tenant.openagents/omega

diff --git a/script/bundle-omega-rc b/script/bundle-omega-rc
index 15d0187931..87fa9f0f8c 100755
--- a/script/bundle-omega-rc
+++ b/script/bundle-omega-rc
@@ -1372,7 +1372,36 @@ PACKAGED_BINDINGS_JSON="$(collect_staged_packaged_bindings_json "${dmg_source_di
13721372 
13731373 echo "Creating DMG ${DMG_PATH}"
13741374 rm -f "${DMG_PATH}"
1375-hdiutil create -volname "${OMEGA_VOLUME_NAME}" -srcfolder "${dmg_source_directory}" -ov -format UDZO "${DMG_PATH}"
1375+
1376+# `hdiutil create -srcfolder` mounts its staging volume under /Volumes and
1377+# copies there. On this host that copy began failing with
1378+#
1379+#   could not access /Volumes/Omega RC/Omega.app - Operation not permitted
1380+#
1381+# after 0.2.0-rc16 had built the same way from the same directory. The source
1382+# tree is readable, carries no special flags, and /Volumes holds no stale
1383+# mount; the refusal is on the destination, which is the shape of a privacy
1384+# restriction on mounted volumes rather than anything about the artifact.
1385+#
1386+# A release must not depend on whether this machine will let a tool write
1387+# under /Volumes, so the image is built at a mountpoint we choose. Same
1388+# contents, same compressed format, no /Volumes involvement.
1389+dmg_scratch_image="${OUTPUT_DIR}/.dmg-scratch.dmg"
1390+dmg_scratch_mount="${OUTPUT_DIR}/.dmg-mnt"
1391+rm -f "${dmg_scratch_image}"
1392+rm -rf "${dmg_scratch_mount}"
1393+mkdir -p "${dmg_scratch_mount}"
1394+
1395+dmg_staged_megabytes="$(du -sm "${dmg_source_directory}" | cut -f1)"
1396+hdiutil create -size "$(( dmg_staged_megabytes + 120 ))m" -fs HFS+ \
1397+  -volname "${OMEGA_VOLUME_NAME}" -layout NONE "${dmg_scratch_image}" >/dev/null
1398+hdiutil attach "${dmg_scratch_image}" -nobrowse -quiet -mountpoint "${dmg_scratch_mount}"
1399+cp -R "${dmg_source_directory}/." "${dmg_scratch_mount}/"
1400+hdiutil detach "${dmg_scratch_mount}" -quiet
1401+hdiutil convert "${dmg_scratch_image}" -format UDZO -o "${DMG_PATH}" >/dev/null
1402+rm -f "${dmg_scratch_image}"
1403+rmdir "${dmg_scratch_mount}" 2>/dev/null || true
1404+
13761405 rm -f "${dmg_source_directory}/Applications"
13771406 
13781407 /usr/bin/codesign --deep --force --timestamp --options runtime \