tests

CHANGELOG.md

@@ -25,7 +25,7 @@ All notable changes to Holesail Browser are documented here.
 - Fixed tt-native not available on Linux (SSH PTY disabled): build script now sets a host-specific addon resolution map so each platform binary loads the correct tt-native prebuild instead of the first host’s (darwin-arm64).
 - Fixed tt-native not available on Windows (SSH PTY disabled): use forward-slash addon resolution key for all platforms (including win32) so the runtime finds the addon when the bundle normalizes paths; Windows prebuild is still written under both forward and backslash keys for compatibility.
 - Fixed "Unexpected end of JSON input" on Windows when running the native host exe: write all path variants for every .json in the bundle (forward slash, backslash, with/without leading slash) so bundle.read() returns content regardless of how the runtime normalizes keys; refill empty or invalid JSON from disk or alternate key before writing variants.
-- macOS: installer now pre-runs the native host twice (15s + 8s) so lazy-loaded native addons (e.g. bare-pipe.bare) are extracted and ad-hoc signed, preventing "Apple could not verify ... is free of malware" for addons that load on first use. README documents a one-liner to sign existing extracted addons if the warning appears after install.
+- macOS: native host supports `--extract-addons`; installer runs it once so every native addon (tt-native, bare-pipe, bare-module-lexer) is extracted and ad-hoc signed before first use. Users should never see "Apple could not verify ... is free of malware." README documents a manual one-liner using `--extract-addons` if the warning appears.
 - Fixed `ReferenceError` for undeclared `regenerated` variable in `certificate-authority.js` on Windows
 - Added `hs.removeAllListeners()` in error paths of `setVirtualHost` and `startServiceTunnel` to prevent stale listener leaks
 - Cleared `reconnectTimer` when replacing an existing virtual host or service tunnel entry

README.md

@@ -142,16 +142,19 @@ The native host has no active tunnel for that hostname. Possible causes:
 
 **macOS: "Apple cannot verify..." / Gatekeeper warning (e.g. bare-pipe.bare)**
 
-Run the installer again — it now pre-runs the binary twice and ad-hoc signs all extracted native addons (including lazy-loaded ones like bare-pipe). If you moved the binary manually or see the warning for a specific addon after installing, run:
+Run the installer again — it runs the binary with `--extract-addons` so every native addon (tt-native, bare-pipe, etc.) is extracted and ad-hoc signed before you use the host; you should not see this dialog after a normal install. If you moved the binary manually or see the warning for a specific addon, run:
 
 ```bash
 # Main binary
 xattr -rd com.apple.quarantine ~/.holesail-browser
 codesign --force --sign - ~/.holesail-browser/holesail-browser-host
 
-# Sign any addons already extracted to temp (stops Gatekeeper blocking them)
+# Extract addons then sign (same as installer)
+~/.holesail-browser/holesail-browser-host --extract-addons 2>/dev/null
+sleep 2
 for d in "${TMPDIR:-/tmp}"/holesail-browser-host-*/; do
-  [[ -d "$d" ]] && xattr -rd com.apple.quarantine "$d" 2>/dev/null; \
+  [[ -d "$d" ]] || continue
+  xattr -rd com.apple.quarantine "$d" 2>/dev/null
   find "$d" -type f \( -name "*.bare" -o -name "*.dylib" \) -exec codesign --force --sign - {} \; 2>/dev/null
 done
 ```

