macOS 27: install-auto fails every start (kbnm blocked by System Policy browser-data protection, cli symlink, --uninstall-cli crash), misleading error dialog

The issue covers four separate macOS install failures. Start in go/kbnm/installer/installer.go, where KnownInstallers() is looped over without browser detection, and in go/install/install_darwin.go installCommandLine, where os.Symlink has no fallback; the KBCommandLine uninstall: crash lives in the Objective-C osx/KBKit code. Done means maintainers have agreed on scope for each part (kbnm, cli symlink, uninstall crash, kbfuse support), since the kbfuse part needs a product decision and is not a first-timer task.

Environment

• Keybase 6.6.3 (6.6.3-20260603142618+f60f2ff97e)
• macOS 27.0.1 (26A434), Apple Silicon, clean install
• Chrome not installed; Firefox installed; /usr/local/bin does not exist (stock macOS)

1. kbnm install fails on every startup — macOS 27 browser-data protection

keybase install-auto / keybase install --components=kbnm fails with:

mkdir /Users/<user>/Library/Application Support/Google/Chrome: operation not permitted

and the GUI shows a "Keybase Install Error" dialog at every app start. macOS 27 protects Chrome's data directory at the kernel level from any app other than Chrome itself:

kernel (Sandbox) System Policy: mkdir deny(1) file-write-create /Users/<user>/Library/Application Support/Google/Chrome

The dialog's suggested fix (sudo chown -R ...) cannot work — the denial is System Policy, not ownership; even mkdir by the directory owner fails. Reproduction: mkdir "$HOME/Library/Application Support/Google/Chrome" fails for any process; mkdir Chrome2 in the same parent succeeds.

go/kbnm/installer/installer.go unconditionally loops over all KnownInstallers() (chrome, chromium, firefox) with no browser detection — the failure happens even though Chrome is not installed — and there is no config toggle to disable the kbnm component. Workaround we used: set KBNM_INSTALL_OVERLAY to redirect manifest writes. Note master already retired the browser extension (go/install/legacy_kbnm_darwin.go cleanup) — a release shipping that removal would fix this.

2. cli component always fails on clean macOS; privileged installer never creates the symlink

install-auto reports:

symlink .../Keybase.app/Contents/SharedSupport/bin/keybase /usr/local/bin/keybase: no such file or directory

go/install/install_darwin.go installCommandLine calls os.Symlink unprivileged with no fallback, which fails when /usr/local/bin doesn't exist (and the dir is root-owned anyway). Meanwhile the privileged installer frontend (KBCommandLine refreshComponent, osx/KBKit) considers the CLI installed whenever /etc/paths.d/Keybase exists (etcPathsExists short-circuit), so KeybaseInstaller --install-cli is a no-op and never creates the symlink. Result: another recurring install-error dialog.

3. KeybaseInstaller --uninstall-cli crashes

*** Terminating app due to uncaught exception 'NSInvalidArgumentException',
    reason: '*** -[__NSPlaceholderDictionary initWithObjects:forKeys:count:]: attempt to insert nil object from objects[1]'
	... -[KBCommandLine uninstall:]

Reproducible on demand (/Applications/Keybase.app/Contents/Resources/KeybaseInstaller.app/Contents/MacOS/Keybase --uninstall-cli ...), which makes cleaning up the CLI install impossible.

4. kbfuse has no kext for current macOS

kbfuse.bundle only ships Extensions/12/kbfuse.kext (macOS 12). KBFuseComponent looks for Extensions/<major>.<minor>/kbfuse.kext, so on macOS 27 the fuse component can never succeed; it reports only exit status 1 with no actionable message. KBFS mounting is therefore impossible on current macOS.

Related issues (similar symptoms, different root cause): #28376, #28375 (CLI installed into /usr/local/bin on Apple Silicon), #24469 (CLI didn't install, undiagnosed), #25503 (recurring install errors, undiagnosed).

Suggested fixes

• Skip kbnm for browsers that aren't installed and/or handle EPERM gracefully; ship the browser-extension retirement already on master.
• Have the privileged helper create /usr/local/bin + symlinks when missing, or make the unprivileged cli check mirror KBCommandLine's etcPathsExists so it doesn't error.
• Fix the -[KBCommandLine uninstall:] nil-dictionary crash.
• State clearly whether kbfuse/KBFS mounting is supported on modern macOS, and improve the fuse error message.

Additional numbers
The number 345567

(Supersedes #29863, which was auto-closed by the anti-spam workflow because this template marker was missing.)