAUTHN_CHOOSER_TIMEOUT_MS) / 1e3)}s; cancelling the request`
+    );
+    this.settle(entry, null, "expired");
+  }
+  /** The wire view of one pending request. Never a credential id in the token
+   * position: `requestId` is this module's own. */
+  view(requestId2) {
+    const entry = this.pending.get(requestId2);
+    if (!entry) {
+      throw new Error(`no pending passkey request ${requestId2}`);
+    }
+    return {
+      requestId: entry.requestId,
+      relyingPartyId: entry.relyingPartyId,
+      accounts: entry.accounts,
+      tabId: entry.tabId,
+      pageTitle: entry.pageTitle
+    };
+  }
+  /** Answer exactly once, then tell the renderer the request is gone.
+   *
+   * Both halves matter. The map entry and the guarded callback are the
+   * exactly-once half; `onSettled` is what stops the renderer offering a choice
+   * for a request main has already answered — the dead-end dialog of design
+   * round 1, D2 — and it fires for EVERY path, including the host's own stop.
+   */
+  settle(entry, credentialId, outcome) {
+    if (!this.pending.has(entry.requestId)) return;
+    this.pending.delete(entry.requestId);
+    clearTimeout(entry.timer);
+    entry.answer(credentialId);
+    this.options.onSettled?.(entry.requestId, outcome);
+  }
+}
+const answerableCallbacks = /* @__PURE__ */ new WeakMap();
+function onceAnswer(callback) {
+  const existing = answerableCallbacks.get(callback);
+  if (existing) return existing;
+  let answered = false;
+  const guarded = (credentialId) => {
+    if (answered) return;
+    answered = true;
+    callback(credentialId ?? void 0);
+  };
+  answerableCallbacks.set(callback, guarded);
+  return guarded;
+}
+const chooserListeners = /* @__PURE__ */ new WeakMap();
+function attachWebauthnChooser(session, chooser, log) {
+  const previous = chooserListeners.get(session);
+  if (previous) {
+    session.removeListener("select-webauthn-account", previous);
+    log(
+      "[webauthn] replaced the previous passkey chooser listener (a second browser host started in this process)"
+    );
+  }
+  const listener = (_event, details, callback) => {
+    chooser.handle(details, callback);
+  };
+  session.on("select-webauthn-account", listener);
+  chooserListeners.set(session, listener);
+  return () => {
+    if (chooserListeners.get(session) !== listener) return;
+    session.removeListener("select-webauthn-account", listener);
+    chooserListeners.delete(session);
+  };
+}
+function toAccountView(account) {
+  return {
+    credentialId: typeof account.credentialId === "string" ? account.credentialId : "",
+    name: typeof account.name === "string" ? account.name : null,
+    displayName: typeof account.displayName === "string" ? account.displayName : null,
+    userHandle: typeof account.userHandle === "string" ? account.userHandle : null
+  };
+}
+function labelOf(account) {
+  if (!account) return "an unnamed passkey";
+  return account.displayName || account.name || "an unnamed passkey";
+}
 const PRIVATE_FILE_MODE = 384;
 const PRIVATE_DIR_MODE = 448;
 function writeJsonAtomic(path2, value) {
@@ -11000,14 +11531,48 @@ function settle(contents, timeoutMs = 3e4) {
 function permittedScheme(url) {
   return url.protocol === "http:" || url.protocol === "https:";
 }
+async function resolveMainFrameId(ctx, contents) {
+  let pageEnabled = false;
+  try {
+    await ctx.cdp.send(contents, "Page.enable", {});
+    pageEnabled = true;
+    const tree = await ctx.cdp.send(contents, "Page.getFrameTree", {});
+    const id2 = tree?.frameTree?.frame?.id;
+    return {
+      mainFrameId: typeof id2 === "string" && id2 ? id2 : null,
+      pageEnabled
+    };
+  } catch {
+    return { mainFrameId: null, pageEnabled };
+  }
+}
 async function withOriginGate(ctx, view, requester, approved, operation) {
   const contents = view.webContents;
   const blocked = [];
   const seen = /* @__PURE__ */ new Set();
+  const frameTree = await resolveMainFrameId(ctx, contents);
+  const mainFrameId = frameTree.mainFrameId;
+  if (mainFrameId === null) {
+    ctx.log(
+      `[browser] could not read the frame tree for ${requester}; this navigation is gated on every Document request, which may refuse cross-origin frames the page needs${// The domain's state travels with the fallback because it is not
+      // inferable from the failure: an enable that resolved and a read that
+      // did not left `Page` armed, an enable that never resolved did not
+      // (agent review round 2, R3).
