Skip to content

fix(kiro-extension): unbreak Windows CI, handle macOS quarantine - #37

Merged
AlleyBo55 merged 1 commit into
masterfrom
kiro/extension-hardening
Jul 28, 2026
Merged

AlleyBo55 merged 1 commit into
masterfrom
kiro/extension-hardening

Conversation

@AlleyBo55

Copy link
Copy Markdown
Owner

The win32-x64 job failed on a test defect, not a product one. path.join follows the host separator rather than the stubbed process.platform, so a Windows runner resolved bin\darwin-arm64\doraemon-companion while the assertion looked for forward slashes. Assertions now compare on a single separator. The resolver itself was always correct.

Revived a dead test branch while here. The "existing hooks are left alone" check was guarded by typeof installAgentHooks === 'function', but that symbol is internal to the bundle and never exported, so the check had been silently skipped on every platform. It now drives the real path a user hits, a second activate() with the hook files already on disk, and asserts nothing is rewritten.

macOS ships downloaded binaries with com.apple.quarantine, which kills the companion before it prints a single byte (measured: 32 bytes clean, 0 when quarantined). The extension now detects the flag and offers to clear it, only on explicit consent, since stripping it silently would defeat the control it exists to provide. Declining falls back to window mode rather than leaving the user with a pet that never appears.

Verified: typecheck, build, 34 smoke checks, 4 quarantine checks against a real quarantined binary. Windows and Linux running the pet for real remain unverified, no runner on hand for that.

The win32-x64 job failed on a test defect, not a product one. path.join
follows the host separator rather than the stubbed process.platform, so a
Windows runner resolved bin\darwin-arm64\doraemon-companion while the
assertion looked for forward slashes. Assertions now compare on a single
separator. The resolver itself was always correct.

Revived a dead test branch while here. The "existing hooks are left alone"
check was guarded by `typeof installAgentHooks === 'function'`, but that
symbol is internal to the bundle and never exported, so the check had been
silently skipped on every platform. It now drives the real path a user
hits, a second activate() with the hook files already on disk, and asserts
nothing is rewritten.

macOS ships downloaded binaries with com.apple.quarantine, which kills the
companion before it prints a single byte (measured: 32 bytes clean, 0 when
quarantined). The extension now detects the flag and offers to clear it,
only on explicit consent, since stripping it silently would defeat the
control it exists to provide. Declining falls back to window mode rather
than leaving the user with a pet that never appears.

Verified: typecheck, build, 34 smoke checks, 4 quarantine checks against
a real quarantined binary. Windows and Linux running the pet for real
remain unverified, no runner on hand for that.
@AlleyBo55
AlleyBo55 merged commit a5c33c4 into master Jul 28, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant