starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-26 00:03:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

build(macos): use a distinct bundle id for local packaging

Browse Source 
Local 'pnpm build' carried the release appId com.stablyai.orca under a
different (ad-hoc/local) signature; macOS TCC keys grants to bundle id +
signature, so local builds collided with and corrupted the installed
release's grant identity. Non-release packaging now uses
com.stablyai.orca.local, gated on ORCA_MAC_RELEASE — the same env that
enables release signing — so release artifacts are byte-identical.
Knock-ons covered: sidecar peer-trust allowlist, notification-status
sidecar bundle id, and the notification settings deep-link now trusts
the launchd-provided id.

Refs #9756
This commit is contained in:
Brennan Benson
2026-07-22 12:21:48 -07:00
parent dfbc2e8ba7
commit 2a1c2b0af1
5 changed files with 57 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
native/computer-use-macos/Sources/OrcaComputerUseMacOS/main.swift
+4 -2
View File
@@ -3603,9 +3603,11 @@ private func isTrustedOrcaApplication(_ pid: pid_t) -> Bool {
else {
return false
}
// Why: dev validation runs from per-worktree wrapper apps with stable
// Orca-owned bundle ids; the sidecar peer check must still authorize them.
// Why: dev validation runs from per-worktree wrapper apps and local
// packaging uses its own bundle id (#9756); the sidecar peer check must
// still authorize these Orca-owned identities.
return bundleId == "com.stablyai.orca" ||
bundleId == "com.stablyai.orca.local" ||
bundleId.hasPrefix("com.stablyai.orca.dev.") ||
bundleId == "com.github.Electron"
}