#!/bin/bash
# Runs as root right after the .pkg lays down /Applications/CiCy Desktop.app.
# The app is unsigned-but-ad-hoc (no Apple cert). pkg-installed files normally
# aren't quarantined, but strip any quarantine + re-ad-hoc-sign to be safe so the
# app opens without "已损坏 / unidentified developer". Best-effort — never fail install.
APP="/Applications/CiCy Desktop.app"
[ -d "$APP" ] || exit 0
/usr/bin/xattr -dr com.apple.quarantine "$APP" 2>/dev/null || true
/usr/bin/xattr -cr "$APP" 2>/dev/null || true
# Re-ad-hoc-sign so the app opens with no Apple cert. (A self-signed cert was tried to
# make the Screen-Recording grant persist — it did sign, but macOS 15 still re-prompts
# without an Apple Team ID, so it was dropped; desktop capture is OFF by default on mac.)
/usr/bin/codesign --force --deep --sign - "$APP" 2>/dev/null || true

# Desktop shortcut for the logged-in user (postinstall runs as root, so resolve the
# console user + their home and chown the symlink to them). Launchpad/Spotlight pick
# the app up automatically from /Applications.
CUSER="$(/usr/bin/stat -f%Su /dev/console 2>/dev/null)"
if [ -n "$CUSER" ] && [ "$CUSER" != "root" ]; then
  UHOME="$(/usr/bin/dscl . -read "/Users/$CUSER" NFSHomeDirectory 2>/dev/null | awk '{print $2}')"
  if [ -d "$UHOME/Desktop" ]; then
    /bin/ln -sfn "$APP" "$UHOME/Desktop/CiCy Desktop.app" 2>/dev/null || true
    /usr/sbin/chown -h "$CUSER:staff" "$UHOME/Desktop/CiCy Desktop.app" 2>/dev/null || true
  fi
fi
exit 0