feat(build): enhance macOS application signing process

- Updated the Makefile and GitHub workflows to include entitlements during the codesigning process for macOS applications, improving security and compliance.
- Added timestamp and runtime options to the codesigning commands, ensuring better handling of application signatures.
- Refactored the signing logic to maintain consistency across different build targets, enhancing the overall release process.

.github/codesign/entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+</dict>
+</plist>

.github/workflows/release-macos.yml

@@ -156,7 +156,9 @@ jobs:
           for ARCH in arm64 amd64; do
             for SUFFIX in "" "-prod"; do
               BIN="dist/release/yao-${VERSION}-darwin-${ARCH}${SUFFIX}"
-              codesign --force --verbose --timestamp --options runtime --sign "$IDENTITY" "$BIN"
+              codesign --force --verbose --timestamp --options runtime \
+                --entitlements .github/codesign/entitlements.plist \
+                --sign "$IDENTITY" "$BIN"
               codesign --verify --deep --strict --verbose=2 "$BIN"
             done
           done

Makefile

@@ -739,7 +739,9 @@ release: prepare
 
 #   MacOS Application Signing
 	@if [ "$(OS)" = "Darwin" ]; then \
-	    codesign --deep --force --verify --verbose --sign "${APPLE_SIGN}" dist/release/yao ; \
+	    codesign --deep --force --verbose --timestamp --options runtime \
+	        --entitlements .github/codesign/entitlements.plist \
+	        --sign "${APPLE_SIGN}" dist/release/yao ; \
 	fi
 
 # make prod (production build only, ~111M on macOS)
@@ -779,7 +781,9 @@ prod: prepare
 
 #   MacOS Application Signing
 	@if [ "$(OS)" = "Darwin" ]; then \
-	    codesign --deep --force --verify --verbose --sign "${APPLE_SIGN}" dist/release/yao-prod ; \
+	    codesign --deep --force --verbose --timestamp --options runtime \
+	        --entitlements .github/codesign/entitlements.plist \
+	        --sign "${APPLE_SIGN}" dist/release/yao-prod ; \
 	fi
 
 	@echo ""
@@ -829,8 +833,12 @@ release-all: prepare
 
 #   MacOS Application Signing
 	@if [ "$(OS)" = "Darwin" ]; then \
-	    codesign --deep --force --verify --verbose --sign "${APPLE_SIGN}" dist/release/yao ; \
-	    codesign --deep --force --verify --verbose --sign "${APPLE_SIGN}" dist/release/yao-prod ; \
+	    codesign --deep --force --verbose --timestamp --options runtime \
+	        --entitlements .github/codesign/entitlements.plist \
+	        --sign "${APPLE_SIGN}" dist/release/yao ; \
+	    codesign --deep --force --verbose --timestamp --options runtime \
+	        --entitlements .github/codesign/entitlements.plist \
+	        --sign "${APPLE_SIGN}" dist/release/yao-prod ; \
 	fi
 
 	@echo ""

agent/sandbox/v2/claude/parse.go

@@ -244,6 +244,23 @@ func parseStreamJSON(_ context.Context, stdout io.ReadCloser, handler message.St
 							}
 						}
 					}
+
+					// Close any open message from the streaming phase.
+					// stream_event text_deltas set messageStarted=true but
+					// nothing resets it when the turn ends — the assistant
+					// message marks the turn boundary, so we must close
+					// the message here to keep state in sync with the
+					// stream handler (which already sent message_end).
+					if handler != nil {
+						if toolBlockActive {
+							handler(message.ChunkMessageEnd, nil)
+							toolBlockActive = false
+						}
+						if messageStarted {
+							handler(message.ChunkMessageEnd, nil)
+							messageStarted = false
+						}
+					}
 				}
 			}