Skip to content

Support default pkg install script when cask lacks pkg artifact and URL override is used - #45893

Merged
allenhouchins merged 11 commits into
mainfrom
allenhouchins-update-default-scripting
Jun 1, 2026
Merged

Support default pkg install script when cask lacks pkg artifact and URL override is used#45893
allenhouchins merged 11 commits into
mainfrom
allenhouchins-update-default-scripting

Conversation

@allenhouchins

@allenhouchins allenhouchins commented May 20, 2026

Copy link
Copy Markdown
Member

Support installer_format="pkg" even when the Homebrew cask describes no pkg artifact by installing the downloaded package at $INSTALLER_PATH. Adds caskHasPkgArtifact and InstallPkgFromInstallerPath, and updates installScriptForApp to use quit/track and relaunch helpers around a direct installer call when appropriate. Includes unit tests for both code paths. Removes per-app install script files and clears install_script_path from input JSONs; updates output refs for 1Password, Slack and Zoom to the new consolidated scripts.

Related issue: Resolves #

Checklist for submitter

If some of the following don't apply, delete the relevant line.

  • Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
    See Changes files for more information.

  • Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

  • Timeouts are implemented and retries are limited to avoid infinite loops

  • If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

For unreleased bug fixes in a release candidate, one of:

  • Confirmed that the fix is not expected to adversely impact load test results
  • Alerted the release DRI if additional load testing is needed

Database migrations

  • Checked schema for all modified table for columns that will auto-update timestamps during migration.
  • Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
  • Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).

New Fleet configuration settings

  • Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for GitOps-enabled settings:

  • Verified that the setting is exported via fleetctl generate-gitops
  • Verified the setting is documented in a separate PR to the GitOps documentation
  • Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional)
  • Verified that any relevant UI is disabled when GitOps mode is enabled

fleetd/orbit/Fleet Desktop

  • Verified compatibility with the latest released version of Fleet (see Must rule)
  • If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
  • Verified that fleetd runs on macOS, Linux and Windows
  • Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

Summary by CodeRabbit

  • New Features
    • Enhanced Homebrew application installation with improved error detection and app lifecycle handling during package updates.
  • Chores
    • Consolidated custom installer logic into centralized system; removed redundant installation configurations.
  • Tests
    • Added test coverage for package installation scenarios.

Support installer_format="pkg" even when the Homebrew cask describes no pkg artifact by installing the downloaded package at $INSTALLER_PATH. Adds caskHasPkgArtifact and InstallPkgFromInstallerPath, and updates installScriptForApp to use quit/track and relaunch helpers around a direct installer call when appropriate. Includes unit tests for both code paths. Removes per-app install script files and clears install_script_path from input JSONs; updates output refs for 1Password, Slack and Zoom to the new consolidated scripts.
@github-actions

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/1password/darwin.json

=== Install // ef2a17ff -> c8c35fa0 ===

--- /tmp/old.VeacDZ	2026-05-20 15:59:10.675942609 +0000
+++ /tmp/new.MZLoIa	2026-05-20 15:59:10.675942609 +0000
@@ -1,21 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
   # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
     return
   fi
 
   local console_user
   console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -37,5 +51,50 @@
   fi
 }
 
-quit_application 'com.1password.1password'
-installer -pkg "$INSTALLER_PATH" -target /
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
+  else
+    echo "Failed to relaunch application '$bundle_id'."
+  fi
+}
+
+
+# install pkg files
+quit_and_track_application 'com.1password.1password'
+sudo installer -pkg "$INSTALLER_PATH" -target /
+relaunch_application 'com.1password.1password'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/slack/darwin.json

=== Install // 6025885d -> 53397c19 ===

--- /tmp/old.NDMp2O	2026-05-20 15:59:10.735942581 +0000
+++ /tmp/new.OE5m6J	2026-05-20 15:59:10.735942581 +0000
@@ -1,21 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
   # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
     return
   fi
 
   local console_user
   console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -37,5 +51,50 @@
   fi
 }
 
-quit_application 'com.tinyspeck.slackmacgap'
-installer -pkg "$INSTALLER_PATH" -target /
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
+  else
+    echo "Failed to relaunch application '$bundle_id'."
+  fi
+}
+
+
+# install pkg files
+quit_and_track_application 'com.tinyspeck.slackmacgap'
+sudo installer -pkg "$INSTALLER_PATH" -target /
+relaunch_application 'com.tinyspeck.slackmacgap'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zoom/darwin.json

=== Install // 05e6a85c -> b67a020b ===

--- /tmp/old.h4H9QX	2026-05-20 15:59:10.787942557 +0000
+++ /tmp/new.uG3jZm	2026-05-20 15:59:10.787942557 +0000
@@ -1,15 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
-  local console_user="$2"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -31,32 +51,50 @@
   fi
 }
 
-restart_zoom() {
-  local console_user="$1"
-  
-  if [[ -n "$console_user" && "$console_user" != "root" ]]; then
-    echo "Restarting Zoom for user: $console_user"
-    sudo -u "$console_user" open -a "zoom.us"
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
   else
-    echo "No console user found, attempting direct Zoom start..."
-    open -a "zoom.us"
+    echo "Failed to relaunch application '$bundle_id'."
   fi
 }
 
-# Get console user once (used by both quit and restart)
-CONSOLE_USER=$(stat -f "%Su" /dev/console 2>/dev/null || echo "")
 
-# Check if Zoom is running
-ZOOM_WAS_RUNNING=false
-if osascript -e "application id \"us.zoom.xos\" is running" 2>/dev/null; then
-  ZOOM_WAS_RUNNING=true
-  quit_application 'us.zoom.xos' "$CONSOLE_USER"
-fi
-
-installer -pkg "$INSTALLER_PATH" -target /
-
-# Restart Zoom if it was running before installation
-if [[ "$ZOOM_WAS_RUNNING" == "true" ]]; then
-  sleep 2
-  restart_zoom "$CONSOLE_USER" || true
-fi
+# install pkg files
+quit_and_track_application 'us.zoom.xos'
+sudo installer -pkg "$TMPDIR/ZoomInstallerIT.pkg" -target /
+relaunch_application 'us.zoom.xos'

=== Uninstall Script (no changes) ===

@codecov

codecov Bot commented May 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.83%. Comparing base (846e51c) to head (093ef86).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #45893      +/-   ##
==========================================
+ Coverage   66.82%   66.83%   +0.01%     
==========================================
  Files        2808     2808              
  Lines      223582   223620      +38     
  Branches    11346    11346              
==========================================
+ Hits       149407   149467      +60     
+ Misses      60619    60600      -19     
+ Partials    13556    13553       -3     
Flag Coverage Δ
backend 68.56% <100.00%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

fleet-release
fleet-release previously approved these changes May 21, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/1password/darwin.json

=== Install // ef2a17ff -> c8c35fa0 ===

--- /tmp/old.xgOWnI	2026-05-21 13:03:11.066095004 +0000
+++ /tmp/new.iTX6tf	2026-05-21 13:03:11.066095004 +0000
@@ -1,21 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
   # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
     return
   fi
 
   local console_user
   console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -37,5 +51,50 @@
   fi
 }
 
-quit_application 'com.1password.1password'
-installer -pkg "$INSTALLER_PATH" -target /
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
+  else
+    echo "Failed to relaunch application '$bundle_id'."
+  fi
+}
+
+
+# install pkg files
+quit_and_track_application 'com.1password.1password'
+sudo installer -pkg "$INSTALLER_PATH" -target /
+relaunch_application 'com.1password.1password'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/slack/darwin.json

=== Install // 6025885d -> 53397c19 ===

--- /tmp/old.nQLOqk	2026-05-21 13:03:11.232098215 +0000
+++ /tmp/new.P6KL7j	2026-05-21 13:03:11.232098215 +0000
@@ -1,21 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
   # check if the application is running
-  if ! osascript -e "application id \"$bundle_id\" is running" 2>/dev/null; then
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
     return
   fi
 
   local console_user
   console_user=$(stat -f "%Su" /dev/console)
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -37,5 +51,50 @@
   fi
 }
 
-quit_application 'com.tinyspeck.slackmacgap'
-installer -pkg "$INSTALLER_PATH" -target /
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
+  else
+    echo "Failed to relaunch application '$bundle_id'."
+  fi
+}
+
+
+# install pkg files
+quit_and_track_application 'com.tinyspeck.slackmacgap'
+sudo installer -pkg "$INSTALLER_PATH" -target /
+relaunch_application 'com.tinyspeck.slackmacgap'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zoom/darwin.json

=== Install // 05e6a85c -> b67a020b ===

--- /tmp/old.APjmWI	2026-05-21 13:03:11.271098969 +0000
+++ /tmp/new.AfCSE5	2026-05-21 13:03:11.271098969 +0000
@@ -1,15 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
-  local console_user="$2"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -31,32 +51,50 @@
   fi
 }
 
