From b16096acf53630b766154024c3024dbb1e2979e8 Mon Sep 17 00:00:00 2001
From: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Date: Thu, 22 Oct 2026 21:27:41 +0800
Subject: [PATCH] build(macos): Add hardened-runtime entitlements for the
 plugin JIT

Signed builds run under the hardened runtime, where wasmtime needs JIT
and unsigned executable memory to compile plugins. Also set the minimum
macOS version to 11.0.

Claude-Session: https://claude.ai/code/session_01B65qLEKnkeYTGdbwhLpjCu
---
 src-tauri/Entitlements.plist | 11 +++++++++++
 src-tauri/tauri.conf.json    |  6 +++++-
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 src-tauri/Entitlements.plist

diff --git a/src-tauri/Entitlements.plist b/src-tauri/Entitlements.plist
new file mode 100644
index 000000000..27873b1cb
--- /dev/null
+++ b/src-tauri/Entitlements.plist
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <!-- wasmtime (plugin host) compiles WebAssembly to native code at runtime. -->
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+</dict>
+</plist>
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 90acc15ae..308e552a3 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -47,7 +47,11 @@
     "license": "Apache-2.0",
     "licenseFile": "../LICENSE",
     "shortDescription": "An open-source IDE inspired by IntelliJ IDEA",
-    "longDescription": "OpenIDEA is an open-source IDE inspired by IntelliJ IDEA. Not affiliated with JetBrains."
+    "longDescription": "OpenIDEA is an open-source IDE inspired by IntelliJ IDEA. Not affiliated with JetBrains.",
+    "macOS": {
+      "entitlements": "./Entitlements.plist",
+      "minimumSystemVersion": "11.0"
+    }
   },
   "mainBinaryName": "openidea",
   "plugins": {