c2405f212447c7d6beac0c383713f7fb1e8e4945
COMMAND: node --input-type=module < /tmp/21282-evidence/config-runner.mjs
CONFIG ONLY — executed real exports on Linux; no packaging, signing, TCC or native helper execution
C2 signing fixture: {"appId":"com.t3tools.t3code","teamId":"ABC1234567","rpDomains":["clerk.example.com","example.clerk.accounts.dev"],"provisioningProfilePath":"/tmp/synthetic.provisionprofile"}
C2 generated plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.application-identifier</key>
    <string>ABC1234567.com.t3tools.t3code</string>
    <key>com.apple.developer.team-identifier</key>
    <string>ABC1234567</string>
    <key>com.apple.developer.associated-domains</key>
    <array>
      <string>webcredentials:clerk.example.com</string>
      <string>webcredentials:example.clerk.accounts.dev</string>
    </array>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <!-- The hardened runtime denies camera and microphone to the app and every
         child process, with no prompt, unless the app claims these. Terminals
         and coding agents inherit the app's TCC identity, so without these a
         command like ffmpeg or imagesnap gets silent access-denied. -->
    <key>com.apple.security.device.camera</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
    <!-- Same inheritance: without this, tccd rejects Apple Events sent by
         agent helpers such as Codex computer use. -->
    <key>com.apple.security.automation.apple-events</key>
    <true/>
  </dict>
</plist>

{
  "row": "C1/C3 unsigned config",
  "signed": false,
  "usageDescription": "T3 Code lets commands run by terminals and coding agents control other apps.",
  "entitlements": null,
  "provisioningProfile": null
}
{
  "row": "C3 signed config",
  "signed": true,
  "usageDescription": "T3 Code lets commands run by terminals and coding agents control other apps.",
  "entitlements": "/tmp/synthetic-entitlements.mac.plist",
  "provisioningProfile": "/tmp/synthetic.provisionprofile"
}
EXIT_CODE=0
C3 source wiring (not runtime artifact proof):
  const configuredMacPasskeySigning =
    options.platform === "mac" && options.signed
      ? yield* Effect.try({
          try: () => resolveMacPasskeySigningConfiguration(loadRepoEnv({ repoRoot })),
          catch: MacPasskeySigningConfigurationResolutionError.fromCause,
        })
      : undefined;
  const macPasskeySigning = configuredMacPasskeySigning
    ? {
        ...configuredMacPasskeySigning,
        provisioningProfilePath: path.resolve(
          repoRoot,
          configuredMacPasskeySigning.provisioningProfilePath,
        ),
      }
    : undefined;
  const macEntitlementsPath = macPasskeySigning
    ? path.join(stageAppDir, "entitlements.mac.plist")
    : undefined;
  let macWebAuthn: MacWebAuthnEntitlements | undefined;
  if (macPasskeySigning && macEntitlementsPath) {
    if (!(yield* fs.exists(macPasskeySigning.provisioningProfilePath))) {
      return yield* new MacProvisioningProfileNotFoundError({
        provisioningProfilePath: macPasskeySigning.provisioningProfilePath,
      });
    }
    macWebAuthn = resolveMacWebAuthnEntitlements(
      yield* fs.readFileString(macPasskeySigning.provisioningProfilePath),
      macPasskeySigning,
    );
    yield* Effect.log(
      `[desktop-artifact] In-app browser passkeys: Touch ID ${macWebAuthn.touchIdKeychainAccessGroup ? "enabled" : "disabled"}, browser passkeys ${macWebAuthn.browserPasskeys ? "enabled" : "disabled"}.`,
    );
    yield* fs.writeFileString(
      macEntitlementsPath,
      renderMacPasskeyEntitlements(macPasskeySigning, macWebAuthn),
    );
  }