fix(desktop): load downloaded mesh runtime on signed macOS builds (#1932)

.github/workflows/release.yml

@@ -203,6 +203,10 @@ jobs:
           DMG_PATH: ${{ steps.unsigned.outputs.dmg }}
         run: desktop/scripts/set-dmg-finder-text-size.sh "$DMG_PATH" 14
 
+      # mdx-ios-codesign-helper discovers this file by its exact lowercase basename.
+      - name: Stage signing entitlements
+        run: cp desktop/src-tauri/Entitlements.plist "${RUNNER_TEMP}/entitlements.plist"
+
       - name: Codesign and Notarize
         id: codesign
         uses: block/apple-codesign-action@679535d1ab7c5a7c18e6f9afcba3464512cc3dde # v1.1.0
@@ -210,7 +214,7 @@ jobs:
           osx-codesign-role: ${{ secrets.OSX_CODESIGN_ROLE }}
           codesign-s3-bucket: ${{ secrets.CODESIGN_S3_BUCKET }}
           unsigned-artifact-path: ${{ steps.unsigned.outputs.dmg }}
-          entitlements-plist-path: desktop/src-tauri/Entitlements.plist
+          entitlements-plist-path: ${{ runner.temp }}/entitlements.plist
           artifact-name: buzz-${{ github.sha }}-${{ github.run_id }}-arm64
 
       - name: Replace DMG and rebuild updater archive
@@ -247,6 +251,8 @@ jobs:
             desktop/src-tauri/target/release/bundle/macos/Buzz.app
           spctl --assess --type execute --verbose=4 \
             desktop/src-tauri/target/release/bundle/macos/Buzz.app
+          desktop/scripts/verify-macos-entitlements.sh \
+            desktop/src-tauri/target/release/bundle/macos/Buzz.app
 
       - name: Locate build artifacts
         id: artifacts
@@ -369,6 +375,10 @@ jobs:
           DMG_PATH: ${{ steps.unsigned.outputs.dmg }}
         run: desktop/scripts/set-dmg-finder-text-size.sh "$DMG_PATH" 14
 
+      # mdx-ios-codesign-helper discovers this file by its exact lowercase basename.
+      - name: Stage signing entitlements
+        run: cp desktop/src-tauri/Entitlements.plist "${RUNNER_TEMP}/entitlements.plist"
+
       - name: Codesign and Notarize
         id: codesign
         uses: block/apple-codesign-action@679535d1ab7c5a7c18e6f9afcba3464512cc3dde # v1.1.0
@@ -376,7 +386,7 @@ jobs:
           osx-codesign-role: ${{ secrets.OSX_CODESIGN_ROLE }}
           codesign-s3-bucket: ${{ secrets.CODESIGN_S3_BUCKET }}
           unsigned-artifact-path: ${{ steps.unsigned.outputs.dmg }}
-          entitlements-plist-path: desktop/src-tauri/Entitlements.plist
+          entitlements-plist-path: ${{ runner.temp }}/entitlements.plist
           artifact-name: buzz-${{ github.sha }}-${{ github.run_id }}-x64
 
       - name: Replace DMG and rebuild updater archive
@@ -411,6 +421,7 @@ jobs:
           APP_DIR="desktop/src-tauri/target/${TARGET}/release/bundle/macos/Buzz.app"
           codesign --verify --deep --strict --verbose=2 "$APP_DIR"
           spctl --assess --type execute --verbose=4 "$APP_DIR"
+          desktop/scripts/verify-macos-entitlements.sh "$APP_DIR"
 
       - name: Locate updater archive
         id: artifacts

desktop/scripts/verify-macos-entitlements.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Fail a macOS release if the signing service dropped Buzz's entitlements.
+
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "Usage: $0 <path-to-Buzz.app>" >&2
+  exit 2
+fi
+
+APP_PATH="$1"
+INFO_PLIST="$APP_PATH/Contents/Info.plist"
+
+[[ -d "$APP_PATH" ]] || { echo "Missing app bundle: $APP_PATH" >&2; exit 1; }
+[[ -f "$INFO_PLIST" ]] || { echo "Missing app Info.plist: $INFO_PLIST" >&2; exit 1; }
+
+EXECUTABLE_NAME="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$INFO_PLIST")"
+EXECUTABLE_PATH="$APP_PATH/Contents/MacOS/$EXECUTABLE_NAME"
+[[ -f "$EXECUTABLE_PATH" ]] || { echo "Missing app executable: $EXECUTABLE_PATH" >&2; exit 1; }
+
+ENTITLEMENTS="$(mktemp -t buzz-entitlements)"
+trap 'rm -f "$ENTITLEMENTS"' EXIT
+
+codesign --display --entitlements "$ENTITLEMENTS" --xml "$EXECUTABLE_PATH" 2>/dev/null
+[[ -s "$ENTITLEMENTS" ]] || {
+  echo "Signed app has no embedded entitlements: $EXECUTABLE_PATH" >&2
+  exit 1
+}
+
+required_entitlements=(
+  com.apple.security.device.audio-input
+  com.apple.security.device.camera
+  com.apple.security.cs.disable-library-validation
+)
+
+for entitlement in "${required_entitlements[@]}"; do
+  value="$(/usr/libexec/PlistBuddy -c "Print :$entitlement" "$ENTITLEMENTS" 2>/dev/null || true)"
+  if [[ "$value" != "true" ]]; then
+    echo "Signed app is missing required entitlement: $entitlement" >&2
+    exit 1
+  fi
+done
+
+echo "Verified required macOS entitlements on $EXECUTABLE_PATH"

desktop/src-tauri/Entitlements.plist

@@ -6,5 +6,8 @@
     <true/>
     <key>com.apple.security.device.camera</key>
     <true/>
+    <!-- MeshLLM installs versioned native runtimes outside the app bundle. -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
 </dict>
 </plist>

desktop/src-tauri/src/mesh_llm/mod.rs

@@ -228,7 +228,9 @@ async fn initialize_mesh_native_runtime() -> anyhow::Result<()> {
     // requiring a separate `mesh-llm runtime install` command.
     mesh_llm_host_runtime::initialize_host_runtime()
         .await
-        .map_err(|error| anyhow::anyhow!("mesh native runtime failed to install or load: {error}"))
+        .map_err(|error| {
+            anyhow::anyhow!("mesh native runtime failed to install or load: {error:#}")
+        })
 }
 
 /// Tokio worker stack size for the runtime that polls mesh-llm futures.