update makefile

ober

3202239378c2feb13eae8bf53c321c0a84d99857

diff --git a/Makefile b/Makefile
index e9e4f0c..59eaaf5 100644
--- a/Makefile
+++ b/Makefile
@@ -114,7 +114,7 @@ PODMAN ?= podman
         jerboa-native-host vendor-staged-libs check-vendor-staged-libs-fresh jerboa-yubikey-lib check-yubikey-lib-fresh \
         yubikey-native-linux-amd64 yubikey-native-linux-arm64 vendor-deps vendor-deps-linux vendor-native-rs vendor-native-rs-pruned \
         check-android-host jsh-android jsh-android-native jsh-android-cross jsh-android-minimal jsh-android-full android \
-        musl gen-embed embed-crypto gen-certs verify-harden install install-binary install-shims install-hooks learn-codex-shim \
+        musl gen-embed embed-crypto gen-certs verify-harden install install-binary install-shims install-extras install-hooks learn-codex-shim \
         upload-macos-libs check-platforms run security test test-binary test-native test-mux test-mux-screen test-mux-tcp test-security-policy \
         test-native-sanitize test-security-regressions adversarial-corpus audit \
         sbom reproducibility-report timing-evidence verify release-evidence \
@@ -217,6 +217,7 @@ extras: configure
 	  *) echo "Unsupported platform: $$(uname -s)" >&2; exit 1 ;; \
 	esac; \
 	cp -f "$(JERBOA_SHELL_EXTRAS_DIR)/$$extras_bin" "$(CURDIR)/jsh-extras"; \
+	[ "$$(uname -s)" = "Darwin" ] && codesign --force --sign - "$(CURDIR)/jsh-extras" 2>/dev/null || true; \
 	echo "=== Extras shell ready: $(CURDIR)/jsh-extras ==="; \
 	echo "=== JSH_EMBED: $$embed_path ==="
 
@@ -774,7 +775,7 @@ upload-macos-libs:
 PREFIX ?= $(HOME)/.local
 SHIM_DIR ?= $(HOME)/.jsh/shims
 
-install: install-binary install-shims
+install: install-binary install-shims install-extras
 
 install-binary: $(if $(JSH_BIN),,jsh)
 	@set -e; \
@@ -799,6 +800,17 @@ install-binary: $(if $(JSH_BIN),,jsh)
 	install -m 755 "$$bin" "$(PREFIX)/bin/jsh"; \
 	echo "installed $$bin -> $(PREFIX)/bin/jsh"
 
+install-extras:
+	@set -e; \
+	if [ ! -x "jsh-extras" ]; then \
+	  echo "jsh-extras not built -- run 'make extras' first" >&2; \
+	  exit 1; \
+	fi; \
+	mkdir -p "$(PREFIX)/bin"; \
+	printf '#!/bin/sh\nexec "%s" "$$@"\n' "$(abspath jsh-extras)" > "$(PREFIX)/bin/jsh-extras"; \
+	chmod 755 "$(PREFIX)/bin/jsh-extras"; \
+	echo "installed jsh-extras wrapper -> $(PREFIX)/bin/jsh-extras"
+
 install-shims:
 	@set -e; \
 	mkdir -p "$(SHIM_DIR)"; \
@@ -1054,6 +1066,7 @@ help:
 	@echo "Install:"
 	@echo "  make install          Build/install jsh + shims"
 	@echo "  make install-binary   Install just the platform-native jsh binary"
+	@echo "  make install-extras   Install jsh-extras wrapper for ~/.local/bin/jsh-extras"
 	@echo "  make install-shims    Install shims into ~/.jsh/shims"
 	@echo ""
 	@echo "Other:"