Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• New Features

  • Added the latest available releases for dozens of macOS and Windows applications, including browsers, productivity tools, developer utilities, communication apps, and media software.
  • Updated download details and verification information so installations use the correct current packages.

• Bug Fixes

  • Improved removal of residual files and background services for Aviatrix VPN Client, Citrix Workspace, Krita, MongoDB Compass, and Proton Drive.
  • Corrected package metadata and version detection for several applications.

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/alt-tab/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/amadine/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/applite/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/arc/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json

=== Install Script (no changes) ===
=== Uninstall // 7ef6154e -> abc2830e ===

--- /tmp/old.AUzVBK	2026-08-07 16:21:48.832132654 +0000
+++ /tmp/new.kZJqtl	2026-08-07 16:21:48.832132654 +0000
@@ -188,10 +188,11 @@
   fi
 }
 
-remove_launchctl_service 'aviatrix.vpn.client.rp.plist'
+remove_launchctl_service 'aviatrix.vpn.client.rp'
 remove_pkg_files 'com.Aviatrix.VPNClient'
 forget_pkg 'com.Aviatrix.VPNClient'
 sudo rm -rf '/Applications/Aviatrix VPN Client.app'
+trash $LOGGED_IN_USER '/Library/Application Support/Aviatrix VPN Client'
 trash $LOGGED_IN_USER '~/Library/Aviatrix'
 trash $LOGGED_IN_USER '~/Library/Logs/AviatrixVPNC'
 trash $LOGGED_IN_USER '~/Library/Preferences/org.pythonmac.unspecified.AviatrixVPNClient.plist'

ee/maintained-apps/outputs/badgeify/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/beekeeper-studio/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/brave-browser/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/burp-suite/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/calibre/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/calibre/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/capcut/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/chatbox/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/chatgpt/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/cherry-studio/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/citrix-workspace/darwin.json

=== Install // f06e00fd -> a78b38b6 ===

--- /tmp/old.OPrq5q	2026-08-07 16:21:49.289128110 +0000
+++ /tmp/new.i5Glsj	2026-08-07 16:21:49.289128110 +0000
@@ -96,5 +96,5 @@
 
 # install pkg files
 quit_and_track_application 'com.citrix.receiver.nomas'
-sudo installer -pkg "$TMPDIR/CitrixWorkspaceAppUniversal26.03.11.41.pkg" -target / || exit $?
+sudo installer -pkg "$TMPDIR/CitrixWorkspaceAppUniversal26.07.0.71.pkg" -target / || exit $?
 relaunch_application 'com.citrix.receiver.nomas'

=== Uninstall // edbf2a34 -> c847120e ===

--- /tmp/old.fRix24	2026-08-07 16:21:49.309127911 +0000
+++ /tmp/new.iKjZTM	2026-08-07 16:21:49.309127911 +0000
@@ -233,6 +233,7 @@
 remove_launchctl_service 'com.citrix.CtxWorkspaceHelperDaemon'
 remove_launchctl_service 'com.citrix.ctxworkspaceupdater'
 remove_launchctl_service 'com.citrix.devicetrust.launchagent'
+remove_launchctl_service 'com.citrix.PluginBroker'
 remove_launchctl_service 'com.citrix.ReceiverHelper'
 remove_launchctl_service 'com.citrix.ReceiverUninstallHelper'
 remove_launchctl_service 'com.citrix.ReceiverUpdaterHelper'
@@ -259,6 +260,9 @@
 forget_pkg 'com.citrix.ICAClienthdx'
 remove_pkg_files 'com.citrix.receiver.bcr'
 forget_pkg 'com.citrix.receiver.bcr'
+sudo rm -rf '/Applications/Citrix Workspace.app'
+sudo rm -rf '/Library/Citrix Workspace'
+trash $LOGGED_IN_USER '/Library/Logs/Citrix Workspace'
 trash $LOGGED_IN_USER '~/Library/Application Support/Citrix Receiver'
 trash $LOGGED_IN_USER '~/Library/Application Support/Citrix Workspace'
 trash $LOGGED_IN_USER '~/Library/Application Support/Citrix'

ee/maintained-apps/outputs/claude/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/clion/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/cmake-app/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/codexbar/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/coteditor/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/cursor/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/dataflare/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/dataflare/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/datagrip/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/deezer/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/downie/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/drawio/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/drofus/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/elevate-uc/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/evernote/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/fellow/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/firefox@nightly/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/framer/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/gitkraken/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/gog-galaxy/darwin.json

=== Install // 9f170824 -> 89b9a1b7 ===

--- /tmp/old.JyCdpY	2026-08-07 16:21:50.054120503 +0000
+++ /tmp/new.d0aclp	2026-08-07 16:21:50.054120503 +0000
@@ -96,5 +96,5 @@
 
 # install pkg files
 quit_and_track_application 'com.gog.galaxy.cef.renderer'
-sudo installer -pkg "$TMPDIR/galaxy_client_2.1.7.22.pkg" -target / || exit $?
+sudo installer -pkg "$TMPDIR/galaxy_client_2.1.8.32.pkg" -target / || exit $?
 relaunch_application 'com.gog.galaxy.cef.renderer'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/google-chrome/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/granola/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/granola/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/ibm-semeru-jre-11/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/imageglass/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/kiro-cli/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/kiro/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/kiro/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/krita/darwin.json

=== Install Script (no changes) ===
=== Uninstall // 7b9f27dc -> 3947b0f0 ===

--- /tmp/old.YN1e5Z	2026-08-07 16:21:50.394117123 +0000
+++ /tmp/new.pcW7sM	2026-08-07 16:21:50.394117123 +0000
@@ -52,8 +52,11 @@
   fi
 }
 