-restart_zoom() {
-  local console_user="$1"
-  
-  if [[ -n "$console_user" && "$console_user" != "root" ]]; then
-    echo "Restarting Zoom for user: $console_user"
-    sudo -u "$console_user" open -a "zoom.us"
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
   else
-    echo "No console user found, attempting direct Zoom start..."
-    open -a "zoom.us"
+    echo "Failed to relaunch application '$bundle_id'."
   fi
 }
 
-# Get console user once (used by both quit and restart)
-CONSOLE_USER=$(stat -f "%Su" /dev/console 2>/dev/null || echo "")
 
-# Check if Zoom is running
-ZOOM_WAS_RUNNING=false
-if osascript -e "application id \"us.zoom.xos\" is running" 2>/dev/null; then
-  ZOOM_WAS_RUNNING=true
-  quit_application 'us.zoom.xos' "$CONSOLE_USER"
-fi
-
-installer -pkg "$INSTALLER_PATH" -target /
-
-# Restart Zoom if it was running before installation
-if [[ "$ZOOM_WAS_RUNNING" == "true" ]]; then
-  sleep 2
-  restart_zoom "$CONSOLE_USER" || true
-fi
+# install pkg files
+quit_and_track_application 'us.zoom.xos'
+sudo installer -pkg "$TMPDIR/ZoomInstallerIT.pkg" -target /
+relaunch_application 'us.zoom.xos'

=== Uninstall Script (no changes) ===

Bump 1Password mac version from 8.12.12 to 8.12.21 and update the corresponding patched query to match the new version. Update Slack mac version (bundle com.tinyspeck.slackmacgap) from 4.50.121 to 4.49.89 and adjust its patched query accordingly. Installer URLs and install_script_ref values are unchanged.
@github-actions

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/1password/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/slack/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zoom/darwin.json

=== Install // 05e6a85c -> b67a020b ===

--- /tmp/old.GiBLtH	2026-05-21 13:13:50.324596314 +0000
+++ /tmp/new.MacdWC	2026-05-21 13:13:50.325596344 +0000
@@ -1,15 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
-  local console_user="$2"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -31,32 +51,50 @@
   fi
 }
 
-restart_zoom() {
-  local console_user="$1"
-  
-  if [[ -n "$console_user" && "$console_user" != "root" ]]; then
-    echo "Restarting Zoom for user: $console_user"
-    sudo -u "$console_user" open -a "zoom.us"
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
   else
-    echo "No console user found, attempting direct Zoom start..."
-    open -a "zoom.us"
+    echo "Failed to relaunch application '$bundle_id'."
   fi
 }
 
-# Get console user once (used by both quit and restart)
-CONSOLE_USER=$(stat -f "%Su" /dev/console 2>/dev/null || echo "")
 
-# Check if Zoom is running
-ZOOM_WAS_RUNNING=false
-if osascript -e "application id \"us.zoom.xos\" is running" 2>/dev/null; then
-  ZOOM_WAS_RUNNING=true
-  quit_application 'us.zoom.xos' "$CONSOLE_USER"
-fi
-
-installer -pkg "$INSTALLER_PATH" -target /
-
-# Restart Zoom if it was running before installation
-if [[ "$ZOOM_WAS_RUNNING" == "true" ]]; then
-  sleep 2
-  restart_zoom "$CONSOLE_USER" || true
-fi
+# install pkg files
+quit_and_track_application 'us.zoom.xos'
+sudo installer -pkg "$TMPDIR/ZoomInstallerIT.pkg" -target /
+relaunch_application 'us.zoom.xos'

=== Uninstall Script (no changes) ===

@allenhouchins allenhouchins changed the title Install PKG when cask lacks pkg artifact Support default pkg install script when cask lacks pkg artifact when URL override is used May 21, 2026
fleet-release
fleet-release previously approved these changes May 21, 2026
fleet-release
fleet-release previously approved these changes May 21, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/1password/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/slack/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zoom/darwin.json

=== Install // 05e6a85c -> b67a020b ===

--- /tmp/old.Vx2LQ4	2026-05-21 16:09:10.562921272 +0000
+++ /tmp/new.0Gzqru	2026-05-21 16:09:10.562921272 +0000
@@ -1,15 +1,35 @@
 #!/bin/bash
 
-quit_application() {
+# variables
+APPDIR="/Applications/"
+TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+# functions
+
+quit_and_track_application() {
   local bundle_id="$1"
-  local console_user="$2"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
-  if [[ $EUID -eq 0 && "$console_user" == "root" ]]; then
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    eval "export $var_name=0"
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
     echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    eval "export $var_name=0"
     return
   fi
 
+  # App was running, mark it for relaunch
+  eval "export $var_name=1"
+  echo "Application '$bundle_id' was running; will relaunch after installation."
+
   echo "Quitting application '$bundle_id'..."
 
