fix(scripts): scope quarantine-strip to cli.sh; drop spm.sh strip; chmod 0755 (DEVA11Y-752)

Address PR review (maunilm):

- P1: remove the com.apple.quarantine strip from the three spm.sh scripts.
  The SPM plugin downloads AND execs the binary within a single
  `swift package plugin scan` invocation, so a shell-level strip before
  that call cannot cover a cold cache or a CLI version bump — the first
  run in an MDM environment would still fail. Rather than ship a partial
  mitigation that reads as full coverage, spm.sh is reverted to main; the
  plugin-side fix (strip at the download site) / notarization is tracked
  as a follow-up.

- P2b: cli.sh downloads a binary that nothing else verifies and Gatekeeper
  no longer gates, so tighten its permissions from 0775 (group-writable —
  the macOS primary group `staff` includes every local user) to 0755.

The cli.sh strip is unchanged and remains full coverage: download_binary
re-extracts and strips on every invocation, so the strip always lands
after the write. Sidecars regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Crash0v3rrid3

scripts/bash/cli.sh

@@ -192,7 +192,7 @@ strip_quarantine() {
 
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`

scripts/bash/cli.sh.sha256

@@ -1 +1 @@
-90218e86363718406766c63830bac54f4c390030df0bc702fb95b3f032843545  cli.sh
+2dc6f5c62109ff1ae5185c417ea3896e4bb9f326ce91764e87161d1d27f976fb  cli.sh

scripts/bash/spm.sh

@@ -131,21 +131,6 @@ EOF
   }
   trap cleanup EXIT
 
-  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
-  # attribute unless they are Developer ID signed and notarized. Some managed
-  # environments (MDM/security tooling) stamp it on network-written files, which
-  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
-  # from any cached binary. No-op off macOS / when the cache or attr is absent.
-  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
-  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
-  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
-  # would miss the plugin's real binary when that var is set to a custom path.
-  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
-    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
-      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
-  fi
-
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi

scripts/bash/spm.sh.sha256

@@ -1 +1 @@
-0559b6ab17f8cceb44a5defe9a88b5dcd54eaa5a72e7a4f7b5fcee1f13be9be1  spm.sh
+b520c458bec538505c9ff9ca75a02ec901597fd66b3c2d951b928e58e58e60da  spm.sh

scripts/fish/cli.sh

@@ -204,7 +204,7 @@ strip_quarantine() {
 
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`

scripts/fish/cli.sh.sha256

@@ -1 +1 @@
-3e8fe00cebdcb140c4c1f8029c01e96d72cf906e681597317be60bed5e9db2a5  cli.sh
+6a83801b611b3550f46c91daeaeaa8233644d8edd0092e4dfd92098d268e63d4  cli.sh

scripts/fish/spm.sh

@@ -144,21 +144,6 @@ EOF
   }
   trap cleanup EXIT
 
-  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
-  # attribute unless they are Developer ID signed and notarized. Some managed
-  # environments (MDM/security tooling) stamp it on network-written files, which
-  # blocks the SPM plugin's cached CLI with no "Allow Anyway" option. Strip it
-  # from any cached binary. No-op off macOS / when the cache or attr is absent.
-  # The plugin runs below under `env -i`, which drops XDG_CACHE_HOME, so it always
-  # resolves its cache to $HOME/.cache (see Plugins/.../BrowserStackAccessibilityLint.swift).
-  # Mirror that here rather than the outer shell's XDG_CACHE_HOME, or the strip
-  # would miss the plugin's real binary when that var is set to a custom path.
-  if [[ "$(uname -s)" == "Darwin" ]] && command -v xattr >/dev/null 2>&1; then
-    cli_cache="$HOME/.cache/browserstack/devtools/spm-plugin"
-    [ -d "$cli_cache" ] && find "$cli_cache" -type f -name 'browserstack-cli' \
-      -exec xattr -d com.apple.quarantine {} \; 2>/dev/null || true
-  fi
-
   if [[ -z "$EXTRA_ARGS" ]]; then
     EXTRA_ARGS="--include **/*.swift --include **/*.xib --include **/*.storyboard"
   fi

scripts/fish/spm.sh.sha256

@@ -1 +1 @@
-bfc7fbcf9b3df10c4352bc426566a605a1a14554233ed649899cb045efdb5024  spm.sh
+982bbb10bb9bd55428208454a766384fae58c41dacabb1e5b8a74d2366f0d1e7  spm.sh

scripts/zsh/cli.sh

@@ -203,7 +203,7 @@ strip_quarantine() {
 
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH" && strip_quarantine
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`

scripts/zsh/cli.sh.sha256

@@ -1 +1 @@
-713db299874844d7b2a182250864d9703a21c3a7602240ffc413ad40ee7af8e2  cli.sh
+0f6344ba1db459bfa34bde971294215e883649e3107842cb585accf83349c462  cli.sh