-sudo rm -rf "$APPDIR/krita.app"
-trash $LOGGED_IN_USER '~/Library/Application Support/krita'
+sudo rm -rf "$APPDIR/Krita.app"
+trash $LOGGED_IN_USER '~/Library/Application Scripts/org.krita.*'
+trash $LOGGED_IN_USER '~/Library/Application Support/krita*'
+trash $LOGGED_IN_USER '~/Library/Caches/krita'
+trash $LOGGED_IN_USER '~/Library/Containers/org.krita.*'
 trash $LOGGED_IN_USER '~/Library/Preferences/kritadisplayrc'
 trash $LOGGED_IN_USER '~/Library/Preferences/kritarc'
 trash $LOGGED_IN_USER '~/Library/Saved Application State/org.krita.savedState'

ee/maintained-apps/outputs/loom/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/loom/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/marked-app/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/masscode/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/melodics/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/microsoft-edge/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/mongodb-compass/darwin.json

=== Install Script (no changes) ===
=== Uninstall // 9db6b9b2 -> 022cab65 ===

--- /tmp/old.YS9Z1y	2026-08-07 16:21:50.667114408 +0000
+++ /tmp/new.1iKctN	2026-08-07 16:21:50.668114398 +0000
@@ -5,6 +5,46 @@
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
 # functions
 
+quit_application() {
+  local bundle_id="$1"
+  local timeout_duration=10
+
+  # check if the application is running
+  local app_running
+  app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
+  if [[ "$app_running" != "true" ]]; then
+    return
+  fi
+
+  local console_user
+  console_user=$(stat -f "%Su" /dev/console)
+  if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
+    echo "Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'."
+    return
+  fi
+
+  echo "Quitting application '$bundle_id'..."
+
+  # try to quit the application within the timeout period
+  local quit_success=false
+  SECONDS=0
+  while (( SECONDS < timeout_duration )); do
+    if osascript -e "tell application id \"$bundle_id\" to quit" >/dev/null 2>&1; then
+      if ! pgrep -f "$bundle_id" >/dev/null 2>&1; then
+        echo "Application '$bundle_id' quit successfully."
+        quit_success=true
+        break
+      fi
+    fi
+    sleep 1
+  done
+
+  if [[ "$quit_success" = false ]]; then
+    echo "Application '$bundle_id' did not quit."
+  fi
+}
+
+
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
@@ -52,6 +92,7 @@
   fi
 }
 
+quit_application 'com.mongodb.compass'
 sudo rm -rf "$APPDIR/MongoDB Compass.app"
 trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.mongodb.compass.sfl*'
 trash $LOGGED_IN_USER '~/Library/Application Support/MongoDB Compass'

ee/maintained-apps/outputs/mongodb-compass/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/nordpass/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/nordpass/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/notesnook/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/nova/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/onedrive/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/opencode-desktop/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/opera/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/orbstack/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/p4v/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/p4v/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/pale-moon/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/parallels/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/postman/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/postman/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/powerphotos/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/prisma-browser/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/prisma-browser/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/proton-drive/darwin.json

=== Install Script (no changes) ===
=== Uninstall // fc6f5099 -> ac89ef74 ===

--- /tmp/old.W2cFck	2026-08-07 16:21:51.478106344 +0000
+++ /tmp/new.uV1UgO	2026-08-07 16:21:51.479106334 +0000
@@ -5,6 +5,76 @@
 LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
 # functions
 
+remove_launchctl_service() {
+  local service="$1"
+  local booleans=("true" "false")
+  local plist_status
+  local paths
+  local should_sudo
+
+  echo "Removing launchctl service ${service}"
+
+  # A wildcard label can't be used with launchctl or as a plist name, so expand
+  # it to the labels of currently loaded services that match the pattern.
+  local services=("$service")
+  if [[ "$service" == *"*"* ]]; then
+    local regex
+    # Escape regex metacharacters, turn '*' into '.*', and anchor the pattern so
+    # it matches a full label rather than a substring.
+    regex=$(printf '%s' "$service" | sed -e 's/[][(){}.^$+?|\\]/\\&/g' -e 's/\*/.*/g')
+    regex="^${regex}$"
+    services=()
+    local id
+    # Match every loaded job by label regardless of PID; launchctl list reports
+    # loaded-but-not-running jobs with a "-" in the PID column.
+    while read -r _ _ id; do
+      [[ "$id" =~ $regex ]] && services+=("$id")
+    done < <(launchctl list 2>/dev/null | tail -n +2)
+    if [[ ${#services[@]} -eq 0 ]]; then
+      echo "No loaded launchctl service matches ${service}"
+      return
+    fi
+  fi
+
+  local service_label
+  for service_label in "${services[@]}"; do
+    for should_sudo in "${booleans[@]}"; do
+      plist_status=$(launchctl list "${service_label}" 2>/dev/null)
+
+      if [[ $plist_status == \{* ]]; then
+        if [[ $should_sudo == "true" ]]; then
+          sudo launchctl remove "${service_label}"
+        else
+          launchctl remove "${service_label}"
+        fi
+        sleep 1
+      fi
+
+      paths=(
+        "/Library/LaunchAgents/${service_label}.plist"
+        "/Library/LaunchDaemons/${service_label}.plist"
+      )
+
+      # if not using sudo, prepend the home directory to the paths
+      if [[ $should_sudo == "false" ]]; then
+        for i in "${!paths[@]}"; do
+          paths[i]="${HOME}${paths[i]}"
+        done
+      fi
+
+      for path in "${paths[@]}"; do
+        if [[ -e "$path" ]]; then
+          if [[ $should_sudo == "true" ]]; then
+            sudo rm -f -- "$path"
+          else
+            rm -f -- "$path"
+          fi
+        fi
+      done
+    done
+  done
+}
+
 trash() {
   local logged_in_user="$1"
   local target_file="$2"
@@ -52,6 +122,7 @@
   fi
 }
 
