From def9051578d0df5091c019e01e1751f796f7c5ee Mon Sep 17 00:00:00 2001
From: JonathanLab <jonathanmieloo@gmail.com>
Date: Fri, 21 Nov 2025 13:50:05 +0100
Subject: [PATCH] fix: add proper entitlements

---
 build/entitlements.mac.plist | 17 +++++++++++++++++
 forge.config.ts              |  7 +++++++
 package.json                 |  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 build/entitlements.mac.plist

diff --git a/build/entitlements.mac.plist b/build/entitlements.mac.plist
new file mode 100644
index 00000000..0d3832ce
--- /dev/null
+++ b/build/entitlements.mac.plist
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!--
+	For forking the process (the shell does this for example)
+	- https://www.electronjs.org/de/docs/latest/api/utility-process#utilityprocessforkmodulepath-args-options -->
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+
+	<!-- Enable JIT compilation for V8 -->
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+</dict>
+</plist>
diff --git a/forge.config.ts b/forge.config.ts
index c6c0c79b..d728c60a 100644
--- a/forge.config.ts
+++ b/forge.config.ts
@@ -65,6 +65,13 @@ const notarizeConfig =
 const osxSignConfig = shouldSignMacApp
   ? ({
       identity: appleCodesignIdentity!,
+      optionsForFile: (_filePath) => {
+        // Entitlements for all binaries/frameworks
+        return {
+          hardenedRuntime: true,
+          entitlements: "build/entitlements.mac.plist",
+        };
+      },
     } satisfies Record<string, unknown>)
   : undefined;
 
diff --git a/package.json b/package.json
index 52e0521d..54ca6334 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "array",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Array - PostHog desktop task manager",
   "main": ".vite/build/index.js",
   "versionHash": "dynamic",