From 3e4f6fccc2c9234ed91cba0dd634fb35ed074333 Mon Sep 17 00:00:00 2001
From: Crash0v3rrid3 <jain240298@gmail.com>
Date: Wed, 19 Aug 2026 14:54:41 +0530
Subject: [PATCH 1/5] fix(cli): strip com.apple.quarantine from downloaded CLI
 binary (DEVA11Y-752)

macOS Gatekeeper kills the downloaded browserstack-cli binary with
"ASP: Security policy would not allow process" when the file carries the
com.apple.quarantine attribute. Some managed environments (MDM/security
tooling) stamp this attribute on network-written files, and their policy
removes the manual "Allow Anyway" override, making the CLI unusable
without IT intervention.

Add a guarded strip_quarantine step that removes the attribute after the
binary is extracted and made executable, in the bash/zsh/fish cli.sh
scripts. It is a no-op on non-macOS hosts and when the attribute is
absent, so unaffected users see no change. spm.sh is unchanged because
the SPM plugin path manages the binary internally and never writes a
standalone binary for the script to strip.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/bash/cli.sh | 13 ++++++++++++-
 scripts/fish/cli.sh | 13 ++++++++++++-
 scripts/zsh/cli.sh  | 13 ++++++++++++-
 3 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/scripts/bash/cli.sh b/scripts/bash/cli.sh
index 4472c07..a3d5fd8 100644
--- a/scripts/bash/cli.sh
+++ b/scripts/bash/cli.sh
@@ -179,9 +179,20 @@ script_self_update() {
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/fish/cli.sh b/scripts/fish/cli.sh
index a069b36..db3bfb1 100644
--- a/scripts/fish/cli.sh
+++ b/scripts/fish/cli.sh
@@ -191,9 +191,20 @@ script_self_update() {
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/zsh/cli.sh b/scripts/zsh/cli.sh
index 8d11b0e..edc0c80 100644
--- a/scripts/zsh/cli.sh
+++ b/scripts/zsh/cli.sh
@@ -190,9 +190,20 @@ script_self_update() {
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`

From e4f69814747e20a23c309b46d68c9c9d1fc6905a Mon Sep 17 00:00:00 2001
From: Crash0v3rrid3 <jain240298@gmail.com>
Date: Wed, 19 Aug 2026 15:05:28 +0530
Subject: [PATCH 2/5] chore(cli): regenerate cli.sh.sha256 sidecars after
 quarantine-strip edit (DEVA11Y-752)

Self-update verifies each launcher script against its committed sidecar,
so the sidecars must be regenerated whenever the script changes; the
verify-selfupdate-checksums CI gate enforces this.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/bash/cli.sh.sha256 | 2 +-
 scripts/fish/cli.sh.sha256 | 2 +-
 scripts/zsh/cli.sh.sha256  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/bash/cli.sh.sha256 b/scripts/bash/cli.sh.sha256
index f6165bd..8df11c4 100644
--- a/scripts/bash/cli.sh.sha256
+++ b/scripts/bash/cli.sh.sha256
@@ -1 +1 @@
-e233e16b32a0ec18d24acf32e8c415d26c4eeecdc287452117fe51de2f4791dc  cli.sh
+90218e86363718406766c63830bac54f4c390030df0bc702fb95b3f032843545  cli.sh
diff --git a/scripts/fish/cli.sh.sha256 b/scripts/fish/cli.sh.sha256
index 1a6478f..4226bc2 100644
--- a/scripts/fish/cli.sh.sha256
+++ b/scripts/fish/cli.sh.sha256
@@ -1 +1 @@
-332c8583f95291bf72ac4199702697656d28f5b98eba3a6a724a0272ecf77f83  cli.sh
+3e8fe00cebdcb140c4c1f8029c01e96d72cf906e681597317be60bed5e9db2a5  cli.sh
diff --git a/scripts/zsh/cli.sh.sha256 b/scripts/zsh/cli.sh.sha256
index 445f73c..0eaa0c8 100644
--- a/scripts/zsh/cli.sh.sha256
+++ b/scripts/zsh/cli.sh.sha256
@@ -1 +1 @@
-67edf6abb80741b1f723f07533448288de7652aba859499d287672e8c6c299b4  cli.sh
+713db299874844d7b2a182250864d9703a21c3a7602240ffc413ad40ee7af8e2  cli.sh