+remove_launchctl_service 'ch.protonmail.drive.agent'
 sudo rm -rf "$APPDIR/Proton Drive.app"
 trash $LOGGED_IN_USER '~/Library/Application Scripts/ch.protonmail.drive*'
 trash $LOGGED_IN_USER '~/Library/Application Support/FileProvider/ch.protonmail.drive.fileprovider'

ee/maintained-apps/outputs/rider/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/rive/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/rustrover/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/rustrover/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/shapr3d/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/spokenly/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/spotify/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/spyder/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/superwhisper/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/sync/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/telegram/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/viscosity/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/viscosity/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/vivaldi/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/webex/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/whatsapp/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/windows-app/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/wispr-flow/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/workflowy/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/xnconvert/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/zen/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

[coderabbitai]

Walkthrough

Updated maintained-app JSON definitions for many Darwin and Windows applications. Changes include release versions, patch detection thresholds, installer URLs, artifact identifiers, and SHA-256 checksums. Selected entries also update install or uninstall script references and cleanup commands for launch services, applications, logs, caches, and support files.

Possibly related PRs

• fleetdm/fleet#50779 — Updates the same maintained-app manifests with corresponding release metadata.
• fleetdm/fleet#50778 — Updates overlapping maintained-app versions, URLs, queries, and checksums.
• fleetdm/fleet#50656 — Directly overlaps with the Krita Darwin uninstall-script changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description identifies the automated app-data update but omits the required issue reference, checklist, and testing information.	Complete the template sections, or remove non-applicable items, and document testing and QA results.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: updating Fleet-maintained application data.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2608071615

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json`:
- Line 20: Update remove_launchctl_service in
ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json (lines 20-20),
ee/maintained-apps/outputs/citrix-workspace/darwin.json (lines 20-20), and
ee/maintained-apps/outputs/proton-drive/darwin.json (lines 19-19) to resolve the
console user’s UID and remove user-scoped services through that user’s launchctl
bootstrap context, such as launchctl asuser or the equivalent gui/user bootout
flow; preserve the existing system/root removal behavior and apply it to
aviatrix.vpn.client.rp, com.citrix.* and ch.protonmail.drive.agent.

In `@ee/maintained-apps/outputs/brave-browser/windows.json`:
- Around line 4-9: Update the Brave entry’s “version” value and the version
threshold in the “patched” query to 1.93.132 so they match the installer release
at “installer_url”; preserve the existing query structure and other metadata.

In `@ee/maintained-apps/outputs/citrix-workspace/darwin.json`:
- Line 20: The quit_application helper currently logs timeout failures but
allows destructive uninstall steps to continue. In
ee/maintained-apps/outputs/citrix-workspace/darwin.json:20-20, make
quit_application return failure when the application remains running and abort
the script after the last required Citrix quit_application call if any required
process cannot quit; in
ee/maintained-apps/outputs/mongodb-compass/darwin.json:19-19, apply the same
behavior for com.mongodb.compass before removing the application or user data.
Add a force-quit path only if required.

In `@ee/maintained-apps/outputs/krita/darwin.json`:
- Line 19: Update the uninstall script’s application removal command to use the
same case-sensitive bundle path as the installer, `/Applications/krita.app`,
instead of `/Applications/Krita.app`. Keep the existing removal flow unchanged
so it targets only the installed Krita bundle.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0be683bb-5a7f-4d44-97ec-dc24a49920ba

📥 Commits

Reviewing files that changed from the base of the PR and between fc35085 and e56681b.

📒 Files selected for processing (92)

