release: sign + notarize the `agents` binary so EDR (CrowdStrike Falcon) stops blocking it

[muqsitnawaz]

Problem

CrowdStrike Falcon (macOS endpoint security) is blocking agents sessions execution on at least one user machine. The silent block also surfaces inside editor extensions that read sessions in-process and shell out to the agents binary for related calls. Anyone on an EDR-enabled Mac effectively loses the sessions feature.

Root cause

The combination of behaviors below makes the agents CLI look like ransomware/recon malware to Falcon's behavioral IOA engine:

A. The binary is unsigned.

$ codesign -dv $(which agents)
~/.local/bin/agents: code object is not signed at all

It's a Node.js shebang script in a user-writable path. When spawned by an Electron child (Code Helper (Renderer) / Code Helper (Plugin)) it matches the post-exploitation profile Falcon flags by default.

B. Whole-system process enumeration on --active.
src/commands/sessions/active.ts:383 runs ps -A -o pid=,ppid=,comm= — listing every process is a high-fidelity ransomware-recon TTP.

C. Parallel per-PID lsof probes.
src/commands/sessions/active.ts:425 calls execFileAsync('lsof', ['-a', '-p', pid, '-d', 'cwd', '-Fn']) under Promise.all() for every unattributed agent PID — lateral-movement / credential-staging heuristic.

D. Rapid bulk reads across multiple dotfile dirs.
src/lib/session/discover.ts:147-163 scans ~/.claude/, ~/.codex/, ~/.gemini/ simultaneously under Promise.all() — ransomware file-enumeration heuristic.

E. Base64-decoded credential at runtime.
src/lib/session/discover.ts:577 parses ~/.codex/auth.json's JWT payload — credential-harvesting IOA.

The dominant trigger is A (unsigned + Electron-child parent). Fixing A alone likely clears the block for most users; C/D/E are hardening.

Mitigations (priority order)

1. Sign + notarize the released binary (Developer ID + notarytool) — primary fix.
2. Gate the lsof / ps fan-out behind a flag or sequentialize it.
3. Avoid simultaneous bulk dotfile scans; stagger or read lazily.
4. Defer the auth.json JWT decode until the value is actually needed.

[muqsitnawaz]

Status update — the pure-TypeScript EDR-hardening mitigations (2-4) are already implemented on main:

• Mitigation 2 (whole-system process enumeration + parallel per-PID lsof): src/lib/session/active.ts shells out to lsof only for candidate PIDs, not the whole table (active.ts:590-596), via bounded + staggered probes — resolveCwds uses mapBounded({ concurrency: LSOF_CONCURRENCY, staggerMs: LSOF_STAGGER_MS }) (active.ts:516-520, 599-604). Landed in cf00830 (perf(sessions): bound + stagger the per-PID lsof fan-out).
• Mitigation 3 (simultaneous bulk dotfile scans): the multi-dotfile scan is bounded + staggered via mapBounded instead of a single Promise.all (discover.ts:31,171,199).
• Mitigation 4 (eager auth.json JWT decode): the Codex auth.json JWT decode is now lazy + memoized — decodeJwtEmail/getCodexAccount only run when the account is actually read, with decode/resolve counters as test seams (discover.ts:666-697,728-745). Both landed in d3b6d3f (perf(sessions): stagger dotfile scans + defer the Codex auth.json JWT decode).

Remaining: mitigation 1 — sign + notarize the released binary (Developer ID + notarytool), the primary fix. Gated on an Apple Developer ID signing cert + notarytool credentials, not available to the autonomous/Linux build path. Leaving this issue open to track the signing work.