From 3c736e4be91eaa5f23e6fe85968a3f703572a1fb Mon Sep 17 00:00:00 2001 From: Theo Browne Date: Tue, 25 Aug 2026 20:01:55 -0700 Subject: [PATCH] fix(server): one-click Codex updates no longer break brew installs on macOS Homebrew cask upgrades quarantine the new binary. macOS then blocks the next exec behind a Gatekeeper approval prompt the T3 server cannot answer, so the provider probe hangs until it times out and the model picker shows no models. Pass --no-quarantine to brew upgrade so managed updates never quarantine the binary. The flag is a no-op for formulae. Co-Authored-By: Claude Fable 5 --- apps/server/src/provider/providerMaintenance.test.ts | 12 ++++++------ apps/server/src/provider/providerMaintenance.ts | 6 +++++- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/apps/server/src/provider/providerMaintenance.test.ts b/apps/server/src/provider/providerMaintenance.test.ts index 5683da2c1a82..50787fe2a473 100644 --- a/apps/server/src/provider/providerMaintenance.test.ts +++ b/apps/server/src/provider/providerMaintenance.test.ts @@ -321,11 +321,11 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => { provider: driver("packageTool"), packageName: "@example/package-tool", update: { - command: "brew upgrade package-tool", + command: "brew upgrade --no-quarantine package-tool", executable: "brew", - args: ["upgrade", "package-tool"], + args: ["upgrade", "--no-quarantine", "package-tool"], lockKey: "homebrew", }, @@ -418,11 +418,11 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => { provider: driver("nativePackageTool"), packageName: "@example/native-package-tool", update: { - command: "brew upgrade native-package-tool", + command: "brew upgrade --no-quarantine native-package-tool", executable: "brew", - args: ["upgrade", "native-package-tool"], + args: ["upgrade", "--no-quarantine", "native-package-tool"], lockKey: "homebrew", }, @@ -441,11 +441,11 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => { provider: driver("scopedPackageTool"), packageName: "@example/scoped-package-tool", update: { - command: "brew upgrade example/tap/scoped-package-tool", + command: "brew upgrade --no-quarantine example/tap/scoped-package-tool", executable: "brew", - args: ["upgrade", "example/tap/scoped-package-tool"], + args: ["upgrade", "--no-quarantine", "example/tap/scoped-package-tool"], lockKey: "homebrew", }, diff --git a/apps/server/src/provider/providerMaintenance.ts b/apps/server/src/provider/providerMaintenance.ts index 14d17cf365c3..09e9d31b2811 100644 --- a/apps/server/src/provider/providerMaintenance.ts +++ b/apps/server/src/provider/providerMaintenance.ts @@ -202,7 +202,11 @@ function makeHomebrewProviderMaintenanceCapabilities( provider: definition.provider, packageName: definition.npmPackageName, updateExecutable: "brew", - updateArgs: ["upgrade", definition.homebrewFormula], + // Cask upgrades quarantine the new binary by default. macOS then blocks + // the next exec behind a Gatekeeper approval prompt, which the T3 server + // cannot answer, so the provider probe hangs until a human approves the + // binary. --no-quarantine skips that and is a no-op for formulae. + updateArgs: ["upgrade", "--no-quarantine", definition.homebrewFormula], updateLockKey: "homebrew", }); }