• ee/maintained-apps/outputs/alt-tab/darwin.json
• ee/maintained-apps/outputs/amadine/darwin.json
• ee/maintained-apps/outputs/applite/darwin.json
• ee/maintained-apps/outputs/arc/darwin.json
• ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json
• ee/maintained-apps/outputs/badgeify/darwin.json
• ee/maintained-apps/outputs/beekeeper-studio/windows.json
• ee/maintained-apps/outputs/brave-browser/windows.json
• ee/maintained-apps/outputs/burp-suite/darwin.json
• ee/maintained-apps/outputs/calibre/darwin.json
• ee/maintained-apps/outputs/calibre/windows.json
• ee/maintained-apps/outputs/capcut/darwin.json
• ee/maintained-apps/outputs/chatbox/windows.json
• ee/maintained-apps/outputs/chatgpt/darwin.json
• ee/maintained-apps/outputs/cherry-studio/darwin.json
• ee/maintained-apps/outputs/citrix-workspace/darwin.json
• ee/maintained-apps/outputs/claude/darwin.json
• ee/maintained-apps/outputs/clion/windows.json
• ee/maintained-apps/outputs/cmake-app/windows.json
• ee/maintained-apps/outputs/codexbar/darwin.json
• ee/maintained-apps/outputs/coteditor/darwin.json
• ee/maintained-apps/outputs/cursor/darwin.json
• ee/maintained-apps/outputs/dataflare/darwin.json
• ee/maintained-apps/outputs/dataflare/windows.json
• ee/maintained-apps/outputs/datagrip/darwin.json
• ee/maintained-apps/outputs/deezer/darwin.json
• ee/maintained-apps/outputs/downie/darwin.json
• ee/maintained-apps/outputs/drawio/darwin.json
• ee/maintained-apps/outputs/drofus/windows.json
• ee/maintained-apps/outputs/elevate-uc/windows.json
• ee/maintained-apps/outputs/evernote/windows.json
• ee/maintained-apps/outputs/fellow/windows.json
• ee/maintained-apps/outputs/firefox@nightly/darwin.json
• ee/maintained-apps/outputs/framer/darwin.json
• ee/maintained-apps/outputs/gitkraken/windows.json
• ee/maintained-apps/outputs/gog-galaxy/darwin.json
• ee/maintained-apps/outputs/google-chrome/darwin.json
• ee/maintained-apps/outputs/granola/darwin.json
• ee/maintained-apps/outputs/granola/windows.json
• ee/maintained-apps/outputs/ibm-semeru-jre-11/windows.json
• ee/maintained-apps/outputs/imageglass/windows.json
• ee/maintained-apps/outputs/kiro-cli/darwin.json
• ee/maintained-apps/outputs/kiro/darwin.json
• ee/maintained-apps/outputs/kiro/windows.json
• ee/maintained-apps/outputs/krita/darwin.json
• ee/maintained-apps/outputs/loom/darwin.json
• ee/maintained-apps/outputs/loom/windows.json
• ee/maintained-apps/outputs/marked-app/darwin.json
• ee/maintained-apps/outputs/masscode/darwin.json
• ee/maintained-apps/outputs/melodics/darwin.json
• ee/maintained-apps/outputs/microsoft-edge/darwin.json
• ee/maintained-apps/outputs/mongodb-compass/darwin.json
• ee/maintained-apps/outputs/mongodb-compass/windows.json
• ee/maintained-apps/outputs/nordpass/darwin.json
• ee/maintained-apps/outputs/nordpass/windows.json
• ee/maintained-apps/outputs/notesnook/windows.json
• ee/maintained-apps/outputs/nova/darwin.json
• ee/maintained-apps/outputs/onedrive/windows.json
• ee/maintained-apps/outputs/opencode-desktop/darwin.json
• ee/maintained-apps/outputs/opera/darwin.json
• ee/maintained-apps/outputs/orbstack/darwin.json
• ee/maintained-apps/outputs/p4v/darwin.json
• ee/maintained-apps/outputs/p4v/windows.json
• ee/maintained-apps/outputs/pale-moon/windows.json
• ee/maintained-apps/outputs/parallels/darwin.json
• ee/maintained-apps/outputs/postman/darwin.json
• ee/maintained-apps/outputs/postman/windows.json
• ee/maintained-apps/outputs/powerphotos/darwin.json
• ee/maintained-apps/outputs/prisma-browser/darwin.json
• ee/maintained-apps/outputs/prisma-browser/windows.json
• ee/maintained-apps/outputs/proton-drive/darwin.json
• ee/maintained-apps/outputs/rider/windows.json
• ee/maintained-apps/outputs/rive/darwin.json
• ee/maintained-apps/outputs/rustrover/darwin.json
• ee/maintained-apps/outputs/rustrover/windows.json
• ee/maintained-apps/outputs/shapr3d/darwin.json
• ee/maintained-apps/outputs/spokenly/darwin.json
• ee/maintained-apps/outputs/spotify/darwin.json
• ee/maintained-apps/outputs/spyder/windows.json
• ee/maintained-apps/outputs/superwhisper/darwin.json
• ee/maintained-apps/outputs/sync/darwin.json
• ee/maintained-apps/outputs/telegram/windows.json
• ee/maintained-apps/outputs/viscosity/darwin.json
• ee/maintained-apps/outputs/viscosity/windows.json
• ee/maintained-apps/outputs/vivaldi/darwin.json
• ee/maintained-apps/outputs/webex/darwin.json
• ee/maintained-apps/outputs/whatsapp/darwin.json
• ee/maintained-apps/outputs/windows-app/windows.json
• ee/maintained-apps/outputs/wispr-flow/darwin.json
• ee/maintained-apps/outputs/workflowy/darwin.json
• ee/maintained-apps/outputs/xnconvert/windows.json
• ee/maintained-apps/outputs/zen/darwin.json

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for file in \
  ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json \
  ee/maintained-apps/outputs/citrix-workspace/darwin.json \
  ee/maintained-apps/outputs/proton-drive/darwin.json
do
  jq -r '.refs[.versions[0].uninstall_script_ref]' "$file" |
    rg -n -C 3 'launchctl list|launchctl remove|\$HOME|LaunchAgents'
done

rg -n -C 3 'uninstall_script_ref|INSTALLER_PATH|run.*script|script.*run' .

Repository: fleetdm/fleet

Length of output: 50370

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for file in \
  ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json \
  ee/maintained-apps/outputs/citrix-workspace/darwin.json \
  ee/maintained-apps/outputs/proton-drive/darwin.json
do
  echo "== $file refs =="
  jq -r '.refs[.versions[0].uninstall_script_ref]' "$file" > "/tmp/uninstall.$(basename "$file" .json).sh"
  echo "== launchctl and home paths in script =="
  rg -n -C 2 'launchctl (list|remove|bootout|asuser)|\$HOME|/Library/LaunchAgents|~/Library/LaunchAgents|rm -f|Applications/Aviatrix VPN Client.app|com.citrix|ch.protonmail.drive.agent' "/tmp/uninstall.$(basename "$file" .json).sh" || true
done

echo "== focused launchctl occurrences in the three scripts =="
rg -n 'launchctl (list|remove|asuser|bootout)' /tmp/uninstall.*.sh

Repository: fleetdm/fleet

Length of output: 8079

---

🌐 Web query:

launchctl asuser man page bootstrap domains list remove user agent domain macOS

💡 Result:

The launchctl tool in macOS provides specific commands for managing services within different bootstrap domains [1][2]. Asuser The asuser subcommand executes a given command within the context of a specified user's bootstrap, including the Mach bootstrap namespace, exception server, and security audit session [3][4]. It does not modify credentials (UID, GID) or inherit user-specific environment variables [5][6]. It is primarily used to run commands as if they were launched by a specific user account [7][8]. The syntax is: launchctl asuser [args] Bootstrap Domains launchctl uses domain targets to manage services [1][2]. Key domains include: - gui/: The graphical user session (Aqua). This domain is created when a user logs in via the GUI [1][9]. It is the appropriate target for LaunchAgents that require UI interaction or keychain access [9]. - user/: The background session for a user. This exists independently of a GUI login and is used for non-UI tasks (e.g., SSH sessions) [1][9]. - system: The system domain, which manages root-level services [1][2]. Managing Services (Bootstrap/Bootout) To add or remove services from a domain, use the bootstrap and bootout subcommands [1][2]. The legacy load and unload commands have been largely superseded by these in modern macOS versions [2][6]. - To load a service into a specific domain: launchctl bootstrap Example: launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.example.plist [9] - To remove (unload) a service from a domain: launchctl bootout [1][10] Notes - Always use the UID (not the username) for asuser and domain-target commands [7][6]. You can retrieve a UID via id -u <username> [6]. - When working with services, ensure you are targeting the correct domain (e.g., gui/ vs. user/) to avoid permission or session-related issues, such as keychain or TCC errors [9]. [9]