+      frameTree.pageEnabled ? " (the Page domain may still be enabled)" : ""}`
+    );
+  }
+  let unattributed = 0;
   const unsubscribe = ctx.cdp.subscribe(contents.id, (method, params) => {
     if (method !== "Fetch.requestPaused") return;
     const requestId2 = typeof params.requestId === "string" ? params.requestId : "";
     if (!requestId2) return;
+    const frameId = typeof params.frameId === "string" ? params.frameId : "";
+    if (mainFrameId !== null && frameId && frameId !== mainFrameId) {
+      void ctx.cdp.send(contents, "Fetch.continueRequest", { requestId: requestId2 }).catch(() => {
+      });
+      return;
+    }
+    if (mainFrameId !== null && !frameId) unattributed += 1;
     const rawUrl = typeof params.request === "object" && params.request !== null ? params.request.url : void 0;
     let url = null;
     try {
@@ -11056,10 +11621,21 @@ async function withOriginGate(ctx, view, requester, approved, operation) {
     throw error;
   } finally {
     unsubscribe();
+    if (unattributed > 0) {
+      ctx.log(
+        `[browser] ${unattributed} paused document request(s) during ${requester}'s navigation carried no frame id; they were gated as navigation hops`
+      );
+    }
     try {
       await ctx.cdp.send(contents, "Fetch.disable", {});
     } catch {
     }
+    if (frameTree.pageEnabled) {
+      try {
+        await ctx.cdp.send(contents, "Page.disable", {});
+      } catch {
+      }
+    }
   }
 }
 async function navigateView(ctx, view, url, requester, approved, timeoutMs = 3e4) {
@@ -11681,6 +12257,20 @@ class TabRegistry {
   list() {
     return [...this.tabs.values()].sort((a, b) => a.tabId - b.tabId);
   }
+  /**
+   * The tab whose view owns this webContents id, if any.
+   *
+   * The passkey chooser needs it to name the page a request came from: Electron
+   * hands the initiating frame, `webContents.fromFrame` turns that into a
+   * webContents, and this is the mapping from there to a tab of THIS host — the
+   * frame may belong to no tab here at all, which is why the answer is optional
+   * rather than an error.
+   */
+  byWebContentsId(webContentsId) {
+    return this.list().find(
+      (record) => !record.view.webContents.isDestroyed() && record.view.webContents.id === webContentsId
+    );
+  }
   get activeTab() {
     return this.activeTabId === null ? null : this.tabs.get(this.activeTabId) ?? null;
   }
@@ -13027,7 +13617,9 @@ const BROWSER_IPC_CHANNELS = [
   "browser-revoke-approval",
   "browser-revoke-all-approvals",
   "browser-forget-site",
-  "browser-clear-data"
+  "browser-clear-data",
+  "browser-webauthn-respond",
+  "browser-webauthn-pending"
 ];
 function registerBrowserIpc(options) {
   function authorize(event) {
@@ -13097,6 +13689,25 @@ function registerBrowserIpc(options) {
     const host = authorize(event);
     return host.revokeHandOver(numberOrThrow(tabId, "tabId"));
   });
+  electron.ipcMain.handle(
+    "browser-webauthn-respond",
+    (event, requestId2, credentialId) => {
+      authorize(event);
+      const chooser = options.webauthn();
+      if (!chooser) throw new Error("The browser host is not running.");
+      if (typeof requestId2 !== "string" || !requestId2) {
+        throw new Error("A pending passkey request id is required.");
+      }
+      if (credentialId !== null && typeof credentialId !== "string") {
+        throw new Error("A passkey choice must name a credential or nothing.");
+      }
+      return chooser.respond(requestId2, credentialId);
+    }
+  );
+  electron.ipcMain.handle("browser-webauthn-pending", (event) => {
+    authorize(event);
+    return options.webauthn()?.pendingRequests() ?? [];
+  });
   electron.ipcMain.handle(
     "browser-consent-respond",
     (event, entryId, decision) => {
@@ -13488,8 +14099,9 @@ class OwnershipLedger {
 const BROWSER_PARTITION = "persist:local-operator-browser";
 function browserUserAgent() {
   const chrome = process.versions.chrome ?? "0";
+  const major = chrome.split(".")[0] || "0";
   const platform = process.platform === "darwin" ? "Macintosh; Intel Mac OS X 10_15_7" : process.platform === "win32" ? "Windows NT 10.0; Win64; x64" : "X11; Linux x86_64";
-  return `Mozilla/5.0 (${platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chrome} Safari/537.36 LocalOperator/${electron.app.getVersion()}`;
+  return `Mozilla/5.0 (${platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
 }
 function resolveBrowserSession() {
   return electron.session.fromPartition(BROWSER_PARTITION);
@@ -14930,6 +15542,43 @@ async function startBrowserHost(options) {
     log
   });
   configurePslRules(PSL_RULES);
+  await installWebauthn({ log });
+  const describeSource = (frame) => {
+    if (!frame || typeof frame !== "object") {
+      return { tabId: null, pageTitle: null };
+    }
+    const contents = electron.webContents.fromFrame(frame);
+    const record = contents === void 0 ? void 0 : registry.byWebContentsId(contents.id);
+    if (!record) return { tabId: null, pageTitle: null };
+    const title = record.view.webContents.isDestroyed() ? "" : record.view.webContents.getTitle();
+    return { tabId: record.tabId, pageTitle: title || null };
+  };
+  const webauthn = new WebauthnChooser({
+    notify: (request) => {
+      if (options.window.isDestroyed()) return;
+      options.window.webContents.send("browser-webauthn-request", request);
+    },
+    /*
+     * AND THE OTHER DIRECTION: every settle is pushed, not only every arrival.
+     *
+     * Without this the renderer cannot tell a live request from one main has
+     * already cancelled, so a chooser whose request expired while the user was
+     * away stays on screen offering rows that can no longer do anything (design
+     * round 1, D2) — and the click is then discarded silently. The outcome travels
+     * with the push because the two cases differ for the user: their own answer is
+     * already off the screen, an expiry has to be explained.
+     */
+    onSettled: (requestId2, outcome) => {
+      if (options.window.isDestroyed()) return;
+      options.window.webContents.send("browser-webauthn-settled", {
+        requestId: requestId2,
+        outcome
+      });
+    },
+    describeSource,
+    log
+  });
+  const detachWebauthn = attachWebauthnChooser(browserSession, webauthn, log);
   const cookieJar = createHiddenCookieJarTarget(
     new electron.WebContentsView({
       webPreferences: { ...HIDDEN_COOKIE_JAR_WEB_PREFERENCES }
@@ -15074,6 +15723,7 @@ async function startBrowserHost(options) {
