Fix bundled node permissions

[bcotrim]

Related issues

• Fixes STU-1253

Proposed Changes

• Add custom entitlements for the bundled Node.js binary to fix SIGTRAP crashes on Intel Macs

Root Cause

When electron-forge signs the app, it re-signs the bundled Node binary with Electron's default entitlements. These entitlements are missing critical permissions that Node.js/V8 requires for JIT compilation:

Entitlement	Official Node	Bundled (before)	Bundled (after)
cs.allow-jit	✅	✅	✅
cs.allow-unsigned-executable-memory	✅	❌	✅
cs.disable-executable-page-protection	✅	❌	✅
cs.disable-library-validation	✅	❌	✅

Without these entitlements, V8's baseline compiler crashes when trying to allocate executable memory:

Fatal error in , line 0
Check failed: 12 == (*__error()).  // ENOMEM

The Fix

• Created entitlements/node.plist with the required V8/JIT entitlements
• Updated forge.config.ts to use optionsForFile to apply these entitlements specifically to bin/node during code signing

Testing Instructions

1. Download the Intel (x64) build from CI
2. Install and run Studio
3. Create or start a site - it should work without crashing

To verify the fix is applied:

codesign -d --entitlements - /Applications/Studio.app/Contents/Resources/bin/node

Should show:

• com.apple.security.cs.allow-jit
• com.apple.security.cs.allow-unsigned-executable-memory
• com.apple.security.cs.disable-executable-page-protection
• com.apple.security.cs.disable-library-validation

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[fredrikekelund]

I confirm that this fixes the issue: the bundled node runtime now spawns as expected in the macOS Intel build.

[wpmobilebot]

📊 Performance Test Results

Comparing b920a90 vs trunk

site-editor

Metric	trunk	b920a90	Diff	Change
load	2875.00 ms	2888.00 ms	+13.00 ms	🔴 0.5%

site-startup

Metric	trunk	b920a90	Diff	Change
siteCreation	7077.00 ms	7070.00 ms	-7.00 ms	🟢 -0.1%
siteStartup	3935.00 ms	3918.00 ms	-17.00 ms	🟢 -0.4%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change