Citations:

• 1: https://keith.github.io/xcode-man-pages/launchctl.1.html
• 2: https://ss64.com/mac/launchctl.html
• 3: https://www.manpagez.com/man/1/launchctl/osx-10.10.php
• 4: https://manp.gs/mac/1/launchctl
• 5: https://www.unix.com/man_page/mojave/1/launchctl/
• 6: https://babodee.wordpress.com/2016/04/09/launchctl-2-0-syntax/
• 7: https://bartreardon.github.io/2019/09/18/sudo-u-vs-launchctl-asuser.html
• 8: https://mjtsai.com/blog/2016/11/12/launchctl-asuser/
• 9: https://thekodelab.com/en/posts/macos-gui-terminal-vs-ssh-session/
• 10: https://lists.macosforge.org/pipermail/launchd-dev/2015-July/001139.html

---

Remove console-user launch services in the console-user domain.

When Fleet runs as root, launchctl list targets root/system domains and launchctl remove cannot see user-scoped launch agents. Resolve the console-user UID and run the removal in that user’s bootstrap context, for example launchctl asuser "$uid" launchctl remove "$service_label" or launchctl bootout gui/user:${uid} "$service_label". Apply this to the launched remove_launchctl_service calls in aviatrix-vpn-client, citrix-workspace, and proton-drive so com.citrix.*, ch.protonmail.drive.agent, and aviatrix.vpn.client.rp user LaunchAgents are removed.

📍 Affects 3 files

• ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json#L20-L20 (this comment)
• ee/maintained-apps/outputs/citrix-workspace/darwin.json#L20-L20
• ee/maintained-apps/outputs/proton-drive/darwin.json#L19-L19

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json` at line 20,
Update remove_launchctl_service in
ee/maintained-apps/outputs/aviatrix-vpn-client/darwin.json (lines 20-20),
ee/maintained-apps/outputs/citrix-workspace/darwin.json (lines 20-20), and
ee/maintained-apps/outputs/proton-drive/darwin.json (lines 19-19) to resolve the
console user’s UID and remove user-scoped services through that user’s launchctl
bootstrap context, such as launchctl asuser or the equivalent gui/user bootout
flow; preserve the existing system/root removal behavior and apply it to
aviatrix.vpn.client.rp, com.citrix.* and ch.protonmail.drive.agent.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== target json ==="
cat -n ee/maintained-apps/outputs/brave-browser/windows.json

echo
echo "=== similar maintained app samples ==="
fd -a . ee/maintained-apps/outputs | head -50

echo
echo "=== version fields and installer_url pattern for .json ==="
python3 - <<'PY'
import json, pathlib
root=pathlib.Path("ee/maintained-apps/outputs")
for p in sorted(root.glob("*.json")):
    try:
        data=json.loads(p.read_text())
    except Exception as e:
        print(f"{p}: parse error {e}")
        continue
    for section in data.get("platforms", {}).values():
        if isinstance(section, dict):
            version=section.get("version")
            installer=section.get("installer_url")
            queries=section.get("queries", {})
            print(f"{p} {section.get('name') or ''} version={version} installer={installer} patched_contains_version={queries.get('patched','')}")
PY

echo
echo "=== release URL head (installers may not return JSON) ==="
python3 - <<'PY'
import urllib.request, socket
urls=[
  "https://github.com/brave/brave-browser/releases/download/v1.93.132/BraveBrowserStandaloneSilentSetup.exe",
  "https://github.com/brave/brave-browser/releases/download/v151.1.93.132/BraveBrowserStandaloneSilentSetup.exe",
]
for url in urls:
    req=urllib.request.Request(url, method="HEAD", headers={"User-Agent":"CodeRabbit verifier"})
    try:
        with urllib.request.urlopen(req, timeout=20) as r:
            print(url, r.status, dict(r.headers), r.headers.get("Location") or "")
    except Exception as e:
        print(url, type(e).__name__, str(e)[:500])
PY

Repository: fleetdm/fleet

Length of output: 12749

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== target json ==="
cat -n ee/maintained-apps/outputs/brave-browser/windows.json

echo
echo "=== similar maintained app samples ==="
fd -a . ee/maintained-apps/outputs | head -50

echo
echo "=== version fields and installer_url pattern for .json ==="
python3 - <<'PY'
import json, pathlib
root=pathlib.Path("ee/maintained-apps/outputs")
for p in sorted(root.glob("*.json")):
    try:
        data=json.loads(p.read_text())
    except Exception as e:
        print(f"{p}: parse error {e}")
        continue
    for section in data.get("platforms", {}).values():
        if isinstance(section, dict):
            version=section.get("version")
            installer=section.get("installer_url")
            queries=section.get("queries", {})
            print(f"{p} {section.get('name') or ''} version={version} installer={installer} patched_contains_version={queries.get('patched','')}")
PY

echo
echo "=== release URL head (installers may not return JSON) ==="
python3 - <<'PY'
import urllib.request, socket
urls=[
  "https://github.com/brave/brave-browser/releases/download/v1.93.132/BraveBrowserStandaloneSilentSetup.exe",
  "https://github.com/brave/brave-browser/releases/download/v151.1.93.132/BraveBrowserStandaloneSilentSetup.exe",
]
for url in urls:
    req=urllib.request.Request(url, method="HEAD", headers={"User-Agent":"CodeRabbit verifier"})
    try:
        with urllib.request.urlopen(req[:20) as r:
            print(url, r.status, dict(r.headers), r.headers.get("Location") or "")
    except Exception as e:
        print(url, type(e).__name__, str(e)[:500])
PY

