fix(desktop): forward macOS XPC bootstrap env vars to v2 terminal shells

packages/host-service/src/terminal/clean-shell-env.ts

@@ -4,7 +4,7 @@ const SHELL_ENV_TIMEOUT_MS = 8_000;
 const CACHE_TTL_MS = 60_000;
 const DELIMITER = "__SUPERSET_SHELL_ENV__";
 
-const SHELL_BOOTSTRAP_KEYS = [
+export const SHELL_BOOTSTRAP_KEYS = [
 	"HOME",
 	"USER",
 	"LOGNAME",
@@ -17,6 +17,14 @@ const SHELL_BOOTSTRAP_KEYS = [
 	"LC_CTYPE",
 	"__CF_USER_TEXT_ENCODING",
 	"Apple_PubSub_Socket_Render",
+	// macOS XPC bootstrap — without these, the helper shell (and every PTY
+	// downstream) loses its Mach handles to securityd/opendirectoryd, which
+	// breaks getpwuid_r (whoami → uid; OpenSSH "No user exists for uid N")
+	// and SecTrustEvaluateWithError (gh, terraform: "x509: OSStatus -26276").
+	"__CFBundleIdentifier",
+	"XPC_SERVICE_NAME",
+	"XPC_FLAGS",
+	"MallocNanoZone",
 	"COMSPEC",
 	"USERPROFILE",
 	"SYSTEMROOT",

packages/host-service/src/terminal/env.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { SHELL_BOOTSTRAP_KEYS } from "./clean-shell-env";
 import {
 	buildV2TerminalEnv,
 	getShellBootstrapEnv,
@@ -216,6 +217,31 @@ describe("stripTerminalRuntimeEnv", () => {
 		expect(result.GOPATH).toBe("/Users/dev/go");
 		expect(result.SSH_AUTH_SOCK).toBe("/tmp/ssh-agent.sock");
 	});
+
+	test("macOS XPC bootstrap keys flow seed → PTY env unmolested", () => {
+		// Seed: buildMinimalEnv() copies SHELL_BOOTSTRAP_KEYS from process.env
+		// into the helper shell, so the keys must be on this list.
+		expect(SHELL_BOOTSTRAP_KEYS).toContain("__CFBundleIdentifier");
+		expect(SHELL_BOOTSTRAP_KEYS).toContain("XPC_SERVICE_NAME");
+		expect(SHELL_BOOTSTRAP_KEYS).toContain("XPC_FLAGS");
+		expect(SHELL_BOOTSTRAP_KEYS).toContain("MallocNanoZone");
+
+		// Strip pass: none of these match a denylist prefix or exact key, so
+		// they survive stripTerminalRuntimeEnv into the PTY base env.
+		resetTerminalBaseEnvForTests();
+		initTerminalBaseEnv({
+			__CFBundleIdentifier: "com.example.app",
+			XPC_SERVICE_NAME: "0",
+			XPC_FLAGS: "0x1",
+			MallocNanoZone: "0",
+			HOME: "/Users/test",
+		});
+		const env = getTerminalBaseEnv();
+		expect(env.__CFBundleIdentifier).toBe("com.example.app");
+		expect(env.XPC_SERVICE_NAME).toBe("0");
+		expect(env.XPC_FLAGS).toBe("0x1");
+		expect(env.MallocNanoZone).toBe("0");
+	});
 });
 
 // ── Shell launch behavior ────────────────────────────────────────────

packages/host-service/src/terminal/env.ts

@@ -181,8 +181,9 @@ export function buildV2TerminalEnv(
 		env.SUPERSET_HOME_DIR = supersetHomeDir;
 	}
 
-	// Electron child processes can't access macOS Keychain for TLS cert verification,
-	// causing "x509: OSStatus -26276" in Go binaries like `gh`. File-based fallback.
+	// Belt-and-suspenders for tools that prefer file-based trust roots even
+	// when the macOS Security framework is reachable (clean-shell-env now
+	// forwards the XPC bootstrap vars, so trust evaluation works directly).
 	if (
 		os.platform() === "darwin" &&
 		!env.SSL_CERT_FILE &&