rdmsm4x-changelog-20260905-1653-devupdate-cask-greedy-latest-switch

Revised all fleet maintenance and update scripts to use brew upgrade --greedy-latest by default instead of full --greedy, preventing automated wipes of auto_updates true application bundles (such as Google Chrome), preserving macOS Notification Center and TCC permissions; added --greedy override flags to dev_update.zsh.

Scope

• Hosts affected: rdmsm4x (and fleet-wide via centralized update tooling in ~/bin and ~/dev/scripts)
• Tooling: Homebrew Cask update pipelines across dev_update.zsh, fleet_update.zsh, fleet-dev-update.zsh, mac_fleet_library_updates.zsh, macos-update.sh, omnibus_maintenance.sh, and fleet-modernize.zsh.

Rationale

• When Homebrew Cask upgrades an app marked auto_updates true using --greedy, it unlinks and replaces the entire .app bundle from the downloaded DMG.
• This creates a new filesystem inode, invalidates LaunchServices registration tokens, and forces macOS usernotificationsd and TCC to treat the app as an unverified/fresh installation, causing persistent prompts to re-authorize notifications on Google Chrome and other apps.
• Switching to --greedy-latest ensures unversioned casks (version :latest) are still upgraded, while casks managing their own delta updates (Chrome, 1Password, Slack) update gracefully in-place via their native mechanisms without dropping system authorizations.

Exact Changes Made

1. /Users/richh/dev/scripts/dev_update_v1.96.zsh (symlinked via ~/dev_update.zsh and /Users/richh/dev/scripts/devupdate.zsh):
   • Added --greedy and --greedy-latest flags to top-level CLI argument parsing (FU_DU_PASS) and usage documentation.
   • In the embedded dev_update.zsh payload:
     • Set default CASK_GREEDY=0 (--greedy-latest).
     • Added CLI flag parsing for --greedy (CASK_GREEDY=1) and --greedy-latest (CASK_GREEDY=0).
     • Dynamically selects brew outdated --cask $cask_greedy_flag and brew upgrade --cask $cask_greedy_flag.
     • Recalculated payload SHA256 (28467549c5c5cbb1a44237921cf68c0a24fb962b2fcec1df14e885e7226154a7) and verified payload materialization via --verify-embedded.
2. /Users/richh/bin/fleet_update.zsh:
   • Added flag parsing defaulting GREEDY_FLAG="--greedy-latest".
   • Allows explicit --greedy argument override if requested.
   • Updated step invocation to run "brew upgrade $GREEDY_FLAG" brew upgrade "$GREEDY_FLAG".
3. /Users/richh/bin/fleet-dev-update.zsh:
   • Added flag parsing defaulting GREEDY_FLAG="--greedy-latest" with --greedy override.
   • Updated step invocation to step "brew upgrade ($GREEDY_FLAG)" brew upgrade "$GREEDY_FLAG".
4. /Users/richh/dev/scripts/mac_fleet_library_updates.zsh:
   • Updated line 128 to run_step "Homebrew Upgrade (Greedy-Latest)" "brew upgrade --greedy-latest" 180.
5. /Users/richh/dev/scripts/macos-update.sh:
   • Updated line 423 to step "Upgrade unversioned casks (brew upgrade --greedy-latest)" brew upgrade --greedy-latest.
6. /Users/richh/dev/scripts/omnibus_maintenance.sh:
   • Updated line 92 to brew upgrade --greedy-latest 2>&1 | tee -a "${LOG_FILE}".
7. /Users/richh/dev/scripts/fleet-modernize.zsh:
   • Updated line 370 to DEP_CASKS="$(brew outdated --cask --greedy-latest 2>/dev/null | wc -l | tr -d ' ')".

Verification Evidence

• zsh -n and bash -n syntax checks passed across all modified scripts.
• /Users/richh/dev/scripts/dev_update_v1.96.zsh --verify-embedded verified clean payload materialization and sha256 integrity.
• /Users/richh/dev_update.zsh --help confirms new --greedy and --greedy-latest flags appear in usage.

How to Undo / Override

• To run a one-off full greedy upgrade: run dev_update.zsh --greedy or fleet_update.zsh --greedy.
• To revert defaults: git checkout /Users/richh/dev/scripts/ or restore from /Users/richh/dev/scripts/dev_update_v1.96.zsh.bak-20260905-pre-greedy-latest.