Update Fleet-maintained apps - #49804
Closed
fleet-release wants to merge 1 commit into
Closed
Conversation
Generated automatically with cmd/maintained-apps.
Contributor
Script Diff Resultsee/maintained-apps/outputs/advanced-installer/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/akiflow/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/amie/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/aws-cli/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/betterzip/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/beyond-compare/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/brave-browser/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/brave-browser/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/cleanmymac/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/clop/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/comet/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/cursor/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/dataflare/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/dataflare/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/datagrip/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/datagrip/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/dockside/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/firefox@developer-edition/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/firefox@nightly/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/google-ads-editor/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/google-gemini/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/granola/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/granola/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/hwmonitor/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/kiro-cli/darwin.json=== Install Script (no changes) ===
=== Uninstall // 31b59062 -> ed98f0de ===
--- /tmp/old.sFwPgh 2026-07-23 05:09:04.354861718 +0000
+++ /tmp/new.LWeU0b 2026-07-23 05:09:04.354861718 +0000
@@ -5,6 +5,76 @@
LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
# functions
+remove_launchctl_service() {
+ local service="$1"
+ local booleans=("true" "false")
+ local plist_status
+ local paths
+ local should_sudo
+
+ echo "Removing launchctl service ${service}"
+
+ # A wildcard label can't be used with launchctl or as a plist name, so expand
+ # it to the labels of currently loaded services that match the pattern.
+ local services=("$service")
+ if [[ "$service" == *"*"* ]]; then
+ local regex
+ # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so
+ # it matches a full label rather than a substring.
+ regex=$(printf '%s' "$service" | sed -e 's/[][(){}.^$+?|\\]/\\&/g' -e 's/\*/.*/g')
+ regex="^${regex}$"
+ services=()
+ local id
+ # Match every loaded job by label regardless of PID; launchctl list reports
+ # loaded-but-not-running jobs with a "-" in the PID column.
+ while read -r _ _ id; do
+ [[ "$id" =~ $regex ]] && services+=("$id")
+ done < <(launchctl list 2>/dev/null | tail -n +2)
+ if [[ ${#services[@]} -eq 0 ]]; then
+ echo "No loaded launchctl service matches ${service}"
+ return
+ fi
+ fi
+
+ local service_label
+ for service_label in "${services[@]}"; do
+ for should_sudo in "${booleans[@]}"; do
+ plist_status=$(launchctl list "${service_label}" 2>/dev/null)
+
+ if [[ $plist_status == \{* ]]; then
+ if [[ $should_sudo == "true" ]]; then
+ sudo launchctl remove "${service_label}"
+ else
+ launchctl remove "${service_label}"
+ fi
+ sleep 1
+ fi
+
+ paths=(
+ "/Library/LaunchAgents/${service_label}.plist"
+ "/Library/LaunchDaemons/${service_label}.plist"
+ )
+
+ # if not using sudo, prepend the home directory to the paths
+ if [[ $should_sudo == "false" ]]; then
+ for i in "${!paths[@]}"; do
+ paths[i]="${HOME}${paths[i]}"
+ done
+ fi
+
+ for path in "${paths[@]}"; do
+ if [[ -e "$path" ]]; then
+ if [[ $should_sudo == "true" ]]; then
+ sudo rm -f -- "$path"
+ else
+ rm -f -- "$path"
+ fi
+ fi
+ done
+ done
+ done
+}
+
trash() {
local logged_in_user="$1"
local target_file="$2"
@@ -52,10 +122,14 @@
fi
}
+remove_launchctl_service 'com.amazon.codewhisperer.launcher'
sudo rm -rf "$APPDIR/Kiro CLI.app"
trash $LOGGED_IN_USER '~/.kiro'
trash $LOGGED_IN_USER '~/.local/bin/kiro-cli'
trash $LOGGED_IN_USER '~/.local/bin/kiro-cli-chat'
trash $LOGGED_IN_USER '~/Library/Application Support/kiro-cli'
+trash $LOGGED_IN_USER '~/Library/Caches/com.amazon.codewhisperer'
trash $LOGGED_IN_USER '~/Library/Caches/dev.kiro.cli'
+trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.amazon.codewhisperer.launcher.plist'
trash $LOGGED_IN_USER '~/Library/Preferences/dev.kiro.cli.plist'
+trash $LOGGED_IN_USER '~/Library/WebKit/com.amazon.codewhisperer'ee/maintained-apps/outputs/kiro/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/kiro/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/lookaway/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/loom/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/loom/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/macwhisper/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/marsedit/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/megasync/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/microsoft-teams/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/microsoft-teams/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/mozilla-vpn/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/mozilla-vpn/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/naps2/darwin.json=== Install // 54ba1114 -> 27c40399 ===
--- /tmp/old.eX8Ssk 2026-07-23 05:09:04.882853494 +0000
+++ /tmp/new.ye3a39 2026-07-23 05:09:04.882853494 +0000
@@ -96,5 +96,5 @@
# install pkg files
quit_and_track_application 'com.naps2.desktop'
-sudo installer -pkg "$TMPDIR/naps2-8.3.1-mac-arm64.pkg" -target /
+sudo installer -pkg "$TMPDIR/naps2-8.3.2-mac-arm64.pkg" -target /
relaunch_application 'com.naps2.desktop'
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/naps2/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/nosql-workbench/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/nosql-workbench/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/notepadexe/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/obs/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/only-switch/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/onlyoffice/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/popclip/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/powerphotos/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/powershell/windows.json=== Install Script (no changes) ===
