fix(evaos): fail closed on incomplete staging signer

resources/evaos-beta/bridge/src/evaos_desktop_bridge/cli.py

@@ -3327,7 +3327,7 @@ def _connector_mac_control_canary_environment(env: Mapping[str, str] | None = No
         return {}
     configured = {key: str(source_env.get(key) or "").strip() for key in CONNECTOR_MAC_CONTROL_CANARY_ENV_KEYS}
     present = {key: value for key, value in configured.items() if value}
-    if present and len(present) != len(CONNECTOR_MAC_CONTROL_CANARY_ENV_KEYS):
+    if len(present) != len(CONNECTOR_MAC_CONTROL_CANARY_ENV_KEYS):
         missing = sorted(key for key, value in configured.items() if not value)
         raise RuntimeError("Mac-control canary configuration is incomplete; missing " + ", ".join(missing))
     return present

tests/unit/evaos/evaosDesktopBridgeReceipt.test.ts

@@ -47,8 +47,22 @@ try:
     assert len(launchctl_calls) == 3
 
     launchctl_calls.clear()
-    cli.CONNECTOR_USER_PLIST = root / "staging.plist"
+    cli.CONNECTOR_USER_PLIST = root / "mode-only.plist"
+    for key in cli.CONNECTOR_MAC_CONTROL_CANARY_ENV_KEYS:
+        os.environ.pop(key, None)
     os.environ[cli.CONNECTOR_MAC_CONTROL_CANARY_MODE_ENV_KEY] = cli.CONNECTOR_MAC_CONTROL_CANARY_MODE
+    try:
+        cli._launchctl_start()
+    except RuntimeError as error:
+        assert "configuration is incomplete" in str(error)
+    else:
+        raise AssertionError("staging mode without signer configuration was accepted")
+    assert not cli.CONNECTOR_USER_PLIST.exists()
+    assert launchctl_calls == []
+
+    launchctl_calls.clear()
+    cli.CONNECTOR_USER_PLIST = root / "staging.plist"
+    os.environ.update(signer_env)
     cli._launchctl_start()
 
     payload = plistlib.loads(cli.CONNECTOR_USER_PLIST.read_bytes())