     window: () => options.window,
     expectedUrl: options.expectedUrl,
     host: () => host,
+    webauthn: () => webauthn,
     clearData: (what) => sessionCookies.clearBrowsingData(what),
     log
   });
@@ -15102,6 +15752,8 @@ async function startBrowserHost(options) {
       await cdp.close();
       await server.close();
       unregisterBrowserIpc();
+      detachWebauthn();
+      webauthn.dispose();
       stateWriter?.clear();
       approvals.resetPending();
       ownership.clear();
@@ -17075,6 +17727,7 @@ const INSTALL_IN_FLIGHT_RECHECK_MS = 1e4;
 const LAUNCHCTL_NOT_LOADED_REGEX = /could not find|no such process/i;
 const APP_OWNED_PUBLISH_HEADROOM_BYTES = 450 * 1024 * 1024;
 const SEAL_PROBE_TIMEOUT_MS = 45e3;
+const STAGED_SIGNATURE_PROBE_TIMEOUT_MS = 2e4;
 const STARTUP_SEAL_PROBE_DELAY_MS = 15e3;
 const POST_WAKE_CHECK_DELAY_MS = 2e4;
 function versionSuffix(version) {
@@ -17767,6 +18420,7 @@ class UpdateService {
         );
         this.reapWatchdog(outcome.marker, true);
         clearPendingInstallMarker(this.markerDir());
+        this.retireSupersededInstallRecord();
         return;
       case "stale":
         logger.info(
@@ -17775,6 +18429,7 @@ class UpdateService {
         );
         this.reapWatchdog(outcome.marker, true);
         clearPendingInstallMarker(this.markerDir());
+        this.retireSupersededInstallRecord();
         return;
       case "in-flight": {
         this.installWasInFlight = true;
@@ -18551,10 +19206,123 @@ ${heal.removed.join("\n")}`,
         `Staged artifact verified: ${artifactPath} (${verdict.size} bytes, sha512 matches, ${required} bytes required free, ${installedBundleSize ?? "unknown"} byte app).`,
         LogFileType.UPDATE_SERVICE
       );
-      return null;
+      return this.stagedSignatureBlock(artifactPath, info);
     }
     return verdict.block;
   }
+  /**
+   * Refuse a staged artifact macOS would not launch, before the app quits.
+   *
+   * Why this is worth a probe of its own. On 2026-09-19 the operator's install
+   * updated itself to 0.29.6, which was Developer-ID signed, notarized, stapled,
+   * `codesign --verify --deep --strict`-clean and `spctl -t exec`-accepted - and
+   * completely unlaunchable: every executable in the bundle claimed the
+   * restricted `keychain-access-groups` entitlement while the bundle embedded no
+   * provisioning profile to authorize it, so amfid refused every Mach-O at exec
+   * (`AppleMobileFileIntegrityError Code=-413 "No matching profile found"`).
+   * `open` reported `RBSRequestErrorDomain Code=5 / NSPOSIXErrorDomain Code=163
+   * "Launchd job spawn failed"`. The ShipIt that should have relaunched the app
+   * was refused for the same reason, so the install completed and left the user
+   * with no app, no message and no automatic way back.
+   *
+   * The signature check is done on the STAGED artifact rather than on the
+   * installed bundle because by the time the installed bundle is the broken one,
+   * there is nothing left running to report it.
+   *
+   * A probe that could not read the artifact at all is not a refusal by itself -
+   * `stagedSignatureBlock` decides that - and neither is a non-zip artifact: the
+   * macOS in-app update is a `.zip`, and an artifact this cannot read is reported
+   * as such rather than treated as clean.
+   */
+  async stagedSignatureBlock(artifactPath, info) {
+    const facts = await this.inspectStagedSignature(artifactPath, info);
+    if (!facts) return null;
+    const block = stagedSignatureBlock(facts);
+    if (!block) {
+      logger.info(
+        `Staged artifact signature checked: ${facts.artifactName} claims no entitlement macOS needs a provisioning profile for.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    }
+    logger.warn(
+      `Refusing the update to ${info?.version ?? "an unknown version"}: ${block.detail}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    return block;
+  }
+  /**
+   * The facts `stagedSignatureBlock` decides on, read out of the archive.
+   *
+   * Two members of the zip and one `codesign`, which is cheap because the file
+   * that carries the entitlements is the bundle's LAUNCHER rather than the app
+   * (`Contents/MacOS/Local Operator` is ~54 KB beside a ~376 MB bundle). The
+   * listing comes from the central directory, so neither the interpreter nor the
+   * frameworks are ever decompressed.
