Find per-user and MSIX-packaged AI apps in the ai_tools Windows collector by juan-fdz-hawa · Pull Request #50771 · fleetdm/fleet

juan-fdz-hawa · 2026-08-07T14:50:10Z

Resolves #50704

scanApps read only HKLM plus the calling process's CURRENT_USER. Because fleetd runs as NT AUTHORITY\SYSTEM, CURRENT_USER resolves to SYSTEM's own empty hive, so per-user Electron/Squirrel installers (Ollama, ChatGPT desktop, LM Studio) were invisible — none of them offers a machine-wide install to begin with.

Walk the loaded hives under HKEY_USERS for real user SIDs, skipping _Classes hives and service accounts. Machine-wide roots are still searched first so an app installed both ways keeps scope "system".

Checklist for submitter

If some of the following don't apply, delete the relevant line.

Testing

Added/updated automated tests
QA'd all new/changed functionality manually

Summary by CodeRabbit

New Features
- Added Windows MSIX/Appx discovery for installed and per-user packages.
- App records now include improved vendor, version, installation path, source, and scope details.
- Combined registry and MSIX/Appx scanning reduces duplicate application entries.
- Expanded registry scanning across machine, current-user, and loaded real-user profiles.
Bug Fixes
- Unreadable registry locations, directories, and manifests no longer interrupt collection.
- Resource-only packages and invalid metadata are filtered out.
- Improved handling of package identity and publisher information.

juan-fdz-hawa · 2026-08-07T14:51:23Z

@coderabbitai full review

coderabbitai · 2026-08-07T14:51:27Z

✅ Action performed

Full review finished.

coderabbitai · 2026-08-07T14:55:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c483f824-00fa-4c6a-b5df-25ea3e7a65ad

📥 Commits

Reviewing files that changed from the base of the PR and between 6055e47 and b29f7e8.

⛔ Files ignored due to path filters (1)

orbit/pkg/table/ai_tools/README.md is excluded by !**/*.md

📒 Files selected for processing (5)

orbit/pkg/table/ai_tools/internal/apps/apps.go
orbit/pkg/table/ai_tools/internal/apps/appx.go
orbit/pkg/table/ai_tools/internal/apps/appx_scan_test.go
orbit/pkg/table/ai_tools/internal/apps/appx_test.go
orbit/pkg/table/ai_tools/internal/apps/appx_windows.go

🚧 Files skipped from review as they are similar to previous changes (3)

orbit/pkg/table/ai_tools/internal/apps/apps.go
orbit/pkg/table/ai_tools/internal/apps/appx_windows.go
orbit/pkg/table/ai_tools/internal/apps/appx.go

Walkthrough

Windows app scanning discovers uninstall entries from machine-wide, current-user, and loaded real-user registry hives. It filters non-user hives and skips registry access failures. Appx/MSIX scanning reads staged and per-user package directories, filters resource packages, extracts metadata, and assigns scope. A shared collector deduplicates registry and Appx results while preserving discovery order and metadata. Tests cover parsing, scanning, vendor extraction, hive filtering, and collection behavior.

Possibly related PRs

fleetdm/fleet#49243: This PR extends the Windows registry-based app scanning and shared collection code introduced by that pull request.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes detecting per-user and MSIX-packaged AI applications in the Windows collector.
Description check	✅ Passed	The description explains the issue, root cause, intended behavior, linked issue, and testing performed; omitted checklist items are non-critical here.
Linked Issues check	✅ Passed	The changes satisfy issue `#50704` by scanning real user hives, supporting per-user uninstall entries, preserving system scope, and detecting relevant applications.
Out of Scope Changes check	✅ Passed	The changes remain within scope because MSIX support, shared collection, deduplication, and related tests support the stated Windows app-detection objectives.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 50704-ai_tools-apps-collector-on-windows-cant-see-per-user-installed-ai-apps

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@orbit/pkg/table/ai_tools/internal/apps/usersid.go`:
- Around line 26-29: The isRealUserHive logic must validate complete SIDs rather
than accepting any non-empty suffix after a known prefix. In
orbit/pkg/table/ai_tools/internal/apps/usersid.go lines 26-29, update
isRealUserHive to require decimal SID segments and the correct segment count for
every accepted SID form. In
orbit/pkg/table/ai_tools/internal/apps/usersid_test.go lines 12-33, add coverage
for malformed suffixes including non-numeric segments and incorrect segment
counts.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 70e15708-8735-4917-8c4c-fa8f32f89e2a

📥 Commits

Reviewing files that changed from the base of the PR and between f656ac5 and 2763e08.