   # try to quit the application within the timeout period
@@ -31,32 +51,50 @@
   fi
 }
 
-restart_zoom() {
-  local console_user="$1"
-  
-  if [[ -n "$console_user" && "$console_user" != "root" ]]; then
-    echo "Restarting Zoom for user: $console_user"
-    sudo -u "$console_user" open -a "zoom.us"
+
+relaunch_application() {
+  local bundle_id="$1"
+  local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
+  local was_running
+
+  # Check if the app was running before installation
+  eval "was_running=\$$var_name"
+  if [[ "$was_running" != "1" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Relaunching application '$bundle_id'..."
+
+  # Launch the app in the logged-in user's GUI session. Apps launched by root
+  # won't register with the user's Dock/GUI, so run 'open' as the console user.
+  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
+  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
+  # LSOpenURLsWithRole() failures even when 'open' exits 0.
+  local open_status=0
+  if [[ $EUID -eq 0 ]]; then
+    local console_uid
+    console_uid=$(id -u "$console_user")
+    /bin/launchctl asuser "$console_uid" sudo -u "$console_user" open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  else
+    open -b "$bundle_id" >/dev/null 2>&1 || open_status=$?
+  fi
+
+  if [[ $open_status -eq 0 ]]; then
+    echo "Application '$bundle_id' relaunched successfully."
   else
-    echo "No console user found, attempting direct Zoom start..."
-    open -a "zoom.us"
+    echo "Failed to relaunch application '$bundle_id'."
   fi
 }
 
-# Get console user once (used by both quit and restart)
-CONSOLE_USER=$(stat -f "%Su" /dev/console 2>/dev/null || echo "")
 
-# Check if Zoom is running
-ZOOM_WAS_RUNNING=false
-if osascript -e "application id \"us.zoom.xos\" is running" 2>/dev/null; then
-  ZOOM_WAS_RUNNING=true
-  quit_application 'us.zoom.xos' "$CONSOLE_USER"
-fi
-
-installer -pkg "$INSTALLER_PATH" -target /
-
-# Restart Zoom if it was running before installation
-if [[ "$ZOOM_WAS_RUNNING" == "true" ]]; then
-  sleep 2
-  restart_zoom "$CONSOLE_USER" || true
-fi
+# install pkg files
+quit_and_track_application 'us.zoom.xos'
+sudo installer -pkg "$TMPDIR/ZoomInstallerIT.pkg" -target /
+relaunch_application 'us.zoom.xos'

=== Uninstall Script (no changes) ===

Agent-Logs-Url: https://github.com/fleetdm/fleet/sessions/33d23e62-6f13-4aa7-93ea-fa1ab4045c60

Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
@allenhouchins
allenhouchins marked this pull request as ready for review May 22, 2026 02:06
@allenhouchins
allenhouchins requested a review from a team as a code owner May 22, 2026 02:06
Copilot AI review requested due to automatic review settings May 22, 2026 02:06

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

Tip: disable this comment in your organization's Code Review settings.

fleet-release
fleet-release previously approved these changes May 29, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/1password/darwin.json

=== Install Script (no changes) ===
=== Uninstall // f58c31b3 -> dadf8c51 ===

--- /tmp/old.61KD46	2026-05-29 15:00:49.568918878 +0000
+++ /tmp/new.JV5sZl	2026-05-29 15:00:49.568918878 +0000
@@ -5,6 +5,46 @@
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
 # functions
 
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
+
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
@@ -27,6 +67,7 @@
   fi
 }
 
+quit_application 'com.1password.1password'
 sudo rm -rf "$APPDIR/1Password.app"
 trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.1password*'
 trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.agilebits'

ee/maintained-apps/outputs/slack/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zoom/darwin.json

=== Install // b67a020b -> e9a9b924 ===

--- /tmp/old.bUQmmF	2026-05-29 15:00:49.638920407 +0000
+++ /tmp/new.7TT8Hl	2026-05-29 15:00:49.638920407 +0000
@@ -97,4 +97,8 @@
 # install pkg files
 quit_and_track_application 'us.zoom.xos'
 sudo installer -pkg "$TMPDIR/ZoomInstallerIT.pkg" -target /
+INSTALL_EXIT_CODE=$?
 relaunch_application 'us.zoom.xos'
+if [ "$INSTALL_EXIT_CODE" -ne 0 ]; then
+  exit "$INSTALL_EXIT_CODE"
+fi

=== Uninstall Script (no changes) ===

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
ee/maintained-apps/ingesters/homebrew/scripts.go (1)

60-76: ⚡ Quick win

Consider propagating copy failures on the App path too.

