Allen Houchins
98f82ce19f
## Summary - `pkg/patch_policy/GenerateQueryForManifest` now wraps the caller-supplied exists query in an inner set of parentheses before appending the trailing `AND version_compare(...) < 0` clause. Without the wrap, any `OR` in the exists body binds *after* the appended `AND` (SQL precedence: `AND` > `OR`), producing an incorrect `patched` query. The bug is currently only observable on `codex-cli` (uses `path = ... OR path LIKE ...`) but would silently break any future FMA whose exists query contains `OR`. - All FMA outputs regenerated via `cmd/maintained-apps`. For AND-only exists queries (the vast majority of existing FMAs), the new patched SQL is semantically identical to the previous form — just with extra parens around the WHERE body. `codex-cli/windows.json`'s OR clause is now correctly grouped. - `docker-desktop` is unchanged: its patched SQL is constructed inline in the homebrew ingester at [ingester.go:198-201](https://github.com/fleetdm/fleet/blob/claude/compassionate-merkle-afbd8a/ee/maintained-apps/ingesters/homebrew/ingester.go#L198-L201) and bypasses the generator. ### Heads-up: upstream version drift bundled in The regeneration also pulled in a handful of upstream version bumps that landed since the last FMA run. These are real upstream changes, not generator artifacts: | App | Platform | Old → New | |---|---|---| | Figma | windows | 126.3.12 → 126.4.9 | | GoLand | darwin | 2026.1.1 → 2026.1.2 | | IntelliJ IDEA | darwin | 2026.1.1 → 2026.1.2 | | RubyMine | darwin | 2026.1.1 → 2026.1.2 | | Zed | darwin | 1.2.5 → 1.2.6 | If you'd prefer these isolated from the paren-only change, let me know and I'll split the PR. ### Code changes - [pkg/patch_policy/patch_policy.go](pkg/patch_policy/patch_policy.go): added `(` to `templateStart` and `)` to `templateEnd{Darwin,Windows}` so `GenerateQueryForManifest` emits `... NOT EXISTS ((<before>) AND version_compare(...) < 0);`. - [pkg/patch_policy/patch_policy_test.go](pkg/patch_policy/patch_policy_test.go): updated existing expectations and added an OR-precedence case mirroring codex-cli's exists query. - [ee/maintained-apps/ingesters/homebrew/ingester_test.go](ee/maintained-apps/ingesters/homebrew/ingester_test.go): updated the generic `Patched` assertion (docker-desktop's hardcoded expectation is unchanged — it bypasses the generator). - 282 regenerated files under `ee/maintained-apps/outputs/**/*.json`. ## Test plan - [x] `go test ./pkg/patch_policy/...` passes (incl. new OR case). - [x] `go test ./ee/maintained-apps/...` passes. - [x] `go vet ./pkg/patch_policy/... ./ee/maintained-apps/...` clean. - [x] `cmd/maintained-apps` runs end-to-end with no errors against the live Homebrew/winget APIs (with `NETWORK_TEST_GITHUB_TOKEN` set). - [x] `git diff` audited: every diffed `patched` line on `outputs/**/*.json` is a paren-only delta; non-`patched` deltas confined to the 5 upstream version bumps listed above. - [x] `docker-desktop/darwin.json` unchanged after regeneration. - [ ] CI green.
pkg directory
This top-level pkg directory contains packages that may be shared between all fleet backend components.