📒 Files selected for processing (3)

orbit/pkg/table/ai_tools/internal/apps/apps_windows.go
orbit/pkg/table/ai_tools/internal/apps/usersid.go
orbit/pkg/table/ai_tools/internal/apps/usersid_test.go

codecov · 2026-08-07T15:17:23Z

Codecov Report

❌ Patch coverage is 98.69281% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.55%. Comparing base (f292c7d) to head (b29f7e8).
⚠️ Report is 37 commits behind head on main.

Files with missing lines	Patch %	Lines
orbit/pkg/table/ai_tools/internal/apps/appx.go	98.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #50771      +/-   ##
==========================================
+ Coverage   68.50%   68.55%   +0.04%     
==========================================
  Files        3974     3983       +9     
  Lines      255606   256451     +845     
  Branches    13658    13658              
==========================================
+ Hits       175108   175812     +704     
- Misses      64901    65003     +102     
- Partials    15597    15636      +39

Flag	Coverage Δ
backend	`69.66% <98.69%> (+0.05%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai · 2026-08-07T19:40:07Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@orbit/pkg/table/ai_tools/internal/apps/appx_scan_test.go`:
- Around line 60-71: Extend TestScanAppxDirsResourcePackageSkipped to create a
package with a custom resource ID and a manifest containing
<Properties><ResourcePackage>true</ResourcePackage></Properties>. Verify
scanAppxDirs produces zero apps, covering resource packages that do not use the
split. prefix.

In `@orbit/pkg/table/ai_tools/internal/apps/appx.go`:
- Around line 43-45: The resource-package check in appxPackage.isResourcePackage
must use Properties/ResourcePackage from readAppxManifest() when the manifest is
readable, while retaining the split. ResourceID prefix check only as the
unreadable-manifest fallback. In
orbit/pkg/table/ai_tools/internal/apps/appx.go#L43-L45, update the
manifest-based candidate filtering accordingly; in
orbit/pkg/table/ai_tools/internal/apps/appx_scan_test.go#L60-L71, add coverage
for a non-split. ResourceID with ResourcePackage=true.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2681906b-0762-4f69-a5c9-7cc569a1f580

📥 Commits

Reviewing files that changed from the base of the PR and between fc97ff2 and e53f89e.

⛔ Files ignored due to path filters (1)

orbit/pkg/table/ai_tools/README.md is excluded by !**/*.md

📒 Files selected for processing (10)

orbit/pkg/table/ai_tools/internal/apps/apps.go
orbit/pkg/table/ai_tools/internal/apps/apps_windows.go
orbit/pkg/table/ai_tools/internal/apps/appx.go
orbit/pkg/table/ai_tools/internal/apps/appx_scan_test.go
orbit/pkg/table/ai_tools/internal/apps/appx_test.go
orbit/pkg/table/ai_tools/internal/apps/appx_windows.go
orbit/pkg/table/ai_tools/internal/apps/collect.go
orbit/pkg/table/ai_tools/internal/apps/collect_test.go
orbit/pkg/table/ai_tools/internal/apps/usersid.go
orbit/pkg/table/ai_tools/internal/apps/usersid_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

orbit/pkg/table/ai_tools/internal/apps/usersid.go
orbit/pkg/table/ai_tools/internal/apps/usersid_test.go

…ctor Resolves #50704 The apps collector read only HKLM and CURRENT_USER uninstall keys. Because the extension runs as SYSTEM, CURRENT_USER resolves to SYSTEM's own empty hive, so per-user Electron/Squirrel installers (Ollama, LM Studio) that offer no machine-wide option were invisible. Walk real users' loaded hives under HKEY_USERS instead, filtering to account SIDs (S-1-5-21-, S-1-12-1-) and skipping the redundant _Classes sub-hives. That still misses MSIX/Store packages, which register in the AppModel repository and never write an uninstall entry at all. Add a second pass over it, taking identity and version from the package full name.

dantecatalfamo · 2026-08-10T21:17:08Z

+
+	// Anything the install root did not yield. Sorted so that two family names
+	// matching one app resolve the same way on every run.
+	for _, family := range slices.Sorted(maps.Keys(userFamilies)) {


%LOCALAPPDATA%\Packages\<family> is per-user app state, not proof of installation: Windows creates it the first time the app is run and routinely leaves it behind after uninstall, so this loop reports uninstalled apps indefinitely, with no version or path to sanity-check them against. Since an unreadable installRoot makes this the only source, I'd gate the row on a registered-package cross-check (HKU\<SID>_Classes\...\AppModel\Repository\Packages) or drop the fallback entirely; a missed row is cheaper than a phantom one on an inventory table.

- Report MSIX apps only from the install root, never from user state - Resolve the MSIX install root through %ProgramW6432% overed by tests rather than by inspection.

