Legacy macOS Detect Cleanup

#!/bin/bash
# Runlayer: tidy up after the legacy script-based AI Watch Detect rollout.
# Runs as root from your MDM. Idempotent; always exits 0.
set -u

LABEL="com.runlayer.scan"
KEY_NAME="ai_watch_mdm"

# Hosts stored in ~/.runlayer/config.yaml: the `url:` of every entry under
# `hosts:`. The CLI matches --host against that stored url, so pass it as is.
stored_hosts() {
    /usr/bin/awk '
        /^hosts:/ { inhosts = 1; next }
        inhosts && /^[^ ]/ { inhosts = 0 }
        inhosts && /^    url:[ \t]*/ {
            sub(/^    url:[ \t]*/, ""); gsub(/^["'"'"']|["'"'"']$/, ""); print
        }' "$1" 2>/dev/null
}

# Run a command as the home's owner with the environment the legacy
# installer used, so uv and the CLI see the same tool dir and config.
# Plain sudo, not `launchctl asuser`: the latter needs the user's GUI
# bootstrap, which does not exist at the login window, where MDMs often
# run one-time scripts.
as_owner() {
    local user="$1" home="$2"
    shift 2
    /usr/bin/sudo -u "$user" /usr/bin/env HOME="$home" UV_CACHE_DIR="$home/.cache/uv" "$@"
}

for home in /Users/*; do
    [ -d "$home" ] || continue
    case "$home" in /Users/Shared) continue ;; esac
    uid=$(/usr/bin/stat -f %u "$home" 2>/dev/null || echo "")
    user=$(/usr/bin/stat -f %Su "$home" 2>/dev/null || echo "")
    case "$uid" in ""|0|*[!0-9]*) continue ;; esac

    plist="$home/Library/LaunchAgents/$LABEL.plist"
    if [ -e "$plist" ]; then
        /bin/launchctl bootout "gui/${uid}/${LABEL}" 2>/dev/null || true
        rm -f "$plist"
    fi

    # Remove only the MDM key entry from ~/.runlayer/config.yaml, under every
    # stored host; personal `runlayer login` credentials and the hosts
    # themselves are preserved. Needs the CLI, so it runs before the uv tool
    # is removed. Falls back to uvx when the shim is already gone (that path
    # downloads the CLI; network needed).
    shim="$home/.local/bin/runlayer"
    config="$home/.runlayer/config.yaml"
    cli=""
    if [ -x "$shim" ]; then
        cli="$shim"
    elif [ -x /usr/local/bin/uvx ]; then
        cli="/usr/local/bin/uvx runlayer"
    fi
    if [ -n "$cli" ] && /usr/bin/grep -qs "$KEY_NAME" "$config"; then
        while IFS= read -r url; do
            [ -n "$url" ] || continue
            # shellcheck disable=SC2086  # $cli is intentionally "uvx runlayer" in the fallback
            as_owner "$user" "$home" $cli org-api-key remove "$KEY_NAME" --host "$url" >/dev/null 2>&1 || true
        done <<< "$(stored_hosts "$config")"
    fi

    # uv-installed CLI + shim. `uv tool uninstall` keeps uv's own records
    # consistent; the rm lines cover a half-removed install.
    if [ -x /usr/local/bin/uv ]; then
        as_owner "$user" "$home" /usr/local/bin/uv tool uninstall runlayer >/dev/null 2>&1 || true
    fi
    rm -rf "$home/.local/share/uv/tools/runlayer"
    if [ -L "$shim" ] && [ ! -e "$shim" ]; then
        rm -f "$shim"   # dangling shim left by a removed tool dir
    fi
done

rm -f /usr/local/bin/runlayer-scan
rm -f /var/log/runlayer/ai_watch_detect.log
rmdir /var/log/runlayer 2>/dev/null || true   # only if nothing else logs there
rm -f /tmp/runlayer-ai_watch_detect.log /tmp/runlayer-scan.stdout.log /tmp/runlayer-scan.stderr.log

echo "Legacy AI Watch Detect tidy-up complete."
exit 0

#!/bin/bash
set -u

EXPECT_TIDY=0   # set to 1 once the tidy script has been deployed

LEFTOVERS=0
check_gone() {
    if [ -e "$2" ] || [ -L "$2" ]; then
        echo "FAIL: $1 still present: $2"
        LEFTOVERS=$((LEFTOVERS + 1))
    else
        echo "OK: $1 removed"
    fi
}
# User-space leftovers count only when the tidy script is expected to have run.
user_space_leftover() {
    if [ "$EXPECT_TIDY" = "1" ]; then
        echo "FAIL: $1 (run the tidy script)"
        LEFTOVERS=$((LEFTOVERS + 1))
    else
        echo "NOTE: $1 (tidy script not run yet)"
    fi
}

check_gone "old wrapper" /usr/local/bin/runlayer-scan

for home in /Users/*; do
    [ -d "$home" ] || continue
    case "$home" in /Users/Shared) continue ;; esac
    uid=$(/usr/bin/stat -f %u "$home" 2>/dev/null || echo "")
    case "$uid" in ""|0|*[!0-9]*) continue ;; esac
    name=$(basename "$home")

    check_gone "old LaunchAgent plist ($name)" "$home/Library/LaunchAgents/com.runlayer.scan.plist"
    if [ -e "$home/.local/share/uv/tools/runlayer" ]; then
        user_space_leftover "uv-installed Runlayer CLI still present for $name"
    else
        echo "OK: old Runlayer CLI removed ($name)"
    fi
    if /usr/bin/grep -qs "ai_watch_mdm" "$home/.runlayer/config.yaml"; then
        user_space_leftover "ai_watch_mdm key entry still in ~/.runlayer/config.yaml for $name"
    else
        echo "OK: ai_watch_mdm key entry removed ($name)"
    fi
    # A GUI domain exists only for signed-in users; absent is as good as unloaded.
    if /bin/launchctl print "gui/${uid}/com.runlayer.scan" >/dev/null 2>&1; then
        echo "FAIL: old LaunchAgent com.runlayer.scan is still loaded for $name"
        LEFTOVERS=$((LEFTOVERS + 1))
    else
        echo "OK: old LaunchAgent not loaded ($name)"
    fi
done

if [ "$LEFTOVERS" -gt 0 ]; then
    echo "Legacy cleanup incomplete: $LEFTOVERS item(s) left."
    exit 1
fi
echo "Legacy cleanup verified."
exit 0

# 1. Old wrapper gone
test ! -e /usr/local/bin/runlayer-scan && echo "old wrapper removed"

# 2. Old per-user LaunchAgent gone (launchctl exits 113 when the service does not exist)
launchctl print "gui/$(id -u)/com.runlayer.scan" >/dev/null 2>&1; [ $? -eq 113 ] && echo "old LaunchAgent removed"

# 3. New system LaunchAgent loaded
launchctl print "gui/$(id -u)/com.runlayer.aiwatch" >/dev/null 2>&1 && echo "new LaunchAgent loaded"

# 4. Only the new PPPC pin is active (com.runlayer.aiwatch, signed by Anysource Inc.)
sudo log show --predicate 'subsystem == "com.apple.TCC"' --last 1h | grep -E "com\.runlayer\.(scan|aiwatch)"