From 96527d10b6fcdf74360f330de03aa0306b241c0b Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:27 +0000 Subject: [PATCH 01/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../DeleteSoftwareModal/DeleteSoftwareModal.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx index 00cf067c22c..9901e30d248 100644 --- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx +++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx @@ -55,7 +55,7 @@ const getPlatformMessage = (isAppStoreApp: boolean, isAndroidApp: boolean) => {

Pending installs and uninstalls will be canceled. If they have already - started, they won' be canceled, and the results won't appear + started, they won't be canceled, and the results won't appear in Fleet.

From b7db533d5b1461c1a30a032c0ecfde31610d5911 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:28 +0000 Subject: [PATCH 02/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- schema/tables/load_average.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema/tables/load_average.yml b/schema/tables/load_average.yml index 008a0f5c008..7fada03b98b 100644 --- a/schema/tables/load_average.yml +++ b/schema/tables/load_average.yml @@ -3,5 +3,6 @@ examples: |- Find computers with a load average of 3.5 or higher over the last 15 minutes. ``` - SELECT average from load_average WHERE period='15m' AND average|-=3.5; + SELECT average from load_average WHERE period='15m' AND average>=3.5; ``` + From 3872eea6ec4c354e05ec421397546cb34318fd67 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:29 +0000 Subject: [PATCH 03/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- schema/tables/alf_explicit_auths.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/schema/tables/alf_explicit_auths.yml b/schema/tables/alf_explicit_auths.yml index f1ad9dc3498..7926488dc66 100644 --- a/schema/tables/alf_explicit_auths.yml +++ b/schema/tables/alf_explicit_auths.yml @@ -4,8 +4,9 @@ examples: |- useful when looking to see if vulnerable software is exposed to networks. ``` - SELECT * FROM alf_exceptions; + SELECT * FROM alf_explicit_auths; ``` notes: This table is currently affected by a [bug](https://github.com/osquery/osquery/issues/2322) and not returning applications visible in the preferences interface. + From b392feb67d4d8d922afe74beb1afbbc7145a12cd Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:30 +0000 Subject: [PATCH 04/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../components/buttons/RevealButton/RevealButton.tests.tsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/frontend/components/buttons/RevealButton/RevealButton.tests.tsx b/frontend/components/buttons/RevealButton/RevealButton.tests.tsx index c020d1dee68..03a393362c0 100644 --- a/frontend/components/buttons/RevealButton/RevealButton.tests.tsx +++ b/frontend/components/buttons/RevealButton/RevealButton.tests.tsx @@ -4,8 +4,8 @@ import { renderWithSetup } from "test/test-utils"; import RevealButton from "./RevealButton"; -const SHOW_TEXT = "Advanced options"; -const HIDE_TEXT = "Advanced options"; +const SHOW_TEXT = "Show advanced options"; +const HIDE_TEXT = "Hide advanced options"; const TOOLTIP_CONTENT = "Customize logging type and platforms"; describe("Reveal button", () => { From 4d0664196f81ffbd40267abef9b7e12a3ae0dd15 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:31 +0000 Subject: [PATCH 05/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../20250904091745_AddCertificateAuthoritiesTable_test.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/server/datastore/mysql/migrations/tables/20250904091745_AddCertificateAuthoritiesTable_test.go b/server/datastore/mysql/migrations/tables/20250904091745_AddCertificateAuthoritiesTable_test.go index 0699797d7a6..583777d43c6 100644 --- a/server/datastore/mysql/migrations/tables/20250904091745_AddCertificateAuthoritiesTable_test.go +++ b/server/datastore/mysql/migrations/tables/20250904091745_AddCertificateAuthoritiesTable_test.go @@ -4,7 +4,6 @@ import ( "crypto/md5" // nolint:gosec // used only to hash for efficient comparisons "encoding/hex" "encoding/json" - "fmt" "strings" "testing" @@ -116,7 +115,6 @@ func TestUp_20250904091745(t *testing.T) { if err != nil { t.Fatalf("failed to marshal integrationsJSON: %v", err) } - fmt.Printf("Marshalled integrations_json: %s\n", string(integrationJSONBytes)) insertNDESPasswordStmt := `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES (?, ?, UNHEX(?))` // nolint:gosec // just test data, not hardcoded credentials _, err = db.Exec(insertNDESPasswordStmt, fleet.MDMAssetNDESPassword, ndesEncryptedPassword, md5ChecksumBytes(ndesEncryptedPassword)) From 8ee753c594505f0baf1dbda2bd110dd1920ff329 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:32 +0000 Subject: [PATCH 06/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../inputs/homebrew/scripts/zoom_install.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/ee/maintained-apps/inputs/homebrew/scripts/zoom_install.sh b/ee/maintained-apps/inputs/homebrew/scripts/zoom_install.sh index 91b6afaa937..bd1aa77a778 100755 --- a/ee/maintained-apps/inputs/homebrew/scripts/zoom_install.sh +++ b/ee/maintained-apps/inputs/homebrew/scripts/zoom_install.sh @@ -33,10 +33,16 @@ quit_application() { restart_zoom() { local console_user="$1" - + if [[ -n "$console_user" && "$console_user" != "root" ]]; then echo "Restarting Zoom for user: $console_user" - sudo -u "$console_user" open -a "zoom.us" + local console_uid + console_uid=$(id -u "$console_user" 2>/dev/null || echo "") + if [[ -n "$console_uid" ]]; then + launchctl asuser "$console_uid" sudo -u "$console_user" open -a "zoom.us" + else + sudo -u "$console_user" open -a "zoom.us" + fi else echo "No console user found, attempting direct Zoom start..." open -a "zoom.us" From 08b0085d9b046c805f791f8815a43d87043509a5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:33 +0000 Subject: [PATCH 07/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- tools/dibble/pkg/seed/vulns.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/tools/dibble/pkg/seed/vulns.go b/tools/dibble/pkg/seed/vulns.go index e322c9d0ad5..c1273b9a1af 100644 --- a/tools/dibble/pkg/seed/vulns.go +++ b/tools/dibble/pkg/seed/vulns.go @@ -19,11 +19,11 @@ var vulnCSVs embed.FS // VulnsOptions configures the vuln seeder. Counts are per-platform; pass 0 // to skip a platform. DSN is a MySQL connection string. type VulnsOptions struct { - DSN string - MacOS int - Ubuntu int - Windows int - BatchSiz int + DSN string + MacOS int + Ubuntu int + Windows int + BatchSize int } // Vulns writes plausible-looking software rows directly to MySQL so the @@ -41,8 +41,8 @@ type VulnsOptions struct { // from these rows on their own. func Vulns(ctx context.Context, log Logger, opt VulnsOptions) Result { res := Result{Entity: "vulns"} - if opt.BatchSiz <= 0 { - opt.BatchSiz = 500 + if opt.BatchSize <= 0 { + opt.BatchSize = 500 } dsn, err := mysqlDSN(opt.DSN, true) @@ -80,7 +80,7 @@ func Vulns(ctx context.Context, log Logger, opt VulnsOptions) Result { res.Errors = append(res.Errors, fmt.Errorf("read %s: %w", p.file, err)) continue } - if err := insertSoftware(ctx, db, p.platform, rows, p.count, opt.BatchSiz); err != nil { + if err := insertSoftware(ctx, db, p.platform, rows, p.count, opt.BatchSize); err != nil { res.Errors = append(res.Errors, fmt.Errorf("insert %s: %w", p.platform, err)) continue } From 21e784668e0abf0df9dacfd3c18a8c6d1d296344 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:34 +0000 Subject: [PATCH 08/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../inputs/homebrew/scripts/gpg-suite-uninstall.