The Pkg path now captures the installer exit code and exits non-zero on failure via RelaunchAndPropagateInstallStatus, but the App-copy path still ends with a bare relaunch_application. Since the generated script has no set -e, a failed sudo cp -R is followed by relaunch_application (which exits 0), so the script returns success and a failed install is reported as installed — the same class of bug this PR fixes for pkg.

♻️ Reuse the propagation helper for consistency
-			// Relaunch the app if it was running before installation
-			sb.Writef("relaunch_application '%s'", app.UniqueIdentifier)
+			// Relaunch the app if it was running before installation, then
+			// propagate a failed copy so it isn't reported as successful.
+			sb.RelaunchAndPropagateInstallStatus(app.UniqueIdentifier)
Note: with multiple `App` items only the last `cp`'s status is captured, but that still beats unconditionally reporting success.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/ingesters/homebrew/scripts.go` around lines 60 - 76, The
App-copy path currently always calls relaunch_application and can mask copy
failures; modify the block that calls sb.Copy (inside the loop over
artifact.App) to capture the cp/mv exit status and propagate it the same way the
Pkg path does by invoking the existing RelaunchAndPropagateInstallStatus helper
instead of an unconditional relaunch_application; specifically, after each
sb.Copy(appPath, "$APPDIR") (or at least after the loop) record the last
command's exit code and call RelaunchAndPropagateInstallStatus with
app.UniqueIdentifier so a failed sudo cp causes the script to exit non-zero and
still relaunch the app if appropriate.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ee/maintained-apps/ingesters/homebrew/scripts.go`:
- Around line 60-76: The App-copy path currently always calls
relaunch_application and can mask copy failures; modify the block that calls
sb.Copy (inside the loop over artifact.App) to capture the cp/mv exit status and
propagate it the same way the Pkg path does by invoking the existing
RelaunchAndPropagateInstallStatus helper instead of an unconditional
relaunch_application; specifically, after each sb.Copy(appPath, "$APPDIR") (or
at least after the loop) record the last command's exit code and call
RelaunchAndPropagateInstallStatus with app.UniqueIdentifier so a failed sudo cp
causes the script to exit non-zero and still relaunch the app if appropriate.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fda72519-20db-4578-9bfb-1ba221d816ea

📥 Commits

Reviewing files that changed from the base of the PR and between 4a739b2 and ade6ce9.

📒 Files selected for processing (1)
  • ee/maintained-apps/ingesters/homebrew/scripts.go

cdcme
cdcme previously approved these changes May 30, 2026
@allenhouchins

Copy link
Copy Markdown
Member Author

@copilot resolve the merge conflicts in this pull request

Copilot AI dismissed stale reviews from cdcme and fleet-release via ac14d55 June 1, 2026 02:17

Copilot AI commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflict in scripts_test.go — the file now includes both the DMG test added in main (TestInstallScriptDmgExtractUsesYesPipe) and our pkg tests (TestInstallScriptForPkgWithoutPkgArtifact, TestInstallScriptForPkgWithPkgArtifact). All tests pass.

fleet-release
fleet-release previously approved these changes Jun 1, 2026
cdcme
cdcme previously approved these changes Jun 1, 2026
@allenhouchins
allenhouchins dismissed stale reviews from cdcme and fleet-release via 093ef86 June 1, 2026 13:31
@allenhouchins
allenhouchins merged commit 9f46c84 into main Jun 1, 2026
45 checks passed
@allenhouchins
allenhouchins deleted the allenhouchins-update-default-scripting branch June 1, 2026 14:52
allenhouchins added a commit that referenced this pull request Jun 1, 2026
…ct and URL override is used" (#46574)

Reverts #45893

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved application installation for 1Password, Slack, and Zoom by
implementing graceful application shutdown before installation and
automatic restart after completion.
* Enhanced installation reliability by simplifying application lifecycle
management during package updates, reducing potential conflicts from
running applications during installation processes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants