fix

CHANGELOG.md

@@ -26,6 +26,7 @@ All notable changes to Holesail Browser are documented here.
 - Fixed tt-native not available on Windows (SSH PTY disabled): use forward-slash addon resolution key for all platforms (including win32) so the runtime finds the addon when the bundle normalizes paths; Windows prebuild is still written under both forward and backslash keys for compatibility.
 - Fixed "Unexpected end of JSON input" on Windows when running the native host exe: write all path variants for every .json in the bundle (forward slash, backslash, with/without leading slash) so bundle.read() returns content regardless of how the runtime normalizes keys; refill empty or invalid JSON from disk or alternate key before writing variants.
 - macOS: installer creates a launcher script (`run-holesail-browser-host.sh`) that sets `TMPDIR` before exec, extracts addons to `<binary-dir>/tmp`, signs all addons, then re-signs the main binary with `com.apple.security.cs.disable-library-validation` so it can load ad-hoc signed `.bare` addons on macOS 15+ and 26+ (Tahoe). Manifest points to the launcher. README one-liner updated to include the entitlement for manual fix.
+- macOS installer: sign main binary with entitlement **before** running `--extract-addons` so the process is not killed (SIGKILL 9) when loading addons. Use `/usr/bin/xattr` for quarantine removal so the system xattr is used when a different `xattr` is in PATH.
 - Fixed `ReferenceError` for undeclared `regenerated` variable in `certificate-authority.js` on Windows
 - Added `hs.removeAllListeners()` in error paths of `setVirtualHost` and `startServiceTunnel` to prevent stale listener leaks
 - Cleared `reconnectTimer` when replacing an existing virtual host or service tunnel entry

README.md

@@ -148,14 +148,15 @@ On macOS 15+ and 26+ (Tahoe), the main binary must have the `com.apple.security.
 REAL_BIN=$(find ~/.holesail-browser -name holesail-browser-host -type f | head -1)
 HOST_DIR=$(dirname "$REAL_BIN")
 ADDON_TMP="${HOST_DIR}/tmp"
-xattr -rd com.apple.quarantine ~/.holesail-browser
+/usr/bin/xattr -rd com.apple.quarantine ~/.holesail-browser 2>/dev/null || true
+# Sign main binary FIRST so --extract-addons is not killed (SIGKILL 9)
+printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>' '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">' '<plist version="1.0"><dict><key>com.apple.security.cs.disable-library-validation</key><true/></dict></plist>' > "${HOST_DIR}/entitlements.plist"
+codesign --force --sign - --entitlements "${HOST_DIR}/entitlements.plist" "$REAL_BIN"
 mkdir -p "$ADDON_TMP"
 export TMPDIR="$ADDON_TMP"
 "$REAL_BIN" --extract-addons 2>/dev/null
 sleep 2
 find "$ADDON_TMP" -type f \( -name "*.bare" -o -name "*.dylib" \) -exec codesign --force --sign - {} \; 2>/dev/null
-printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>' '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">' '<plist version="1.0"><dict><key>com.apple.security.cs.disable-library-validation</key><true/></dict></plist>' > "${HOST_DIR}/entitlements.plist"
-codesign --force --sign - --entitlements "${HOST_DIR}/entitlements.plist" "$REAL_BIN"
 ```
 
 **`Access to the specified native messaging host is forbidden`**

scripts/install.sh

@@ -96,17 +96,25 @@ if [[ "$HAD_PREVIOUS" == "true" ]]; then
 fi
 rm -rf "$STASH_DIR"
 
-# On macOS: launcher sets TMPDIR before exec; extract addons, sign them, then sign
-# main binary with disable-library-validation so it can load ad-hoc signed addons (15+/26+).
+# On macOS: launcher sets TMPDIR before exec; sign main binary with entitlement
+# FIRST so it can load (unsigned) addons during --extract-addons without being killed (SIGKILL 9).
+# Then extract addons, sign them.
 if [[ "$PLATFORM" == "darwin" ]]; then
   echo "  Clearing quarantine and signing..."
 
-  xattr -rd com.apple.quarantine "$INSTALL_DIR" 2>/dev/null || true
+  # Use system xattr (Apple's supports -r); other xattr in PATH may not
+  /usr/bin/xattr -rd com.apple.quarantine "$INSTALL_DIR" 2>/dev/null || true
 
   HOST_DIR="$(dirname "$HOST_BIN")"
   ADDON_TMPDIR="${HOST_DIR}/tmp"
   mkdir -p "$ADDON_TMPDIR"
 
+  # Sign main binary with entitlement BEFORE running it, so loading addons during
+  # --extract-addons doesn't get killed (macOS kills processes that load unsigned libs).
+  ENTITLEMENTS_PLIST="${HOST_DIR}/entitlements.plist"
+  printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>' '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">' '<plist version="1.0"><dict><key>com.apple.security.cs.disable-library-validation</key><true/></dict></plist>' > "$ENTITLEMENTS_PLIST"
+  codesign --force --sign - --entitlements "$ENTITLEMENTS_PLIST" "$HOST_BIN" 2>/dev/null || true
+
   # Launcher sets TMPDIR before exec so addons always extract to the same dir
   LAUNCHER="${HOST_DIR}/run-holesail-browser-host.sh"
   printf '%s\n' '#!/bin/bash' 'DIR="$(cd "$(dirname "$0")" && pwd)"' 'export TMPDIR="${DIR}/tmp"' 'exec "${DIR}/holesail-browser-host" "$@"' > "$LAUNCHER"
@@ -118,17 +126,12 @@ if [[ "$PLATFORM" == "darwin" ]]; then
 
   SIGNED=0
   if [[ -d "$ADDON_TMPDIR" ]]; then
-    xattr -rd com.apple.quarantine "$ADDON_TMPDIR" 2>/dev/null || true
+    /usr/bin/xattr -rd com.apple.quarantine "$ADDON_TMPDIR" 2>/dev/null || true
     while IFS= read -r -d '' f; do
       codesign --force --sign - "$f" 2>/dev/null && SIGNED=$((SIGNED + 1)) || true
     done < <(find "$ADDON_TMPDIR" \( -name "*.bare" -o -name "*.dylib" \) -print0 2>/dev/null)
   fi
 
-  # Re-sign main binary with entitlement so it can load ad-hoc signed addons (macOS 15+/26+)
-  ENTITLEMENTS_PLIST="${HOST_DIR}/entitlements.plist"
-  printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>' '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">' '<plist version="1.0"><dict><key>com.apple.security.cs.disable-library-validation</key><true/></dict></plist>' > "$ENTITLEMENTS_PLIST"
-  codesign --force --sign - --entitlements "$ENTITLEMENTS_PLIST" "$HOST_BIN" 2>/dev/null || true
-
   echo "  Signed ${SIGNED} native addons; main binary has library-validation disabled"
   HOST_BIN="$LAUNCHER"
 fi