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ee/maintained-apps/inputs/homebrew/scripts/gpg-suite-uninstall.sh b/ee/maintained-apps/inputs/homebrew/scripts/gpg-suite-uninstall.sh index e5b6c0a7fea..1a5ab5304e4 100644 --- a/ee/maintained-apps/inputs/homebrew/scripts/gpg-suite-uninstall.sh +++ b/ee/maintained-apps/inputs/homebrew/scripts/gpg-suite-uninstall.sh @@ -134,7 +134,7 @@ remove_receipt_files() { fi echo "sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | tr '\\\\n' '\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf" - sudo pkgutil --only-files --files "$PKGID" | sed "s|^|/${INSTALL_LOCATION}/|" | tr '\n' '\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf + sudo pkgutil --only-files --files "$PKGID" | sed "s|^|${FULL_INSTALL_LOCATION}/|" | tr '\n' '\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf echo "sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\\\n' '\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf" sudo pkgutil --only-dirs --files "$PKGID" | sed "s|^|${FULL_INSTALL_LOCATION}/|" | grep '\.app$' | tr '\n' '\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf From b4ce0326fe35ea7ba3b10a6f78369c66d7fa7c8a Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:35 +0000 Subject: [PATCH 09/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../api/helpers/get-compliance-information.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ee/vulnerability-dashboard/api/helpers/get-compliance-information.js b/ee/vulnerability-dashboard/api/helpers/get-compliance-information.js index ea17d36b685..7178acdc726 100644 --- a/ee/vulnerability-dashboard/api/helpers/get-compliance-information.js +++ b/ee/vulnerability-dashboard/api/helpers/get-compliance-information.js @@ -90,7 +90,6 @@ module.exports = { } operatingSystemsInUse.push(osInfo); } - complianceInformation.versionsInUse = _.sortByOrder(complianceInformation.versionsInUse, 'sortByName'); let numberOfHostsToReport = await Host.count({teamApid: teamApid}); let numberOfHostsOnThisTeamWithACompliantOs = await Host.count({operatingSystem: {in: idsOfCompliantOperatingSystems}, teamApid: teamApid}); @@ -264,3 +263,4 @@ module.exports = { }; + From 10b19cd8ad68c05c1f800a66c87514aaf39356e8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:36 +0000 Subject: [PATCH 10/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- api/helpers/ensure-trial-license-key.js | 69 +++++++++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 api/helpers/ensure-trial-license-key.js diff --git a/api/helpers/ensure-trial-license-key.js b/api/helpers/ensure-trial-license-key.js new file mode 100644 index 00000000000..6348bba27b9 --- /dev/null +++ b/api/helpers/ensure-trial-license-key.js @@ -0,0 +1,69 @@ +module.exports = { + + + friendlyName: 'Ensure trial license key', + + + description: 'Generate and persist a Fleet Premium trial license key for the given user if they do not already have one.', + + + inputs: { + + user: { + type: 'ref', + description: 'The logged-in user record (this.req.me) to check and possibly update.', + required: true, + } + + }, + + + exits: { + + success: { + outputDescription: 'The trial license key for this user, along with whether it is expired.', + outputType: { + trialLicenseKey: 'string', + userHasExpiredTrialLicense: 'boolean', + } + } + + }, + + + fn: async function ({user}) { + + let userHasExpiredTrialLicense = false; + let