six-degrees 0.8.0 → 1.0.0

package/.next/standalone/app/api/scraper/route.js

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { existsSync, readFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
 import path from 'node:path';
+import { release as osRelease } from 'node:os';
 import { projectRoot, dataDir } from '../../../lib/paths';
 import { resolveProfile, networkCounts } from '../../../lib/profile';
 import { scanProgress, mappingNow } from '../../../lib/scan-progress';
@@ -15,7 +16,8 @@ import { waitingPhotoCount } from '../../../lib/photos';
 import { readSettings } from '../../../lib/settings';
 import { riskAccepted, touchesLinkedIn, RISK_REFUSAL } from '../../../lib/scan-risk';
 import { reachIndex, circleState } from '../../../lib/reach';
-import { chromeInstalled, signedInFrom, SIGNED_IN_FILE, CHROME_REFUSAL } from '../../../lib/scanner-setup';
+import { chromeInstalled, signedInFrom, macosVersion, SIGNED_IN_FILE, CHROME_REFUSAL } from '../../../lib/scanner-setup';
+import { installKind } from '../../../lib/release';
 import { AUTO_REFUSAL, connectResultIn, connectMarks, inviteRefusal, personRefusal } from '../../../lib/auto-connect';
 import { markSentRows, awardXP, whose, requestStanding } from '../../../lib/requests';
 import {
@@ -385,6 +387,12 @@ async function status() {
       signedIn: signedIn(),
       // The one-time "I understand" before the first scan (lib/scan-risk.js).
       riskAccepted: scanRisk(),
+      // Step 1's App Management item (lib/scanner-setup.js appManagementStep):
+      // which macOS, so its button opens the pane where that version keeps it,
+      // and whether this is the Mac app, the name macOS asks about. null off a Mac.
+      mac: process.platform === 'darwin'
+        ? { version: macosVersion(process.platform, osRelease()), app: installKind(process.env, projectRoot()) === 'mac-app' }
+        : null,
     },
     network,
     photosWaiting,

package/.next/standalone/app/setup/page.js

@@ -5,7 +5,8 @@ import { useSearchParams } from 'next/navigation';
 import OnboardingGate from '../components/OnboardingGate';
 import Link from 'next/link';
 import { stopScrape, pickedPerson, scanRequest, HIDE_CHROME_KEY } from '../../lib/scraper-client';
-import { setupStep, askForField } from '../../lib/scanner-setup';
+import { setupStep, askForField, appManagementStep } from '../../lib/scanner-setup';
+import { saveSettings } from '../../lib/settings-client';
 import { RISK_POINTS } from '../../lib/scan-risk';
 import { IS_DEMO } from '../../lib/demo';
 import { circleScanCost } from '../../lib/reach';
@@ -82,6 +83,8 @@ function SetupInner() {
   // loads, null when it couldn't be read. And the answer given here, if any.
   const [settings, setSettings] = useState(undefined);
   const [field, setField] = useState(null);
+  // Step 1's App Management item, answered here ('done' or 'skipped'), if it was.
+  const [appAnswer, setAppAnswer] = useState(null);
   // Someone sent here to have their circle scanned (Bridge Chains, the Degrees
   // panel's Ready to scan): /setup?scan=<id>. Nothing starts until it's confirmed.
   // The router's search params rather than window.location: every way here is a
@@ -143,6 +146,15 @@ function SetupInner() {
     window.scrollTo(0, 0);
   }
 
