Harden macOS publication broker installation

[s-hiraoku]

Summary

• normalize the installer PATH and umask after validating the pinned toolchain
• add an explicit, validated npm path with deterministic Node-sibling fallback
• require a protocol-valid scheduler socket response before installation succeeds and roll back on readiness failure
• add regression tests and update operator documentation

Verification

• npm test (54 files, 796 passed, 1 skipped)
• npm run typecheck
• npm run build
• npm run check:dist
• npm run audit:production
• sh -n scripts/install-macos-publication-broker.sh
• node --check scripts/macos/wait-for-unix-socket.mjs

Closes #420

[coderabbitai]

Warning

Review limit reached

Next included review available in 51 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: kaizen-agents-org/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 35c2f080-9015-4b1d-94b6-32883718730b

📥 Commits

Reviewing files that changed from the base of the PR and between 497eed3 and 54ac8c8.

📒 Files selected for processing (6)

• README.md
• docs/16-macos-publication-broker.md
• scripts/install-macos-publication-broker.sh
• scripts/macos/wait-for-unix-socket.mjs
• test/macos-publication-broker.test.ts
• test/wait-for-unix-socket.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[s-hiraoku]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54ac8c89a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".