Seed ComputerUseAppApprovals.json with discovered macOS app bundle identifiers

seed-computer-use-app-approvals.sh

#!/bin/bash

set -euo pipefail

DEFAULT_OUTPUT="$HOME/Library/Group Containers/2DC432GLL2.com.openai.sky.CUAService/Library/Application Support/Software/ComputerUseAppApprovals.json"
OUTPUT_PATH="${1:-$DEFAULT_OUTPUT}"

TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

APP_PATHS_FILE="$TMP_DIR/app_paths.txt"
BUNDLE_IDS_FILE="$TMP_DIR/bundle_ids.txt"
JSON_FILE="$TMP_DIR/ComputerUseAppApprovals.json"

collect_apps_from_launch_services() {
  local lsregister

  lsregister="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"

  if [[ -x "$lsregister" ]]; then
    "$lsregister" -dump 2>/dev/null \
      | sed -n 's/^.*path:[[:space:]]*//p' \
      | while IFS= read -r app_path; do
          [[ "$app_path" == *.app ]] || continue
          [[ -e "$app_path" ]] || continue
          printf '%s\n' "$app_path"
        done >>"$APP_PATHS_FILE"
  fi
}

collect_apps_from_spotlight() {
  if command -v mdfind >/dev/null 2>&1; then
    mdfind "kMDItemContentType == 'com.apple.application-bundle'" 2>/dev/null >>"$APP_PATHS_FILE" || true
  fi
}

collect_apps_from_find() {
  local root
  local roots=(
    "/Applications"
    "/Applications/Setapp"
    "/System/Applications"
    "/System/Library/CoreServices"
    "$HOME/Applications"
    "$HOME/.local/bin"
    "$HOME/bin"
    "/Volumes"
  )

  for root in "${roots[@]}"; do
    if [[ -d "$root" ]]; then
      find "$root" \( -type d -o -type l \) -name "*.app" -prune -print 2>/dev/null >>"$APP_PATHS_FILE" || true
    fi
  done
}

extract_bundle_identifier() {
  local app_path="$1"
  local info_plist="$app_path/Contents/Info.plist"
  local bundle_id=""

  if [[ ! -f "$info_plist" ]]; then
    return 0
  fi

  bundle_id="$(plutil -extract CFBundleIdentifier raw -o - "$info_plist" 2>/dev/null || true)"

  if [[ -n "$bundle_id" && "$bundle_id" != "null" ]]; then
    printf '%s\n' "$bundle_id"
  fi
}

write_json() {
  local ids_file="$1"

  {
    printf '{\n'
    printf '  "approvedBundleIdentifiers": ['

    if [[ -s "$ids_file" ]]; then
      local first=1
      local bundle_id
      while IFS= read -r bundle_id; do
        if [[ $first -eq 1 ]]; then
          printf '\n'
          first=0
        else
          printf ',\n'
        fi

        printf '    "%s"' "$bundle_id"
      done <"$ids_file"

      printf '\n'
    fi

    printf '  ]\n'
    printf '}\n'
  } >"$JSON_FILE"
}

backup_existing_output() {
  if [[ -e "$OUTPUT_PATH" ]]; then
    local timestamp
    local backup_path

    timestamp="$(date +%Y%m%d-%H%M%S)"
    backup_path="$(mktemp "${OUTPUT_PATH}.backup.${timestamp}.XXXXXX")"

    cp -p "$OUTPUT_PATH" "$backup_path"
    printf 'Backed up existing approvals to %s\n' "$backup_path"
  fi
}

: >"$APP_PATHS_FILE"

collect_apps_from_launch_services
collect_apps_from_spotlight
collect_apps_from_find

sort -u "$APP_PATHS_FILE" | while IFS= read -r app_path; do
  extract_bundle_identifier "$app_path"
done | sort -u >"$BUNDLE_IDS_FILE"

mkdir -p "$(dirname "$OUTPUT_PATH")"
backup_existing_output
write_json "$BUNDLE_IDS_FILE"
mv "$JSON_FILE" "$OUTPUT_PATH"

printf 'Wrote %s bundle identifiers to %s\n' "$(wc -l <"$BUNDLE_IDS_FILE" | tr -d ' ')" "$OUTPUT_PATH"