Repository: fleetdm/fleet

Length of output: 12737

---

🌐 Web query:

Brave Browser Windows installer reports version 1.93.132 version_compare comparison

💡 Result:

Brave Browser version 1.93.132 is a legitimate release, officially launched on August 5, 2026 [1][2]. The term "version_compare" is not a specific error message associated with the Brave Browser Windows installer [1][3]. Instead, version_compare is a standard PHP function used in web development (such as in CMS platforms like WordPress or Nextcloud) to compare version number strings [4][5][6]. If you are encountering an error involving this term, it is likely occurring within an unrelated software environment, a custom script, or a web-based management tool that is attempting to compare software versions, rather than a native alert generated by the Brave Browser installer itself [4][5][7]. If you are seeing such an error, it typically indicates a programming or compatibility issue where a system is failing to correctly parse or compare the version string "1.93.132" [6]. If you are trying to install or update the browser and are encountering this, ensure that you are downloading the official installer from the Brave website [8][3] and that no local security software or scripts are interfering with the process.

Citations:

• 1: https://brave.com/latest/
• 2: https://newreleases.io/project/github/brave/brave-browser/release/v1.93.132
• 3: https://community.brave.app/t/release-channel-1-93-132/656637
• 4: https://github.com/nextcloud/server/blob/ee8226621064580cfc0eeeb7132abcc3e6857573/lib/private/Installer.php
• 5: WordPress/WordPress@9f2d529
• 6: https://www.php.net/manual/en/function.version-compare.php
• 7: version_compare(): Passing null to parameter #1 ($version1) of type string is deprecated YahnisElsts/plugin-update-checker#526
• 8: https://www.neowin.net/software/brave-browser-193132/

---

🌐 Web query:

Brave Browser for Windows install path uninstall registry entry displayed version 1.93.132

💡 Result:

The installation path and registry details for Brave Browser on Windows are determined by the installation method (system-wide versus per-user) [1]. Installation Path Brave Browser typically installs to one of the following locations: - System-wide install: C:\Program Files\BraveSoftware\Brave-Browser\Application\ [2][3][4] - Per-user install: %LOCALAPPDATA%\BraveSoftware\Brave-Browser\Application\ (which resolves to C:\Users<Username>\AppData\Local\BraveSoftware\Brave-Browser\Application) [2][4] Uninstall Registry Entries The registry key used for uninstallation depends on whether the browser was installed for all users (system-level) or for a single user [1]. For system-wide installations, the registry key is generally located at: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser [1][5][6] For per-user installations, the registry key is generally located at: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser [7] The "Displayed Version" (e.g., 1.93.132) is stored within these registry keys under the DisplayVersion value [5]. You can view or verify this by navigating to the appropriate Uninstall key in the Registry Editor (regedit) and checking the data field for DisplayVersion [5]. Notes on Uninstallation - If you need to uninstall via command line, the setup.exe located in the Application<Version>\Installer directory is typically used [1][6]. - Brave maintains a support article on uninstalling the browser, which emphasizes using the "Add or Remove programs" window in Windows for a standard removal [8]. - Be aware that some registry keys and folders may persist after uninstallation, depending on whether you choose to remove browsing data during the uninstall process [9][8].

Citations:

• 1: https://community.brave.app/t/uninstalling-brave-via-command-line-with-switches/158271
• 2: https://superuser.com/questions/1696956/what-is-the-location-of-brave-browser-executable-in-windows-10
• 3: Windows Install folder always on harddisk c: in user area brave/brave-browser#46998
• 4: https://community.brave.app/t/installer-timing-out-on-win10-install-installs-in-user-app-directory/606787
• 5: https://silentinstallhq.com/create-a-custom-detection-script-for-brave-browser-powershell/
• 6: https://www.advanceduninstaller.com/Brave-edfef93fc4418645ad7f471c46b2d5ab-application.htm
• 7: https://gist.github.com/choco-bot/965c7e92a9d81ec9fd2b2e278c8a609f
• 8: https://support.brave.app/hc/en-us/articles/4404876135565-How-do-I-uninstall-Brave
• 9: After uninstalling Windows Brave, so many folders and registry keys were not deleted as required by Microsoft. brave/brave-browser#35885

---

🌐 Web query:

site:silentinstallhq.com "BraveSoftware Brave-Browser" "DisplayVersion"

💡 Result:

In Windows systems, the DisplayVersion of Brave Browser is typically stored within the Windows Registry under the uninstall keys used for application management [1]. You can retrieve this information by querying the following registry paths [1]: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser The DisplayVersion value is stored as a string within these keys, representing the installed version of the browser [1]. Administrators and system managers often use this registry entry to detect if Brave is installed or to verify its current version using scripting tools like PowerShell [1]. For example, using PowerShell, you can access this information with the following command: Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser' -Name DisplayVersion -ea SilentlyContinue This command retrieves the version number directly from the registry, allowing for automated detection and verification processes [1].

Citations:

• 1: https://silentinstallhq.com/create-a-custom-detection-script-for-brave-browser-powershell/

---

Align Brave’s tracked version with the installed release.

The installer URL points to release v1.93.132, so the installed DisplayVersion will be 1.93.132. With the current patched query comparing against 151.1.93.132, any installed Brave matches version_compare(version, '151.1.93.132') < 0 and the software stays marked as needing an update. Use 1.93.132 in both "version" and the patched query, or point at an artifact that actually installs 151.1.93.132.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/brave-browser/windows.json` around lines 4 - 9,
Update the Brave entry’s “version” value and the version threshold in the
“patched” query to 1.93.132 so they match the installer release at
“installer_url”; preserve the existing query structure and other metadata.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files =="
git ls-files | rg '(^|/)citrix-workspace/darwin\.json$|(^|/)mongodb-compass/darwin\.json$'

echo "== citrix relevant lines =="
sed -n '1,220p' ee/maintained-apps/outputs/citrix-workspace/darwin.json | cat -n

echo "== mongodb relevant lines =="
sed -n '1,120p' ee/maintained-apps/outputs/mongodb-compass/darwin.json | cat -n

echo "== function call occurrences in citrix darwin =="
python3 - <<'PY'
import json
p='ee/maintained-apps/outputs/citrix-workspace/darwin.json'
data=json.load(open(p))
script=data[list(data.keys())[0]]
lines=script.splitlines()
for i,l in enumerate(lines,1):
    if "quit_application" in l or "remove_pkg_files" in l or "forget_pkg" in l or "sudo rm -rf" in l or "trash" in l:
        print(f"{i}: {l}")
PY

echo "== mongodb function call occurrences =="
python3 - <<'PY'
import json
p='ee/maintained-apps/outputs/mongodb-compass/darwi n.json'
PY
python3 - <<'PY'
import json
p='ee/maintained-apps/outputs/mongodb-compass/darwin.json'
data=json.load(open(p))
script=data[list(data.keys())[0]]
lines=script.splitlines()
for i,l in enumerate(lines,1):
    if "quit_application" in l or "rm -rf" in l or "trash" in l:
        print(f"{i}: {l}")
PY

Repository: fleetdm/fleet

Length of output: 24141

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json, pathlib

for path in [
    "ee/maintained-apps/outputs/citrix-workspace/darwin.json",
    "ee/maintained-apps/outputs/mongodb-compass/darwin.json",
]:
    p=pathlib.Path(path)
    data=json.loads(p.read_text())
    ref=data["refs"][next(k for k,v in data["refs"].items() if "uninstall_script_ref" in data["versions"][0] and v == next(kv["uninstall_script_ref"] for kv in data["versions"]))]
    lines=ref.splitlines()
    print(f"== {path} ==")
    for i,l in enumerate(lines,1):
        if any(tok in l for tok in ("quit_application", "remove_pkg_files", "forget_pkg", "rm -rf", "trash", "}"), exact_word=False):
            pass
        for tok in ["quit_application", "remove_pkg_files", "forget_pkg", "rm -rf", "trash"]:
            if tok in l:
                print(f"{i}: {l}")
    print()

# Behavioral static verifier for the concern: does any uninstall script call quit_application and later remove files unconditionally?
for path in [
    "ee/maintained-apps/outputs/citrix-workspace/darwin.json",
    "ee/maintained-apps/outputs/mongodb-compass/darwin.json",
]:
    data=json.load(open(path))
    # pick the unique refs of the uninstall script, no dependency on schema details.
    refs=[v for v in data["refs"].values()]
    # each file has one uninstall ref in both outputs.
    script=refs[0]
    lines=script.splitlines()
    quit_calls=[]
    removes=[]
    for i,l in enumerate(lines,1):
        if "quit_application " in l or "quit_application(" in l:
            quit_calls.append((i,l.strip()))
        if any(rem in l for rem in ["sudo rm -rf", "rm -rf", "trash "]):
            removes.append((i,l.strip(), "remove"))
    print(f"== unconditional removal check for {path} ==")
    if quit_calls and removes and quit_calls[-1][0] < removes[0][0]:
        print("CONCERN_TRUE: exit 2")
    else:
        print("CONCERN_FALSE: exit 0")
PY

Repository: fleetdm/fleet

Length of output: 376

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json, pathlib, re

for path in [
    "ee/maintained-apps/outputs/citrix-workspace/darwin.json",
    "ee/maintained-apps/outputs/mongodb-compass/darwin.json",
]:
    data=json.load(open(path))
    refs=data["refs"]
    version=data["versions"][0]
    target=version["uninstall_script_ref"]
    script=refs[target]
    print(f"== {path} target ref {target} ==")
    for i,l in enumerate(script.splitlines(), 1):
        if any(tok in l for tok in ("quit_application", "remove_pkg_files", "forget_pkg", "rm -rf", "trash")) and not l.strip().startswith("#"):
            print(f"{i}: {l}")

for path in ["ee/maintained-apps/outputs/citrix-workspace/darwin.json", "ee/maintained-apps/outputs/mongodb-compass/darwin.json"]:
    data=json.load(open(path))
    script=data["refs"][data["versions"][0]["uninstall_script_ref"]]
    quit_calls=[]
    removal_calls=[]
    for i,l in enumerate(script.splitlines(),1):
        if re.search(r"\bquit_application\b", l) and not l.strip().startswith("#"):
            quit_calls.append((i,l.strip()))
        if re.search(r"\b(sudo\s+)?rm\s+-rf\b|\btrash\b", l) and not l.strip().startswith("#"):
            removal_calls.append((i,l.strip()))
    concern=False
    if quit_calls and removal_calls and quit_calls[-1][0] < removal_calls[0][0]:
        concern=True
    print(f"== conditional removal check for {path} ==")
    print("quit_calls:", quit_calls)
    print("removal_calls:", removal_calls)
    print("CONCERN_TRUE" if concern else "CONCERN_FALSE")
PY

Repository: fleetdm/fleet

Length of output: 8727

---

Stop uninstall when the application cannot quit.

quit_application logs failure but keeps going, then both uninstall scripts remove the app bundle, receipts/packages, and user data unconditionally. Make the helper return a failure and return from the script after the last requiredCitrix MongoDB Compass quit call when the timeout expires. Add an explicit force-quit path only if required.

• ee/maintained-apps/outputs/citrix-workspace/darwin.json#L20-L20: abort package, application, and data removal when any required Citrix process remains running.
• ee/maintained-apps/outputs/mongodb-compass/darwin.json#L19-L19: abort application and data removal when com.mongodb.compass remains running.