=== Uninstall // 0995d374 -> 06cf76b8 ===
--- /tmp/old.7RrdAB 2026-07-23 05:09:05.365845972 +0000
+++ /tmp/new.wWzBRP 2026-07-23 05:09:05.366845956 +0000
@@ -1,4 +1,4 @@
-$product_code = '{7B031DCF-BDCE-47D6-89B9-4C558D76E773}'
+$product_code = '{92D9A5DC-8C64-40D5-B1BC-98DB9C7FDB7F}'
$timeoutSeconds = 300 # 5 minute timeout
# Fleet uninstalls app using product code that's extracted on uploadee/maintained-apps/outputs/prisma-browser/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/pritunl/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/pritunl/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/rider/darwin.json=== Install Script (no changes) ===
=== Uninstall // c52dae57 -> 22db20ac ===
--- /tmp/old.VKqBZM 2026-07-23 05:09:05.535843304 +0000
+++ /tmp/new.M8atQ6 2026-07-23 05:09:05.535843304 +0000
@@ -54,9 +54,9 @@
sudo rm -rf "$APPDIR/Rider.app"
sudo rm -rf 'rider'
-trash $LOGGED_IN_USER '~/Library/Application Support/Rider2026.1'
-trash $LOGGED_IN_USER '~/Library/Caches/Rider2026.1'
-trash $LOGGED_IN_USER '~/Library/Logs/Rider2026.1'
+trash $LOGGED_IN_USER '~/Library/Application Support/Rider2026.2'
+trash $LOGGED_IN_USER '~/Library/Caches/Rider2026.2'
+trash $LOGGED_IN_USER '~/Library/Logs/Rider2026.2'
trash $LOGGED_IN_USER '~/Library/Preferences/jetbrains.rider.71e559ef.plist'
-trash $LOGGED_IN_USER '~/Library/Preferences/Rider2026.1'
+trash $LOGGED_IN_USER '~/Library/Preferences/Rider2026.2'
trash $LOGGED_IN_USER '~/Library/Saved Application State/com.jetbrains.rider.savedState'ee/maintained-apps/outputs/rive/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/rustrover/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/setapp/darwin.json=== Install Script (no changes) ===
=== Uninstall // e23bd29d -> 9ef05eb6 ===
--- /tmp/old.OiCZZ2 2026-07-23 05:09:05.663841279 +0000
+++ /tmp/new.VYpegK 2026-07-23 05:09:05.663841279 +0000
@@ -5,6 +5,76 @@
LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
# functions
+remove_launchctl_service() {
+ local service="$1"
+ local booleans=("true" "false")
+ local plist_status
+ local paths
+ local should_sudo
+
+ echo "Removing launchctl service ${service}"
+
+ # A wildcard label can't be used with launchctl or as a plist name, so expand
+ # it to the labels of currently loaded services that match the pattern.
+ local services=("$service")
+ if [[ "$service" == *"*"* ]]; then
+ local regex
+ # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so
+ # it matches a full label rather than a substring.
+ regex=$(printf '%s' "$service" | sed -e 's/[][(){}.^$+?|\\]/\\&/g' -e 's/\*/.*/g')
+ regex="^${regex}$"
+ services=()
+ local id
+ # Match every loaded job by label regardless of PID; launchctl list reports
+ # loaded-but-not-running jobs with a "-" in the PID column.
+ while read -r _ _ id; do
+ [[ "$id" =~ $regex ]] && services+=("$id")
+ done < <(launchctl list 2>/dev/null | tail -n +2)
+ if [[ ${#services[@]} -eq 0 ]]; then
+ echo "No loaded launchctl service matches ${service}"
+ return
+ fi
+ fi
+
+ local service_label
+ for service_label in "${services[@]}"; do
+ for should_sudo in "${booleans[@]}"; do
+ plist_status=$(launchctl list "${service_label}" 2>/dev/null)
+
+ if [[ $plist_status == \{* ]]; then
+ if [[ $should_sudo == "true" ]]; then
+ sudo launchctl remove "${service_label}"
+ else
+ launchctl remove "${service_label}"
+ fi
+ sleep 1
+ fi
+
+ paths=(
+ "/Library/LaunchAgents/${service_label}.plist"
+ "/Library/LaunchDaemons/${service_label}.plist"
+ )
+
+ # if not using sudo, prepend the home directory to the paths
+ if [[ $should_sudo == "false" ]]; then
+ for i in "${!paths[@]}"; do
+ paths[i]="${HOME}${paths[i]}"
+ done
+ fi
+
+ for path in "${paths[@]}"; do
+ if [[ -e "$path" ]]; then
+ if [[ $should_sudo == "true" ]]; then
+ sudo rm -f -- "$path"
+ else
+ rm -f -- "$path"
+ fi
+ fi
+ done
+ done
+ done
+}
+
trash() {
local logged_in_user="$1"
local target_file="$2"
@@ -52,10 +122,19 @@
fi
}
+remove_launchctl_service 'com.setapp.DesktopClient.SetappAgent'
+remove_launchctl_service 'com.setapp.DesktopClient.SetappAssistant'
+remove_launchctl_service 'com.setapp.DesktopClient.SetappLauncher'
+remove_launchctl_service 'com.setapp.DesktopClient.SetappUpdater'
sudo rm -rf "$APPDIR/Setapp.app"
trash $LOGGED_IN_USER '~/Library/Application Scripts/com.setapp.DesktopClient.SetappAgent.FinderSyncExt'
+trash $LOGGED_IN_USER '~/Library/Application Support/Setapp*'
trash $LOGGED_IN_USER '~/Library/Caches/com.setapp.DesktopClient'
trash $LOGGED_IN_USER '~/Library/Caches/com.setapp.DesktopClient.SetappAgent'
+trash $LOGGED_IN_USER '~/Library/Containers/com.setapp.DesktopClient.SetappAgent.FinderSyncExt'
+trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.setapp.DesktopClient*'
+trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.setapp.DesktopClient.*plist'
trash $LOGGED_IN_USER '~/Library/Logs/Setapp'
+trash $LOGGED_IN_USER '~/Library/Preferences/com.setapp.DesktopClient.plist'
trash $LOGGED_IN_USER '~/Library/Preferences/com.setapp.DesktopClient.SetappAgent.plist'
trash $LOGGED_IN_USER '~/Library/Saved Application State/com.setapp.DesktopClient.savedState'ee/maintained-apps/outputs/signal/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/signal/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/snagit/darwin.json=== Install Script (no changes) ===
=== Uninstall // b52ff2b2 -> 59bfdeae ===
--- /tmp/old.OkwBaR 2026-07-23 05:09:05.784839364 +0000
+++ /tmp/new.lNYPY2 2026-07-23 05:09:05.785839348 +0000
@@ -5,6 +5,46 @@
LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
# functions
+quit_application() {
+ local bundle_id="$1"
+ local timeout_duration=10
+
+ # check if the application is running
+ local app_running
+ app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+ if [[ "$app_running" != "true" ]]; then
+ return
+ fi
+
+ local console_user
+ console_user=$(stat -f "%Su" /dev/console)
+ if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+ echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+ return
+ fi
+
+ echo "Quitting application '$bundle_id'..."
+
+ # try to quit the application within the timeout period
+ local quit_success=false
+ SECONDS=0
+ while (( SECONDS < timeout_duration )); do
+ if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+ if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+ echo "Application '$bundle_id' quit successfully."
+ quit_success=true
+ break
+ fi
+ fi
+ sleep 1
+ done
+
+ if [[ "$quit_success" = false ]]; then
+ echo "Application '$bundle_id' did not quit."
+ fi
+}
+
+
trash() {
local logged_in_user="$1"
local target_file="$2"
@@ -52,9 +92,14 @@
fi
}
+quit_application 'com.TechSmith.Snagit'
sudo rm -rf "$APPDIR/Snagit.app"
+trash $LOGGED_IN_USER '~/Library/Application Scripts/7TQL462TU8.com.techsmith.snagit'
+trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.techsmith.snagit.sfl*'
+trash $LOGGED_IN_USER '~/Library/Application Support/Snagit'
trash $LOGGED_IN_USER '~/Library/Caches/com.TechSmith.Snagit*'
trash $LOGGED_IN_USER '~/Library/Group Containers/*.com.techsmith.snagit'
+trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.TechSmith.Snagit*'
trash $LOGGED_IN_USER '~/Library/Preferences/com.TechSmith.Snagit*.plist'
trash $LOGGED_IN_USER '~/Library/Preferences/com.techsmith.snagit.capturehelper*.plist'
trash $LOGGED_IN_USER '~/Library/Saved Application State/com.TechSmith.Snagit*.savedState'ee/maintained-apps/outputs/sourcetree/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/superwhisper/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/tabby/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/trezor-suite/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/typora/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/visual-studio-code/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/vivaldi/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/wechat/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/whatsapp/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/workflowy/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/zed/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/zed/windows.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) === |
Contributor
WalkthroughUpdated maintained-app output manifests for newer application releases across macOS and Windows. Changes primarily synchronize version fields, SQL patch-detection thresholds, installer URLs, and SHA-256 checksums. Several entries also update installer or uninstaller script references and payloads, including cleanup paths, launch services, MSI product codes, and application termination behavior. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)ee/maintained-apps/outputs/advanced-installer/windows.jsonTraceback (most recent call last): ee/maintained-apps/outputs/akiflow/darwin.jsonTraceback (most recent call last): ee/maintained-apps/outputs/amie/darwin.jsonTraceback (most recent call last):
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ee/maintained-apps/outputs/google-gemini/darwin.json`:
- Around line 4-7: Update the artifact configuration in
ee/maintained-apps/outputs/google-gemini/darwin.json lines 4-7 to use an
immutable, version-specific Gemini download URL and replace sha256: "no_check"
with the artifact’s verified SHA-256; apply the same change to
ee/maintained-apps/outputs/whatsapp/darwin.json lines 4-7 for the pinned
WhatsApp version, keeping each queries.patched version aligned with its
downloaded artifact.
In `@ee/maintained-apps/outputs/kiro-cli/darwin.json`:
- Line 20: Update the uninstall flow around remove_launchctl_service and the
com.amazon.codewhisperer.launcher call to resolve /Users/$LOGGED_IN_USER, obtain
that user’s UID, and invoke launchctl remove through launchctl asuser in the
console user’s domain before deleting the plist. Ensure the user-domain unload
occurs even when the script itself runs elevated, while preserving the existing
cleanup behavior.
In `@ee/maintained-apps/outputs/onlyoffice/darwin.json`:
- Around line 9-12: Align the installer_url in the OnlyOffice Darwin
configuration with install_script_ref 5beeff19 by restoring a ZIP archive URL,
or replace that referenced install script with a DMG-mounting implementation and
update install_script_ref accordingly. Ensure the installer format and
installation payload are compatible so ONLYOFFICE.app is copied successfully.
In `@ee/maintained-apps/outputs/setapp/darwin.json`:
- Line 20: Update remove_launchctl_service to run user-scoped launchctl list and
remove operations through launchctl asuser using the UID resolved from
LOGGED_IN_USER, while retaining sudo handling for system-domain operations.
Derive non-sudo plist paths from /Users/$LOGGED_IN_USER instead of $HOME so
service unloading and file cleanup target the logged-in user’s domain.
In `@ee/maintained-apps/outputs/visual-studio-code/darwin.json`:
- Line 9: Update the Visual Studio Code 1.130.0 artifact entry in darwin.json to
replace the sha256 value "no_check" with the verified SHA-256 checksum for the
installer URL, using an approved exception only if pinning is genuinely
unavailable.
In `@ee/maintained-apps/outputs/zed/darwin.json`:
- Around line 4-9: Update the generic Darwin Zed manifest’s installer_url to use
the Intel-compatible Zed-x86_64.dmg artifact for version 1.12.0 instead of
Zed-aarch64.dmg. Keep the existing version and query configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 0a451f48-cf46-4b7e-9ab5-336b58be65f9
📒 Files selected for processing (70)
ee/maintained-apps/outputs/advanced-installer/windows.jsonee/maintained-apps/outputs/akiflow/darwin.jsonee/maintained-apps/outputs/amie/darwin.jsonee/maintained-apps/outputs/aws-cli/windows.jsonee/maintained-apps/outputs/betterzip/darwin.jsonee/maintained-apps/outputs/beyond-compare/darwin.jsonee/maintained-apps/outputs/brave-browser/darwin.jsonee/maintained-apps/outputs/brave-browser/windows.jsonee/maintained-apps/outputs/cleanmymac/darwin.jsonee/maintained-apps/outputs/clop/darwin.jsonee/maintained-apps/outputs/comet/windows.jsonee/maintained-apps/outputs/cursor/darwin.jsonee/maintained-apps/outputs/dataflare/darwin.jsonee/maintained-apps/outputs/dataflare/windows.jsonee/maintained-apps/outputs/datagrip/darwin.jsonee/maintained-apps/outputs/datagrip/windows.jsonee/maintained-apps/outputs/dockside/darwin.jsonee/maintained-apps/outputs/firefox@developer-edition/darwin.jsonee/maintained-apps/outputs/firefox@nightly/darwin.jsonee/maintained-apps/outputs/google-ads-editor/windows.jsonee/maintained-apps/outputs/google-gemini/darwin.jsonee/maintained-apps/outputs/granola/darwin.jsonee/maintained-apps/outputs/granola/windows.jsonee/maintained-apps/outputs/hwmonitor/windows.jsonee/maintained-apps/outputs/kiro-cli/darwin.jsonee/maintained-apps/outputs/kiro/darwin.jsonee/maintained-apps/outputs/kiro/windows.jsonee/maintained-apps/outputs/lookaway/darwin.jsonee/maintained-apps/outputs/loom/darwin.jsonee/maintained-apps/outputs/loom/windows.jsonee/maintained-apps/outputs/macwhisper/darwin.jsonee/maintained-apps/outputs/marsedit/darwin.jsonee/maintained-apps/outputs/megasync/windows.jsonee/maintained-apps/outputs/microsoft-teams/darwin.jsonee/maintained-apps/outputs/microsoft-teams/windows.jsonee/maintained-apps/outputs/mozilla-vpn/darwin.jsonee/maintained-apps/outputs/mozilla-vpn/windows.jsonee/maintained-apps/outputs/naps2/darwin.jsonee/maintained-apps/outputs/naps2/windows.jsonee/maintained-apps/outputs/nosql-workbench/darwin.jsonee/maintained-apps/outputs/nosql-workbench/windows.jsonee/maintained-apps/outputs/notepadexe/darwin.jsonee/maintained-apps/outputs/obs/darwin.jsonee/maintained-apps/outputs/only-switch/darwin.jsonee/maintained-apps/outputs/onlyoffice/darwin.jsonee/maintained-apps/outputs/popclip/darwin.jsonee/maintained-apps/outputs/powerphotos/darwin.jsonee/maintained-apps/outputs/powershell/windows.jsonee/maintained-apps/outputs/prisma-browser/windows.jsonee/maintained-apps/outputs/pritunl/darwin.jsonee/maintained-apps/outputs/pritunl/windows.jsonee/maintained-apps/outputs/rider/darwin.jsonee/maintained-apps/outputs/rive/darwin.jsonee/maintained-apps/outputs/rustrover/windows.jsonee/maintained-apps/outputs/setapp/darwin.jsonee/maintained-apps/outputs/signal/darwin.jsonee/maintained-apps/outputs/signal/windows.jsonee/maintained-apps/outputs/snagit/darwin.jsonee/maintained-apps/outputs/sourcetree/darwin.jsonee/maintained-apps/outputs/superwhisper/darwin.jsonee/maintained-apps/outputs/tabby/darwin.jsonee/maintained-apps/outputs/trezor-suite/darwin.jsonee/maintained-apps/outputs/typora/windows.jsonee/maintained-apps/outputs/visual-studio-code/darwin.jsonee/maintained-apps/outputs/vivaldi/darwin.jsonee/maintained-apps/outputs/wechat/darwin.jsonee/maintained-apps/outputs/whatsapp/darwin.jsonee/maintained-apps/outputs/workflowy/darwin.jsonee/maintained-apps/outputs/zed/darwin.jsonee/maintained-apps/outputs/zed/windows.json
Comment on lines
+4
to
+7
| "version": "1.86.7.600", | ||
| "queries": { | ||
| "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.google.GeminiMacOS';", | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.google.GeminiMacOS' AND version_compare(bundle_short_version, '1.84.4.574') < 0);" | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.google.GeminiMacOS' AND version_compare(bundle_short_version, '1.86.7.600') < 0);" |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Ensure the installer artifact matches the pinned version.
Both manifests pin a specific version while retaining a generic download endpoint and sha256: "no_check". If the vendor endpoint advances, Fleet can install a different release than the version represented by queries.patched, without integrity validation.
ee/maintained-apps/outputs/google-gemini/darwin.json#L4-L7: use a versioned/immutable Gemini artifact and record its SHA-256.ee/maintained-apps/outputs/whatsapp/darwin.json#L4-L7: use a versioned/immutable WhatsApp artifact and record its SHA-256.
📍 Affects 2 files
ee/maintained-apps/outputs/google-gemini/darwin.json#L4-L7(this comment)ee/maintained-apps/outputs/whatsapp/darwin.json#L4-L7
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/google-gemini/darwin.json` around lines 4 - 7,
Update the artifact configuration in
ee/maintained-apps/outputs/google-gemini/darwin.json lines 4-7 to use an
immutable, version-specific Gemini download URL and replace sha256: "no_check"
with the artifact’s verified SHA-256; apply the same change to
ee/maintained-apps/outputs/whatsapp/darwin.json lines 4-7 for the pinned
WhatsApp version, keeping each queries.patched version aligned with its
downloaded artifact.
