amosblomqvist
8cb5e14691
- desktop:dist cleans dist/ + .next/standalone before next build: the trace sweep was shipping the PREVIOUS build's DMG inside every new one (standalone/dist = 8.0GB inside the app; measured 7.4GB DMG → 144MB). - the same sweep shipped the repo-root auth.json (dev BYOK keys, byte-identical) in every DMG ever built — excluded in the trace and REFUSED by a new build-server.mjs guard (.env* belt-and-braces). - WARNING (next.config.ts): dir-style trace excludes (dist/** etc., "./"-anchored or not) strip server-external packages to bare package.jsons — pi-ai/pi-agent-core lost their dist/, the packaged server 500'd on ERR_MODULE_NOT_FOUND. Only the three verified-safe entries stay. - new scripts/smoke-server.mjs gates desktop:dist between payload curation and packaging: boots the standalone exactly as the Electron shell does (temp LH_DATA_DIR, empty auth) and requires 200s on / + graph/models/settings. Caught both defects above on its first day. - entitlements: allow-unsigned-executable-memory dropped (2019-era relic per current electron-builder docs; weakens hardened runtime). - pi-ai + pi-agent-core pinned exact 1.0.2 — persisted chat records carry their wire shapes; post-release a bump is a migration event. Gates: typecheck, lint, 1459/1459 tests, full desktop:dist + smoke PASS.
21 lines
997 B
Plaintext
21 lines
997 B
Plaintext
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<!-- Hardened-runtime entitlements (applied once the app is signed).
|
|
Laid 2026-09-17; corrected 2026-10-08 against current electron-builder
|
|
docs:
|
|
- allow-jit: Electron's V8 JIT needs it under hardened runtime — the
|
|
one exception modern Electron requires;
|
|
- allow-unsigned-executable-memory: DROPPED 2026-10-08 — a 2019-era
|
|
Electron relic, not needed by modern V8/Electron (44), and it
|
|
weakens the hardened runtime for no benefit;
|
|
- audio-input: macOS mic for the STT milestone (the Developer-ID
|
|
variant — com.apple.security.device.microphone is the App-Store
|
|
sandbox variant and does NOT apply to Developer ID apps). -->
|
|
<key>com.apple.security.cs.allow-jit</key>
|
|
<true/>
|
|
<key>com.apple.security.device.audio-input</key>
|
|
<true/>
|
|
</dict>
|
|
</plist> |