Privileged helper for system proxy (#796)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

scripts/bundle-proxy.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+/**
+ * Builds Yaak Proxy as a `.app` with its privileged helper inside, signed when a Developer
+ * ID Application identity is in the keychain (or named by APPLE_SIGNING_IDENTITY). The helper
+ * only registers from a signed bundle, and only answers an app signed by the same team, so
+ * the team is taken from the identity and built into the helper.
+ */
+
+import { execFileSync, spawnSync } from "child_process";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const rootDir = path.join(__dirname, "..");
+
+/**
+ * The keychain's Developer ID Application identities, by hash, since names can repeat. With
+ * `wanted`, only the one with that hash or name.
+ */
+function findIdentity(wanted) {
+  try {
+    const output = execFileSync("security", ["find-identity", "-v", "-p", "codesigning"]);
+    const pattern =
+      /^\s*\d+\) ([0-9A-F]{40}) "(Developer ID Application: .+ \(([A-Z0-9]{10})\))"$/gm;
+    for (const match of output.toString().matchAll(pattern)) {
+      if (wanted == null || wanted === match[1] || wanted === match[2]) {
+        return { hash: match[1], name: match[2], team: match[3] };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+const env = { ...process.env };
+const args = ["--bundles", "app", "--config", "crates-tauri/yaak-app-proxy/tauri.bundle.conf.json"];
+
+if (env.APPLE_SIGNING_IDENTITY) {
+  console.log("Signing with APPLE_SIGNING_IDENTITY");
+  const team =
+    env.APPLE_SIGNING_IDENTITY.match(/\(([A-Z0-9]{10})\)$/)?.[1] ??
+    findIdentity(env.APPLE_SIGNING_IDENTITY)?.team;
+  env.YAAK_PROXY_TEAM_ID ??= env.APPLE_TEAM_ID ?? team;
+  if (env.YAAK_PROXY_TEAM_ID == null) {
+    console.error(
+      "Could not tell the signing team, which the helper must know. Set YAAK_PROXY_TEAM_ID or APPLE_TEAM_ID.",
+    );
+    process.exit(1);
+  }
+} else {
+  const identity = process.platform === "darwin" ? findIdentity() : null;
+  if (identity) {
+    console.log(`Signing with "${identity.name}"`);
+    env.APPLE_SIGNING_IDENTITY = identity.hash;
+    env.YAAK_PROXY_TEAM_ID ??= identity.team;
+  } else {
+    console.warn(
+      "No Developer ID Application identity found, so the bundle is unsigned and its helper cannot be registered",
+    );
+    args.push("--no-sign");
+  }
+}
+if (env.YAAK_PROXY_TEAM_ID == null) delete env.YAAK_PROXY_TEAM_ID;
+
+const result = spawnSync(
+  process.execPath,
+  [path.join(__dirname, "run-build.mjs"), "proxy", ...args, ...process.argv.slice(2)],
+  { cwd: rootDir, stdio: "inherit", env },
+);
+process.exit(result.status ?? 1);

scripts/vendor-proxy-helper.cjs

@@ -0,0 +1,49 @@
+/**
+ * Builds Yaak Proxy's privileged helper and places it where the proxy bundle's
+ * `externalBin` expects it, named for the target triple. The helper is macOS only.
+ */
+
+const { execFileSync } = require("node:child_process");
+const { chmodSync, copyFileSync, mkdirSync } = require("node:fs");
+const path = require("node:path");
+
+if (process.platform !== "darwin") {
+  console.log("The proxy helper is macOS only, so there is nothing to vendor");
+  process.exit(0);
+}
+
+const rootDir = path.join(__dirname, "..");
+const destDir = path.join(rootDir, "crates-tauri", "yaak-app-proxy", "vendored", "helper");
+const target = process.env.TAURI_ENV_TARGET_TRIPLE || hostTriple();
+
+function hostTriple() {
+  const output = execFileSync("rustc", ["-vV"]).toString();
+  return output.match(/^host: (\S+)$/m)[1];
+}
+
+/** Where Cargo builds, which CARGO_TARGET_DIR or a config's build.target-dir can move */
+function targetDir() {
+  const args = ["metadata", "--format-version", "1", "--no-deps"];
+  return JSON.parse(execFileSync("cargo", args, { cwd: rootDir })).target_directory;
+}
+
+function build(triple) {
+  execFileSync(
+    "cargo",
+    ["build", "--package", "yaak-proxy-helper", "--release", "--target", triple],
+    { cwd: rootDir, stdio: "inherit" },
+  );
+  return path.join(targetDir(), triple, "release", "yaak-proxy-helper");
+}
+
+mkdirSync(destDir, { recursive: true });
+const dest = path.join(destDir, `yaak-proxy-helper-${target}`);
+if (target === "universal-apple-darwin") {
+  const arm = build("aarch64-apple-darwin");
+  const intel = build("x86_64-apple-darwin");
+  execFileSync("lipo", ["-create", "-output", dest, arm, intel], { stdio: "inherit" });
+} else {
+  copyFileSync(build(target), dest);
+}
+chmodSync(dest, 0o755);
+console.log(`Vendored the proxy helper to ${path.relative(rootDir, dest)}`);