| "31b59062": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nsudo rm -rf \"$APPDIR/Kiro CLI.app\"\ntrash $LOGGED_IN_USER '~/.kiro'\ntrash $LOGGED_IN_USER '~/.local/bin/kiro-cli'\ntrash $LOGGED_IN_USER '~/.local/bin/kiro-cli-chat'\ntrash $LOGGED_IN_USER '~/Library/Application Support/kiro-cli'\ntrash $LOGGED_IN_USER '~/Library/Caches/dev.kiro.cli'\ntrash $LOGGED_IN_USER '~/Library/Preferences/dev.kiro.cli.plist'\n", | ||
| "7bf3d706": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# extract contents\nMOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)\nyes | hdiutil attach -plist -nobrowse -readonly -mountpoint \"$MOUNT_POINT\" \"$INSTALLER_PATH\" || exit 1\nsudo cp -R \"$MOUNT_POINT\"/* \"$TMPDIR\"\nhdiutil detach \"$MOUNT_POINT\" || true\n# copy to the applications folder\nquit_and_track_application 'dev.kiro.cli'\nif [ -d \"$APPDIR/Kiro CLI.app\" ]; then\n\tsudo mv \"$APPDIR/Kiro CLI.app\" \"$TMPDIR/Kiro CLI.app.bkp\"\nfi\nsudo cp -R \"$TMPDIR/Kiro CLI.app\" \"$APPDIR\"\nrelaunch_application 'dev.kiro.cli'\n" | ||
| "7bf3d706": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# extract contents\nMOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)\nyes | hdiutil attach -plist -nobrowse -readonly -mountpoint \"$MOUNT_POINT\" \"$INSTALLER_PATH\" || exit 1\nsudo cp -R \"$MOUNT_POINT\"/* \"$TMPDIR\"\nhdiutil detach \"$MOUNT_POINT\" || true\n# copy to the applications folder\nquit_and_track_application 'dev.kiro.cli'\nif [ -d \"$APPDIR/Kiro CLI.app\" ]; then\n\tsudo mv \"$APPDIR/Kiro CLI.app\" \"$TMPDIR/Kiro CLI.app.bkp\"\nfi\nsudo cp -R \"$TMPDIR/Kiro CLI.app\" \"$APPDIR\"\nrelaunch_application 'dev.kiro.cli'\n", | ||
| "ed98f0de": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nremove_launchctl_service() {\n local service=\"$1\"\n local booleans=(\"true\" \"false\")\n local plist_status\n local paths\n local should_sudo\n\n echo \"Removing launchctl service ${service}\"\n\n # A wildcard label can't be used with launchctl or as a plist name, so expand\n # it to the labels of currently loaded services that match the pattern.\n local services=(\"$service\")\n if [[ \"$service\" == *\"*\"* ]]; then\n local regex\n # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n # it matches a full label rather than a substring.\n regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n regex=\"^${regex}$\"\n services=()\n local id\n # Match every loaded job by label regardless of PID; launchctl list reports\n # loaded-but-not-running jobs with a \"-\" in the PID column.\n while read -r _ _ id; do\n [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n done < <(launchctl list 2>/dev/null | tail -n +2)\n if [[ ${#services[@]} -eq 0 ]]; then\n echo \"No loaded launchctl service matches ${service}\"\n return\n fi\n fi\n\n local service_label\n for service_label in \"${services[@]}\"; do\n for should_sudo in \"${booleans[@]}\"; do\n plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n if [[ $plist_status == \\{* ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo launchctl remove \"${service_label}\"\n else\n launchctl remove \"${service_label}\"\n fi\n sleep 1\n fi\n\n paths=(\n \"/Library/LaunchAgents/${service_label}.plist\"\n \"/Library/LaunchDaemons/${service_label}.plist\"\n )\n\n # if not using sudo, prepend the home directory to the paths\n if [[ $should_sudo == \"false\" ]]; then\n for i in \"${!paths[@]}\"; do\n paths[i]=\"${HOME}${paths[i]}\"\n done\n fi\n\n for path in \"${paths[@]}\"; do\n if [[ -e \"$path\" ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo rm -f -- \"$path\"\n else\n rm -f -- \"$path\"\n fi\n fi\n done\n done\n done\n}\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nremove_launchctl_service 'com.amazon.codewhisperer.launcher'\nsudo rm -rf \"$APPDIR/Kiro CLI.app\"\ntrash $LOGGED_IN_USER '~/.kiro'\ntrash $LOGGED_IN_USER '~/.local/bin/kiro-cli'\ntrash $LOGGED_IN_USER '~/.local/bin/kiro-cli-chat'\ntrash $LOGGED_IN_USER '~/Library/Application Support/kiro-cli'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.amazon.codewhisperer'\ntrash $LOGGED_IN_USER '~/Library/Caches/dev.kiro.cli'\ntrash $LOGGED_IN_USER '~/Library/LaunchAgents/com.amazon.codewhisperer.launcher.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/dev.kiro.cli.plist'\ntrash $LOGGED_IN_USER '~/Library/WebKit/com.amazon.codewhisperer'\n" |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo files matching kiro-cli outputs =="
git ls-files | rg 'kiro-cli|darwin\.json|maintained-apps|output' | head -200
echo
echo "== target file head =="
if [ -f ee/maintained-apps/outputs/kiro-cli/darwin.json ]; then
wc -l ee/maintained-apps/outputs/kiro-cli/darwin.json
sed -n '1,120p' ee/maintained-apps/outputs/kiro-cli/darwin.json | cat -n
else
echo "target file not found"
fi
echo
echo "== related uninstall outputs containing launchctl/remove_launchctl_service =="
rg -n "launchctl|remove_launchctl_service|asuser|ConsoleUser|scutil|~\s*\$LOGGED_IN_USER|LOGGED_IN_USER" ee/maintained-apps/outputs -g '*.json' || true
echo
echo "== changed files diff stat/name only =="
git diff --stat || true
git diff -- ee/maintained-apps/outputs/kiro-cli/darwin.json | sed -n '1,180p' || trueRepository: fleetdm/fleet
Length of output: 11071
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repository context =="
pwd
git rev-parse --show-toplevel 2>/dev/null || true
git rev-parse --show-prefix 2>/dev/null || true
echo
echo "== target file if present =="
if [ -f ee/maintained-apps/outputs/kiro-cli/darwin.json ]; then
echo "ee/maintained-apps/outputs/kiro-cli/darwin.json exists"
wc -l ee/maintained-apps/outputs/kiro-cli/darwin.json
sed -n '1,140p' ee/maintained-apps/outputs/kiro-cli/darwin.json | cat -n
else
echo "ee/maintained-apps/outputs/kiro-cli/darwin.json not found"
fi
echo
echo "== launchctl/remove patterns in maintained-apps outputs =="
rg -n "launchctl|remove_launchctl_service|asuser|ConsoleUser|scutil|~\s*\$LOGGED_IN_USER|LOGGED_IN_USER|trash" ee/maintained-apps/outputs -g '*.json' || true
echo
echo "== diff context =="
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
git diff --stat || true
git diff -- ee/maintained-apps/outputs/kiro-cli/darwin.json | sed -n '1,220p' || true
fiRepository: fleetdm/fleet
Length of output: 50370
Unload the console user’s launchd job before deleting its plist.
When this uninstall script runs elevated, the non-sudo branch still uses root’s $HOME and root’s launchctl domain, so com.amazon.codewhisperer.launcher may remain loaded for the logged-in user. The later trash calls only move/remove the plist and do not unload an already-running agent. Resolve /Users/$LOGGED_IN_USER, get that user’s UID, and run the removal in the user launchd domain with launchctl asuser before deleting the plist.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/kiro-cli/darwin.json` at line 20, Update the
uninstall flow around remove_launchctl_service and the
com.amazon.codewhisperer.launcher call to resolve /Users/$LOGGED_IN_USER, obtain
that user’s UID, and invoke launchctl remove through launchctl asuser in the
console user’s domain before deleting the plist. Ensure the user-domain unload
occurs even when the script itself runs elevated, while preserving the existing
cleanup behavior.
Comment on lines
+9
to
+12
| "installer_url": "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v9.4.0/ONLYOFFICE-arm.dmg", | ||
| "install_script_ref": "5beeff19", | ||
| "uninstall_script_ref": "1f5bdb95", | ||
| "sha256": "9f689b3073f86ecda06cdf3a535bd694ba13f677423a66c623eb69f6e7fe096f", | ||
| "sha256": "e965be2222609add6b5a70baa2a8cdb599402491fb2925825d9039dcb154beb4", |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Keep the installer format aligned with install_script_ref.
The new URL is a .dmg, but the referenced script at Line [20] uses unzip "$INSTALLER_PATH". Installation will fail before ONLYOFFICE.app is copied. Restore a ZIP URL or replace the script with a DMG-mounting payload and update its ref.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/onlyoffice/darwin.json` around lines 9 - 12, Align
the installer_url in the OnlyOffice Darwin configuration with install_script_ref
5beeff19 by restoring a ZIP archive URL, or replace that referenced install
script with a DMG-mounting implementation and update install_script_ref
accordingly. Ensure the installer format and installation payload are compatible
so ONLYOFFICE.app is copied successfully.
| "refs": { | ||
| "1ba0fd31": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# extract contents\nunzip \"$INSTALLER_PATH\" -d \"$TMPDIR\"\n# copy to the applications folder\nquit_and_track_application 'com.setapp.DesktopClient.SetappAgent'\nif [ -d \"$APPDIR/Setapp.app\" ]; then\n\tsudo mv \"$APPDIR/Setapp.app\" \"$TMPDIR/Setapp.app.bkp\"\nfi\nsudo cp -R \"$TMPDIR/Setapp.app\" \"$APPDIR\"\nrelaunch_application 'com.setapp.DesktopClient.SetappAgent'\n", | ||
| "e23bd29d": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nsudo rm -rf \"$APPDIR/Setapp.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.setapp.DesktopClient.SetappAgent.FinderSyncExt'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.setapp.DesktopClient'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.setapp.DesktopClient.SetappAgent'\ntrash $LOGGED_IN_USER '~/Library/Logs/Setapp'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.setapp.DesktopClient.SetappAgent.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.setapp.DesktopClient.savedState'\n" | ||
| "9ef05eb6": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nremove_launchctl_service() {\n local service=\"$1\"\n local booleans=(\"true\" \"false\")\n local plist_status\n local paths\n local should_sudo\n\n echo \"Removing launchctl service ${service}\"\n\n # A wildcard label can't be used with launchctl or as a plist name, so expand\n # it to the labels of currently loaded services that match the pattern.\n local services=(\"$service\")\n if [[ \"$service\" == *\"*\"* ]]; then\n local regex\n # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so\n # it matches a full label rather than a substring.\n regex=$(printf '%s' \"$service\" | sed -e 's/[][(){}.^$+?|\\\\]/\\\\&/g' -e 's/\\*/.*/g')\n regex=\"^${regex}$\"\n services=()\n local id\n # Match every loaded job by label regardless of PID; launchctl list reports\n # loaded-but-not-running jobs with a \"-\" in the PID column.\n while read -r _ _ id; do\n [[ \"$id\" =~ $regex ]] && services+=(\"$id\")\n done < <(launchctl list 2>/dev/null | tail -n +2)\n if [[ ${#services[@]} -eq 0 ]]; then\n echo \"No loaded launchctl service matches ${service}\"\n return\n fi\n fi\n\n local service_label\n for service_label in \"${services[@]}\"; do\n for should_sudo in \"${booleans[@]}\"; do\n plist_status=$(launchctl list \"${service_label}\" 2>/dev/null)\n\n if [[ $plist_status == \\{* ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo launchctl remove \"${service_label}\"\n else\n launchctl remove \"${service_label}\"\n fi\n sleep 1\n fi\n\n paths=(\n \"/Library/LaunchAgents/${service_label}.plist\"\n \"/Library/LaunchDaemons/${service_label}.plist\"\n )\n\n # if not using sudo, prepend the home directory to the paths\n if [[ $should_sudo == \"false\" ]]; then\n for i in \"${!paths[@]}\"; do\n paths[i]=\"${HOME}${paths[i]}\"\n done\n fi\n\n for path in \"${paths[@]}\"; do\n if [[ -e \"$path\" ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo rm -f -- \"$path\"\n else\n rm -f -- \"$path\"\n fi\n fi\n done\n done\n done\n}\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nremove_launchctl_service 'com.setapp.DesktopClient.SetappAgent'\nremove_launchctl_service 'com.setapp.DesktopClient.SetappAssistant'\nremove_launchctl_service 'com.setapp.DesktopClient.SetappLauncher'\nremove_launchctl_service 'com.setapp.DesktopClient.SetappUpdater'\nsudo rm -rf \"$APPDIR/Setapp.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.setapp.DesktopClient.SetappAgent.FinderSyncExt'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Setapp*'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.setapp.DesktopClient'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.setapp.DesktopClient.SetappAgent'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.setapp.DesktopClient.SetappAgent.FinderSyncExt'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.setapp.DesktopClient*'\ntrash $LOGGED_IN_USER '~/Library/LaunchAgents/com.setapp.DesktopClient.*plist'\ntrash $LOGGED_IN_USER '~/Library/Logs/Setapp'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.setapp.DesktopClient.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.setapp.DesktopClient.SetappAgent.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.setapp.DesktopClient.savedState'\n" |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift
Run launchctl operations in the logged-in user’s domain.
Line [20] invokes launchctl list/remove in the script’s current bootstrap domain, but the script separately resolves LOGGED_IN_USER. Consequently, user-scoped Setapp agents may remain loaded after their plist files are moved to Trash; deleting the files does not unload existing services.
Use the console user’s UID with launchctl asuser for user-domain operations, and derive user paths from LOGGED_IN_USER rather than the process’s $HOME.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/setapp/darwin.json` at line 20, Update
remove_launchctl_service to run user-scoped launchctl list and remove operations
through launchctl asuser using the UID resolved from LOGGED_IN_USER, while
retaining sudo handling for system-domain operations. Derive non-sudo plist
paths from /Users/$LOGGED_IN_USER instead of $HOME so service unloading and file
cleanup target the logged-in user’s domain.
