fix(ca): use .command file opened in Terminal to get sudo password prompt

Made-with: Cursor

extension/dashboard.html

@@ -1498,7 +1498,7 @@
         This installs the Holesail root certificate authority into your system keychain, so Chrome trusts HTTPS for all <code style="font-family:'JetBrains Mono',monospace;font-size:11px;color:var(--cyan);">*.hole.sail</code> virtual host domains.
       </p>
       <p class="modal-desc" style="color:var(--amber);">
-        You will be prompted for your administrator password. This is required to add the certificate to the system trust store.
+        A Terminal window will open and ask for your password. Enter it and wait for the success message, then close the Terminal window.
       </p>
       <p class="modal-desc" style="color:var(--fg-muted);font-size:11px;">
         After installing, fully quit and reopen Chrome (Cmd+Q) for the trust to take effect.

native-host/certificate-authority.js

@@ -173,27 +173,69 @@ function installRootCA(callback) {
     }
 
     function addToSystemKeychain(done) {
-      // The native host runs as a background daemon (spawned by Chrome) with no
-      // GUI session, so osascript "with administrator privileges" silently fails.
-      // Fix: use `launchctl asuser <uid> osascript` to run in the user's GUI
-      // session — this correctly shows the macOS password dialog.
-      const uid = process.getuid ? process.getuid() : 0;
-      const inner = `security add-trusted-cert -d -r trustRoot -k ${systemKeychain} ${caPath}`;
-      const appleScript = `do shell script "${inner.replace(/"/g, '\\"')}" with administrator privileges`;
-      const command = `launchctl asuser ${uid} osascript -e '${appleScript.replace(/'/g, "'\"'\"'")}'`;
-      runCommand(command, (err, _stdout, stderr) => {
-        if (!err) {
-          logInfo('CA', 'Root CA installed to System keychain (trusted by all apps including Chrome).');
-          done(null);
+      // The native host is a background daemon with no GUI session.
+      // osascript "with administrator privileges" and launchctl asuser both
+      // fail without root. Solution: write a .command file and open it with
+      // `open` — macOS launches it in Terminal.app inside the user's GUI
+      // session, which can show the sudo password prompt. Poll a flag file
+      // to know when it completes.
+      const home = process.env.HOME || '';
+      const tmpCmd = path.join(home, '.holesail-install-ca.command');
+      const tmpDone = path.join(home, '.holesail-ca-done');
+      const tmpErr = path.join(home, '.holesail-ca-err');
+
+      try { fs.unlinkSync(tmpDone); } catch (_) {}
+      try { fs.unlinkSync(tmpErr); } catch (_) {}
+
+      const script = [
+        '#!/bin/bash',
+        `sudo security add-trusted-cert -d -r trustRoot -k "${systemKeychain}" "${caPath}"`,
+        'if [ $? -eq 0 ]; then',
+        `  echo ok > "${tmpDone}"`,
+        '  echo ""',
+        '  echo "Holesail Browser CA installed successfully. You can close this window."',
+        'else',
+        `  echo fail > "${tmpErr}"`,
+        '  echo ""',
+        '  echo "Installation failed. Please try again."',
+        'fi',
+        'sleep 3',
+        `rm -f "${tmpCmd}"`,
+      ].join('\n');
+
+      try {
+        fs.writeFileSync(tmpCmd, script, { mode: 0o755 });
+      } catch (e) {
+        done(new Error('Could not write install script: ' + e.message));
+        return;
+      }
+
+      runCommand(`open "${tmpCmd}"`, (errOpen) => {
+        if (errOpen) {
+          try { fs.unlinkSync(tmpCmd); } catch (_) {}
+          done(new Error('Could not open Terminal to install CA: ' + errOpen.message));
           return;
         }
-        const msg = (stderr || err.message || '').trim();
-        logError('CA', 'launchctl osascript failed: ' + msg);
-        if (msg.includes('cancelled') || msg.includes('cancel') || msg.includes('-128')) {
-          done(new Error('Installation cancelled.'));
-        } else {
-          done(new Error('Could not install CA: ' + msg));
-        }
+
+        // Poll for completion flag (up to 120s for user to enter password)
+        let waited = 0;
+        const interval = setInterval(() => {
+          waited += 1000;
+          if (fs.existsSync(tmpDone)) {
+            clearInterval(interval);
+            try { fs.unlinkSync(tmpDone); } catch (_) {}
+            logInfo('CA', 'Root CA installed to System keychain.');
+            done(null);
+          } else if (fs.existsSync(tmpErr)) {
+            clearInterval(interval);
+            try { fs.unlinkSync(tmpErr); } catch (_) {}
+            done(new Error('CA installation failed. Make sure you entered the correct password.'));
+          } else if (waited >= 120000) {
+            clearInterval(interval);
+            try { fs.unlinkSync(tmpCmd); } catch (_) {}
+            done(new Error('Timed out waiting for CA installation.'));
+          }
+        }, 1000);
       });
     }