From 9ff51af2601fca840b30174c6655c915afdce625 Mon Sep 17 00:00:00 2001
From: u8array <alexanderleinich1@gmail.com>
Date: Mon, 27 Jul 2026 16:04:48 +0200
Subject: [PATCH] fix(macos): grant MCP sidecar allow-jit entitlement

Node SEA binary crashes under hardened runtime without allow-jit
("Failed to reserve virtual memory for CodeRange"); the sidecar never
reaches listening, so MCP fails to start on installed macOS builds.
---
 src-tauri/entitlements.plist | 13 +++++++++++++
 src-tauri/tauri.conf.json    |  3 ++-
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 src-tauri/entitlements.plist

diff --git a/src-tauri/entitlements.plist b/src-tauri/entitlements.plist
new file mode 100644
index 00000000..f32b14fb
--- /dev/null
+++ b/src-tauri/entitlements.plist
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <!-- The MCP sidecar is a Node SEA binary; V8 needs to map executable memory
+       for its JIT. Under hardened runtime this crashes ("Failed to reserve
+       virtual memory for CodeRange") without these entitlements. -->
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+</dict>
+</plist>
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 1f8c83c4..3cb2aabd 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -47,7 +47,8 @@
     "shortDescription": "ZPL label designer",
     "longDescription": "Visual designer for Zebra ZPL printer labels with live preview and ZPL import/export.",
     "macOS": {
-      "signingIdentity": "-"
+      "signingIdentity": "-",
+      "entitlements": "entitlements.plist"
     },
     "icon": [
       "icons/32x32.png",