fix(ca): use launchctl asuser to show password dialog from background daemon

Made-with: Cursor

native-host/certificate-authority.js

@@ -173,27 +173,22 @@ function installRootCA(callback) {
     }
 
     function addToSystemKeychain(done) {
-      // osascript "with administrator privileges" only works when launched from a .scpt file,
-      // not when passed inline via -e from a background process (no GUI session context).
-      // Write the AppleScript to a temp file and run it — this correctly shows the macOS
-      // password dialog even when called from a background native messaging host.
-      const tmpScpt = '/tmp/holesail-install-ca.scpt';
-      const scriptContent = `do shell script "security add-trusted-cert -d -r trustRoot -k ${systemKeychain} ${caPath}" with administrator privileges`;
-      try {
-        fs.writeFileSync(tmpScpt, scriptContent);
-      } catch (e) {
-        done(new Error('Could not write temp script: ' + e.message));
-        return;
-      }
-      runCommand(`osascript "${tmpScpt}"`, (err, _stdout, stderr) => {
-        try { fs.unlinkSync(tmpScpt); } catch (_) {}
+      // The native host runs as a background daemon (spawned by Chrome) with no
+      // GUI session, so osascript "with administrator privileges" silently fails.
+      // Fix: use `launchctl asuser <uid> osascript` to run in the user's GUI
+      // session — this correctly shows the macOS password dialog.
+      const uid = process.getuid ? process.getuid() : 0;
+      const inner = `security add-trusted-cert -d -r trustRoot -k ${systemKeychain} ${caPath}`;
+      const appleScript = `do shell script "${inner.replace(/"/g, '\\"')}" with administrator privileges`;
+      const command = `launchctl asuser ${uid} osascript -e '${appleScript.replace(/'/g, "'\"'\"'")}'`;
+      runCommand(command, (err, _stdout, stderr) => {
         if (!err) {
           logInfo('CA', 'Root CA installed to System keychain (trusted by all apps including Chrome).');
           done(null);
           return;
         }
         const msg = (stderr || err.message || '').trim();
-        logError('CA', 'osascript install failed: ' + msg);
+        logError('CA', 'launchctl osascript failed: ' + msg);
         if (msg.includes('cancelled') || msg.includes('cancel') || msg.includes('-128')) {
           done(new Error('Installation cancelled.'));
         } else {