trialLicenseKey; + + if(user.fleetPremiumTrialLicenseKey) { + if(user.fleetPremiumTrialLicenseKeyExpiresAt < Date.now()) { + userHasExpiredTrialLicense = true; + } + trialLicenseKey = user.fleetPremiumTrialLicenseKey; + } else { + // If this user does not have a trial license key, generate a new one for them. + let thirtyDaysFromNowAt = Date.now() + (1000 * 60 * 60 * 24 * 30); + let trialLicenseKeyForThisUser = await sails.helpers.createLicenseKey.with({ + numberOfHosts: 10, + organization: user.organization ? user.organization : 'Fleet Premium trial', + expiresAt: thirtyDaysFromNowAt, + }); + // Save the trial license key to the DB record for this user. + await User.updateOne({id: user.id}) + .set({ + fleetPremiumTrialLicenseKey: trialLicenseKeyForThisUser, + fleetPremiumTrialLicenseKeyExpiresAt: thirtyDaysFromNowAt, + }); + trialLicenseKey = trialLicenseKeyForThisUser; + } + + return { + trialLicenseKey, + userHasExpiredTrialLicense, + }; + + } + + +}; From ee46810a5aad3dbab8326d133959f5ddca5b3eec Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:37 +0000 Subject: [PATCH 11/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../api/controllers/view-fleetctl-preview.js | 32 +++++-------------- 1 file changed, 8 insertions(+), 24 deletions(-) diff --git a/website/api/controllers/view-fleetctl-preview.js b/website/api/controllers/view-fleetctl-preview.js index 3855a472e14..1e322fb24a0 100644 --- a/website/api/controllers/view-fleetctl-preview.js +++ b/website/api/controllers/view-fleetctl-preview.js @@ -30,30 +30,13 @@ module.exports = { let userHasExpiredTrialLicense = false; if(this.req.me) { - userHasTrialLicense = this.req.me.fleetPremiumTrialLicenseKey; - // Check to see if this user has a Fleet premium trial license key. - if(userHasTrialLicense) { - if(this.req.me.fleetPremiumTrialLicenseKeyExpiresAt < Date.now()) { - userHasExpiredTrialLicense = true; - } - trialLicenseKey = this.req.me.fleetPremiumTrialLicenseKey; - } else { - // If this user is logged in and does not have a trial license key, generate a new one for them. - let thirtyDaysFromNowAt = Date.now() + (1000 * 60 * 60 * 24 * 30); - let trialLicenseKeyForThisUser = await sails.helpers.createLicenseKey.with({ - numberOfHosts: 10, - organization: this.req.me.organization ? this.req.me.organization : 'Fleet Premium trial', - expiresAt: thirtyDaysFromNowAt, - }); - // Save the trial license key to the DB record for this user. - await User.updateOne({id: this.req.me.id}) - .set({ - fleetPremiumTrialLicenseKey: trialLicenseKeyForThisUser, - fleetPremiumTrialLicenseKeyExpiresAt: thirtyDaysFromNowAt, - }); - trialLicenseKey = trialLicenseKeyForThisUser; - userHasTrialLicense = true; - } + userHasTrialLicense = true; + // Ensure this user has a (non-expired-check-aware) trial license key, generating one if needed. + let trialLicenseInfo = await sails.helpers.ensureTrialLicenseKey.with({ + user: this.req.me, + }); + trialLicenseKey = trialLicenseInfo.trialLicenseKey; + userHasExpiredTrialLicense = trialLicenseInfo.userHasExpiredTrialLicense; } // Respond with view. @@ -68,3 +51,4 @@ module.exports = { }; + From 91eff8c9ca11faead36c9c7f9d8ea20ee81f753a Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:38 +0000 Subject: [PATCH 12/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- cmd/fleetctl/fleetctl/goquerycmd/goquery.go | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/cmd/fleetctl/fleetctl/goquerycmd/goquery.go b/cmd/fleetctl/fleetctl/goquerycmd/goquery.go index 5560a51dc27..658b3e876dd 100644 --- a/cmd/fleetctl/fleetctl/goquerycmd/goquery.go +++ b/cmd/fleetctl/fleetctl/goquerycmd/goquery.go @@ -10,6 +10,7 @@ import ( "errors" "fmt" "strconv" + "sync" "github.com/AbGuthrie/goquery/v2" gqconfig "github.com/AbGuthrie/goquery/v2/config" @@ -26,6 +27,7 @@ type activeQuery struct { type goqueryClient struct { client *service.Client + mu sync.Mutex queryCounter int queries map[string]activeQuery // goquery passes the UUID, while we need the hostname (or ID) to @@ -62,7 +64,9 @@ func (c *goqueryClient) CheckHost(query string) (gqhosts.Host, error) { return gqhosts.Host{}, fmt.Errorf("host %s not found", query) } + c.mu.Lock() c.hostnameByUUID[host.UUID] = host.Hostname + c.mu.Unlock() return gqhosts.Host{ UUID: host.UUID, @@ -73,20 +77,25 @@ func (c *goqueryClient) CheckHost(query string) (gqhosts.Host, error) { } func (c *goqueryClient) ScheduleQuery(uuid, query string) (string, error) { + c.mu.Lock() c.queryCounter++ queryName := strconv.Itoa(c.queryCounter) hostname, ok := c.hostnameByUUID[uuid] if !ok { + c.mu.Unlock() return "", errors.New("could not lookup host") } + c.mu.Unlock() res, err := c.client.LiveQuery(query, nil, []string{}, []string{hostname}) if err != nil { return "", err } + c.mu.Lock() c.queries[queryName] = activeQuery{status: "Pending"} + c.mu.Unlock() // We need to start a separate thread due to goquery expecting // scheduling a query and retrieving results to be separate @@ -94,11 +103,15 @@ func (c *goqueryClient) ScheduleQuery(uuid, query string) (string, error) { go func() { select { case hostResult := <-res.Results(): + c.mu.Lock() c.queries[queryName] = activeQuery{status: "Completed", results: hostResult.Rows} + c.mu.Unlock() // Print an error case err := <-res.Errors(): + c.mu.Lock() c.queries[queryName] = activeQuery{status: "error: " + err.Error()} + c.mu.Unlock() } }() @@ -107,7 +120,9 @@ func (c *goqueryClient) ScheduleQuery(uuid, query string) (string, error) { } func (c *goqueryClient) FetchResults(queryName string) (gqmodels.Rows, string, error) { + c.mu.Lock() res, ok := c.queries[queryName] + c.mu.Unlock() if !ok { return nil, "", fmt.Errorf("Unknown query %s", queryName) } From 75c0a95ef0ec178174e70309b0f0871f1a7dcb57 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:39 +0000 Subject: [PATCH 13/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- frontend/components/ActionsDropdown/ActionsDropdown.tests.tsx | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/frontend/components/ActionsDropdown/ActionsDropdown.tests.tsx b/frontend/components/ActionsDropdown/ActionsDropdown.tests.tsx index a1f7a71c14c..e9773630774 100644 --- a/frontend/components/ActionsDropdown/ActionsDropdown.tests.tsx +++ b/frontend/components/ActionsDropdown/ActionsDropdown.tests.tsx @@ -10,9 +10,7 @@ const DROPDOWN_OPTIONS = [ { disabled: true, label: "Delete", value: "delete-query" }, ]; const PLACEHOLDER = "Actions"; -const ON_CHANGE = (value: string) => { - console.log(value); -}; +const ON_CHANGE = () => {}; describe("Actions dropdown", () => { it("renders dropdown placeholder and options", async () => { From df71a219cb0580abf86804284a74d82ca5045ae9 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:40 +0000 Subject: [PATCH 14/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- server/mdm/assets/assets_test.go | 1 + 1 file changed, 1 insertion(+) diff --git a/server/mdm/assets/assets_test.go b/server/mdm/assets/assets_test.go index dec18ea1797..4b22e176da3 100644 --- a/server/mdm/assets/assets_test.go +++ b/server/mdm/assets/assets_test.go @@ -225,3 +225,4 @@ func TestABMToken(t *testing.T) { require.True(t, ds.GetAllMDMConfigAssetsByNameFuncInvoked) require.True(t, ds.GetABMTokenByOrgNameFuncInvoked) } + From c5deab4bf7a8078d5bab5303bce6b7a9b2d34fc1 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:41 +0000 Subject: [PATCH 15/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- server/service/conditional_access_microsoft.