fix(install): reliably wait for addon extraction before signing on macOS

Made-with: Cursor

scripts/install.sh

@@ -86,21 +86,30 @@ if [[ "$PLATFORM" == "darwin" ]]; then
   BIN_NAME="$(basename "$HOST_BIN")"
   BARE_TMPDIR="${TMPDIR:-/tmp}"
 
-  echo "  Pre-extracting native addons (2s)..."
-  "$HOST_BIN" >/dev/null 2>&1 &
+  echo "  Pre-extracting native addons..."
+  ("$HOST_BIN" >/dev/null 2>&1; true) &
   BGPID=$!
-  sleep 2
+
+  # Wait up to 10s for addons to be extracted
+  for i in $(seq 1 10); do
+    COUNT=$(find "$BARE_TMPDIR" -maxdepth 4 -name "*.bare" 2>/dev/null | grep -c "${BIN_NAME}" || true)
+    [[ "$COUNT" -gt 5 ]] && break
+    sleep 1
+  done
+  sleep 1
+
   kill $BGPID 2>/dev/null || true
   wait $BGPID 2>/dev/null || true
 
-  # Sign everything in all matching extraction dirs
+  # Sign all .bare and .dylib files in every extraction dir for this binary
   SIGNED=0
-  while IFS= read -r -d '' d; do
+  for d in "$BARE_TMPDIR"/${BIN_NAME}-*/; do
+    [[ -d "$d" ]] || continue
     xattr -rd com.apple.quarantine "$d" 2>/dev/null || true
     while IFS= read -r -d '' f; do
-      codesign --force --sign - "$f" 2>/dev/null && SIGNED=$((SIGNED + 1))
+      codesign --force --sign - "$f" 2>/dev/null && SIGNED=$((SIGNED + 1)) || true
     done < <(find "$d" \( -name "*.bare" -o -name "*.dylib" \) -print0 2>/dev/null)
-  done < <(find "$BARE_TMPDIR" -maxdepth 2 -type d -name "${BIN_NAME}-*" -print0 2>/dev/null)
+  done
 
   echo "  Signed ${SIGNED} native addons — Gatekeeper will not block the binary"
 fi