build(mac): an unsigned local build launches — dev entitlements without the keychain group, no profile; native build scripts survive a path with a space

electron/build/entitlements.mac.dev.plist

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Entitlements for the UNSIGNED local build (scripts/build-app.sh without a signing identity):
+     entitlements.mac.plist minus keychain-access-groups. That group is a restricted entitlement
+     tied to the team's provisioning profile; on an ad-hoc signature macOS refuses it and kills the
+     app at exec. Passkey sign-in via the shared keychain group is therefore off in a dev build; every
+     other capability (JIT, unsigned executable memory, library validation off for native addons,
+     network, microphone, user-selected files) is unchanged. -->
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+  <key>com.apple.security.network.client</key>
+  <true/>
+  <key>com.apple.security.network.server</key>
+  <true/>
+  <key>com.apple.security.files.user-selected.read-write</key>
+  <true/>
+  <key>com.apple.security.inherit</key>
+  <true/>
+  <key>com.apple.security.device.audio-input</key>
+  <true/>
+</dict>
+</plist>

electron/scripts/build-haptics.sh

@@ -11,13 +11,15 @@ HERE="$(cd "$(dirname "$0")/.." && pwd)"   # electron/
 ELECTRON_TARGET="$(node -p "require('$HERE/node_modules/electron/package.json').version.split('+')[0]" 2>/dev/null || echo '42.3.3')"
 SRC="$HERE/native/haptics"
 OUT="$HERE/build-staging/haptics/$ARCH"
-NODE_GYP="$HERE/node_modules/.bin/node-gyp"
-[[ -x "$NODE_GYP" ]] || NODE_GYP="npx --yes node-gyp"  # transitive dep usually, npx if not
+# An array, not a string: the local binary path can contain spaces (a checkout under "Projects Claude/"
+# split it into two words), while the npx fallback is legitimately several words.
+NODE_GYP=("$HERE/node_modules/.bin/node-gyp")
+[[ -x "${NODE_GYP[0]}" ]] || NODE_GYP=(npx --yes node-gyp)  # transitive dep usually, npx if not
 
 echo "[haptics] building for arch=$ARCH (electron $ELECTRON_TARGET)"
 cd "$SRC"
 rm -rf build
-$NODE_GYP rebuild \
+"${NODE_GYP[@]}" rebuild \
   --target="$ELECTRON_TARGET" \
   --arch="$ARCH" \
   --dist-url=https://electronjs.org/headers

electron/scripts/build-mouseclamp.sh

@@ -11,13 +11,15 @@ HERE="$(cd "$(dirname "$0")/.." && pwd)"   # electron/
 ELECTRON_TARGET="$(node -p "require('$HERE/node_modules/electron/package.json').version.split('+')[0]" 2>/dev/null || echo '42.3.3')"
 SRC="$HERE/native/mouseclamp"
 OUT="$HERE/build-staging/mouseclamp/$ARCH"
-NODE_GYP="$HERE/node_modules/.bin/node-gyp"
-[[ -x "$NODE_GYP" ]] || NODE_GYP="npx --yes node-gyp"  # transitive dep usually, npx if not
+# An array, not a string: the local binary path can contain spaces (a checkout under "Projects Claude/"
+# split it into two words), while the npx fallback is legitimately several words.
+NODE_GYP=("$HERE/node_modules/.bin/node-gyp")
+[[ -x "${NODE_GYP[0]}" ]] || NODE_GYP=(npx --yes node-gyp)  # transitive dep usually, npx if not
 
 echo "[mouseclamp] building for arch=$ARCH (electron $ELECTRON_TARGET)"
 cd "$SRC"
 rm -rf build
-$NODE_GYP rebuild \
+"${NODE_GYP[@]}" rebuild \
   --target="$ELECTRON_TARGET" \
   --arch="$ARCH" \
   --dist-url=https://electronjs.org/headers

scripts/build-app.sh

@@ -550,8 +550,23 @@ if $PUBLISH_MODE; then
 elif $SIGN_MODE; then
     npx electron-builder --mac "${EB_ARCH_FLAGS[@]}" --publish never
 else
+    # Unsigned local build. electron-builder falls back to an ad-hoc signature but still applies the
+    # release entitlements + provisioning profile; the restricted keychain-access-groups entitlement
+    # is not honoured for an ad-hoc identity, so macOS SIGKILLs the app at exec (silently: no
+    # window, nothing on stderr). Pack first, then re-sign the outer bundle with the same
+    # entitlements minus that group and no profile (passkeys stay off in a dev build anyway), then
+    # build the dmg/zip from the app that actually launches.
     export CSC_IDENTITY_AUTO_DISCOVERY=false
-    npx electron-builder --mac "${EB_ARCH_FLAGS[@]}" --publish never
+    npx electron-builder --mac "${EB_ARCH_FLAGS[@]}" --dir --publish never
+    for A in "${BUILD_ARCHS[@]}"; do
+        APP_DIR="dist/mac-$A"
+        [[ "$A" == "x64" && ! -d "$APP_DIR" ]] && APP_DIR="dist/mac"
+        APP="$APP_DIR/OpenSwarm.app"
+        [[ -d "$APP" ]] || { echo "ERROR: packed app not found at $APP" >&2; exit 1; }
+        rm -f "$APP/Contents/embedded.provisionprofile"
+        codesign --force --sign - --options runtime --entitlements build/entitlements.mac.dev.plist "$APP"
+        npx electron-builder --mac "--$A" --prepackaged "$APP" --publish never
+    done
 fi
 
 rm -rf "$PROJECT_ROOT/electron/build-staging"