fix(one): sign bundled Node with JIT entitlements to stop macOS crash-loop

The macOS app crash-loops on launch ("sidecar exited; restarting") because
the bundled Node runtime is killed the instant V8 initializes. CI signs the
Node binary with hardened runtime (--options runtime, required for
notarization) but passed no entitlements, so macOS blocks V8's JIT executable
memory and kills node with SIGTRAP (exit 133) before it prints anything.

Add runtime-entitlements.plist (com.apple.security.cs.allow-jit +
allow-unsigned-executable-memory + disable-library-validation) and pass it via
--entitlements in the pre-sign step. Verified on the shipped 7.6.0 binary:
as-signed → exit 133; re-signed with these entitlements → runs (node v22).

Also fail the build if allow-jit is ever missing from the node binary, so this
brick can't ship again. Affected 7.2.x–7.6.0 identically; ship as 7.6.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.github/workflows/one.yml

@@ -179,6 +179,14 @@ jobs:
           # with the same Developer ID, hardened runtime, and a secure
           # timestamp. Tauri's own codesign pass doesn't deep-sign embedded
           # Node native binaries, so we sign them here before Tauri bundles.
+          #
+          # CRITICAL: the Node binary runs V8, which maps executable (JIT)
+          # memory at startup. Under hardened runtime that is blocked unless
+          # the binary carries the JIT entitlements below — otherwise macOS
+          # kills node with SIGTRAP (exit 133) the instant it launches, which
+          # surfaces as the bundled runtime crash-looping on every start
+          # ("sidecar exited; restarting"). Always pass --entitlements.
+          ENTITLEMENTS="apps/objectos-one/src-tauri/runtime-entitlements.plist"
           echo "Scanning $RUNTIME for Mach-O binaries..."
           find "$RUNTIME" -type f \
             \( -name '*.node' -o -name '*.dylib' -o -name '*.so' \
@@ -188,7 +196,8 @@ jobs:
                 if file -b "$f" | grep -qE 'Mach-O'; then
                   echo "  signing $f"
                   codesign --force --sign "$APPLE_SIGNING_IDENTITY" \
-                    --timestamp --options runtime "$f"
+                    --timestamp --options runtime \
+                    --entitlements "$ENTITLEMENTS" "$f"
                 fi
               done
 
@@ -197,6 +206,21 @@ jobs:
             codesign -dv --verbose=2 "$f" 2>&1 | head -10 || true
           done
 
+          # Guard against the JIT-entitlement regression: the node binary MUST
+          # carry com.apple.security.cs.allow-jit or the runtime crash-loops at
+          # launch. Fail the build loudly here rather than shipping a brick.
+          NODE_BIN="$RUNTIME/node"
+          if [ -f "$NODE_BIN" ]; then
+            echo "Verifying node JIT entitlement:"
+            if codesign -d --entitlements - --xml "$NODE_BIN" 2>/dev/null \
+                 | tr -d '\0' | grep -q 'com.apple.security.cs.allow-jit'; then
+              echo "  ✓ allow-jit present on node"
+            else
+              echo "  ✗ allow-jit MISSING on node — runtime would crash-loop." >&2
+              exit 1
+            fi
+          fi
+
       - name: Build Tauri bundle
         env:
           # AppImage tools need FUSE on Linux; ubuntu-22.04 dropped it.

apps/objectos-one/src-tauri/runtime-entitlements.plist

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <!-- The bundled Node runtime is signed with hardened runtime (required for
+       notarization). V8 maps executable (JIT) memory at startup, which the
+       hardened runtime blocks unless these entitlements are granted — without
+       them macOS kills node with SIGTRAP (exit 133) before it prints anything,
+       producing the "sidecar exited; restarting" crash-loop. -->
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+</dict>
+</plist>