+  // Done or Skip on the App Management item: it goes at once, and the answer is
+  // kept so it isn't offered again. If that can't be saved it still goes for
+  // now and comes back next time, which is all it costs (as Skip for now does,
+  // app/components/FieldStep.js).
+  async function answerAppManagement(answer) {
+    setAppAnswer(answer);
+    await saveSettings({ appManagement: answer });
+  }
+
   // "I understand": when, kept with your settings so it travels with a copy.
   async function acceptRisk() {
     setError(null);
@@ -212,6 +224,10 @@ function SetupInner() {
   // Your field, asked once when your connections are in, before who they know
   // (lib/scanner-setup.js askForField); left out while that isn't known (null).
   const askField = IS_DEMO || field ? false : askForField(s, settings);
+  // On a Mac, macOS may ask about App Management when the scanner starts Chrome
+  // (lib/scanner-setup.js appManagementStep): offered once, under step 1, and
+  // never part of whether step 1 is done.
+  const appMgmt = IS_DEMO || appAnswer ? false : appManagementStep(s, settings);
   // Step 4, honestly: the first circle shows in minutes, the rest takes days.
   const pace = li?.limits?.pace;
   const firstCircle = durationText(firstCircleSeconds(pace));
@@ -375,6 +391,10 @@ function SetupInner() {
               more={s && step1.chrome && (
                 <Launch href={step1.chrome.href} quiet={Boolean(step1.button)}>{step1.chrome.label}</Launch>
               )} />
+            {/* Blake, 2026-10-04: "shouldnt we have in the onboarding for scan … a button where the
+                user is basically brought to the app management and enables it like Flow does".
+                Optional, so it sits under the step and never holds it up. */}
+            {appMgmt && <AppManagementItem item={appMgmt} onAnswer={answerAppManagement} />}
           </StepRow>
           <StepRow n={2} label="Sign in" state={stateOf(2, !!c.signedIn)}>
             <Mission title="Sign in to LinkedIn, once" time="You do this part" done={!!c.signedIn}
@@ -799,15 +819,46 @@ function Mission({ title, time, body, launch, more, done = false, children }) {
   );
 }
 
+/**
+ * Step 1's optional item on a Mac (lib/scanner-setup.js appManagementStep):
+ * why macOS may ask about App Management while scanning, the button that opens
+ * that pane, and Done or Skip, either of which puts it away for good.
+ */
+function AppManagementItem({ item, onAnswer }) {
+  return (
+    <section aria-labelledby="app-management-title" data-app-management style={{
+      marginTop: 10, padding: '14px 18px', borderRadius: 14,
+      background: 'rgba(var(--sd-ink, 255, 255, 255), 0.025)',
+      border: '1px dashed rgba(var(--sd-ink, 255, 255, 255), 0.16)',
+    }}>
+      <div style={{ display: 'flex', alignItems: 'baseline', gap: 10, flexWrap: 'wrap' }}>
+        <span id="app-management-title" style={{ fontSize: 16, fontWeight: 800 }}>{item.title}</span>
+        <span style={{ fontSize: 12, color: 'var(--sd-fg-2, #8fd9b6)', marginLeft: 'auto' }}>Optional, once</span>
+      </div>
+      <div style={{ fontSize: 13.5, color: 'var(--sd-fg-3, #9fb0bb)', lineHeight: 1.6, margin: '6px 0 12px', maxWidth: 600 }}>{item.text}</div>
+      <div style={{ display: 'flex', gap: 10, alignItems: 'center', flexWrap: 'wrap' }}>
+        <Launch href={item.href} quiet>Open App Management</Launch>
+        <Btn onClick={() => onAnswer('done')}>Done</Btn>
+        <Btn onClick={() => onAnswer('skipped')}>Skip</Btn>
+      </div>
+      <div style={{ fontSize: 12, color: 'var(--sd-fg-4, #778)', marginTop: 10 }}>It&rsquo;s in {item.where}.</div>
+    </section>
+  );
+}
+
 /**
  * The big go button. `quiet` once that step is done, so the next thing to do
- * stands out. With `href`, a link that looks the same, opened outside the app
- * (the desktop app sends it to the browser): Chrome's download.
+ * stands out. With `href`, a link that looks the same: a web address (Chrome's
+ * download) opens outside the app, which the desktop app sends to the browser.
+ * A System Settings address (App Management) opens in place: a browser then
+ * asks to open System Settings without leaving an empty tab behind, and the
+ * desktop app opens System Settings itself (desktop/main.mjs).
  */
 function Launch({ children, onClick, disabled, quiet = false, href }) {
   if (href) {
+    const web = /^https?:/i.test(href);
     return (
-      <a className="launch-go" href={href} target="_blank" rel="noreferrer" style={{
+      <a className="launch-go" href={href} {...(web ? { target: '_blank', rel: 'noreferrer' } : {})} style={{
         ...launchLook(false, quiet), textDecoration: 'none',
       }}>
         <span aria-hidden="true" style={{ fontSize: quiet ? 11 : 13 }}>▶</span>{children}

