reVPN native service — Apple Silicon
The Swift helper targets macOS 13+, but the current bundled engine was built
with minimum macOS 26.0. This alpha therefore requires macOS 26+ as a whole.
Use an engine with a lower verified deployment target before supporting older Macs.

Build:
  npm run build:mac
  node scripts/build-macos-installer.cjs

The single full installer contains the app, a native Swift root service and
sing-box. The app also contains a component-only installer for first-run setup
when copied as an .app. No Hiddify files, control secret or executable are used.

Root service: /Library/PrivilegedHelperTools/app.revpn.helper/revpn-helper
Root engine: /Library/PrivilegedHelperTools/app.revpn.helper/sing-box
LaunchDaemon: /Library/LaunchDaemons/app.revpn.helper.plist
Socket: /var/run/app.revpn/control.sock

The installer records the logged-in desktop UID in the root-owned launchd
plist. The root-owned socket directory prevents socket replacement; the socket
is 0600 and chowned to that user. getpeereid and LOCAL_PEERPID authenticate the
local account and connection owner independently of request fields.

The service only accepts status, connect and disconnect. It reconstructs the
engine config from validated VLESS access and domain routing rules. Arbitrary
config keys, file paths, log outputs, external listeners, executables, service
hooks and environment variables are never passed through. Both engine and
helper are root-owned. The app stays unprivileged. All programs running as the
installing account can request these narrowly scoped network operations;
code-signature client authentication is not yet implemented for the unsigned
alpha. Another reVPN process cannot stop or replace a live owned connection.

Owner death is checked every second. Stop sends SIGTERM and waits for native
DNS/route cleanup. A failed stop prevents overlap. Runtime config/log are root
0600; config is deleted on stop and logs are truncated on each connection.
The service is dormant without an explicit connect, including after reboot.

Current distribution is an unsigned development build. Developer ID signing,
installer signing, notarization and clean-machine testing are required before
public release. This service uses a TUN device, not an Apple Network Extension.
Support for multiple desktop accounts needs a separate installation design.

Manual removal (administrator): stop/quit reVPN first, then bootout
system/app.revpn.helper and remove only the plist, helper directory and runtime
directory named above. Do not remove another VPN's files or network services.