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.microsoft.VSCode' AND version_compare(bundle_short_version, '1.130.0') < 0);" | ||
| }, | ||
| "installer_url": "https://update.code.visualstudio.com/1.129.1/darwin-universal/stable", | ||
| "installer_url": "https://update.code.visualstudio.com/1.130.0/darwin-universal/stable", |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file =="
cat -n ee/maintained-apps/outputs/visual-studio-code/darwin.json
echo
echo "== relevant usages/overrides =="
rg -n '"installer_url"|"sha256"|"no_check"|visual-studio-code|vscode|visual studio code' ee/maintained-apps ee -g '*darwin.json' -g '*app.json' -g '*recipe*' -g '*policy*' || true
echo
echo "== git diff context =="
git diff -- ee/maintained-apps/outputs/visual-studio-code/darwin.json | sed -n '1,120p' || trueRepository: fleetdm/fleet
Length of output: 50370
🌐 Web query:
Visual Studio Code 1.130.0 darwin-universal downloaded checksum sha256
💡 Result:
To obtain the SHA256 checksum for a specific version of Visual Studio Code, such as 1.130.0, the most reliable and recommended method is to use the official Microsoft update API [1][2]. Microsoft does not publish a static list of checksums for all versions; instead, they provide a structured API that returns this information dynamically [1][2]. For Visual Studio Code 1.130.0, you can query the hash for the darwin-universal (macOS) build by using the following URL structure [1][2]: https://update.code.visualstudio.com/api/versions/1.130.0/darwin-universal/stable This request will return a JSON object containing the sha256hash field, which provides the verification hash for that specific installer [1][2]. Note that recent versions of Visual Studio Code for macOS have shifted to DMG-based installers [3][4]. If you are looking for the current DMG version, you may need to use the darwin-universal-dmg platform identifier in your API request [3][4]. Additional ways to verify hashes include: 1. The official Visual Studio Code download page, which lists checksums for the latest release [1][2]. 2. The global checksums file provided at https://code.visualstudio.com/sha?build=stable [2]. Using these official API endpoints ensures that you are receiving the verified checksums directly from Microsoft's update servers [1][2].
Citations:
- 1: Get SHA256 hash for Visual Studio Code installer file programmatically microsoft/vscode#122396
- 2: https://stackoverflow.com/questions/67287095/get-sha256-hash-for-visual-studio-code-installer-file-programmatically
- 3: Download URL not available microsoft/vscode#293818
- 4: Visual Studio Code download URLs have changed once again autopkg/jc0b-recipes#9
🌐 Web query:
Visual Studio Code darwin JSON checksum no_check verification policy
💡 Result:
There is no official "no_check" verification policy within Visual Studio Code’s internal update mechanism for macOS (darwin). The term "no_check" is not a configuration attribute or a verification policy used by the VS Code update service. VS Code on macOS utilizes the Electron/Squirrel.Mac framework for auto-updates [1]. This system handles the update process by checking for a newer version via an update server, downloading the package, and replacing the existing application [1][2]. The confusion likely stems from the Homebrew package manager's ecosystem. In Homebrew Casks, "sha256:no_check" is a well-known directive used to explicitly skip checksum verification for a package [3][4][5][6]. This is often used for casks where the upstream software is updated in-place (i.e., the URL does not change despite a new version) or where a stable checksum cannot be reliably provided [5][6][7]. In summary: - VS Code’s own auto-updater does not support or use a "no_check" policy [1][2]. - "sha256:no_check" is a specific identifier found in Homebrew Cask definitions to manage packages that do not provide verifiable checksums for every update [3][4][6]. If you are trying to manage VS Code updates, you should use the official "update.mode" setting in your VS Code configuration to control behavior (e.g., setting it to "none" to disable auto-updates) rather than relying on external checksum-skipping flags [8][9].
Citations:
- 1: Test: Switching update mode without restart (macOS) microsoft/vscode#324438
- 2: https://github.com/microsoft/vscode/blob/main/src/vs/platform/update/electron-main/abstractUpdateService.ts
- 3: https://github.com/Homebrew/brew/blob/master/Library/Homebrew/cask/audit.rb
- 4: Allow
--no-require-shaand Brewfilerequire_sha:false. Homebrew/homebrew-cask#102602 - 5: New audit: do not allow checksum on unversioned URL Homebrew/homebrew-cask#94253
- 6: allowing
sha256 :no_checkto overrideversion '<string>'Homebrew/homebrew-cask#6356 - 7: support a --ignore-sha flag to continue even if the SHA does not match Homebrew/homebrew-cask#89484
- 8: https://code.visualstudio.com/docs/setup/mac
- 9: https://code.visualstudio.com/docs/supporting/faq
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, urllib.request
urls = [
"https://update.code.visualstudio.com/api/versions/1.130.0/darwin-universal/stable",
"https://update.code.visualstudio.com/api/versions/1.130.0/darwin-universal-dmg/stable",
"https://update.code.visualstudio.com/1.130.0/darwin-universal/stable",
"https://update.code.visualstudio.com/1.130.0/darwin-universal-dmg/stable",
]
for url in urls:
try:
with urllib.request.urlopen(url, timeout=20) as r:
data = r.read(2_000_000)
print("OK", url, r.status, repr(data[:200]))
except Exception as e:
print("ERR", url, type(e).__name__, str(e))
PYRepository: fleetdm/fleet
Length of output: 1053
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import urllib.request
for suffix in ("/darwin-universal/stable", "/darwin-universal-dmg/stable"):
url = "https://update.code.visualstudio.com/1.130.0" + suffix
req = urllib.request.Request(url, headers={"User-Agent": "curl"})
try:
with urllib.request.urlopen(req, timeout=20) as r:
print("url", r.geturl(), "status", r.status)
for k, v in r.headers.items():
print(k, v)
b = r.read(2_000_000)
print("body", repr(b[:500]))
print("download_url", [line.decode("utf-8") for line in b.splitlines() if b".downloadUrl" in line][0] if any(b".downloadUrl" in line for line in b.splitlines()) else None)
except Exception as e:
print("ERR", url, type(e).__name__, str(e))
PYRepository: fleetdm/fleet
Length of output: 589
Pin a SHA-256 for the new VS Code artifact.
ee/maintained-apps/outputs/visual-studio-code/darwin.json points at Visual Studio Code 1.130.0 while sha256 is still "no_check", so this installer lacks pinned post-download integrity protection. Add the release checksum or replace "no_check" only with an approved exception.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/visual-studio-code/darwin.json` at line 9, Update
the Visual Studio Code 1.130.0 artifact entry in darwin.json to replace the
sha256 value "no_check" with the verified SHA-256 checksum for the installer
URL, using an approved exception only if pinning is genuinely unavailable.
