fix(install): pre-extract and sign bare addons to prevent Gatekeeper blocking

Made-with: Cursor

scripts/install.sh

@@ -67,10 +67,33 @@ if [[ -z "$HOST_BIN" ]]; then
 fi
 chmod +x "$HOST_BIN"
 
-# Ad-hoc sign on macOS so Gatekeeper doesn't block the unsigned binary
+# On macOS: remove quarantine and ad-hoc sign so Gatekeeper doesn't block
+# the binary or the .bare native addons it extracts to /tmp at runtime.
 if [[ "$PLATFORM" == "darwin" ]]; then
-  codesign --force --sign - "$HOST_BIN" 2>/dev/null && echo "  Signed (ad-hoc)" || echo "  Warning: codesign failed (may be blocked by Gatekeeper)"
-  xattr -d com.apple.quarantine "$HOST_BIN" 2>/dev/null || true
+  echo "  Clearing quarantine and signing..."
+
+  # Remove quarantine from the entire install dir
+  xattr -rd com.apple.quarantine "$INSTALL_DIR" 2>/dev/null || true
+
+  # Ad-hoc sign the main binary
+  codesign --force --sign - "$HOST_BIN" 2>/dev/null || true
+
+  # The binary self-extracts .bare addons to a temp dir like:
+  #   /tmp/bare-<hash>/node_modules/<pkg>/prebuilds/<host>/<addon>.bare
+  # Gatekeeper checks those too. We pre-extract them by running the binary
+  # briefly so we can find and sign them, then clear quarantine on /tmp/bare-*
+  echo "  Pre-extracting addons to sign them..."
+  timeout 3 "$HOST_BIN" >/dev/null 2>&1 || true
+  # Sign and clear quarantine on all bare temp dirs
+  for d in /tmp/bare-*/; do
+    [ -d "$d" ] || continue
+    xattr -rd com.apple.quarantine "$d" 2>/dev/null || true
+    find "$d" -name "*.bare" -o -name "*.dylib" 2>/dev/null | while read -r f; do
+      codesign --force --sign - "$f" 2>/dev/null || true
+    done
+  done
+
+  echo "  Done — Gatekeeper should not block the binary"
 fi
 
 echo "  Binary: $HOST_BIN"