* feat(macos): run the private app runtime on the OpenClaw Bun fork
* fix(macos): let the bundled runtime load unsigned plugin addons
* test(macos): remove obsolete worker pruning closure tests
* test(macos): drop stale packaging test imports
* test(macos): migrate CI scope cases to runtime paths
* fix(scripts): use system Bash for macOS tooling and owned Mach-O fixtures
Pin native entrypoints and package commands to /bin/bash, guard portable heredoc callers on Darwin, and preserve Bash 3.2 boolean parsing. Streamed installers explain how to use system Bash when their input cannot be replayed.
Generate deterministic x86_64, arm64, and arm64e framework fixtures instead of borrowing /bin/ls. Preserve the existing framework pipeline repair from #141056 and verify merged slice bytes.
* fix(scripts): keep guarded portable scripts bash 3.2 compatible
* fix(scripts): keep macOS Bash CI coverage green
Distinguish sourced installer returns from stdin exits without ShellCheck unreachable-code warnings. Retain the shebang regression suite in changed-target routing, and repartition hosted tooling tails toward 50-second groups within the existing 150-second budget and 80-job cap.
Validation: 635 interpreter and routing tests plus 53 planner tests passed; ShellCheck, targeted lint, formatting, and fresh Codex review passed. The broader local changed-file check hit an unrelated existing dependency graph crossing through extensions/reef/node_modules/@noble/hashes; exact-head hosted CI remains required.
* docs(install): use system Bash in install and recovery commands
Align macOS-facing copy-and-paste commands and emitted installer guidance with the supported streamed interpreter. This addresses the remaining installer-command review finding without changing the PR body.
Validation: streamed help for both installers, install.sh dry-run, 16 selected fresh-install and upgrade lifecycle tests, formatting, diff check, and fresh Codex review passed. Landing remains blocked by unrelated provider-transport integration CI failure caused by an unchanged incomplete plugin-registry mock.
* fix(scripts): preserve streamed installs and CI packing
Keep public installer commands portable while replaying Darwin Bash 5.3+
stdin under system Bash through an immediately unlinked private temp file.
Retain actionable sourced-install rejection and the SC2317-safe check.
Restore the original CI packing policy and move the Bash policy scan into
its existing macOS tooling owner without adding a routed test file.
Validation: real Homebrew Bash streamed help and cleanup; 642 scan/routing
tests; 23 selected installer tests under both PATH orders; planner cap and
coverage tests; 139 Bash syntax checks; ShellCheck; 1,135 changed-gate tests;
focused lint/changed-check repair; fresh Codex review with no P0/P1 findings.
* feat(macos): connect saved gateways through browser sign-in
* fix(macos): preserve browser session observers across reconnect
* fix(macos): await WebKit cookie deletion
* test(macos): isolate dashboard startup and WebKit cleanup
* fix(macos): preserve browser account ownership across reconnects
Bind native connections and cached queued work to the verified browser account. Retire old account and media authority before replacement or removal, and restore the explicitly selected Gateway after app restart using the existing preference.
Keep removal completion tied to its original owner and correct native test fixtures that assumed unconfigured startup always selected Primary. Release-note context: personal Gateway sign-in now survives restart without changing the machine Primary connection.
* fix(macos): isolate profile notification values
Capture immutable receipt and removal values before entering MainActor callbacks. Remove redundant mutable test state while retaining the real HTTP response gate and explicit deletion wait.
* fix(macos): scope browser stores to credential registries
Use the existing app-profile Keychain namespace in persistent WebKit store identity, so named app profiles at the same Gateway cannot overwrite or clear each other’s cookies. Cover independent persistent cookie replacement and removal.
* test(macos): use localhost for pinned media fixtures
Exercise real TLS through the certificate’s local hostname, retaining exact pins, origin and redirect checks, and cancellation timing. macOS ATS rejects the fixture’s untrusted IP-literal certificate before media authority checks; production trust policy remains unchanged.
* fix(macos): canonicalize gateway URLs before browser discovery
* fix(macos): apply TLS policy to streaming task challenges
* fix(macos): preserve browser state across account renewals
* chore(macos): refresh native localization source inventory
* test(macos): align browser preference fixtures with store lifetime
* fix(macos): initialize reconnect editor from saved gateway
* test(macos): evaluate gateway field predicate before expectation
* style(macos): format gateway editor documentation
* test(macos): retain browser store during account transitions
Pair packaged apps with complete private arm64 and x86_64 workers whose full build identity matches the app. Preserve independently managed Gateways and complete recognized native-first state through the canonical initializer. Verify emitted-SDK filesystem calls, native capabilities, readiness and shutdown before app publication.
Derive elevation payloads without modifying canonical installed inputs. Preserve universal slices, resources and contained links; reject incomplete, malformed, escaping or mismatched payloads. Reuse descriptor-bound native inventory for signing while retaining the portable installer's independent distribution contract and every Foundation identity, entitlement, notarization and architecture gate.
Use the existing pinned-pnpm package path, including Corepack-only builders, and avoid recursive app-glob expansion. Centralize Mac CI ownership. Carry invocation-owned Git lock cleanup into main's canonical Git owner and regenerate its workflow projection, retaining lifetime fencing and pre-existing/junction-linked locks.
Fix the Android refresh race exposed by CI by removing the redundant reconnect after connect already replaces each role's socket. Preserve authentication, scopes and physical connection leases, with a controlled real-WebSocket regression.
Closes#131459
scripts/mac-elevation-host.sh ships as the portable installer added in
#123675, so it is deliberately self-contained and cannot source shared
constants. That forces it to duplicate ELEVATION_TEAM_ID and
ELEVATION_IDENTITY from scripts/codesign-mac-app.sh, with nothing keeping
the two copies in sync. Add a test asserting they agree, so rotation drift
fails at build time instead of on a target Mac.
Also document why the sign-time and install-time elevation verification
functions both exist: verify_elevation_app requires a notarized and stapled
bundle, so it cannot replace the sign-time check, and deleting that check
would defer every identity failure until after a notarization submission is
already spent.
No behavior change: no artifact bytes, filenames, modes, receipt fields,
signing, notarization, or install paths are touched.
