[MikeMcQuaid]

• ChatGPT launches its computer-use helper from an external copy. Approval recorded there is absent from the app bundle, so scanning only the bundle causes a fresh prompt after every upgrade.
• Replace per-file approval tracking with approval throughout the verified app bundle, including new or previously unapproved helpers. The app becomes the approval boundary.
• Keep the requirement that the old app was approved or unquarantined and the upgraded app passes signing-identity verification. Retain quarantine metadata and skip symlinks.
• Inline user_approved_status? into user_approved? without changing its flag check, now that the per-file scanner no longer needs it.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

---

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a5e76d2e-103e-492b-8681-57defd9c8bd3

📥 Commits

Reviewing files that changed from the base of the PR and between b0dd035 and 0631239.

📒 Files selected for processing (4)

• Library/Homebrew/cask/quarantine.rb
• Library/Homebrew/cask/upgrade.rb
• Library/Homebrew/test/cask/quarantine_spec.rb
• Library/Homebrew/test/cask/upgrade_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (19)

• GitHub Check: docker (x86_64 Ubuntu 24.04)
• GitHub Check: docker (arm64 Ubuntu 24.04)
• GitHub Check: docker (x86_64 Ubuntu 26.04)
• GitHub Check: docker (arm64 Ubuntu 26.04)
• GitHub Check: workflow_syntax
• GitHub Check: tests (online, 1/2)
• GitHub Check: tests (load-only macOS)
• GitHub Check: tests (load-only Linux)
• GitHub Check: tests (macOS, 1/2)
• GitHub Check: tests (Linux, 1/2)
• GitHub Check: tests (generic OS, 2/2)
• GitHub Check: tests (Linux, 2/2)
• GitHub Check: tests (no Sorbet)
• GitHub Check: tests (macOS, 2/2)
• GitHub Check: tests (generic OS, 1/2)
• GitHub Check: tests (online, 2/2)
• GitHub Check: syntax
• GitHub Check: docs
• GitHub Check: Analyze

🔇 Additional comments (5)

Library/Homebrew/cask/quarantine.rb (1)

76-79: LGTM!

Also applies to: 82-83, 94-94, 106-109

Library/Homebrew/test/cask/quarantine_spec.rb (1)

303-303: LGTM!

Also applies to: 305-310, 327-335, 339-339

Library/Homebrew/cask/upgrade.rb (2)

438-442: LGTM!

---

471-471: LGTM!

Library/Homebrew/test/cask/upgrade_spec.rb (1)

701-701: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • User-approved quarantine status is carried over to the updated app and its nested helper apps.
  • Approval is applied to the app and its existing descendants, with symlinks excluded so approval does not extend to linked directories.
  • Quarantine status is checked directly when determining whether an app has been approved.

Walkthrough

Quarantine approval inheritance now includes the download path and unique, non-symlink paths found beneath it. Cask upgrades no longer collect or pass approved paths. Tests cover nested helper-app paths and exclude symlink targets.

Changes

Quarantine Approval Inheritance

Layer / File(s)	Summary
Discover paths for approval inheritance Library/Homebrew/cask/quarantine.rb, Library/Homebrew/test/cask/quarantine_spec.rb	inherit_user_approval! drops the approved_paths argument and adds the download path and unique, non-symlink paths from a recursive glob to its xargs input. The test covers nested helper paths and excludes symlink targets.
Update upgrade calls Library/Homebrew/cask/upgrade.rb, Library/Homebrew/test/cask/upgrade_spec.rb	Upgrade code no longer collects approved paths and calls inherit_user_approval! with only the new app target. The test checks the updated arguments.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Suggested reviewers: aholland

Merge Risk: ⚪ Minimal · up to 06312

Approval inheritance remains within the intended app bundle, and no actionable merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 06312

Approval now extends to more application contents, but upgrades still require prior app approval or absence of quarantine and successful signing-identity verification. No introduced boundary bypass was established. Concurrent filesystem changes and partial approval writes remain insufficiently characterized.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The expanded write scope is each eligible upgraded app's recursively discovered non-symlink contents, rather than only previously approved relative paths. The focused test asserts exclusion of an external symlink and a similarly named sibling bundle; the test was inspected, not executed.

Security Findings and Attack Paths

• inferred — Post-verification mutation remains an unresolved attack-path hypothesis: an actor able to alter the installed tree could change targets before enumeration or writing. The broader scan can select newly added descendants, but no privilege amplification, cross-bundle write or resulting execution bypass was verified. The base also separated verification from writes.

Trust Boundaries and Controls

• observed — The old app's designated requirement is obtained only after native validity checking. The new app must satisfy that requirement using validation flags for every architecture, nested code and strict bundle structure. Missing identities, failed validation and signer changes do not authorize inheritance.

Resilience and Maintainability Implications

• observed — Approval authority remains caller-enforced: inherit_user_approval! checks for root quarantine metadata but does not independently verify prior approval or signing identity. The inspected upgrade caller supplies those controls; this division of responsibility predates the PR.

Hardening Proposals

• proposed — For stronger guarantees under concurrent mutation, consider binding approval writes to the validated tree and defining no-follow containment and partial-write recovery semantics. These are hardening options, not verified vulnerabilities.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: preserving cask approval for copied helper applications.
Description check	✅ Passed	The description directly explains the approval-boundary change, retained verification requirements, symlink handling, tests, and motivation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 97c8c07a-7e7c-447f-8234-97f244256bfd

📥 Commits

Reviewing files that changed from the base of the PR and between 8d49321 and b0dd035.

📒 Files selected for processing (4)

• Library/Homebrew/cask/quarantine.rb
• Library/Homebrew/cask/upgrade.rb
• Library/Homebrew/test/cask/quarantine_spec.rb
• Library/Homebrew/test/cask/upgrade_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📜 Review details

⏰ Context from checks skipped due to timeout. (19)

• GitHub Check: docker (arm64 Ubuntu 24.04)
• GitHub Check: docker (x86_64 Ubuntu 26.04)
• GitHub Check: docker (arm64 Ubuntu 26.04)
• GitHub Check: docker (x86_64 Ubuntu 24.04)
• GitHub Check: tests (macOS, 2/2)
• GitHub Check: tests (load-only Linux)
• GitHub Check: tests (Linux, 2/2)
• GitHub Check: tests (Linux, 1/2)
• GitHub Check: tests (generic OS, 1/2)
• GitHub Check: tests (macOS, 1/2)
• GitHub Check: tests (no Sorbet)
• GitHub Check: tests (load-only macOS)
• GitHub Check: tests (generic OS, 2/2)
• GitHub Check: tests (online, 2/2)
• GitHub Check: tests (online, 1/2)
• GitHub Check: syntax
• GitHub Check: docs
• GitHub Check: workflow_syntax
• GitHub Check: Analyze

🔇 Additional comments (2)

Library/Homebrew/cask/upgrade.rb (1)

438-438: LGTM!

Also applies to: 471-471

Library/Homebrew/test/cask/upgrade_spec.rb (1)

701-701: LGTM!