pairling 0.1.0 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairling",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Pair your iPhone with the AI coding agents running on your Mac. CLI and local runtime installer for the Pairling iOS app.",
   "keywords": [
     "pairling",
@@ -40,7 +40,7 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "@pairling/runtime-darwin-arm64": "0.1.0",
-    "@pairling/runtime-darwin-x64": "0.1.0"
+    "@pairling/runtime-darwin-arm64": "0.2.0",
+    "@pairling/runtime-darwin-x64": "0.2.0"
   }
 }

package/payload/mac/SOURCE_REVISION

@@ -1 +1 @@
-35420e4
+58288e6

package/payload/mac/install/doctor.sh

@@ -239,18 +239,18 @@ def next_action_for_stage(stage: str, *, remote_status: str, pair_window_open: b
         return {
             "id": "open_pairing_invitation",
             "label": "Open pairing invitation",
-            "message": "Open a pairing invitation from Pairling Helper, then pair from the iPhone.",
+            "message": "Run pairling pair to open a pairing invitation, then pair from the iPhone.",
         }
     if stage == "runtime_not_ready":
         return {
-            "id": "start_helper",
-            "label": "Start Pairling Helper",
-            "message": "Run Pairling Helper setup and review the failing runtime checks.",
+            "id": "start_runtime",
+            "label": "Start the Pairling runtime",
+            "message": "Run pairling setup and review the failing runtime checks.",
         }
     return {
-        "id": "install_helper",
-        "label": "Install Pairling Helper",
-        "message": "Install Pairling Helper on this Mac before pairing.",
+        "id": "install_cli",
+        "label": "Install the Pairling CLI",
+        "message": "Run npm install -g pairling then pairling setup on this Mac before pairing.",
     }
 
 
@@ -501,39 +501,73 @@ add(
     (out or err)[:2000],
 )
 
-helper_artifact = Path(os.environ.get("PAIRLING_HELPER_ARTIFACT", str(repo_root / "dist" / "PairlingHelper.dmg")))
-helper_bundle = APP_SUPPORT / "Pairling Helper.app"
-if helper_artifact.exists():
-    code, out, err = run([
-        "/usr/sbin/spctl",
-        "-a",
-        "-vv",
-        "--type",
-        "open",
-        "--context",
-        "context:primary-signature",
-        str(helper_artifact),
-    ], timeout=8)
-    if code != 0:
-        release_blockers.append("Developer ID signed/notarized helper DMG is not Gatekeeper-accepted yet.")
+# npm distribution: the staged pairling-connectd binary must be a valid
+# Developer ID build from the pinned team. This replaces the retired dmg
+# Gatekeeper check; the npm install path never sets com.apple.quarantine, so
+# Gatekeeper assessment is not in the launch path, but signature + Team ID
+# verification is the integrity equivalent and matches the fail-closed staging
+# gate in install-runtime.sh.
+expected_team = os.environ.get("PAIRLING_CONNECTD_TEAM_ID", "965AVD34A3")
+staged_connectd = CURRENT / "connectd" / "pairling-connectd"
+if staged_connectd.exists():
+    vcode, vout, verr = run(["/usr/bin/codesign", "--verify", "--strict", str(staged_connectd)], timeout=8)
+    icode, iout, ierr = run(["/usr/bin/codesign", "-dvv", str(staged_connectd)], timeout=8)
+    team_line = next((l for l in ((iout or "") + (ierr or "")).splitlines() if l.startswith("TeamIdentifier=")), "")
+    team_id = team_line.split("=", 1)[1] if "=" in team_line else ""
+    signed_ok = vcode == 0 and (expected_team == "-" or team_id == expected_team)
+    if not signed_ok:
+        release_blockers.append("Staged pairling-connectd is not a valid Developer ID build from the expected team.")
     add(
-        "helper_signing_notarization",
-        code == 0,
+        "connectd_signature",
+        signed_ok,
         "warning",
-        "Helper DMG Gatekeeper assessment.",
-        {"artifact": str(helper_artifact), "assessment": (out or err)[:2000]},
+        "Staged pairling-connectd passes codesign --verify --strict with the expected Team ID.",
+        {"binary": str(staged_connectd), "team_id": team_id or None, "expected_team": expected_team, "verify": (vout or verr)[:1000]},
     )
-elif helper_bundle.exists():
-    code, out, err = run(["/usr/sbin/spctl", "-a", "-vv", str(helper_bundle)], timeout=8)
-    add("helper_signing_notarization", code == 0, "warning", "Helper bundle Gatekeeper assessment.", (out or err)[:2000])
 else:
-    release_blockers.append("Developer ID signed/notarized helper artifact is not present yet.")
+    release_blockers.append("Staged pairling-connectd is not present; run pairling setup.")
     add(
-        "helper_signing_notarization",
+        "connectd_signature",
         False,
         "warning",
-        "Helper artifact not present; signing/notarization remains a release blocker.",
-        {"artifact": str(helper_artifact), "bundle": str(helper_bundle)},
+        "Staged pairling-connectd not present; signature verification unavailable until pairling setup runs.",
+        {"binary": str(staged_connectd)},
+    )
+
+# P3 Python custody: when a vendored interpreter is staged, it must be a valid
+# Developer ID build from the expected team with the dev.pairling.python
+# identity — that scoping is the whole point (TCC grants attach to Pairling, not
+# a generic python3). When no vendored python is staged (the daemon runs under a
+# system python3), this check is informational, not a blocker.
+expected_python_identifier = os.environ.get("PAIRLING_PYTHON_IDENTIFIER", "dev.pairling.python")
+staged_python = CURRENT / "python" / "bin" / "python3"
+if staged_python.exists():
+    pvcode, pvout, pverr = run(["/usr/bin/codesign", "--verify", "--strict", str(staged_python)], timeout=10)
+    picode, piout, pierr = run(["/usr/bin/codesign", "-dvv", str(staged_python)], timeout=10)
+    pinfo = (piout or "") + (pierr or "")
+    p_team = next((l.split("=", 1)[1] for l in pinfo.splitlines() if l.startswith("TeamIdentifier=")), "")
+    p_id = next((l.split("=", 1)[1] for l in pinfo.splitlines() if l.startswith("Identifier=")), "")
+    python_signed_ok = (
+        pvcode == 0
+        and (expected_team == "-" or p_team == expected_team)
+        and p_id == expected_python_identifier
+    )
+    if not python_signed_ok:
+        release_blockers.append("Staged vendored python is not a valid dev.pairling.python Developer ID build.")
+    add(
+        "python_runtime",
+        python_signed_ok,
+        "warning",
+        "Staged vendored CPython is signed dev.pairling.python by the expected Team ID.",
+        {"python": str(staged_python), "team_id": p_team or None, "identifier": p_id or None, "expected_identifier": expected_python_identifier},
+    )
+else:
+    add(
+        "python_runtime",
+        True,
+        "warning",
+        "No vendored CPython staged; daemon runs under a system python3 (acceptable pre-P3-rollout).",
+        {"python": str(staged_python), "vendored": False},
     )
 
 errors = [c for c in checks if c["status"] != "ok" and c["severity"] == "error"]

package/payload/mac/install/install-runtime.sh

@@ -34,7 +34,6 @@ PACKAGED_SOURCE_PATHS=(
   "mac/connectd/go.mod"
   "mac/connectd/go.sum"
   "mac/guardian"
-  "mac/helper-assistant/PairlingHelperAssistant.swift"
   "mac/install"
   "mac/mcp"
 )
@@ -76,6 +75,13 @@ MCP_SERVER_DIR="$HOME/.claude/mcp-servers"
 MCP_SERVER_SHIM="$MCP_SERVER_DIR/phone-tools.py"
 PYTHON3_BIN="${PAIRLING_DAEMON_PYTHON:-${COMPANION_DAEMON_PYTHON:-$(command -v python3)}}"
 GUARDIAN_PYTHON_BIN="${PAIRLING_GUARDIAN_PYTHON:-${COMPANION_GUARDIAN_PYTHON:-/usr/bin/python3}}"
+# P3 Python custody: the npm shim points PAIRLING_DAEMON_PYTHON at the vendored
+# CPython inside the platform runtime package (…/python/bin/python3). When that
+# is in play we stage the whole interpreter into the release tree and run the
+# daemon under it, so a Pairling-signed python (identity dev.pairling.python),
+# not a generic system python3, owns the daemon's TCC grants — and npm churn
+# can't remove the running interpreter.
+PYTHON_CODESIGN_IDENTIFIER="dev.pairling.python"
 DRY_RUN="${PAIRLING_DRY_RUN:-0}"
 
 log() {
@@ -263,6 +269,7 @@ copy_release() {
   cp "$REPO_ROOT/mac/guardian/companion-power-guardian.py" "$tmp/guardian/"
   cp "$REPO_ROOT/mac/guardian/guardian_contract.py" "$tmp/guardian/"
   build_connectd_binary "$tmp/connectd/pairling-connectd"
+  stage_vendored_python "$tmp/python"
   copy_runtime_source_tree "$tmp/mac" "$tmp/connectd/pairling-connectd"
   write_installed_pairling_launcher "$tmp/bin/pairling"
   chmod 755 "$tmp/bin/pairling" "$tmp/companiond/pairlingd.py" "$tmp/mcp/phone_tools.py" "$tmp/guardian/companion-power-guardian.py"
@@ -322,6 +329,59 @@ exec "$ROOT/mac/packaging/bin/pairling" "$@"
 SH
 }
 
+# Stage the vendored CPython (P3 custody) into the release tree when the npm
+# shim provided one via PAIRLING_DAEMON_PYTHON pointing at …/python/bin/python3.
+# Fail-closed: the interpreter must carry a valid signature, the pinned Team ID,
+# and the dev.pairling.python identifier. On success, repoint PYTHON3_BIN at the
+# STAGED interpreter so the daemon plist never references the npm package path.
+stage_vendored_python() {
+  local dest="$1"
+  local provided="${PAIRLING_DAEMON_PYTHON:-}"
+  # Only act on a vendored interpreter living under a runtime package's python/
+  # tree. A bare system python3 (no sibling python/ tree) is left as-is.
+  case "$provided" in
+    */python/bin/python3) : ;;
+    *) return 0 ;;
+  esac
+  local src_tree
+  src_tree="$(cd "$(dirname "$provided")/.." && pwd)"
+  if [[ ! -x "$src_tree/bin/python3" ]]; then
+    return 0
+  fi
+  local required_team="${PAIRLING_CONNECTD_TEAM_ID:-965AVD34A3}"
+  # Always enforce signature integrity and the dev.pairling.python identity
+  # (cert-independent defense in depth). Pin the Apple Team ID unless the dev
+  # switch (-) disables that one check for local ad-hoc builds.
+  if ! /usr/bin/codesign --verify --strict "$src_tree/bin/python3" >/dev/null 2>&1; then
+    log "ERROR: vendored python failed codesign verification; refusing to stage: $src_tree/bin/python3" >&2
+    exit 1
+  fi
+  local team identifier
+  identifier="$(/usr/bin/codesign -dvv "$src_tree/bin/python3" 2>&1 | sed -n 's/^Identifier=//p')"
+  if [[ "$identifier" != "$PYTHON_CODESIGN_IDENTIFIER" ]]; then
+    log "ERROR: vendored python identifier '${identifier:-none}' is not '$PYTHON_CODESIGN_IDENTIFIER'; refusing to stage." >&2
+    exit 1
+  fi
+  if [[ "$required_team" == "-" ]]; then
+    log "WARNING: vendored python Team ID pin disabled (PAIRLING_CONNECTD_TEAM_ID=-). Dev builds only."
+  else
+    team="$(/usr/bin/codesign -dvv "$src_tree/bin/python3" 2>&1 | sed -n 's/^TeamIdentifier=//p')"
+    if [[ "$team" != "$required_team" ]]; then
+      log "ERROR: vendored python TeamIdentifier '${team:-none}' does not match required '$required_team'; refusing to stage." >&2
+      exit 1
+    fi
+  fi
+  rm -rf "$dest"
+  mkdir -p "$(dirname "$dest")"
+  cp -R "$src_tree" "$dest"
+  chmod 755 "$dest/bin/python3" 2>/dev/null || true
+  # Point the daemon at the interpreter through the stable `current` symlink
+  # (not $dest, which is the pre-move temp path) so the plist resolves after the
+  # release is moved into place and after rollback — exactly like connectd.
+  PYTHON3_BIN="$CURRENT_LINK/python/bin/python3"
+  log "Staged vendored CPython (daemon will run under dev.pairling.python via $PYTHON3_BIN)"
+}
+
 build_connectd_binary() {
   local out="$1"
   # npm-delivered binary: the shim points PAIRLING_CONNECTD_PREBUILT at the
@@ -551,7 +611,7 @@ if [[ -x "$RUNTIME_PAIRLING" ]]; then
   exec "$RUNTIME_PAIRLING" "$@"
 fi
 
-printf 'Pairling runtime command is not installed. Open Pairling Helper and run Start setup, or use a repo-local mac/packaging/bin/pairling.\n' >&2
+printf 'Pairling runtime command is not installed. Run: npm install -g pairling && pairling setup (or use a repo-local mac/packaging/bin/pairling).\n' >&2
 exit 127
 SH
   chmod 755 "$tmp"
@@ -559,11 +619,17 @@ SH
 }
 
 render_plists() {
+  # Prefer the staged vendored interpreter whenever it exists, so start/
+  # rollback (which don't re-stage) also run the daemon under dev.pairling.python.
+  local daemon_python="$PYTHON3_BIN"
+  if [[ -x "$CURRENT_LINK/python/bin/python3" ]]; then
+    daemon_python="$CURRENT_LINK/python/bin/python3"
+  fi
   python3 "$REPO_ROOT/mac/install/render-launchd.py" \
     --current-root "$CURRENT_LINK" \
     --logs-root "$LOGS_ROOT" \
     --output-dir "$PLIST_BUILD_DIR" \
-    --daemon-python "$PYTHON3_BIN" \
+    --daemon-python "$daemon_python" \
     --guardian-python "$GUARDIAN_PYTHON_BIN"
 }
 

package/payload-manifest.json

@@ -1,11 +1,11 @@
 {
   "connectd": {
     "darwin-arm64": {
-      "sha256": "df87d4a1c2bf2cd439693fdf9defe5905a7914c6b8e7955d5c7dc07c8db24995",
+      "sha256": "369fc39855b2ddbd5e5470a2026908e7914dc5190a8762de5d39d36d00255347",
       "team_id": "965AVD34A3"
     },
     "darwin-x64": {
-      "sha256": "c0e70a4d4ce415988922177c7b3646b9e154b6b131231e2040b400afeb104660",
+      "sha256": "6110a1487cd8f9bc8330b9310180bbf4fd5031307466a821bea8073dc847e013",
       "team_id": "965AVD34A3"
     }
   },
@@ -20,7 +20,7 @@
     },
     {
       "path": "payload/mac/SOURCE_REVISION",
-      "sha256": "3081b56cba3fd9ec092b6aab851dfe6a4fdd2f978c57e07216424058dfa3ab29"
+      "sha256": "370a8df0d6204eedc89b94236b02447ca8bf1f2b366e2d34fcc2e48213e60f65"
     },
     {
       "path": "payload/mac/VERSION",
@@ -224,11 +224,11 @@
     },
     {
       "path": "payload/mac/install/doctor.sh",
-      "sha256": "d893083b40fb7d0e6c90e6c0ce5c40856fe428de8f5d597f529a906217de814c"
+      "sha256": "167309444030de8edd2f1010b65f6a6079371f1fd2a234861d2bc5a115b1743e"
     },
     {
       "path": "payload/mac/install/install-runtime.sh",
-      "sha256": "78119310f756ec573194e1bfd07752705c74d26d6f08098e6ce28c5d0bc6cda7"
+      "sha256": "afc0f40ffc08e4c5effef78b1926621ca6e8dd7d2222d3fdecadbf3d703c5362"
     },
     {
       "path": "payload/mac/install/render-launchd.py",
@@ -248,8 +248,8 @@
     }
   ],
   "package": "pairling",
-  "package_version": "0.1.0",
+  "package_version": "0.2.0",
   "schema_version": 1,
   "source_dirty": false,
-  "source_revision": "35420e4"
+  "source_revision": "58288e6"
 }