mirror of
https://github.com/openclaw/openclaw.git
synced 2026-09-03 06:38:40 +00:00
dd4528b639
Pair packaged apps with complete private arm64 and x86_64 workers whose full build identity matches the app. Preserve independently managed Gateways and complete recognized native-first state through the canonical initializer. Verify emitted-SDK filesystem calls, native capabilities, readiness and shutdown before app publication. Derive elevation payloads without modifying canonical installed inputs. Preserve universal slices, resources and contained links; reject incomplete, malformed, escaping or mismatched payloads. Reuse descriptor-bound native inventory for signing while retaining the portable installer's independent distribution contract and every Foundation identity, entitlement, notarization and architecture gate. Use the existing pinned-pnpm package path, including Corepack-only builders, and avoid recursive app-glob expansion. Centralize Mac CI ownership. Carry invocation-owned Git lock cleanup into main's canonical Git owner and regenerate its workflow projection, retaining lifetime fencing and pre-existing/junction-linked locks. Fix the Android refresh race exposed by CI by removing the redundant reconnect after connect already replaces each role's socket. Preserve authentication, scopes and physical connection leases, with a controlled real-WebSocket regression. Closes #131459
24 lines
959 B
Python
24 lines
959 B
Python
#!/usr/bin/python3
|
|
"""Confine a bundle mutation to the caller's fixed app and private temp roots."""
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
|
|
PROFILE = '''(version 1)
|
|
(allow default)
|
|
(deny file-write*)
|
|
(allow file-write* (subpath (param "APP")) (subpath (param "TEMP")))'''
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 4:
|
|
raise SystemExit("Usage: mac-bundle-mutation.py <app-root> <temp-root> <command> [args...]")
|
|
app_root, temp_root = sys.argv[1:3]
|
|
# Seatbelt does not revoke already-open writable descriptors. Only the
|
|
# caller's standard I/O belongs across this boundary; paths remain kernel-checked.
|
|
result = subprocess.run(
|
|
["/usr/bin/sandbox-exec", "-D", f"APP={app_root}", "-D", f"TEMP={temp_root}",
|
|
"-p", PROFILE, *sys.argv[3:]],
|
|
env={**os.environ, "TMPDIR": temp_root},
|
|
close_fds=True,
|
|
)
|
|
raise SystemExit(result.returncode if result.returncode >= 0 else 128 - result.returncode)
|