+   *
+   * Returns null when there is nothing this can ask about - not a zip, or a zip
+   * whose listing could not be read - and says so in the log. That is a
+   * deliberate "we could not tell", which is different from "we looked and it is
+   * clean"; the caller logs the clean case itself.
+   */
+  async inspectStagedSignature(artifactPath, info) {
+    const artifactName = path$1.basename(artifactPath);
+    if (!artifactPath.toLowerCase().endsWith(".zip")) {
+      logger.info(
+        `Staged artifact ${artifactName} is not a zip; its signature was not inspected before the install.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    }
+    const listing = await runCommand("/usr/bin/unzip", ["-Z1", artifactPath], {
+      timeoutMs: STAGED_SIGNATURE_PROBE_TIMEOUT_MS
+    });
+    if (!listing.ran || listing.exitCode !== 0) {
+      logger.warn(
+        `Could not list ${artifactName} to check its signature (exit ${listing.exitCode}): ${listing.stderr.trim() || "no output"}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    }
+    const embeddedProfile = zipListingHasEmbeddedProfile(listing.stdout);
+    const entry = zipMainExecutableEntry(listing.stdout);
+    const base = {
+      entitlementsPlist: null,
+      embeddedProfile,
+      artifactName,
+      version: info?.version ?? null
+    };
+    if (!entry) {
+      logger.warn(
+        `${artifactName} has no Contents/MacOS entry to read a signature from; its entitlements were not inspected before the install.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return base;
+    }
+    const scratch = fs.mkdtempSync(path$1.join(os.tmpdir(), "lo-staged-signature-"));
+    try {
+      const extracted = await runCommand(
+        "/usr/bin/unzip",
+        ["-o", "-q", artifactPath, entry, "-d", scratch],
+        { timeoutMs: STAGED_SIGNATURE_PROBE_TIMEOUT_MS }
+      );
+      if (!extracted.ran || extracted.exitCode !== 0) {
+        logger.warn(
+          `Could not extract ${entry} from ${artifactName} (exit ${extracted.exitCode}): ${extracted.stderr.trim() || "no output"}`,
+          LogFileType.UPDATE_SERVICE
+        );
+        return base;
+      }
+      const signature = await runCommand(
+        "/usr/bin/codesign",
+        ["-d", "--entitlements", "-", "--xml", path$1.join(scratch, entry)],
+        { timeoutMs: STAGED_SIGNATURE_PROBE_TIMEOUT_MS }
+      );
+      return signature.ran && signature.exitCode === 0 ? { ...base, entitlementsPlist: signature.stdout } : base;
+    } finally {
+      fs.rmSync(scratch, { recursive: true, force: true });
+    }
+  }
   /**
    * Everything that has to hold before the app is allowed to quit.
    *
@@ -18772,9 +19540,39 @@ ${heal.removed.join("\n")}`,
    * a dismiss: the panel that reports a failure is not the only place the user
    * can find out what happened, which is what made Dismiss an information loss
    * (reviews U1, D3).
+   *
+   * AND IT RETIRES ONCE THE MACHINE HAS ARRIVED, which is the other half of that
+   * promise: a record that survives a dismiss must not survive the state it
+   * describes, or "Version 0.28.2 is running" is printed to a user on 0.29.1 for
+   * ever (the operator's report, 2026-09-18 - a 0.28.3 record against a running
+   * 0.29.1). The test is read-time because the fact becomes true without this
+   * process doing anything: the installer ran, the user relaunched, and the app
+   * that comes up is the one that answers every reader.
    */
   lastInstallAttempt() {
-    return readLastInstallAttempt(this.markerDir());
+    return this.retireSupersededInstallRecord();
+  }
+  /**
+   * The record, retired first when the version now running has reached its target.
+   *
+   * One function rather than the same test written at each site, because there are two
+   * moments the fact becomes true - the launch that reads the record, and a start-up
+   * that observes an install having succeeded or been superseded - and two spellings of
+   * one rule is how the arms drift apart. The predicate keeps a record whose versions
+   * cannot be ordered, so nothing is dropped on a guess (`installAttemptSupersededBy`).
