tianxiaochannel-oss88 · Nov 7, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 4, 2026 · Nov 6, 2026
@@ -68,15 +68,15 @@
   },
   "devDependencies": {
     "@electron/asar": "4.3.1",
-    "@electron/osx-sign": "2.7.1",
+    "@electron/osx-sign": "2.7.2",
     "@fontsource-variable/inter": "5.3.0",
     "@playwright/test": "1.64.1",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
-    "electron": "44.9.1",
-    "electron-builder": "^26.15.3",
+    "electron": "45.2.1",
+    "electron-builder": "26.18.0",
     "esbuild": "^0.28.1",
     "resedit": "3.1.0",
     "vite": "^8.2.1"

@@ -4,7 +4,7 @@ import { createDarwinPlatformSigner } from "./darwin-platform-signer.mjs";
 import { runProviderAwareSign } from "./hooks.mjs";
 
 /**
- * Electron Builder 26.15.3 `mac.sign` callback.  Builder hands the callback a
+ * Pinned Electron Builder `mac.sign` callback. Builder hands the callback a
  * bundle path rather than an individual executable.  The fixture/release
  * adapter records the outer main executable as the governed app identity;
  * the real macOS signer remains an injected platform service in Slice 6A.

@@ -1,7 +1,7 @@
 import { runProviderAwareSign } from "./hooks.mjs";
 
 /**
- * Electron Builder 26.15.3 `win.signtoolOptions.sign` callback.  The callback
+ * Pinned Electron Builder `win.signtoolOptions.sign` callback. The callback
  * receives the exact file task that Builder is about to sign; the shared seam
  * either proves the sealed provider digest and skips it or delegates the outer
  * executable to the injected/release signer.

@@ -29,6 +29,7 @@ import {
 import { SigningContractError } from "./signing-contract.mjs";
 import { createDmgInputSnapshot } from "./dmg-input-snapshot.mjs";
 import { createDmgAttachmentCustody } from "./dmg-attachment-custody.mjs";
+import { builderVersion } from "../distribution/installer-builder.mjs";
 
 const require = createRequire(import.meta.url);
 const COMMAND_TIMEOUT_MS = 120_000;
@@ -288,10 +289,10 @@ async function resolvePinnedSevenZip() {
   const electronBuilderRequire = createRequire(electronBuilderPackage);
   const appBuilderPackage = electronBuilderRequire.resolve("app-builder-lib/package.json");
   const appBuilder = electronBuilderRequire(appBuilderPackage);
-  if (electronBuilder.version !== "26.15.3" || appBuilder.version !== "26.15.3") {
+  if (electronBuilder.version !== builderVersion || appBuilder.version !== builderVersion) {
     throw contractError(
       "final_artifact_builder_version_mismatch",
-      `Expected electron-builder/app-builder-lib 26.15.3, got ${String(electronBuilder.version)}/${String(appBuilder.version)}`,
+      `Expected electron-builder/app-builder-lib ${builderVersion}, got ${String(electronBuilder.version)}/${String(appBuilder.version)}`,
     );
   }
   const pinnedRequire = createRequire(appBuilderPackage);

@@ -5,6 +5,7 @@ import { fileURLToPath } from "node:url";
 import { cuaDriverArtifactLayoutFor } from "../../shared/cua-driver-artifact-layout.mjs";
 import { validateCuaDriverPackageAuthority } from "../../shared/cua-driver-package-authority-contract.mjs";
 import { verifyCuaDriverPackagedHostAuthority } from "../cua-driver-package-host-authority.mjs";
+import { builderVersion } from "../distribution/installer-builder.mjs";
 import { createDarwinPlatformSigner } from "./darwin-platform-signer.mjs";
 import {
   createDisposableFixtureSigner,
@@ -256,7 +257,7 @@ export async function runAfterPack(context, callOptions = {}) {
     }
 
     const state = {
-      electronBuilderVersion: "26.15.3",
+      electronBuilderVersion: builderVersion,
       platform,
       signingTier: profile.signingTier,
       distributionChannel: profile.distributionChannel,

@@ -2,6 +2,7 @@ import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 
 import { SigningContractError, canonicalJson, sha256Bytes } from "./signing-contract.mjs";
+import { builderVersion } from "../distribution/installer-builder.mjs";
 
 const TRACE_FILE = "provider-signing-trace.json";
 const STATE_FILE = "provider-signing-state.json";
@@ -75,7 +76,7 @@ async function appendSigningTraceSerially(directory, event) {
   const trace = {
     schemaVersion: 1,
     kind: "ling-cua-driver-signing-feasibility-trace",
-    electronBuilderVersion: "26.15.3",
+    electronBuilderVersion: builderVersion,
     events: [...events, normalized],
   };
   await writeJsonAtomically(join(directory, TRACE_FILE), trace);

@@ -3,7 +3,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpat
 import { createRequire } from "node:module";
 import { dirname, join, resolve } from "node:path";
 
-export const builderVersion = "26.15.3";
+export const builderVersion = "26.18.0";
 export const originalTemplates = Object.freeze({
   "templates/nsis/installSection.nsh": "74c4dbb4163cdd90ca4850b75d304e916235c882d6af7b5cdad63bffbc977072",
   "templates/nsis/include/installer.nsh": "0e319437dd01dcbf911f3f48f664fde0cefbaef704f1cdb1739f63d563f5d4a0",

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "component": "NSIS embedded zlib runtime and compiler headers",
-  "appBuilderLibVersion": "26.15.3",
+  "appBuilderLibVersion": "26.18.0",
   "toolsetModuleSha256": "a6e3009ca9680aec48646793289224a8df26cfb9c8dafba1e3b08323f09a331b",
   "releaseName": "nsis-3.0.4.1",
   "archive": "https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-3.0.4.1/nsis-3.0.4.1.7z",
   "archiveSha256": "9877df902530f96357d13a7a31ae2b9df67f48b11ffc9a1700a7c961574ec5fa",
   "licensePath": "COPYING",
   "licenseSha256": "3c8de989f6504d52f5f8dfafedb6668cd47201f5d01f1319570727c091425dd6",
-  "scope": "Original COPYING from the exact compiler archive selected by app-builder-lib 26.15.3. The private stock-template overlay retains stock upgrade/rollback and 7z extraction, replaces WinShell calls with MIT LingShell System/COM macros, and removes SpiderBanner display calls. StdUtils/nsis7z original paired source archives are supplied separately."
+  "scope": "Original COPYING from the exact compiler archive selected by app-builder-lib 26.18.0. The private stock-template overlay retains stock upgrade/rollback and 7z extraction, replaces WinShell calls with MIT LingShell System/COM macros, and removes SpiderBanner display calls. StdUtils/nsis7z original paired source archives are supplied separately."
 }
@@ -46,7 +46,7 @@ test.afterEach(() => {
   resetProviderSigningHooks();
 });
 
-test("opt-in Electron Builder 26.15.3 fixture config wires both platform signing callbacks", async () => {
+test("opt-in pinned Electron Builder fixture config wires both platform signing callbacks", async () => {
   const config = (await import("../scripts/cua-driver-signing/electron-builder.signing-feasibility.config.mjs?fixture=1")).default;
   assert.equal(config.afterPack, "./scripts/cua-driver-signing/after-pack.mjs");
   assert.equal(config.afterSign, "./scripts/cua-driver-signing/after-sign.mjs");

@@ -43,7 +43,7 @@
     "@expo/dom-webview": "~58.0.2"
   },
   "devDependencies": {
-    "expo-doctor": "1.21.4",
+    "expo-doctor": "1.21.5",
     "expo-mcp": "0.2.4",
     "react-dom": "19.3.0",
     "react-types-mobile": "npm:@types/react@19.3.0",