Cherry-picks: - #50771 - #50768 - #50770 - #50772

juan-fdz-hawa temporarily deployed to Docker Hub August 7, 2026 14:50 — with GitHub Actions Inactive

coderabbitai Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread orbit/pkg/table/ai_tools/internal/apps/usersid.go

juan-fdz-hawa force-pushed the 50704-ai_tools-apps-collector-on-windows-cant-see-per-user-installed-ai-apps branch from 2763e08 to e961610 Compare August 7, 2026 18:01

juan-fdz-hawa temporarily deployed to Docker Hub August 7, 2026 18:01 — with GitHub Actions Inactive

juan-fdz-hawa changed the title ~~Enumerate HKEY_USERS in the ai_tools Windows apps collector~~ Find per-user and MSIX-packaged AI apps in the ai_tools Windows collector Aug 7, 2026

juan-fdz-hawa marked this pull request as ready for review August 7, 2026 19:38

juan-fdz-hawa requested a review from a team as a code owner August 7, 2026 19:38

juan-fdz-hawa self-assigned this Aug 7, 2026

juan-fdz-hawa force-pushed the 50704-ai_tools-apps-collector-on-windows-cant-see-per-user-installed-ai-apps branch from e961610 to e53f89e Compare August 7, 2026 19:38

juan-fdz-hawa temporarily deployed to Docker Hub August 7, 2026 19:38 — with GitHub Actions Inactive

coderabbitai Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread orbit/pkg/table/ai_tools/internal/apps/appx_scan_test.go

Comment thread orbit/pkg/table/ai_tools/internal/apps/appx.go

juan-fdz-hawa force-pushed the 50704-ai_tools-apps-collector-on-windows-cant-see-per-user-installed-ai-apps branch from e53f89e to 6055e47 Compare August 7, 2026 19:52

juan-fdz-hawa temporarily deployed to Docker Hub August 7, 2026 19:52 — with GitHub Actions Inactive

juan-fdz-hawa assigned lucasmrod and unassigned juan-fdz-hawa and lucasmrod Aug 10, 2026

dantecatalfamo reviewed Aug 10, 2026

View reviewed changes

juan-fdz-hawa assigned dantecatalfamo Aug 10, 2026

Misc bugs:

b29f7e8

- Report MSIX apps only from the install root, never from user state - Resolve the MSIX install root through %ProgramW6432% overed by tests rather than by inspection.

juan-fdz-hawa temporarily deployed to Docker Hub August 10, 2026 21:57 — with GitHub Actions Inactive

dantecatalfamo approved these changes Aug 11, 2026

View reviewed changes

juan-fdz-hawa merged commit 56e2a28 into main Aug 11, 2026
55 checks passed

juan-fdz-hawa deleted the 50704-ai_tools-apps-collector-on-windows-cant-see-per-user-installed-ai-apps branch August 11, 2026 17:51

juan-fdz-hawa mentioned this pull request Aug 11, 2026

For Fleetd 1.59 RC: Issues with ai_tools table #50990

Merged

juan-fdz-hawa added a commit that referenced this pull request Aug 11, 2026

For Fleetd 1.59 RC: Fixed issues with ai_tools table

ee17edf

Cherry-picks: - #50771 - #50768 - #50770 - #50772

This was referenced Aug 12, 2026

ai_tools: user-scoped rows on Windows report a group SID as uid and a blank username #51061

Closed

ai_tools: apps collector reports NVIDIA/VLC/Plex as AI apps via substring name matching, and masks genuine installs #51093

Closed

coderabbitai Bot mentioned this pull request Aug 13, 2026

Fix ai_tools apps collector matching AI apps by raw substring #51132

Merged

3 tasks

xpkoala mentioned this pull request Aug 13, 2026

ai_tools: apps collector on Windows can't see per-user-installed AI apps (Ollama, ChatGPT desktop, LM Studio) #50704

Closed

2 tasks

This was referenced Aug 27, 2026

ai_tools: detect custom and framework-based AI agents #52040

Open

Detect custom and framework-based AI agents in ai_tools #52054

Open

Navigation Menu

Uh oh!

Find per-user and MSIX-packaged AI apps in the ai_tools Windows collector - #50771

Find per-user and MSIX-packaged AI apps in the ai_tools Windows collector#50771
juan-fdz-hawa merged 2 commits into
mainfrom
50704-ai_tools-apps-collector-on-windows-cant-see-per-user-installed-ai-apps

juan-fdz-hawa commented Aug 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

juan-fdz-hawa commented Aug 7, 2026

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

codecov Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 7, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

dantecatalfamo Aug 10, 2026

Uh oh!

juan-fdz-hawa Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

juan-fdz-hawa commented Aug 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist for submitter

Testing

Summary by CodeRabbit

Uh oh!

juan-fdz-hawa commented Aug 7, 2026

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot commented Aug 7, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dantecatalfamo Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

juan-fdz-hawa Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

juan-fdz-hawa commented Aug 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

codecov Bot commented Aug 7, 2026 •

edited

Loading