tests

scripts/install.sh

@@ -109,31 +109,16 @@ if [[ "$PLATFORM" == "darwin" ]]; then
 
   # The binary extracts .bare addons to a content-addressed dir:
   #   $TMPDIR/holesail-browser-host-<sha256>/node_modules/...
-  # Addons can be extracted on first use (e.g. bare-pipe when a stream is used),
-  # so we run the binary long enough to allow the module graph to load, then
-  # run again briefly and sign again to catch any addons extracted on second run.
+  # Run with --extract-addons so the host loads every native addon (tt-native,
+  # bare-pipe, etc.) and the runtime extracts them; then we sign all of them.
+  # This guarantees the user never sees "Apple could not verify ... is free of malware".
   BIN_NAME="$(basename "$HOST_BIN")"
   BARE_TMPDIR="${TMPDIR:-/tmp}"
 
-  echo "  Pre-extracting native addons (run 1)..."
-  "$HOST_BIN" >/dev/null 2>&1 &
-  BGPID=$!
-  sleep 15
-  kill $BGPID 2>/dev/null || true
-  pkill -P $BGPID 2>/dev/null || true
-  wait $BGPID 2>/dev/null || true
-  pkill -f "holesail-browser-host$" 2>/dev/null || true
+  echo "  Extracting native addons (--extract-addons)..."
+  "$HOST_BIN" --extract-addons 2>/dev/null || true
   sleep 2
 
-  echo "  Pre-extracting native addons (run 2, catch lazy-loaded addons)..."
-  "$HOST_BIN" >/dev/null 2>&1 &
-  BGPID=$!
-  sleep 8
-  kill $BGPID 2>/dev/null || true
-  pkill -P $BGPID 2>/dev/null || true
-  wait $BGPID 2>/dev/null || true
-  pkill -f "holesail-browser-host$" 2>/dev/null || true
-
   # Sign all .bare and .dylib files in every extraction dir for this binary
   SIGNED=0
   for d in "$BARE_TMPDIR"/${BIN_NAME}-*/; do