package/.next/standalone/install.sh

@@ -9,12 +9,13 @@
 #   3. copies "Six Degrees.app" into /Applications (or ~/Applications)
 #   4. opens it
 #
-# Why a script and not just the .dmg: the app is not signed with a paid Apple
-# developer certificate, so a .dmg downloaded in a browser makes macOS refuse the
-# first launch until you approve it in System Settings. A file fetched with curl
-# is not marked as "downloaded from the internet", so installed this way it
-# simply opens. The .dmg on the Releases page still works; it just needs that
-# one approval.
+# Why a script as well as the .dmg: one line that picks the right build for this
+# Mac, checks it against the published checksums, installs it and opens it, and
+# running it again updates. Until 0.8.0 the app wasn't signed, and this was also
+# the way around macOS's first-launch block (a file fetched with curl isn't
+# marked as downloaded from the internet). Since then the app is signed by Blake
+# Burford and notarized by Apple (docs/brain/DESKTOP.md D4), so the .dmg opens
+# like any Mac app too.
 #
 # Your data is never touched: it lives in ~/.six-degrees, not in the app, so
 # running this again later is also how you update.

package/.next/standalone/lib/scanner-setup.js

@@ -1,8 +1,9 @@
 // What the Scan page's first step says and offers, from the checks GET
 // /api/scraper reports (app/api/scraper/route.js, lib/scanner-python.js),
-// whether it asks for your field once your connections are in (askForField),
-// and two answers the server gives that step: is Google Chrome here
-// (chromeInstalled), and are you signed in to LinkedIn (signedInFrom).
+// its optional item on a Mac about macOS's App Management question
+// (appManagementStep), whether it asks for your field once your connections
+// are in (askForField), and two answers the server gives that step: is Google
+// Chrome here (chromeInstalled), and are you signed in to LinkedIn (signedInFrom).
 // Plain data in, plain data out: the page draws it, and
 // tests/scanner-setup.test.mjs checks every state without a browser. No Node
 // imports here; the page runs in the browser.
@@ -178,6 +179,84 @@ function stepOnly(status) {
   };
 }
 
