fix(cli): strip com.apple.quarantine from downloaded CLI binary (DEVA11Y-752)

scripts/bash/cli.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 GIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
@@ -179,9 +179,20 @@
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`

scripts/bash/cli.sh.sha256

@@ -1 +1 @@
-e233e16b32a0ec18d24acf32e8c415d26c4eeecdc287452117fe51de2f4791dc  cli.sh
+2dc6f5c62109ff1ae5185c417ea3896e4bb9f326ce91764e87161d1d27f976fb  cli.sh

scripts/fish/cli.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 export PATH="$PATH:/opt/homebrew/bin"
@@ -191,9 +191,20 @@
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`

scripts/fish/cli.sh.sha256

@@ -1 +1 @@
-332c8583f95291bf72ac4199702697656d28f5b98eba3a6a724a0272ecf77f83  cli.sh
+6a83801b611b3550f46c91daeaeaa8233644d8edd0092e4dfd92098d268e63d4  cli.sh

scripts/zsh/cli.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 # Shell specific
@@ -190,9 +190,20 @@
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`

scripts/zsh/cli.sh.sha256

@@ -1 +1 @@
-67edf6abb80741b1f723f07533448288de7652aba859499d287672e8c6c299b4  cli.sh
+0f6344ba1db459bfa34bde971294215e883649e3107842cb585accf83349c462  cli.sh