fix install

scripts/install.sh

@@ -98,7 +98,11 @@ if [[ "$HAD_PREVIOUS" == "true" && -d "$STASH_STORAGE" ]]; then
 fi
 rm -rf "$STASH_DIR"
 
-# On macOS: clear quarantine, ad-hoc sign, extract/sign native addons
+# On macOS: TMPDIR MUST be set in the process environment BEFORE the Bare
+# runtime starts (shell launcher), or addons extract to /var/folders and
+# Gatekeeper blocks unsigned .bare modules ("Apple could not verify…").
+# Match holesail-browser: sign binary → launcher exports TMPDIR → extract →
+# sign every .bare/.dylib → register the launcher as the native messaging path.
 if [[ "$PLATFORM" == "darwin" ]]; then
   echo "  Clearing quarantine and signing..."
   /usr/bin/xattr -rd com.apple.quarantine "$INSTALL_DIR" 2>/dev/null || true
@@ -109,16 +113,16 @@ if [[ "$PLATFORM" == "darwin" ]]; then
 
   ENTITLEMENTS_PLIST="${HOST_DIR}/entitlements.plist"
   printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>' '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">' '<plist version="1.0"><dict><key>com.apple.security.cs.disable-library-validation</key><true/></dict></plist>' > "$ENTITLEMENTS_PLIST"
+  # Sign main binary with entitlement BEFORE extract-addons so loading unsigned
+  # libs during extraction is not SIGKILL'd by library validation.
   codesign --force --sign - --entitlements "$ENTITLEMENTS_PLIST" "$HOST_BIN" 2>/dev/null || true
 
-  # Optional helper launcher (manual runs). Native messaging uses the Mach-O
-  # binary directly — set-tmpdir.mjs inside the binary pins TMPDIR for signed addons.
   LAUNCHER="${HOST_DIR}/run-bridge-swarm-host.sh"
   printf '%s\n' '#!/bin/bash' 'DIR="$(cd "$(dirname "$0")" && pwd)"' 'export TMPDIR="${DIR}/tmp"' 'export BRIDGE_SWARM_STORAGE="${BRIDGE_SWARM_STORAGE:-${DIR}/bridge-swarm-storage}"' 'exec "${DIR}/bridge-swarm-host" "$@"' > "$LAUNCHER"
   chmod +x "$LAUNCHER"
 
   echo "  Extracting native addons (--extract-addons)..."
-  TMPDIR="$ADDON_TMPDIR" "$HOST_BIN" --extract-addons 2>/dev/null || true
+  "$LAUNCHER" --extract-addons 2>/dev/null || true
   sleep 2
 
   SIGNED=0
@@ -129,20 +133,16 @@ if [[ "$PLATFORM" == "darwin" ]]; then
     done < <(find "$ADDON_TMPDIR" \( -name "*.bare" -o -name "*.dylib" \) -print0 2>/dev/null)
   fi
   echo "  Signed ${SIGNED} native addons; main binary has library-validation disabled"
-  # Keep HOST_BIN as the Mach-O binary for Chrome native messaging
+  HOST_BIN="$LAUNCHER"
 else
-  # Linux: binary path is fine; set-tmpdir is macOS-only
   HOST_DIR="$(dirname "$HOST_BIN")"
   LAUNCHER="${HOST_DIR}/run-bridge-swarm-host.sh"
   printf '%s\n' '#!/bin/bash' 'DIR="$(cd "$(dirname "$0")" && pwd)"' 'export BRIDGE_SWARM_STORAGE="${BRIDGE_SWARM_STORAGE:-${DIR}/bridge-swarm-storage}"' 'exec "${DIR}/bridge-swarm-host" "$@"' > "$LAUNCHER"
   chmod +x "$LAUNCHER"
+  HOST_BIN="$LAUNCHER"
 fi
 
-# Default storage next to install when launched by the browser
-# (bare host also honors BRIDGE_SWARM_STORAGE if set by a wrapper)
-export BRIDGE_SWARM_STORAGE="${BRIDGE_SWARM_STORAGE:-${INSTALL_DIR}/bridge-swarm-storage}"
-
-echo "  Binary: $HOST_BIN"
+echo "  Native messaging host: $HOST_BIN"
 
 # ── Extension downloads ────────────────────────────────────────────────────────
 echo "Cleaning up old extension files in Downloads..."

scripts/repair-macos-codesign.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Repair macOS Gatekeeper / "Apple could not verify … .bare" for an existing
+# ~/.bridgeswarm install. Re-signs the host + every extracted addon and points
+# Chrome native messaging at the TMPDIR-exporting launcher.
+set -euo pipefail
+
+INSTALL_DIR="${BRIDGE_SWARM_HOME:-$HOME/.bridgeswarm}"
+HOST_BIN="$INSTALL_DIR/bridge-swarm-host"
+LAUNCHER="$INSTALL_DIR/run-bridge-swarm-host.sh"
+CHROME_EXT_ID="${CHROME_EXT_ID:-jhmbaojjfkkpoolhkoohklbjokdmbdpm}"
+FIREFOX_EXT_ID="${FIREFOX_EXT_ID:-bridgeswarm[email protected]}"
+
+if [[ ! -x "$HOST_BIN" ]]; then
+  echo "No host at $HOST_BIN — run scripts/install.sh first." >&2
+  exit 1
+fi
+
+echo "Repairing BridgeSwarm macOS codesign under $INSTALL_DIR"
+
+# Remove stale system-temp extractions that trigger Gatekeeper dialogs.
+# find often exits 1 under /var/folders (permission noise) — ignore that under pipefail.
+echo "Cleaning stale system-temp addon extracts..."
+while IFS= read -r d; do
+  [[ -z "$d" ]] && continue
+  echo "  rm -rf $d"
+  rm -rf "$d" 2>/dev/null || true
+done < <(find /var/folders -maxdepth 5 -type d -name 'bridge-swarm-host-*' 2>/dev/null || true)
+
+/usr/bin/xattr -rd com.apple.quarantine "$INSTALL_DIR" 2>/dev/null || true
+mkdir -p "$INSTALL_DIR/tmp"
+
+ENTITLEMENTS_PLIST="$INSTALL_DIR/entitlements.plist"
+printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>' '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">' '<plist version="1.0"><dict><key>com.apple.security.cs.disable-library-validation</key><true/></dict></plist>' > "$ENTITLEMENTS_PLIST"
+codesign --force --sign - --entitlements "$ENTITLEMENTS_PLIST" "$HOST_BIN" || true
+
+printf '%s\n' '#!/bin/bash' 'DIR="$(cd "$(dirname "$0")" && pwd)"' 'export TMPDIR="${DIR}/tmp"' 'export BRIDGE_SWARM_STORAGE="${BRIDGE_SWARM_STORAGE:-${DIR}/bridge-swarm-storage}"' 'exec "${DIR}/bridge-swarm-host" "$@"' > "$LAUNCHER"
+chmod +x "$LAUNCHER"
+
+echo "Extracting addons into $INSTALL_DIR/tmp ..."
+"$LAUNCHER" --extract-addons 2>/dev/null || true
+sleep 2
+
+/usr/bin/xattr -rd com.apple.quarantine "$INSTALL_DIR/tmp" 2>/dev/null || true
+SIGNED=0
+while IFS= read -r -d '' f; do
+  codesign --force --sign - "$f" 2>/dev/null && SIGNED=$((SIGNED + 1)) || true
+done < <(find "$INSTALL_DIR/tmp" \( -name '*.bare' -o -name '*.dylib' \) -print0 2>/dev/null)
+echo "Signed $SIGNED native addons"
+
+MANIFEST_CHROME=$(cat <<JSON
+{
+  "name": "com.bridgeswarm",
+  "description": "BridgeSwarm native host (Bare / Hyperswarm)",
+  "path": "${LAUNCHER}",
+  "type": "stdio",
+  "allowed_origins": ["chrome-extension://${CHROME_EXT_ID}/"]
+}
+JSON
+)
+
+MANIFEST_FIREFOX=$(cat <<JSON
+{
+  "name": "com.bridgeswarm",
+  "description": "BridgeSwarm native host (Bare / Hyperswarm)",
+  "path": "${LAUNCHER}",
+  "type": "stdio",
+  "allowed_extensions": ["${FIREFOX_EXT_ID}"]
+}
+JSON
+)
+
+CHROME_DIRS=(
+  "$HOME/Library/Application Support/Google/Chrome/NativeMessagingHosts"
+  "$HOME/Library/Application Support/Chromium/NativeMessagingHosts"
+)
+FIREFOX_DIRS=(
+  "$HOME/Library/Application Support/Mozilla/NativeMessagingHosts"
+)
+
+for dir in "${CHROME_DIRS[@]}"; do
+  mkdir -p "$dir"
+  echo "$MANIFEST_CHROME" > "$dir/com.bridgeswarm.json"
+  echo "Wrote $dir/com.bridgeswarm.json"
+done
+for dir in "${FIREFOX_DIRS[@]}"; do
+  mkdir -p "$dir" 2>/dev/null || continue
+  echo "$MANIFEST_FIREFOX" > "$dir/com.bridgeswarm.json" 2>/dev/null || true
+done
+
+echo ""
+echo "Done. Quit Chrome fully (Cmd+Q) and reopen, then try the demo again."
+echo "Native messaging path: $LAUNCHER"