+// ── macOS's App Management question ─────────────────────────────────────────
+// The scanner starts Google Chrome, and Chrome's own updater may then try to
+// update /Applications/Google Chrome.app. macOS puts that down to the app that
+// started Chrome and asks whether Six Degrees may manage apps (System Settings
+// → Privacy & Security → App Management). Saying no is harmless: Chrome updates
+// itself the next time you open it, and scanning works either way. Now that
+// the Mac app is signed, a yes lasts across updates (unsigned copies lost it
+// every update). "shouldnt we have in the onboarding for scan … a button where
+// the user is basically brought to the app management and enables it like
+// Flow does" (Blake, 2026-10-04). So step 1 offers the pane, once, and never
+// waits for it: the app can't read whether it was allowed, and it's optional.
+
+// The pane's address, as macOS 26 has it (checked on 26.5.1; macOS 15 knows it
+// too), and as macOS 13 and 14 have it. desktop/lib.mjs SETTINGS_URLS lets
+// exactly these two out of the Mac app; tests/desktop.test.mjs keeps them equal.
+export const APP_MANAGEMENT_URL = 'x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?Privacy_AppBundles';
+export const APP_MANAGEMENT_URL_OLDER = 'x-apple.systempreferences:com.apple.preference.security?Privacy_AppBundles';
+export const APP_MANAGEMENT_URLS = Object.freeze([APP_MANAGEMENT_URL, APP_MANAGEMENT_URL_OLDER]);
+export const APP_MANAGEMENT_TITLE = 'Let Six Degrees open Chrome without macOS asking';
+export const APP_MANAGEMENT_WHERE = 'System Settings → Privacy & Security → App Management';
+
+/** The Scan page's App Management item, once answered: 'done' or 'skipped' (null: not yet). */
+export const APP_MANAGEMENT_SETTING = {
+  default: null,
+  parse(value) {
+    if (value === null || value === 'done' || value === 'skipped') return value;
+    throw new Error('The App Management answer is done, skipped or null.');
+  },
+};
+
+/**
+ * macOS's major version from the Darwin kernel's (os.release() on the
+ * server): Darwin 25 is macOS 26, when the numbers jumped to the year, and 20
+ * to 24 are macOS 11 to 15. null off a Mac, or when it can't be read.
+ */
+export function macosVersion(platform, release) {
+  if (platform !== 'darwin') return null;
+  const darwin = Number.parseInt(String(release ?? ''), 10);
+  if (!Number.isInteger(darwin) || darwin < 1) return null;
+  if (darwin >= 25) return darwin + 1;
+  if (darwin >= 20) return darwin - 9;
+  return 10; // Catalina and before were all 10.x
+}
+
+/**
+ * Step 1's optional item about App Management: { title, text, href, where }
+ * to show it, false not to, null while that isn't known yet (the page leaves
+ * it out until it is, as with askForField).
+ *
+ * Only on a Mac (`status.checks.mac`: { version, app }, null elsewhere and
+ * from an older server), and from macOS 13, which brought App Management.
+ * Never once answered, Done or Skip (`settings.appManagement`), and not when
+ * settings couldn't be read, since the answer couldn't be kept either. The
+ * button opens the pane for that macOS (an unknown version gets the newest
+ * address), and `where` says where it is by hand.
+ *
+ * In the Mac app macOS asks about Six Degrees. Started with npx, Chrome's
+ * starter is the app Six Degrees was started from (Terminal, for example), and
+ * that is the one macOS names.
+ */
+export function appManagementStep(status, settings) {
+  if (!status) return null;
+  const mac = status.checks?.mac;
+  if (!mac || (mac.version != null && mac.version < 13)) return false;
+  if (settings === undefined) return null;
+  if (!settings || settings.appManagement) return false;
+  const asked = mac.app ? 'Six Degrees' : 'the app you started Six Degrees from (Terminal, for example)';
+  const allow = mac.app ? 'Allow Six Degrees' : 'Allow that app';
+  return {
+    title: APP_MANAGEMENT_TITLE,
+    text: `When the scanner starts Google Chrome, macOS may ask whether ${asked} can manage apps. `
+      + 'That’s Chrome updating itself while the scanner uses it. '
+      + `${allow} once in App Management and macOS won’t ask again. Scanning works either way.`,
+    href: mac.version != null && mac.version < 15 ? APP_MANAGEMENT_URL_OLDER : APP_MANAGEMENT_URL,
+    where: APP_MANAGEMENT_WHERE,
+  };
+}
+
 /**
  * Whether the Scan page asks for your field (app/components/FieldStep.js):
  * once, when your own connections are in (step 3) and before who they know is

package/.next/standalone/lib/settings.js

@@ -17,6 +17,7 @@ import { SCAN_RISK_SETTING } from './scan-risk.js';
 import { AUTO_ACCEPTED_SETTING } from './auto-connect.js';
 import { THEME_SETTING } from './themes.js';
 import { GALAXY_LAYOUTS_SETTING } from './galaxy-layouts.js';
+import { APP_MANAGEMENT_SETTING } from './scanner-setup.js';
 
 export const SETTINGS = {
   // Scores → Your sector: industries whose companies count for more (lib/sector-focus.js).
@@ -29,6 +30,8 @@ export const SETTINGS = {
   titleRanking: TITLE_RANKING_SETTING,
   // The Scan page's "I understand" before the first scan: when it was given (lib/scan-risk.js).
   scanRiskAccepted: SCAN_RISK_SETTING,
+  // The Scan page's optional App Management item on a Mac: Done or Skip, so it's offered once (lib/scanner-setup.js).
+  appManagement: APP_MANAGEMENT_SETTING,
   // Auto's one-time question before its first connection request: when it was answered yes (lib/auto-connect.js).
   autoConnectAccepted: AUTO_ACCEPTED_SETTING,
   // Settings → Appearance: the look (lib/themes.js). Here so it travels with a

package/.next/standalone/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "six-degrees",
-  "version": "0.8.0",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "six-degrees",
-      "version": "0.8.0",
+      "version": "1.0.0",
       "license": "MIT",
       "os": [
         "darwin",