📍 Affects 2 files

• ee/maintained-apps/outputs/citrix-workspace/darwin.json#L20-L20 (this comment)
• ee/maintained-apps/outputs/mongodb-compass/darwin.json#L19-L19

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/citrix-workspace/darwin.json` at line 20, The
quit_application helper currently logs timeout failures but allows destructive
uninstall steps to continue. In
ee/maintained-apps/outputs/citrix-workspace/darwin.json:20-20, make
quit_application return failure when the application remains running and abort
the script after the last required Citrix quit_application call if any required
process cannot quit; in
ee/maintained-apps/outputs/mongodb-compass/darwin.json:19-19, apply the same
behavior for com.mongodb.compass before removing the application or user data.
Add a force-quit path only if required.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file='ee/maintained-apps/outputs/krita/darwin.json'
jq -r '
  .refs[.versions[0].install_script_ref],
  .refs[.versions[0].uninstall_script_ref]
' "$file" | rg -n '\$APPDIR/.+krita\.app|\$APPDIR/.+Krita\.app'

Repository: fleetdm/fleet

Length of output: 219

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file='ee/maintained-apps/outputs/krita/darwin.json'

printf 'JSON refs:\n'
jq -r '.refs[.versions[0].install_script_ref], .refs[.versions[0].uninstall_script_ref]' "$file"

install_ref=$(jq -r '.refs[.versions[0].install_script_ref]' "$file")
uninstall_ref=$(jq -r '.refs[.versions[0].uninstall_script_ref]' "$file")

printf '\nInstall script references:\n'
python3 - <<'PY' "$install_ref"
import json, re, sys
ref=sys.argv[1]
matches=re.findall(r'(?<!["\'])sha256-[0-9a-fA-F]{64}', ref)
print('\n'.join(matches))
PY
uninstall_line=$(jq -r '.refs[.versions[0].uninstall_script_ref]' "$file" | python3 - <<'PY'
import re, sys
s=sys.stdin.read()
print('\n'.join(re.findall(r'(?<!["\'])sha256-[0-9a-fA-F]{64}', s)))
PY
)

printf '\nInstall line matching AppleBundlePath:\n'
grep -n 'AppleBundlePath\|rita\.app\|Krita\.app' ee/maintained-apps/outputs/krita/darwin.json || true

printf '\nUninstall line matching rm paths:\n'
grep -n 'rm -rf\|rita\.app\|Krita\.app' ee/maintained-apps/outputs/krita/darwin.json || true

printf '\nPython case-sensitivity probe for filesystem string comparison:\n'
python3 - <<'PY'
for a,b in [("/Applications/krita.app","/Applications/Krita.app"), ("/Applications/Krita.app","/Applications/Krita.app")]:
    print(f"{a!r} != {b!r}: {a != b}")
PY

Repository: fleetdm/fleet

Length of output: 6039

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file='ee/maintained-apps/outputs/krita/darwin.json'
install_ref="$(jq -r '.refs[.versions[0].install_script_ref]' "$file" | sha256sum | cut -d' ' -f1)"
uninstall_ref="$(jq -r '.refs[.versions[0].uninstall_script_ref]' "$file" | sha256sum | cut -d' ' -f1)"

jq -r '
  "install_hash: \(.refs[.versions[0].install_script_ref] | `@text` | sha256sum),
   uninstall_hash: \(.refs[.versions[0].uninstall_script_ref] | `@text` | sha256sum),
   install_shell_refs: \(.refs[.versions[0].install_script_ref | explode[].ascii_downcase? // .] | if test("sha256-") then "refs_found" else "no_refs" end),
   uninstall_shell_refs: \(.refs[.versions[0].uninstall_script_ref | explode[].ascii_downcase? // .] | if test("sha256-") then "refs_found" else "no_refs" end)"
' "$file"

printf '\nCase-sensitive path comparison behavior:\n'
python3 - <<'PY'
for a,b in [("/Applications/krita.app","/Applications/Krita.app"), ("/Applications/Krita.app","/Applications/Krita.app")]:
    print(f"{a!r} != {b!r}: {a != b}")
PY

Repository: fleetdm/fleet

Length of output: 658

---

Use the installed bundle path in the uninstall script.

The install script copies /Applications/krita.app, but this script removes /Applications/Krita.app. On case-sensitive volumes, the uninstall leaves the installed application behind and reports success for unrelated matching names, such as a different app named Krita.app.

Proposed fix

-sudo rm -rf "$APPDIR/Krita.app"
+sudo rm -rf "$APPDIR/krita.app"

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

"3947b0f0": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nsudo rm -rf \"$APPDIR/Krita.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/org.krita.*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/krita*'\ntrash $LOGGED_IN_USER '~/Library/Caches/krita'\ntrash $LOGGED_IN_USER '~/Library/Containers/org.krita.*'\ntrash $LOGGED_IN_USER '~/Library/Preferences/kritadisplayrc'\ntrash $LOGGED_IN_USER '~/Library/Preferences/kritarc'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/org.krita.savedState'\n",

"3947b0f0": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nsudo rm -rf \"$APPDIR/krita.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/org.krita.*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/krita*'\ntrash $LOGGED_IN_USER '~/Library/Caches/krita'\ntrash $LOGGED_IN_USER '~/Library/Containers/org.krita.*'\ntrash $LOGGED_IN_USER '~/Library/Preferences/kritadisplayrc'\ntrash $LOGGED_IN_USER '~/Library/Preferences/kritarc'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/org.krita.savedState'\n",

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/krita/darwin.json` at line 19, Update the
uninstall script’s application removal command to use the same case-sensitive
bundle path as the installer, `/Applications/krita.app`, instead of
`/Applications/Krita.app`. Keep the existing removal flow unchanged so it
targets only the installed Krita bundle.

[github-actions]

Closing in favor of #50794.