From 310d43e7f9c456212b8f0d0be4025f779564af1f Mon Sep 17 00:00:00 2001
From: Crash0v3rrid3 <jain240298@gmail.com>
Date: Wed, 19 Aug 2026 15:09:58 +0530
Subject: [PATCH 3/5] fix(spm): strip com.apple.quarantine from cached CLI
 binary (DEVA11Y-752)

Apply the same Gatekeeper workaround to the SPM launcher scripts. The
swift-package plugin caches browserstack-cli under
${XDG_CACHE_HOME:-$HOME/.cache}/browserstack/devtools/spm-plugin; strip
the quarantine attribute from any cached binary before invoking the
plugin so a previously-downloaded binary is not killed by Gatekeeper in
MDM-managed environments. Guarded to a no-op off macOS and when the
cache or attribute is absent. Sidecars regenerated for verify-sidecars.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/bash/spm.sh        | 11 +++++++++++
 scripts/bash/spm.sh.sha256 |  2 +-
 scripts/fish/spm.sh        | 11 +++++++++++
 scripts/fish/spm.sh.sha256 |  2 +-
 scripts/zsh/spm.sh         | 11 +++++++++++
 scripts/zsh/spm.sh.sha256  |  2 +-
 6 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/scripts/bash/spm.sh b/scripts/bash/spm.sh
index 387daf2..a23b411 100644
--- a/scripts/bash/spm.sh
+++ b/scripts/bash/spm.sh
@@ -131,6 +131,17 @@ EOF
   }
   trap cleanup EXIT
 
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp it on network-written files, which
+  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
+  # from any cached binary. No-op off macOS / when the cache or attr is absent.
+  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
+    cli_cache="${XDG_CACHE_HOME:-$HOME/.cache}/browserstack/devtools/spm-plugin"
+    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
+      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
+  fi
+
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi
diff --git a/scripts/bash/spm.sh.sha256 b/scripts/bash/spm.sh.sha256
index c4f9ac6..89003ad 100644
--- a/scripts/bash/spm.sh.sha256
+++ b/scripts/bash/spm.sh.sha256
@@ -1 +1 @@
-b520c458bec538505c9ff9ca75a02ec901597fd66b3c2d951b928e58e58e60da  spm.sh
+9ed408845416d97570dc5c46cd34d1d388e31319baa0e64db758c0933d3c9ce5  spm.sh
diff --git a/scripts/fish/spm.sh b/scripts/fish/spm.sh
index 2842249..7149867 100644
--- a/scripts/fish/spm.sh
+++ b/scripts/fish/spm.sh
@@ -144,6 +144,17 @@ EOF
   }
   trap cleanup EXIT
 
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp it on network-written files, which
+  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
+  # from any cached binary. No-op off macOS / when the cache or attr is absent.
+  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
+    cli_cache="${XDG_CACHE_HOME:-$HOME/.cache}/browserstack/devtools/spm-plugin"
+    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
+      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
+  fi
+
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi
diff --git a/scripts/fish/spm.sh.sha256 b/scripts/fish/spm.sh.sha256
index 7aac3c4..3f239b8 100644
--- a/scripts/fish/spm.sh.sha256
+++ b/scripts/fish/spm.sh.sha256
@@ -1 +1 @@
-982bbb10bb9bd55428208454a766384fae58c41dacabb1e5b8a74d2366f0d1e7  spm.sh
+3cb1c73b46e57e864cd9c32b1716db2b0d21a5017c6935ec822f4effeeca952c  spm.sh
diff --git a/scripts/zsh/spm.sh b/scripts/zsh/spm.sh
index 9619a0b..016bbd7 100644
--- a/scripts/zsh/spm.sh
+++ b/scripts/zsh/spm.sh
@@ -143,6 +143,17 @@ EOF
   }
   trap cleanup EXIT
 
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp it on network-written files, which
+  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
+  # from any cached binary. No-op off macOS / when the cache or attr is absent.
+  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
+    cli_cache="${XDG_CACHE_HOME:-$HOME/.cache}/browserstack/devtools/spm-plugin"
+    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
+      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
+  fi
+
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi
diff --git a/scripts/zsh/spm.sh.sha256 b/scripts/zsh/spm.sh.sha256
index 0cac838..00ff5a0 100644
--- a/scripts/zsh/spm.sh.sha256
+++ b/scripts/zsh/spm.sh.sha256
@@ -1 +1 @@
-1f28d5b3025636d9b81299032f34886f8804b1c6c95b830204325b325bd1d84f  spm.sh
+d146c03194d740728e2073392b25081df59d9fe8894ca2173409905218eb5c12  spm.sh

From 8e23091b3fa07e26d078486c65004b1f4e13d691 Mon Sep 17 00:00:00 2001
From: Crash0v3rrid3 <jain240298@gmail.com>
Date: Wed, 19 Aug 2026 15:19:18 +0530
Subject: [PATCH 4/5] fix(spm): strip quarantine from $HOME/.cache to match
 plugin's env -i (DEVA11Y-752)

The quarantine strip derived the cache dir from the outer shell's
XDG_CACHE_HOME, but the plugin is invoked under `env -i` which does not
pass XDG_CACHE_HOME through. The plugin therefore always resolves its
cache to $HOME/.cache (Plugins/.../BrowserStackAccessibilityLint.swift,
lines 57-68). Any developer with XDG_CACHE_HOME set to a custom path
would have had the strip target the wrong directory, missing the
plugin's real binary and leaving Gatekeeper to kill it.

Use $HOME/.cache unconditionally so the strip matches the plugin's
runtime environment. Sidecars regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/bash/spm.sh        | 6 +++++-
 scripts/bash/spm.sh.sha256 | 2 +-
 scripts/fish/spm.sh        | 6 +++++-
 scripts/fish/spm.sh.sha256 | 2 +-
 scripts/zsh/spm.sh         | 6 +++++-
 scripts/zsh/spm.sh.sha256  | 2 +-
 6 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/scripts/bash/spm.sh b/scripts/bash/spm.sh
index a23b411..8aaec5e 100644
--- a/scripts/bash/spm.sh
+++ b/scripts/bash/spm.sh
@@ -136,8 +136,12 @@ EOF
   # environments (MDM/security tooling) stamp it on network-written files, which
   # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
   # from any cached binary. No-op off macOS / when the cache or attr is absent.
+  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
+  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
+  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
+  # would miss the plugin's real binary when that var is set to a custom path.
   if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="${XDG_CACHE_HOME:-$HOME/.cache}/browserstack/devtools/spm-plugin"
+    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
     [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
       -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
   fi
diff --git a/scripts/bash/spm.sh.sha256 b/scripts/bash/spm.sh.sha256
index 89003ad..6293baf 100644
--- a/scripts/bash/spm.sh.sha256
+++ b/scripts/bash/spm.sh.sha256
@@ -1 +1 @@
-9ed408845416d97570dc5c46cd34d1d388e31319baa0e64db758c0933d3c9ce5  spm.sh
+0559b6ab17f8cceb44a5defe9a88b5dcd54eaa5a72e7a4f7b5fcee1f13be9be1  spm.sh
diff --git a/scripts/fish/spm.sh b/scripts/fish/spm.sh
index 7149867..c728211 100644
--- a/scripts/fish/spm.sh
+++ b/scripts/fish/spm.sh
@@ -149,8 +149,12 @@ EOF
   # environments (MDM/security tooling) stamp it on network-written files, which
   # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
   # from any cached binary. No-op off macOS / when the cache or attr is absent.
+  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
+  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
+  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
+  # would miss the plugin's real binary when that var is set to a custom path.
   if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="${XDG_CACHE_HOME:-$HOME/.cache}/browserstack/devtools/spm-plugin"
+    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
     [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
       -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
   fi
diff --git a/scripts/fish/spm.sh.sha256 b/scripts/fish/spm.sh.sha256
index 3f239b8..2c76a14 100644
--- a/scripts/fish/spm.sh.sha256
+++ b/scripts/fish/spm.sh.sha256
@@ -1 +1 @@
-3cb1c73b46e57e864cd9c32b1716db2b0d21a5017c6935ec822f4effeeca952c  spm.sh
+bfc7fbcf9b3df10c4352bc426566a605a1a14554233ed649899cb045efdb5024  spm.sh
diff --git a/scripts/zsh/spm.sh b/scripts/zsh/spm.sh
index 016bbd7..a13e618 100644
--- a/scripts/zsh/spm.sh
+++ b/scripts/zsh/spm.sh
@@ -148,8 +148,12 @@ EOF
   # environments (MDM/security tooling) stamp it on network-written files, which
   # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
   # from any cached binary. No-op off macOS / when the cache or attr is absent.
+  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
+  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
+  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
+  # would miss the plugin's real binary when that var is set to a custom path.
   if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="${XDG_CACHE_HOME:-$HOME/.cache}/browserstack/devtools/spm-plugin"
+    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
     [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
       -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
   fi
diff --git a/scripts/zsh/spm.sh.sha256 b/scripts/zsh/spm.sh.sha256
index 00ff5a0..5bd4154 100644
--- a/scripts/zsh/spm.sh.sha256
+++ b/scripts/zsh/spm.sh.sha256
@@ -1 +1 @@
-d146c03194d740728e2073392b25081df59d9fe8894ca2173409905218eb5c12  spm.sh
+e4a04d02a4bcec8a89ed3719ea6f29c3ee7fe09c846ddfe1be622d266dcac690  spm.sh

From e766aa1bf703f324fdf8ca0c16a830abc4f4855a Mon Sep 17 00:00:00 2001
From: Crash0v3rrid3 <jain240298@gmail.com>
Date: Wed, 19 Aug 2026 16:24:16 +0530
Subject: [PATCH 5/5] fix(scripts): scope quarantine-strip to cli.sh; drop
 spm.sh strip; chmod 0755 (DEVA11Y-752)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address PR review (maunilm):

- P1: remove the com.apple.quarantine strip from the three spm.sh scripts.
  The SPM plugin downloads AND execs the binary within a single
  `swift package plugin scan` invocation, so a shell-level strip before
  that call cannot cover a cold cache or a CLI version bump — the first
  run in an MDM environment would still fail. Rather than ship a partial
  mitigation that reads as full coverage, spm.sh is reverted to main; the
  plugin-side fix (strip at the download site) / notarization is tracked
  as a follow-up.

- P2b: cli.sh downloads a binary that nothing else verifies and Gatekeeper
  no longer gates, so tighten its permissions from 0775 (group-writable —
  the macOS primary group `staff` includes every local user) to 0755.

The cli.sh strip is unchanged and remains full coverage: download_binary
re-extracts and strips on every invocation, so the strip always lands
after the write. Sidecars regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/bash/cli.sh        |  2 +-
 scripts/bash/cli.sh.sha256 |  2 +-
 scripts/bash/spm.sh        | 15 ---------------
 scripts/bash/spm.sh.sha256 |  2 +-
 scripts/fish/cli.sh        |  2 +-
 scripts/fish/cli.sh.sha256 |  2 +-
 scripts/fish/spm.sh        | 15 ---------------
 scripts/fish/spm.sh.sha256 |  2 +-
 scripts/zsh/cli.sh         |  2 +-
 scripts/zsh/cli.sh.sha256  |  2 +-
 scripts/zsh/spm.sh         | 15 ---------------
 scripts/zsh/spm.sh.sha256  |  2 +-
 12 files changed, 9 insertions(+), 54 deletions(-)

diff --git a/scripts/bash/cli.sh b/scripts/bash/cli.sh
index a3d5fd8..48bf59b 100644
--- a/scripts/bash/cli.sh
+++ b/scripts/bash/cli.sh
@@ -192,7 +192,7 @@ strip_quarantine() {
 
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/bash/cli.sh.sha256 b/scripts/bash/cli.sh.sha256
index 8df11c4..f898cc6 100644
--- a/scripts/bash/cli.sh.sha256
+++ b/scripts/bash/cli.sh.sha256
@@ -1 +1 @@
-90218e86363718406766c63830bac54f4c390030df0bc702fb95b3f032843545  cli.sh
+2dc6f5c62109ff1ae5185c417ea3896e4bb9f326ce91764e87161d1d27f976fb  cli.sh
diff --git a/scripts/bash/spm.sh b/scripts/bash/spm.sh
index 8aaec5e..387daf2 100644
--- a/scripts/bash/spm.sh
+++ b/scripts/bash/spm.sh
@@ -131,21 +131,6 @@ EOF
   }
   trap cleanup EXIT
 