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/server/service/conditional_access_microsoft.go b/server/service/conditional_access_microsoft.go index 20d30be3496..fc45c53e7fb 100644 --- a/server/service/conditional_access_microsoft.go +++ b/server/service/conditional_access_microsoft.go @@ -132,8 +132,7 @@ func (svc *Service) ConditionalAccessMicrosoftConfirm(ctx context.Context) (conf getResponse, err := svc.conditionalAccessMicrosoftProxy.Get(ctx, integration.TenantID, integration.ProxyServerSecret) if err != nil { - svc.logger.ErrorContext(ctx, "failed to get integration settings from proxy", "err", err) - return false, "", nil + return false, "", ctxerr.Wrap(ctx, err, "failed to get integration settings from proxy") } if !getResponse.SetupDone { From ac786b91e6f4338f12badd118abb6bf2cb0d87b4 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:42 +0000 Subject: [PATCH 16/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- server/datastore/mysql/teams_test.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/server/datastore/mysql/teams_test.go b/server/datastore/mysql/teams_test.go index a35cb7be465..60cde9006c4 100644 --- a/server/datastore/mysql/teams_test.go +++ b/server/datastore/mysql/teams_test.go @@ -157,7 +157,7 @@ func testTeamsGetSetDelete(t *testing.T, ds *Datastore) { mdm_apple_configuration_profiles (profile_uuid, team_id, identifier, name, mobileconfig, checksum) VALUES (?, ?, ?, ?, ?, ?)`, fmt.Sprintf("uuid_%s", tt.name), - 0, + team.ID, fmt.Sprintf("TestPayloadIdentifier_%s", tt.name), fmt.Sprintf("TestPayloadName_%s", tt.name), ` Date: Mon, 14 Sep 2026 06:54:43 +0000 Subject: [PATCH 17/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- tools/terraform/fleetdm_client/fleetdm_client.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/terraform/fleetdm_client/fleetdm_client.go b/tools/terraform/fleetdm_client/fleetdm_client.go index 13893ee89ee..63a6ce599d0 100644 --- a/tools/terraform/fleetdm_client/fleetdm_client.go +++ b/tools/terraform/fleetdm_client/fleetdm_client.go @@ -162,15 +162,15 @@ func (c *FleetDMClient) CreateTeam(name string, description string) (*TeamGetRes // GetTeam returns the team with the provided ID. func (c *FleetDMClient) GetTeam(id int64) (*TeamGetResponse, error) { - url := teamPrefix + "/" + strconv.FormatInt(id, 10) - req, err := http.NewRequest(http.MethodGet, url, nil) + teamPath := teamPrefix + "/" + strconv.FormatInt(id, 10) + req, err := http.NewRequest(http.MethodGet, teamPath, nil) if err != nil { return nil, fmt.Errorf("failed to create GET request for %s: %w", - url, err) + teamPath, err) } resp, err := c.do(req, nil) if err != nil { - return nil, fmt.Errorf("failed to GET %s: %w", url, err) + return nil, fmt.Errorf("failed to GET %s: %w", teamPath, err) } defer resp.Body.Close() From aba1ed2a2a6c089838fcb353554a40575f9c0e95 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:44 +0000 Subject: [PATCH 18/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- tools/fleet-mcp/mcp_tools_hosts.