@@ -0,0 +1,110 @@
+# macOS development packaging dependency review, 2026-11-03
+
+This review covers PR #633 at
+`7f2fc754102f2c49e5e238ead027468f34da0023` plus its Builder compatibility
+corrections, against main `b5713e56ccea5ab75c5c8450d4c8f275c20b1c70`.
+It updates only the existing Darwin arm64, `unsigned_dev`, ad-hoc,
+`provider=false` source prerequisite. It does not accept a final App, ZIP, DMG,
+public signature, notarization, GUI behavior or release.
+
+## Compatibility review
+
+The seven proposed dependency updates are retained: Node types 26.6.6,
+osx-sign 2.7.2, Electron 45.2.1, Electron Builder 26.18.0, Vite 8.3.5,
+expo-doctor 1.21.5 and Babel parser 8.0.10. Builder is now pinned exactly to
+26.18.0. Its installer, extractor and signing-trace consumers share the existing
+version constant, while both Builder package-version checks remain strict.
+
+Independent Codex context `01a1a05f-591b-77a1-86de-2bf4f7e4300e` found no
+blocking dependency-graph or Builder-integration defect in these exact bytes.
+The structured lock audit covered 20 importers, 1,391 packages, 1,395 snapshots
+and 3,123 transitive dependency edges, with no dangling reference. All 22
+overrides and nine security patches, including their hashes, remain intact.
+
+The four pinned NSIS templates and the Windows toolset module are byte-identical
+between the two Builder versions. Their existing hash guards are unchanged.
+The NSIS source receipt changes its Builder version reference only, retaining
+the compiler archive and license hashes. The other NSIS template change adds
+`-NoProfile -NonInteractive` to four PowerShell calls without changing the macro
+interface or fallback. Both signing callback contracts remain compatible.
+Squirrel remains outside this review: its existing 26.15.3 package is not used
+by the current `dir`/NSIS path, and its peer-version mismatch is not accepted
+as a tested Squirrel configuration.
+
+## Independent source and runtime decision
+
+Separate Codex context `01a1a065-bf2b-74a0-b649-ec0012776b23` independently
+reviewed the exact record proposal and returned `SCOPED SOURCE-REVIEW PASS`
+before either persistent record was changed. These are independent contexts
+on the same model host, not human or cross-model approval.
+
+The source audit retains 43 roots and 1,706 unique fixed inputs. It parsed
+1,630 authored files and reached 1,639, with no missing input, unresolved authored
+import or parse error. The new version-constant imports target an already fixed
+module, with no build-time approval discovery or new top-level write effect.
+All 15 Office and 19 sandbox native input digests remain unchanged.
+
+The actual Electron runtime is 45.2.1, with embedded Node 24.22.1 and libuv
+1.52.1, on Darwin arm64. Both records change only their Electron and Node
+runtime fields. Compiler, SDK, headers, deployment target, OS rows, trust,
+signing, approval fields and false/unbound safety axes are unchanged.
+
+The sandbox record was adopted first. The Office record then adopted exactly
+the following ten existing packaging digest replacements. No key was added
+or removed; the other 1,697 values are unchanged.
+
+| Existing packaging input | Approved SHA-256 |
+| --- | --- |
+| `apps/desktop/package.json` | `d8d064c0ea099c78d90b83462d90e590a9d5b4189eb997d0cee8f018cdd382f8` |
+| `packages/core/src/provider-model-catalog.generated.ts` | `c02eaf49e0f4e79f94cb18734d2613a3e9c88e4ca1250d9b353dc0574f7c41e4` |
+| `pnpm-lock.yaml` | `bea9a0f9bd2771063b97e1fd47f20aa43325670213909bcad06033e12fa2a1ad` |
+| `packages/daemon/package.json` | `1f44188e8a668392c8573c011e1aa80e9d589cba7036d6a97315f5445c40898b` |
+| `apps/desktop/scripts/distribution/installer-builder.mjs` | `4f67d19706b4f000a1ab90590932190fb6889803578d9bf0d9bfc38a7fab817d` |