+   */
+  retireSupersededInstallRecord() {
+    const record = readLastInstallAttempt(this.markerDir());
+    if (!record) return null;
+    const running = electron.app.getVersion();
+    if (!installAttemptSupersededBy(record, running)) return record;
+    if (clearLastInstallAttempt(this.markerDir())) {
+      logger.info(
+        `Retired the recorded install failure for ${record.targetVersion}: this app is running ${running}, so the target has been reached and the record describes a state the machine has left`,
+        LogFileType.UPDATE_SERVICE
+      );
+    }
+    return null;
   }
   /**
    * Note that a check was asked for, and let an explicit one re-offer a release
@@ -19612,9 +20410,15 @@ ${heal.removed.join("\n")}`,
    * uv tool root), so a prefix held from minutes ago can name a tree nothing is
    * using any more. The reading is what `didSourceRebuildLand` compares, in both
    * directions.
+   *
+   * Read through the install's own pointer for the same reason the version is (see
+   * `readInstallVersionAt`): a rebuild keeps `pyproject.toml`'s version and moves the
+   * `.lop-source` ref, so the marker is the ONLY evidence of that move on this route -
+   * and a marker read from the frozen `generations/<id>` the daemon started from cannot
+   * show it any more than the version could.
    */
   readRebuildMarkerState(installPath) {
-    const identity = readInstallIdentity(installPath);
+    const identity = readInstallIdentity(installPointerPath(installPath));
     return readSourceMarkerState(identity.venvPrefix ?? null);
   }
   /**
@@ -20400,9 +21204,16 @@ ${heal.removed.join("\n")}`,
    * than into a plausible number. The one caller with a record and no path - the
    * reconciliation reading a marker an older build wrote - names its fallback explicitly
    * and logs it.
+   *
+   * AND THE INSTALL IS READ THROUGH ITS OWN POINTER, because on a generation layout the
+   * install it names cannot move under it: the tree `/health` reports as the install root
+   * is `generations/<id>`, an install lands BESIDE it, and only `<stable>/current` moves.
+   * Reading the concrete path here is what produced the false "did not take effect" verdict
+   * of 2026-09-18; `installPointerPath` is the same install named so the flip is visible,
+   * and it is a no-op on every other layout.
    */
   readInstallVersionAt(installPath) {
-    return readInstallIdentity(installPath)?.version ?? null;
+    return readInstallIdentity(installPointerPath(installPath))?.version ?? null;
   }
   /**
    * Run the install's own front end: `<resolved shim> update`.
@@ -20632,8 +21443,17 @@ ${heal.removed.join("\n")}`,
        * The install this attempt runs, recorded so a later launch does not have to resolve
        * one of its own: the reconciliation reads this, and a marker without it (an older
        * build's) is the only case that falls back.
+       *
+       * RECORDED THROUGH ITS OWN POINTER where the layout has one, so the record outlives
+       * the tree it names: on a generation install the flip an install performs is visible
+       * only through `<stable>/current`, and the generation this attempt started from is
+       * unreferenced the moment it is superseded - which makes it prunable, and a record
+       * naming a pruned tree reads as "nothing moved" for an install that landed. A record
+       * an older build wrote carries the concrete generation path instead, which the reader
+       * resolves through the same pointer (`installPointerPath` is idempotent, so both
+       * spellings land in the same place).
        */
-      installPath
+      installPath: installPointerPath(installPath)
     };
     writePendingServerUpdateMarker(this.markerDir(), marker);
     const run = await this.runGlobalUpdate(
@@ -20655,7 +21475,7 @@ ${heal.removed.join("\n")}`,
           deadlineAt: marker.deadlineAt,
           groupPid: pid,
           groupStartedAt: readProcessStartStamp(pid),
-          installPath
+          installPath: installPointerPath(installPath)
         });
       }
     );