-  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
-  # attribute unless they are Developer ID signed and notarized. Some managed
-  # environments (MDM/security tooling) stamp it on network-written files, which
-  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
-  # from any cached binary. No-op off macOS / when the cache or attr is absent.
-  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
-  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
-  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
-  # would miss the plugin's real binary when that var is set to a custom path.
-  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
-    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
-      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
-  fi
-
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi
diff --git a/scripts/bash/spm.sh.sha256 b/scripts/bash/spm.sh.sha256
index 6293baf..c4f9ac6 100644
--- a/scripts/bash/spm.sh.sha256
+++ b/scripts/bash/spm.sh.sha256
@@ -1 +1 @@
-0559b6ab17f8cceb44a5defe9a88b5dcd54eaa5a72e7a4f7b5fcee1f13be9be1  spm.sh
+b520c458bec538505c9ff9ca75a02ec901597fd66b3c2d951b928e58e58e60da  spm.sh
diff --git a/scripts/fish/cli.sh b/scripts/fish/cli.sh
index db3bfb1..c1db097 100644
--- a/scripts/fish/cli.sh
+++ b/scripts/fish/cli.sh
@@ -204,7 +204,7 @@ strip_quarantine() {
 
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/fish/cli.sh.sha256 b/scripts/fish/cli.sh.sha256
index 4226bc2..480886b 100644
--- a/scripts/fish/cli.sh.sha256
+++ b/scripts/fish/cli.sh.sha256
@@ -1 +1 @@
-3e8fe00cebdcb140c4c1f8029c01e96d72cf906e681597317be60bed5e9db2a5  cli.sh
+6a83801b611b3550f46c91daeaeaa8233644d8edd0092e4dfd92098d268e63d4  cli.sh
diff --git a/scripts/fish/spm.sh b/scripts/fish/spm.sh
index c728211..2842249 100644
--- a/scripts/fish/spm.sh
+++ b/scripts/fish/spm.sh
@@ -144,21 +144,6 @@ EOF
   }
   trap cleanup EXIT
 
-  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
-  # attribute unless they are Developer ID signed and notarized. Some managed
-  # environments (MDM/security tooling) stamp it on network-written files, which
-  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
-  # from any cached binary. No-op off macOS / when the cache or attr is absent.
-  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
-  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
-  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
-  # would miss the plugin's real binary when that var is set to a custom path.
-  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
-    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
-      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
-  fi
-
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi
diff --git a/scripts/fish/spm.sh.sha256 b/scripts/fish/spm.sh.sha256
index 2c76a14..7aac3c4 100644
--- a/scripts/fish/spm.sh.sha256
+++ b/scripts/fish/spm.sh.sha256
@@ -1 +1 @@
-bfc7fbcf9b3df10c4352bc426566a605a1a14554233ed649899cb045efdb5024  spm.sh
+982bbb10bb9bd55428208454a766384fae58c41dacabb1e5b8a74d2366f0d1e7  spm.sh
diff --git a/scripts/zsh/cli.sh b/scripts/zsh/cli.sh
index edc0c80..af319e4 100644
--- a/scripts/zsh/cli.sh
+++ b/scripts/zsh/cli.sh
@@ -203,7 +203,7 @@ strip_quarantine() {
 
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/zsh/cli.sh.sha256 b/scripts/zsh/cli.sh.sha256
index 0eaa0c8..912f7f7 100644
--- a/scripts/zsh/cli.sh.sha256
+++ b/scripts/zsh/cli.sh.sha256
@@ -1 +1 @@
-713db299874844d7b2a182250864d9703a21c3a7602240ffc413ad40ee7af8e2  cli.sh
+0f6344ba1db459bfa34bde971294215e883649e3107842cb585accf83349c462  cli.sh
diff --git a/scripts/zsh/spm.sh b/scripts/zsh/spm.sh
index a13e618..9619a0b 100644
--- a/scripts/zsh/spm.sh
+++ b/scripts/zsh/spm.sh
@@ -143,21 +143,6 @@ EOF
   }
   trap cleanup EXIT
 
-  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
-  # attribute unless they are Developer ID signed and notarized. Some managed
-  # environments (MDM/security tooling) stamp it on network-written files, which
-  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
-  # from any cached binary. No-op off macOS / when the cache or attr is absent.
-  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
-  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
-  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
-  # would miss the plugin's real binary when that var is set to a custom path.
-  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
-    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
-      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
-  fi
-
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi
diff --git a/scripts/zsh/spm.sh.sha256 b/scripts/zsh/spm.sh.sha256
index 5bd4154..0cac838 100644
--- a/scripts/zsh/spm.sh.sha256
+++ b/scripts/zsh/spm.sh.sha256
@@ -1 +1 @@
-e4a04d02a4bcec8a89ed3719ea6f29c3ee7fe09c846ddfe1be622d266dcac690  spm.sh
+1f28d5b3025636d9b81299032f34886f8804b1c6c95b830204325b325bd1d84f  spm.sh