Comment on lines
+4
to
+9
| "version": "1.12.0", | ||
| "queries": { | ||
| "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'dev.zed.Zed';", | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'dev.zed.Zed' AND version_compare(bundle_short_version, '1.11.3') < 0);" | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'dev.zed.Zed' AND version_compare(bundle_short_version, '1.12.0') < 0);" | ||
| }, | ||
| "installer_url": "https://zed.dev/api/releases/stable/1.11.3/Zed-aarch64.dmg", | ||
| "installer_url": "https://zed.dev/api/releases/stable/1.12.0/Zed-aarch64.dmg", |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- target manifest ---\n'
cat -n ee/maintained-apps/outputs/zed/darwin.json
printf '\n--- other zed manifests ---\n'
fd -a '.*zed.*' ee/maintained-apps/outputs || true
printf '\n--- files mentioning zed installer / architectures ---\n'
rg -n "zed|Zed|bundle_identifier|bundle.*arch|aarch64|x86|x64|arm64|architecture|installer_url|queries" ee/maintained-apps -S || trueRepository: fleetdm/fleet
Length of output: 242
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- target manifest ---'
cat -n ee/maintained-apps/outputs/zed/darwin.json || true
printf '%s\n' ''
printf '%s\n' '--- other zed manifests ---'
fd -a '.*zed.*' ee/maintained-apps/outputs || true
printf '%s\n' ''
printf '%s\n' '--- files mentioning zed installer / architectures ---'
rg -n "zed|Zed|bundle_identifier|bundle.*arch|aarch64|x86|x64|arm64|architecture|installer_url|queries" ee/maintained-apps -S || trueRepository: fleetdm/fleet
Length of output: 50370
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- zed mac manifests ---'
cat -n ee/maintained-apps/outputs/zed/darwin.json || true
printf '%s\n' ''
cat -n ee/maintained-apps/outputs/zed/windows.json | sed -n '1,14p' || true
printf '%s\n' ''
printf '%s\n' '--- maintained app architecture selectors/templates ==='
rg -n '"architecture"|architectures|darwin|arm64|aarch64|x86|x64|amd64|installer_url|bundle_identifier' ee/maintained-apps -S --max-count 80 | sed -n '1,120p' || true
printf '%s\n' ''
printf '%s\n' '--- all zed references in repo ==='
rg -n '\bzed\b|Zed|bundle_identifier = '\''dev\.zed\.Zed'\''' . -S --glob '!**/.git/**' --iglob '*zed*' | sed -n '1,200p' || trueRepository: fleetdm/fleet
Length of output: 26076
🌐 Web query:
Zed dev macOS downloads arm64 Intel universal official
💡 Result:
Zed offers separate, native builds for both Apple Silicon (aarch64) and Intel (x86_64) architectures on macOS rather than a single universal binary [1]. You can download the appropriate version directly from the official Zed website [2][3]. The official download page typically detects your system and provides the correct version, but both native installers are readily available [3][4]. For manual downloads, such as those found on the official GitHub releases page, you will see distinct files designated for each architecture (e.g., Zed-aarch64.dmg for Apple Silicon and Zed-x86_64.dmg for Intel Macs) [5][1]. Both versions run natively on their respective hardware, eliminating the need for the Rosetta 2 translation layer on Intel machines or emulation on Apple Silicon [6]. Zed supports macOS 10.15 (Catalina) and later [7][3].
Citations:
- 1: https://github.com/zed-industries/zed/releases/tag/v1.3.7
- 2: https://zed.dev/download
- 3: https://zed.dev/docs/macos
- 4: https://rosettacheck.com/apps/98bexzck
- 5: https://github.com/zed-industries/zed/releases
- 6: https://www.deployhq.com/guides/zed
- 7: https://zed.dev/docs/installation
🌐 Web query:
"zed.dev/api/releases/stable/1.12.0" "Zed-x86_64.dmg"
💡 Result:
The URL zed.dev/api/releases/stable/1.12.0/Zed-x86_64.dmg is the valid direct download link for the Intel-based macOS version of Zed release 1.12.0 [1]. Zed version 1.12.0 is a stable release [1]. You can access its dedicated release page at https://zed.dev/releases/stable/1.12.0 [1].
Citations:
🌐 Web query:
Zed 1.12.0 macOS arm64 universal dmg installer download site:zed.dev
💡 Result:
As of July 23, 2026, there is no official Zed version 1.12.0. The most recent stable release is version 1.11.3 [1][2]. Zed does not typically distribute installers as.dmg files; instead, it uses a streamlined installation process. You can download and install the latest stable version of Zed for macOS by visiting the official download page at https://zed.dev/download [1] or by using the following command in your terminal [1][3]: curl -f https://zed.dev/install.sh | sh After the initial installation, Zed automatically manages its own updates [3]. You can monitor future releases and verify the availability of version 1.12.0 on the official Zed stable releases page: https://zed.dev/releases/stable [4][5].
Citations:
- 1: https://zed.dev/download
- 2: https://zed.dev/releases/stable/1.11.3
- 3: https://zed.dev/docs/installation
- 4: https://zed.dev/releases/stable?b=57
- 5: https://zed.dev/releases/stable
Use an Intel-compatible artifact for the generic Darwin Zed manifest.
Zed-aarch64.dmg is an Apple Silicon-only installer, while the generic zed/darwin manifest has no architecture selector. For the v1.12.0 Intel Windows installer in this PR, use the matching Mac artifact https://zed.dev/api/releases/stable/1.12.0/Zed-x86_64.dmg or add verified architecture-aware selection.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/zed/darwin.json` around lines 4 - 9, Update the
generic Darwin Zed manifest’s installer_url to use the Intel-compatible
Zed-x86_64.dmg artifact for version 1.12.0 instead of Zed-aarch64.dmg. Keep the
existing version and query configuration unchanged.
Contributor
|
Closing in favor of #49807. |
This was referenced Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated ingestion of latest Fleet-maintained app data.
Summary by CodeRabbit