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "six-degrees",
-  "version": "0.8.0",
+  "version": "1.0.0",
   "description": "Map your professional network as a galaxy — leverage tiers, bridges into new circles, and the shortest path to anyone. Runs locally on your own data.",
   "license": "MIT",
   "author": "Blake Burford",

package/.next/standalone/scripts/build-app.mjs

@@ -21,10 +21,15 @@
 // Chromium instead would make the scanner MORE detectable, not less, which
 // defeats the point of driving the user's real browser.
 //
-// Unsigned, because notarisation needs a paid Apple Developer account. macOS
-// will refuse the first launch; the user allows it once in System Settings.
-// An ad-hoc signature is applied anyway — it costs nothing and avoids the
-// separate "app is damaged" failure that unsigned arm64 binaries otherwise hit.
+// Signing (DESKTOP.md D4, scripts/mac-sign.mjs). With a Developer ID identity
+// in SIX_DEGREES_SIGN_IDENTITY, every program and library is signed inside out
+// with the hardened runtime, and with SIX_DEGREES_NOTARY_KEY, _KEY_ID and
+// _ISSUER the app and the disk image are notarized by Apple and stapled: it
+// opens like any Mac app. Releases do this (release.yml). Without an identity
+// (forks, pull requests, a local build) the app is signed ad hoc, exactly as
+// before D4: it costs nothing and avoids the separate "app is damaged" failure
+// that unsigned arm64 binaries otherwise hit, and a copy downloaded in a
+// browser then needs one approval in System Settings.
 
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
@@ -38,6 +43,9 @@ import { fileURLToPath } from 'node:url';
 import {
   standaloneBuild, downloadVerified, machoSlices, machoSlice, megabytes, IMPORTS,
 } from '../lib/scanner-python.js';
+import {
+  signingSetup, signDeveloperId, signatureInfo, signerName, signImage, notarize, staple, stapleValid, assess, SigningError,
+} from './mac-sign.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const pkg = JSON.parse(readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
@@ -53,6 +61,16 @@ if (!['classic', 'electron'].includes(SHELL)) {
   console.error(`\n  ✗ --shell must be classic or electron, not ${SHELL}\n`);
   process.exit(1);
 }
+// How this build is signed: ad hoc, or Developer ID (and notarized) when the
+// environment names an identity (scripts/mac-sign.mjs). A setting that can't be
+// right stops the build here, before anything is built.
+const SIGNING = signingSetup(process.env, { exists: existsSync });
+if (SIGNING.error) {
+  console.error(`\n  ✗ ${SIGNING.error}\n`);
+  process.exit(1);
+}
+const DEVELOPER_ID = SIGNING.mode === 'developer-id';
+const NOTARIZE = Boolean(DEVELOPER_ID && SIGNING.notary);
 const APP_NAME = 'Six Degrees';
 const OUT = path.join(ROOT, 'dist');
 const APP = path.join(OUT, `${APP_NAME}.app`);
@@ -115,6 +133,9 @@ function detach(mountPoint, device) {
 rmSync(OUT, { recursive: true, force: true });
 
 step('Building the app');
+console.log(DEVELOPER_ID
+  ? `  it will be signed with Developer ID${NOTARIZE ? ' and notarized by Apple' : ', not notarized (no SIX_DEGREES_NOTARY_* settings)'}`
+  : '  it will be signed ad hoc (no SIX_DEGREES_SIGN_IDENTITY)');
 if (process.argv.includes('--fast') && existsSync(path.join(ROOT, '.next', 'standalone', 'server.js'))) {
   console.log('  --fast: reusing the existing build (make sure it is current)');
 } else {
@@ -290,7 +311,10 @@ writeFileSync(path.join(APP, 'Contents', 'Info.plist'), `<?xml version="1.0" enc
 </plist>
 `);
 
-// ---- 4. sign, ad-hoc -------------------------------------------------------
+// ---- 4. sign ---------------------------------------------------------------
+if (DEVELOPER_ID) {
+  signWithDeveloperId(APP);
+} else {
 step('Signing (ad-hoc)');
 try {
   run('codesign', ['--force', '--deep', '--sign', '-', APP]);
@@ -298,6 +322,7 @@ try {
 } catch {
   console.log('  codesign failed; the app will still run after the one-time approval');
 }
+}
 } // end of the classic shell
 
 // ---- the Electron shell (--shell=electron) -----------------------------------
@@ -348,6 +373,10 @@ async function buildElectronShell() {
   // and nothing copies them again (TRAPS §37).
   await bundlePython(path.join(APP, 'Contents', 'Resources'));
 
+  if (DEVELOPER_ID) {
+    signWithDeveloperId(APP);
+    return;
+  }
   step('Signing (ad-hoc)');
   // Electron's framework and helpers must all carry the same kind of signature,
   // or macOS refuses to load them; re-signing the whole bundle ad hoc does that.
@@ -359,6 +388,96 @@ async function buildElectronShell() {
   console.log('  signed ad-hoc and verified — no Apple account needed, still unnotarised');
 }
 
+// ---- Developer ID and notarization (DESKTOP.md D4) ----------------------------
+// Inside out with the hardened runtime (scripts/mac-sign.mjs signDeveloperId:
+// every loose program and library, then the helper apps and frameworks deepest
+// first, then the app), then the signed programs are run once to prove their
+// entitlements are enough. With the notary settings, the app goes to Apple and
+// comes back with its ticket stapled to it, and only then is the disk image made
+// from it: the app people drag to Applications carries its own ticket, and so
+// does the copy install.sh and the in-app updater put in place with ditto.
+function signWithDeveloperId(app) {
+  step('Signing with Developer ID (inside out, hardened runtime, timestamped)');
+  const { info } = guard(() => signDeveloperId(app, SIGNING));
+  checkSignedRuntime(app, info);
+  if (!NOTARIZE) return;
+  step('Notarizing the app (Apple; usually a few minutes)');
+  const zip = path.join(OUT, 'notarize-app.zip');
+  run('ditto', ['-c', '-k', '--sequesterRsrc', '--keepParent', app, zip]);
+  guard(() => notarize(zip, SIGNING.notary, { what: 'the app' }));
+  rmSync(zip, { force: true });
+  guard(() => staple(app));
+  const verdict = assess(app, 'exec');
+  if (!verdict.ok && !verdict.disabled) fail(`Gatekeeper doesn't accept the stapled app as notarized: ${oneLine(verdict.text)}`);
+  console.log(verdict.ok ? `  stapled; Gatekeeper says: ${verdict.source}` : gatekeeperOff());
+}
+
+// The signed programs, run as the app runs them: the server's Node (and sharp,
+// the one native module it loads), the scanner's Python with its packages, and
+// Playwright's driver. A missing entitlement or a library that fails library
+// validation stops the build here, minutes before notarization would, and long
+// before a user's scan. Nothing here writes into the app (no bytecode: -B and
+// PYTHONDONTWRITEBYTECODE), which the image check would catch anyway.
+function checkSignedRuntime(app, info) {
+  step('Running the signed programs under the hardened runtime');
+  if (!info.team) {
+    // A self-signed test identity has no Team ID, and library validation then
+    // refuses even the app's own libraries. A Developer ID always has one.
+    console.log('  skipped: this identity has no Team ID (a test identity, not a Developer ID)');
+    return;
+  }
+  const res = path.join(app, 'Contents', 'Resources');
+  const env = {
+    HOME: os.homedir(), TMPDIR: os.tmpdir(), PATH: '/usr/bin:/bin:/usr/sbin:/sbin', LANG: 'en_US.UTF-8',
+    PYTHONNOUSERSITE: '1', PYTHONDONTWRITEBYTECODE: '1',
+  };
+  const server = [path.join(res, 'server'), path.join(res, 'app')].find((d) => existsSync(path.join(d, 'server.js')));
+  const sharp = server && existsSync(path.join(server, 'node_modules', 'sharp')) ? path.join(server, 'node_modules', 'sharp') : null;
+  console.log(`  the server's Node: ${mustRun(path.join(res, 'node'), ['-e',
+    `require('node:sqlite');${sharp ? ` require(${JSON.stringify(sharp)});` : ''} console.log(process.version${sharp ? ", '· sharp loads'" : ''})`],
+  env, 'The app\'s Node doesn\'t run once signed (its entitlements: scripts/entitlements/node.plist)')}`);
+  const py = path.join(res, 'python');
+  if (!existsSync(path.join(py, 'bin', 'python3'))) return;
+  console.log(`  the scanner's Python: ${mustRun(path.join(py, 'bin', 'python3'), ['-E', '-s', '-B', '-c',
+    `${IMPORTS}; import sys; print(sys.version.split()[0], "· its packages load")`],
+  env, 'The scanner\'s Python doesn\'t run once signed')}`);
+  const xy = readdirSync(path.join(py, 'lib')).find((n) => /^python3\.\d+$/.test(n));
+  const driver = path.join(py, 'lib', xy || 'python3', 'site-packages', 'playwright', 'driver');
+  if (existsSync(path.join(driver, 'node'))) {
+    console.log(`  Playwright's driver: ${mustRun(path.join(driver, 'node'), [path.join(driver, 'package', 'cli.js'), '--version'],
+      env, 'Playwright\'s driver doesn\'t start once signed')}`);
+  }
+}
+
+// A step of the signing that failed: its reason, never a credential (mac-sign.mjs
+// never puts one in a message), and the build stops.
+function guard(fn) {
+  try {
+    return fn();
+  } catch (err) {
+    fail(err instanceof SigningError ? err.message : `Signing failed: ${String(err.message || err).split('\n')[0]}`);
+  }
+  return undefined;
+}
+
+function fail(message) {
+  console.error(`\n  ✗ ${message}\n`);
+  process.exit(1);
+}
+
+// When this machine has Gatekeeper's assessments turned off, spctl accepts
+// anything and can't confirm notarization; Apple's "Accepted" and the stapled
+// tickets (validated) are what's left, and the log says so.
+function gatekeeperOff() {
+  return '  stapled; Gatekeeper\'s assessments are turned off on this machine, so it can\'t be asked: '
+    + 'the stapled tickets and Apple\'s Accepted are the check';
+}
+
+// (Function declarations, not consts: the shells call these before this line runs.)
+function oneLine(text) {
+  return String(text || '').trim().split('\n').join(' | ');
+}
+
 // ---- the scanner's Python (Electron app only; DESKTOP.md D2) ------------------
 // A standalone CPython from python-build-standalone, with the scanner's packages
 // installed, at Contents/Resources/python. desktop/main.mjs names it to the
@@ -602,9 +721,11 @@ mkdirSync(staging, { recursive: true });
 // on the build machine: anywhere else those paths do not exist (TRAPS §37).
 run('ditto', [APP, path.join(staging, `${APP_NAME}.app`)]);
 
-// The picture behind the window says what to do: drag across, then the one-time
-// Open Anyway step, since the app is unsigned. It replaces the READ ME text file
-// this image used to carry. Made by scripts/make-dmg-background.mjs from
+// The picture behind the window says what to do: drag across, and that the app
+// is signed and notarized, so it opens like any Mac app (it said Open Anyway
+// until D4). It replaces the READ ME text file this image used to carry. A build
+// signed ad hoc gets the same picture: it never left this Mac, so macOS doesn't
+// ask about it either. Made by scripts/make-dmg-background.mjs from
 // scripts/dmg/background.html; its geometry and the positions below are one
 // layout, so change them together.
 const BACKGROUND = path.join(ROOT, 'scripts', 'dmg', 'background.tiff');
@@ -742,6 +863,21 @@ detach(mount, device);
 run('hdiutil', ['convert', rw, '-format', 'UDZO', '-imagekey', 'zlib-level=9', '-o', dmg, '-ov']);
 rmSync(rw, { force: true });
 rmSync(staging, { recursive: true, force: true });
+
+// The image gets its own signature and ticket (DESKTOP.md D4): Gatekeeper judges
+// a downloaded .dmg by them before it looks at the app inside. Made from the
+// stapled app, so the app keeps its own ticket once it is copied out.
+if (DEVELOPER_ID) {
+  step('Signing the disk image');
+  guard(() => signImage(dmg, SIGNING));
+  console.log('  signed and verified');
+  if (NOTARIZE) {
+    step('Notarizing the disk image (Apple; usually a few minutes)');
+    guard(() => notarize(dmg, SIGNING.notary, { what: 'the disk image' }));
+    guard(() => staple(dmg));
+    console.log('  stapled');
+  }
+}
 checkImage(dmg);
 
 // Check the app as people will get it: inside the finished image, not the copy
@@ -763,6 +899,12 @@ function checkImage(image) {
     } catch (err) {
       problem = `its signature does not verify: ${(err.stderr || '').toString().trim().split('\n').slice(0, 2).join(' ')}`;
     }
+    // Notarized: the app inside carries its ticket, and Gatekeeper accepts it.
+    if (NOTARIZE && !problem) {
+      const verdict = assess(inside, 'exec');
+      if (!stapleValid(inside)) problem = 'it has no valid stapled notarization ticket';
+      else if (!verdict.ok && !verdict.disabled) problem = `Gatekeeper doesn't accept it as notarized (${oneLine(verdict.text)})`;
+    }
     const escaping = execFileSync('find', [inside, '-type', 'l'])
       .toString().split('\n').filter(Boolean)
       .filter((link) => {
@@ -778,10 +920,24 @@ function checkImage(image) {
     console.error(`\n  ✗ The app inside ${path.basename(image)} is broken: ${problem}\n`);
     process.exit(1);
   }
-  console.log('  signature verifies, and every link stays inside the app');
+  // And the image itself, as Gatekeeper judges a downloaded one: by its own
+  // signature (context:primary-signature) and its own ticket.
+  if (NOTARIZE) {
+    const verdict = assess(image, 'open');
+    if (!stapleValid(image)) fail(`${path.basename(image)} has no valid stapled notarization ticket.`);
+    if (!verdict.ok && !verdict.disabled) fail(`Gatekeeper doesn't accept ${path.basename(image)} as notarized: ${oneLine(verdict.text)}`);
+    if (verdict.disabled) console.log(gatekeeperOff());
+  }
+  console.log(`  signature verifies, and every link stays inside the app${NOTARIZE ? '; the app and the image are notarized and stapled, and Gatekeeper accepts both' : ''}`);
 }
 
 const size = execFileSync('du', ['-h', dmg]).toString().split('\t')[0];
 console.log(`\n✓ ${dmg}  (${size})\n`);
-console.log('  Unsigned by design: notarisation needs a paid Apple account.');
-console.log('  First launch needs one approval in System Settings > Privacy & Security.\n');
+if (DEVELOPER_ID) {
+  const who = signerName(signatureInfo(APP).authority) || 'this Developer ID';
+  if (NOTARIZE) console.log(`  Signed by ${who} and notarized by Apple: it opens like any Mac app.\n`);
+  else console.log(`  Signed by ${who}, not notarized: a copy downloaded in a browser still needs one approval\n  in System Settings > Privacy & Security.\n`);
+} else {
+  console.log('  Signed ad hoc (no Developer ID here: SIX_DEGREES_SIGN_IDENTITY). A copy downloaded in a browser');
+  console.log('  needs one approval in System Settings > Privacy & Security.\n');
+}

package/.next/standalone/scripts/build-desktop.mjs

@@ -14,8 +14,9 @@
 //            Menu and Desktop shortcuts. No admin rights asked for.
 //   Linux    @electron/packager, then a .deb (chrome-sandbox setuid root, which
 //            Electron needs on Ubuntu 24.04 and later) and a plain .tar.gz.
-// Unsigned, like the Mac app until D4: Windows shows SmartScreen's "More info →
-// Run anyway" the first time.
+// Unsigned (the Mac app is signed and notarized since D4; Windows signing is
+// D4's other half): Windows shows SmartScreen's "More info → Run anyway" the
+// first time.
 //
 // Built on the platform it is for (release.yml has a job each): pip installs
 // the Python's packages by running that Python. No new npm dependency: packager