docs/INSTALLATION.md

@@ -29,7 +29,7 @@ Or download `install.ps1` from the [latest release](https://git.ssh.surf/snxrave
 5. Downloads `holesail-browser-host-<platform>-<arch>.zip` from the latest release
 6. Extracts the binary to `~/.holesail-browser/holesail-browser-host`
 7. **Restores user data** — the preserved storage and certs directories are copied back, so all tunnels, connections, settings, and certificates survive the upgrade
-8. **macOS only:** removes Gatekeeper quarantine, ad-hoc signs the binary, pre-runs it twice to extract all `.bare` native addons (including lazy-loaded ones like bare-pipe), then signs every extracted addon so Gatekeeper does not block them.
+8. **macOS only:** removes Gatekeeper quarantine, ad-hoc signs the binary, runs it with `--extract-addons` so every `.bare` native addon (tt-native, bare-pipe, etc.) is extracted, then signs all extracted addons so the user never sees "Apple could not verify ... is free of malware."
 9. **Removes old extension files** — any existing `Holesail-Browser-*.zip` and `Holesail-Browser-*.xpi` files in `~/Downloads` are deleted before downloading the new version
 10. Downloads `Holesail-Browser-1.0.0.zip` and `Holesail-Browser-1.0.0.xpi` to `~/Downloads`
 11. Writes the native messaging manifest to all browser locations

native-host/index.mjs

@@ -5,12 +5,28 @@
  * available as a global before any other module runs.
  *
  * All imports are static so bare-pack can pre-resolve the full module graph.
+ *
+ * macOS install: when run with --extract-addons, loads every native addon
+ * (tt-native, bare-pipe, etc.) so the Bare runtime extracts them to the
+ * content-addressed temp dir; the installer then ad-hoc signs those files
+ * so the user never sees a Gatekeeper "could not verify ... is free of malware" dialog.
  */
 
 import 'bare-process/global';
 import _messenger from './host/messenger.js';
 import _host from './host/message-router.js';
 
+if (process.argv.includes('--extract-addons')) {
+  (async () => {
+    const addonPackages = ['tt-native', 'bare-pipe', 'bare-module-lexer'];
+    for (const name of addonPackages) {
+      try {
+        await import(name);
+      } catch (_) {}
+    }
+    process.exit(0);
+  })();
+} else {
 const { createMessenger } = _messenger;
 const { handleMessage, cleanup } = _host;
 
@@ -69,3 +85,4 @@ process.on('uncaughtException', (err) => {
 });
 
 logErr('ready');
+}

scripts/install.sh

@@ -109,31 +109,16 @@ if [[ "$PLATFORM" == "darwin" ]]; then
 
   # The binary extracts .bare addons to a content-addressed dir:
   #   $TMPDIR/holesail-browser-host-<sha256>/node_modules/...
-  # Addons can be extracted on first use (e.g. bare-pipe when a stream is used),
-  # so we run the binary long enough to allow the module graph to load, then
-  # run again briefly and sign again to catch any addons extracted on second run.
+  # Run with --extract-addons so the host loads every native addon (tt-native,
+  # bare-pipe, etc.) and the runtime extracts them; then we sign all of them.
+  # This guarantees the user never sees "Apple could not verify ... is free of malware".
   BIN_NAME="$(basename "$HOST_BIN")"
   BARE_TMPDIR="${TMPDIR:-/tmp}"
 
-  echo "  Pre-extracting native addons (run 1)..."
-  "$HOST_BIN" >/dev/null 2>&1 &
-  BGPID=$!
-  sleep 15
-  kill $BGPID 2>/dev/null || true
-  pkill -P $BGPID 2>/dev/null || true
-  wait $BGPID 2>/dev/null || true
-  pkill -f "holesail-browser-host$" 2>/dev/null || true
+  echo "  Extracting native addons (--extract-addons)..."
+  "$HOST_BIN" --extract-addons 2>/dev/null || true
   sleep 2
 
-  echo "  Pre-extracting native addons (run 2, catch lazy-loaded addons)..."
-  "$HOST_BIN" >/dev/null 2>&1 &
-  BGPID=$!
-  sleep 8
-  kill $BGPID 2>/dev/null || true
-  pkill -P $BGPID 2>/dev/null || true
-  wait $BGPID 2>/dev/null || true
-  pkill -f "holesail-browser-host$" 2>/dev/null || true
-
   # Sign all .bare and .dylib files in every extraction dir for this binary
   SIGNED=0
   for d in "$BARE_TMPDIR"/${BIN_NAME}-*/; do