fix(MESHAGEN-004): 3 review findings in macOSHelpers.js

[flamingo]

Closes 3 review findings in modules/macOSHelpers.js.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 90 high	macOSHelpers.js has a non-conforming, incomplete license/copyright header	modules/macOSHelpers.js:1
2	🟡 80 medium	K&R-style opening braces used throughout macOSHelpers.js instead of Allman style	modules/macOSHelpers.js:38
3	🔴 55 low — review closely	executePlistBuddy builds a shell command string via string concatenation with unsanitized command/path arguments	modules/macOSHelpers.js:205

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 36292efa-450d-4316-bb92-99897b2455bd

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft — 3 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🔴 macOSHelpers.js has a non-conforming, incomplete license/copyright header

Replaced the non-conforming header at the top of the file with the full Apache License 2.0 block comment, including "Copyright 2024 Intel Corporation" and the canonical "http://www.apache.org/licenses/LICENSE-2.0" URL, matching the style used in modules/lib-finder.js, while preserving the trailing description lines.

🤖 Prompt for AI agents

In modules/macOSHelpers.js around line 1, review and complete this code-review fix: macOSHelpers.js has a non-conforming, incomplete license/copyright header.
What the draft fix changed: Replaced the non-conforming header at the top of the file with the full Apache License 2.0 block comment, including "Copyright 2024 Intel Corporation" and the canonical "http://www.apache.org/licenses/LICENSE-2.0" URL, matching the style used in modules/lib-finder.js, while preserving the trailing description lines.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 K&R-style opening braces used throughout macOSHelpers.js instead of Allman style

Reformatted all function, if/else, and object-literal opening braces throughout the file (isRunningFromBundle, getBundleParentDirectory, getBundlePathFromBinaryPath, sanitizeIdentifier, buildServiceId, getPlistPath, getLaunchdDomain, getLaunchdPath, copyBundleWithDitto, executePlistBuddy, module.exports, and the MACOS_PATHS/LAUNCHD_DOMAINS/BUNDLE_STRUCTURE object literals) to Allman style, placing each opening brace on its own line, matching modules/lib-finder.js. Single-line if (!execPath) execPath = process.execPath; guards were expanded into full Allman-braced blocks since the finding calls these out explicitly as needing reformatting.

🤖 Prompt for AI agents

In modules/macOSHelpers.js around line 38, review and complete this code-review fix: K&R-style opening braces used throughout macOSHelpers.js instead of Allman style.
What the draft fix changed: Reformatted all function, if/else, and object-literal opening braces throughout the file (isRunningFromBundle, getBundleParentDirectory, getBundlePathFromBinaryPath, sanitizeIdentifier, buildServiceId, getPlistPath, getLaunchdDomain, getLaunchdPath, copyBundleWithDitto, executePlistBuddy, module.exports, and the MACOS_PATHS/LAUNCHD_DOMAINS/BUNDLE_STRUCTURE object literals) to Allman style, placing each opening brace on its own line, matching modules/lib-finder.js. Single-line `if (!execPath) execPath = process.execPath;` guards were expanded into full Allman-braced blocks since the finding calls these out explicitly as needing reformatting.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 80 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 executePlistBuddy builds a shell command string via string concatenation with unsanitized command/path arguments

Changed executePlistBuddy to use child_process.execFileSync(MACOS_PATHS.PLIST_BUDDY, ['-c', command, plistPath], {...}) instead of building a quoted shell string for execSync, eliminating shell interpretation of the command/plistPath arguments and closing the injection vector. This assumes execFileSync is acceptable in this codebase's runtime (it mirrors the execFile usage already present in copyBundleWithDitto) and that no caller relies on shell features (e.g. globbing) previously enabled by the string form; callers were not exhaustively audited across the repository, so behavior for any edge-case shell-dependent usage should be verified.

🤖 Prompt for AI agents

In modules/macOSHelpers.js around line 205, review and complete this code-review fix: executePlistBuddy builds a shell command string via string concatenation with unsanitized command/path arguments.
What the draft fix changed: Changed executePlistBuddy to use child_process.execFileSync(MACOS_PATHS.PLIST_BUDDY, ['-c', command, plistPath], {...}) instead of building a quoted shell string for execSync, eliminating shell interpretation of the command/plistPath arguments and closing the injection vector. This assumes execFileSync is acceptable in this codebase's runtime (it mirrors the execFile usage already present in copyBundleWithDitto) and that no caller relies on shell features (e.g. globbing) previously enabled by the string form; callers were not exhaustively audited across the repository, so behavior for any edge-case shell-dependent usage should be verified.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer