mirror of
https://github.com/tinyhumansai/openhuman.git
synced 2026-07-28 05:12:33 +00:00
0dd4d1f60b
* fix(macos): restart sidecar so permission grants show after System Settings Fixes #133 - Tauri: restart core after kill+wait; fail fast when port held by non-managed process - ACL: allow core_rpc_url and restart_core_process (IPC was blocked in Tauri 2) - Dev: default_core_bin falls through to release search when binaries/ empty - Core: expose permission_check_process_path on accessibility status - App: Restart & refresh UX, extractError for invoke, Vitest for RPC + slice - Stage script: optional dev codesign helper for stable TCC identity Made-with: Cursor * refactor(onboarding): update button text for clarity and enhance core process restart handling - Changed button text in ScreenPermissionsStep from 'Refresh Status' to 'Restart & Refresh Permissions' for better user understanding. - Introduced a restart lock in CoreProcessHandle to serialize overlapping restart requests, ensuring smoother core process management. - Updated restart_core_process function to acquire the restart lock before initiating a restart, improving reliability during the process. * fix: improve text clarity in AccessibilityPanel and ScreenIntelligencePanel - Adjusted text formatting in AccessibilityPanel for better readability. - Enhanced text clarity in ScreenIntelligencePanel regarding permission refresh instructions. - Standardized the formatting of permission_check_process_path in test files for consistency. --------- Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
86 lines
3.3 KiB
Bash
Executable File
86 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# One-time setup: create a stable local code-signing certificate for the
|
|
# openhuman-core sidecar. Run this once per development machine.
|
|
#
|
|
# Why: macOS TCC identifies unsigned binaries by content hash (Mach-O UUID).
|
|
# Every `yarn core:stage` recompiles the sidecar, changing its hash, so TCC
|
|
# no longer matches the old grant. Signing with a stable certificate causes
|
|
# TCC to use the certificate identity instead — grants persist across rebuilds.
|
|
#
|
|
# After running this script:
|
|
# 1. yarn core:stage (signs the sidecar with the new cert)
|
|
# 2. In OpenHuman → Request Permissions (removes old stale TCC entry,
|
|
# registers current binary)
|
|
# 3. Grant in System Settings → Refresh Status
|
|
# From this point the grant survives future `yarn core:stage` runs.
|
|
|
|
set -euo pipefail
|
|
|
|
IDENTITY="OpenHuman Dev Signer"
|
|
KEYCHAIN="$HOME/Library/Keychains/login.keychain-db"
|
|
TMPDIR_CERT=$(mktemp -d)
|
|
KEY="$TMPDIR_CERT/openhuman-dev.key"
|
|
CERT="$TMPDIR_CERT/openhuman-dev.crt"
|
|
P12="$TMPDIR_CERT/openhuman-dev.p12"
|
|
P12_PASS="${OPENHUMAN_P12_PASS:-openhuman-dev}"
|
|
|
|
cleanup() {
|
|
rm -rf "$TMPDIR_CERT"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
# ── Check if already set up ──────────────────────────────────────────────────
|
|
if security find-identity -v -p codesigning 2>/dev/null | grep -q "$IDENTITY"; then
|
|
echo "[setup-dev-codesign] Certificate \"$IDENTITY\" already exists — nothing to do."
|
|
echo "[setup-dev-codesign] Run 'yarn core:stage' to sign the sidecar."
|
|
exit 0
|
|
fi
|
|
|
|
echo "[setup-dev-codesign] Creating self-signed code-signing certificate: \"$IDENTITY\""
|
|
|
|
# ── Generate key + self-signed certificate ───────────────────────────────────
|
|
openssl req \
|
|
-newkey rsa:2048 \
|
|
-nodes \
|
|
-keyout "$KEY" \
|
|
-x509 \
|
|
-days 3650 \
|
|
-out "$CERT" \
|
|
-subj "/CN=$IDENTITY" \
|
|
2>/dev/null
|
|
|
|
# ── Bundle to PKCS12 ─────────────────────────────────────────────────────────
|
|
openssl pkcs12 \
|
|
-export \
|
|
-out "$P12" \
|
|
-inkey "$KEY" \
|
|
-in "$CERT" \
|
|
-passout "pass:$P12_PASS" \
|
|
2>/dev/null
|
|
|
|
# ── Import into login Keychain ───────────────────────────────────────────────
|
|
security import "$P12" \
|
|
-k "$KEYCHAIN" \
|
|
-P "$P12_PASS" \
|
|
-T /usr/bin/codesign \
|
|
-T /usr/bin/security
|
|
|
|
# ── Trust for code signing ───────────────────────────────────────────────────
|
|
security add-trusted-cert \
|
|
-d \
|
|
-r trustRoot \
|
|
-p codeSign \
|
|
-k "$KEYCHAIN" \
|
|
"$CERT"
|
|
|
|
echo ""
|
|
echo "[setup-dev-codesign] Done. Certificate \"$IDENTITY\" added to login Keychain."
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " 1. yarn core:stage — rebuilds and signs the sidecar"
|
|
echo " 2. In OpenHuman click 'Request Permissions' to register the signed binary"
|
|
echo " 3. Grant in System Settings → Privacy & Security → Accessibility"
|
|
echo " 4. Click 'Refresh Status'"
|
|
echo ""
|
|
echo "After this, accessibility grants will survive future 'yarn core:stage' runs."
|