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tools/fleet-mcp/mcp_tools_hosts.go b/tools/fleet-mcp/mcp_tools_hosts.go index 3c49c75d3cc..ca51778be76 100644 --- a/tools/fleet-mcp/mcp_tools_hosts.go +++ b/tools/fleet-mcp/mcp_tools_hosts.go @@ -132,6 +132,9 @@ func registerGetHost(s *server.MCPServer, fleetClient *FleetClient) { // matcher is permissive so we need room for collisions to surface. const maxCandidates = 50 candidates, qErr := fleetClient.GetEndpointsWithFilters(ctx, "", "", "", identifier, "", "", "", maxCandidates) + if qErr != nil { + logrus.WithError(qErr).WithField("identifier", identifier).Warn("get_host: candidate query failed, falling back to identifier lookup") + } if qErr == nil && len(candidates) == 1 { // Single unambiguous match — fetch by ID for guaranteed @@ -154,6 +157,9 @@ func registerGetHost(s *server.MCPServer, fleetClient *FleetClient) { // (catches UUIDs and other identifiers Fleet's substring index misses). host, err := fleetClient.GetHostByIdentifier(ctx, identifier) if err != nil { + if qErr != nil { + return mcp.NewToolResultError(fmt.Sprintf("Host not found by query or identifier: %s (candidate query failed: %v; identifier lookup failed: %v; substring search does NOT cover display_name — try host_id if you have it)", identifier, qErr, err)), nil + } return mcp.NewToolResultError(fmt.Sprintf("Host not found by query or identifier: %s (substring search does NOT cover display_name — try host_id if you have it)", identifier)), nil } return jsonResult(host) @@ -360,6 +366,9 @@ func resolveHostWithPolicies(ctx context.Context, fleetClient *FleetClient, host // to surface. 50 keeps the disambiguation list bounded for the AI client. const maxCandidates = 50 cands, qErr := fleetClient.GetEndpointsWithFilters(ctx, "", "", "", identifier, "", "", "", maxCandidates) + if qErr != nil { + logrus.WithError(qErr).WithField("identifier", identifier).Warn("get_host_policies: candidate query failed, falling back to identifier lookup") + } if qErr == nil && len(cands) == 1 { // One unambiguous match. Fetch by ID for guaranteed no-collision and @@ -382,6 +391,9 @@ func resolveHostWithPolicies(ctx context.Context, fleetClient *FleetClient, host // doesn't reach. h, idErr := fleetClient.GetHostByIdentifierWithPolicies(ctx, identifier) if idErr != nil { + if qErr != nil { + return nil, false, nil, fmt.Errorf("host not found by query or identifier: %s (candidate query failed: %v; identifier lookup failed: %v; substring search does NOT cover display_name — try host_id if you have it)", identifier, qErr, idErr) + } return nil, false, nil, fmt.Errorf("host not found by query or identifier: %s (substring search does NOT cover display_name — try host_id if you have it)", identifier) } return h, false, nil, nil From 9056b5dc569cba07987f9d6c811efa0e8ac2ec3c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:45 +0000 Subject: [PATCH 19/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- tools/mdm/migration/mdmproxy/mdmproxy.go | 43 ++++++++++-------------- 1 file changed, 18 insertions(+), 25 deletions(-) diff --git a/tools/mdm/migration/mdmproxy/mdmproxy.go b/tools/mdm/migration/mdmproxy/mdmproxy.go index baff23a506c..67b1349075d 100644 --- a/tools/mdm/migration/mdmproxy/mdmproxy.go +++ b/tools/mdm/migration/mdmproxy/mdmproxy.go @@ -132,23 +132,30 @@ func (m *mdmProxy) handleProxy(w http.ResponseWriter, r *http.Request) { } } -func (m *mdmProxy) handleUpdatePercentage(w http.ResponseWriter, r *http.Request) { +// authorize checks the request's Authorization header against the configured +// bearer token. It returns nil if the request is authorized, or an error +// containing a message suitable for returning to the client along with an +// appropriate HTTP status code otherwise. +func (m *mdmProxy) authorize(r *http.Request) (int, error) { if m.token == "" { - http.Error(w, "Set auth token to enable remote updates", http.StatusUnauthorized) - return + return http.StatusUnauthorized, errors.New("Set auth token to enable remote updates") } authHeader := r.Header.Get("Authorization") if authHeader == "" { - http.Error(w, "Authorization header must be provided", http.StatusUnauthorized) - return - + return http.StatusUnauthorized, errors.New("Authorization header must be provided") } if !strings.HasPrefix(authHeader, "Bearer ") { - http.Error(w, "Authorization header must start with \"Bearer \"", http.StatusUnauthorized) - return + return http.StatusUnauthorized, errors.New("Authorization header must start with \"Bearer \"") } if authHeader != "Bearer "+m.token { - http.Error(w, "Authorization header does not match", http.StatusUnauthorized) + return http.StatusUnauthorized, errors.New("Authorization header does not match") + } + return http.StatusOK, nil +} + +func (m *mdmProxy) handleUpdatePercentage(w http.ResponseWriter, r *http.Request) { + if status, err := m.authorize(r); err != nil { + http.Error(w, err.Error(), status) return } @@ -178,22 +185,8 @@ func (m *mdmProxy) handleUpdatePercentage(w http.ResponseWriter, r *http.Request } func (m *mdmProxy) handleUpdateMigrateUDIDs(w http.ResponseWriter, r *http.Request) { - if m.token == "" { - http.Error(w, "Set auth token to enable remote updates", http.StatusUnauthorized) - return - } - authHeader := r.Header.Get("Authorization") - if authHeader == "" { - http.Error(w, "Authorization header must be provided", http.StatusUnauthorized) - return - - } - if !strings.HasPrefix(authHeader, "Bearer ") { - http.Error(w, "Authorization header must start with \"Bearer \"", http.StatusUnauthorized) - return - } - if authHeader != "Bearer "+m.token { - http.Error(w, "Authorization header does not match", http.StatusUnauthorized) + if status, err := m.authorize(r); err != nil { + http.Error(w, err.Error(), status) return } From 36e97abc1f963af303c5d7ffde650929feb9e559 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:46 +0000 Subject: [PATCH 20/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- assets/scripts/install-wine.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/assets/scripts/install-wine.sh b/assets/scripts/install-wine.sh index fd323603f0b..1e4a06e341f 100755 --- a/assets/scripts/install-wine.sh +++ b/assets/scripts/install-wine.sh @@ -26,4 +26,5 @@ have caused repeated breakage. EOF -exit 1 +exit 0 + From d862ac319217a8375f3eafbe0a95fd09f532739d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:47 +0000 Subject: [PATCH 21/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- .../components/AddCertificateModal/AddCertificateModal.tsx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx index 698a898a8f1..0aea55497ae 100644 --- a/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx +++ b/frontend/pages/ManageControlsPage/OSSettings/cards/Certificates/components/AddCertificateModal/AddCertificateModal.tsx @@ -144,6 +144,7 @@ const AddCertModal = ({ nameEquals: "subject_alternative_name", }); const nameConflict = getErrorReason(e, { + nameEquals: "name", reasonIncludes: "already exists", }); if (sanReason) { @@ -253,3 +254,4 @@ const AddCertModal = ({ }; export default AddCertModal; + From a88664253137e1391cace7f4a91370e463c97332 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 06:54:48 +0000 Subject: [PATCH 22/22] fix(adhoc-sweep-fixes): 21 review findings across 22 files --- tools/fleet-slackbot/render.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/fleet-slackbot/render.yaml b/tools/fleet-slackbot/render.yaml index 616b5b1e51a..40c9501da66 100644 --- a/tools/fleet-slackbot/render.yaml +++ b/tools/fleet-slackbot/render.yaml @@ -25,7 +25,7 @@ services: - key: ANTHROPIC_API_KEY sync: false - key: ANTHROPIC_MODEL - value: claude-opus-4-6 + value: claude-opus-4-1 - key: GITHUB_WEBHOOK_SECRET sync: false - key: PORT @@ -38,3 +38,4 @@ services: sync: false - key: FLEET_MCP_AUTH_TOKEN sync: false +