+| `apps/desktop/scripts/cua-driver-signing/electron-builder-mac-sign.mjs` | `7000392b8ca2f4151442773d8150fddcd1c758ab6ad5516a5a7dfdc098ea1ead` |
+| `apps/desktop/scripts/cua-driver-signing/final-artifact-extractor.mjs` | `97e45821742403beaf936ebb5393633845b5be111e346266ec1f186af02efdc4` |
+| `apps/desktop/scripts/cua-driver-signing/hooks.mjs` | `61a37e71e5f6df0b6113cc558eff86210dcf80eeb0d825d3060198d8eff7f76e` |
+| `apps/desktop/scripts/cua-driver-signing/signing-trace.mjs` | `8d8403ecb6d2f3a8c9f7405d51535a61e3e048e4bd19d33cfeaa747ea380eb0e` |
+| `native/sandbox/reviewed-codesign-source-v1.json` | `5e4e8cc68a68f4901244aa773ca04787805021f61c714ab64b52bf960c328572` |
+
+The adopted Office record SHA-256 is
+`c974cf2253ac6d754c9f2cb7141032133d58d7bb0c5d1b17a5827c72b9c8806c`.
+The fixed-order packaging aggregate is
+`069e86b5b33420eacba6a4bf8280433a8245f52fe394cbf44d7e502e514f0c3b`.
+The unchanged Office and sandbox native aggregates are respectively
+`9c5f6a1a05fe63ab96de941432ec13166af8974ec52730934d5ac348c41a854e`
+and `6770a6864706c68c41ed4998c826daeff7e33baf7d59d9d9cfca8a9b63da1dbd`.
+Aggregates encode fixed-order `[path, sha256]` pairs as JSON plus a newline.
+
+## Verification and limits
+
+- Before adoption, the actual committed-form Office record test failed on the
+  stale Desktop manifest digest. After adoption, all 1,706 packaging inputs
+  and all native inputs match, and the exact record/field comparison permits
+  only the independently reviewed changes above.
+- The actual strict Office reader, default local Office reader and codesign
+  reader accepted the final records and fresh native build evidence using the
+  already approved local Xcode/SDK/header profile, without observer mocks or
+  a new toolchain allowance.
+- Office publication, codesign publication, authored-input and toolchain
+  contract tests passed 227/227 with no skips. Their disposable synthetic
+  compiler/signature cases do not establish final artifact acceptance.
+- Fresh Office compilation passed. Primitive/publication/readback suites
+  passed 48/48 under standalone Node and 48/48 under actual Electron 45.2.1,
+  with equal before/after source fingerprints and no fixture residue. The
+  first Electron run passed 47/48 because its confined actor used a symlinked
+  Node path; that failed run was retained. Selecting the canonical standalone
+  actor path through the existing test-only setting resolved it without
+  changing source, tests or policy.
+- The fresh sandbox build recorded 26 Rust passes and two existing ignored
+  cases. Protocol suites passed 19/19, 10/10 and 18/18. Actual restricted-command
+  dispatch with the fresh helper and Electron passed 15/15 without skips.
+- Frozen dependency installation, the nine-package Daemon build graph and
+  Desktop CI typecheck passed. Dependency-security regressions passed 173/173;
+  release/extractor contracts passed 117/117. Installer/NSIS/signing-feasibility
+  tests passed 36 cases, with four existing Windows-only cases skipped on macOS.
+- License policy passed for 1,282 versions across 23 families. Windows execution,
+  installer acceptance, complete hosted CI, final App/archive bytes, real signing,
+  notarization, clean-machine and GUI acceptance remain separate checks.
+
+No approval refresher, fallback reader, disabled guard or new safety capability
+was introduced. Earlier reviews retain their historical snapshots and limits.
@@ -1,6 +1,6 @@
 # Scoped macOS Development Packaging Review
 
-Latest source/runtime rebinding: [2026-11-02 macOS development packaging review](../../docs/release/macos-source-review-2026-11-02.md).
+Latest source/runtime rebinding: [2026-11-03 macOS development packaging review](../../docs/release/macos-source-review-2026-11-03.md).
 The dated reviews below retain their historical evidence and scope.
 
 Status: independently reviewed source prerequisite; final artifact acceptance separate