PrefWatch v.1.4.0

1.4.0 — 2026-07-23

Feature

• New --no-console flag: don't open Console.app or stop when it closes (run until Ctrl+C) — for interactive/VM testing.
• New --debug flag (Jamf $11) logs # FILTERED: <domain> <key> (reason) for suppressed changes. Off by default; also gates the startup # Watchers active: line.
• Spotlight indexing → sudo mdutil -i on/off / (state lives in the metadata store, not a plist).
• Dock add/remove also prints a # dockutil --add/--remove line (folders carry --view/--display/--sort), preceded by a # NOTE: that it's an alternative to the PlistBuddy commands (run one, not both).
• Dock-reorder # NOTE: now points at dockutil (dockutil --move <app> --position <N>).
• Per-app firewall rules (Firewall ▸ Options — the per-app allow/block list, e.g. smbd) → socketfilterfw --add/--blockapp/--unblockapp/--remove, polled via --listapps (modern macOS dropped the diffable com.apple.alf.plist). Complements the global firewall below.
• Security posture (FileVault / Gatekeeper / firewall — state, stealth, block-all, allow-signed) → fdesetup/spctl/socketfilterfw; FileVault emits a # NOTE: (enabling needs a recovery key). Gatekeeper also detects the App Store-only vs +identified-developers sub-mode (spctl --status --verbose) → # NOTE: (GUI/MDM-profile setting).
• Time zone → sudo systemsetup -settimezone "<Zone>" (read from the /etc/localtime symlink); NTP server → -setnetworktimeserver. A # NOTE: flags automatic time zone.
• Wallpaper change → # NOTE: pointing at desktoppr (it lives in the com.apple.wallpaper Store, not reproducible via defaults).
• Default-app changes (any URL scheme / file type) → utiluti url set/type set; http/https/public.html collapse to one url set http. Thanks to Armin Briegel (scriptingosx) for utiluti and desktoppr.
• Hostname (LocalHostName / ComputerName / HostName) → sudo scutil --set (the unreliable raw configd-plist write is now filtered).

Fix

• Integer keys valued 0/1 in a user domain were emitted as -bool instead of -int in ALL mode — the type probe ran defaults read-type as root, which can't see the console user's domain ("Domain not found"), so it fell back to guessing from the value shape (proven on com.apple.dock wvous-tr-modifier, a modifier bitmask). The probe now runs as the console user; system /Library/Preferences prefs stay root-read.
• Privileged emissions that were missing it now carry sudo (pmset, system-domain launchctl incl. bootstrap/bootout, lpadmin, the re-emitted sharing CLIs) — a non-root copy-paste of those used to fail, while scutil/spctl/systemsetup/socketfilterfw/mdutil/dscl/cupsctl already had it.
• Empty-string key ('') made a :: PlistBuddy path that collapses — those subtrees are now skipped with a # NOTE:.
• ColorSync display-profile change dropped the redundant ByHost "re-run with --mdm" NOTE (it contradicted the device-UUID NOTE).
• User-domain launchd toggles now wrap in launchctl asuser <uid> … — a root replay couldn't run the bare gui/<uid> form.
• com.apple.assistant.support un-excluded to surface real Siri prefs (Assistant Enabled, dictation); narrowed com.apple.assistant* to exact names.
• Watchers no longer abort under set -e -o pipefail when a var=$(… | grep | head) finds no match (mdutil, fdesetup/spctl/socketfilterfw, NTP, pmset/cups) — || true inside each pipe.
• Console-close detection now needs 5 consecutive pgrep -x Console misses (a single transient miss under load no longer stops monitoring) and guards the sleep (|| true).
• Battery charge limit no longer emits a bogus defaults write …batteryui.charging.mac …prior.limit (UI state, daemon-reverted — not the SMC control); filtered, with a # NOTE: pointing at System Settings ▸ Battery.

Noise

• Filter com.apple.siri.setup lastShownCoordinatorVersion* — the Siri setup wizard's record of which onboarding panes it displayed (macOS 27); the real opt-ins it produces stay in com.apple.assistant.support.
• Filter *recency*/*Recency* alongside the existing recent-items patterns — e.g. com.apple.EmojiPreferences com.apple.stickers.recency.order, the most-recently-used emoji ordering (usage history, rewritten on every emoji picked).
• Restore FK_SidebarWidth* coverage — the global pattern had narrowed to an exact SidebarWidth, so the save-panel's FK_SidebarWidth2 (UI geometry) leaked again.
• The menu-bar reorder # NOTE: now also fires on macOS 27's central com.apple.MenuBarAgent store (it only knew the old per-app NSStatusItem Preferred Position), so a reorder isn't silent there; adding/removing an item still emits its real command instead.
• Filter *ItemPreferredPositions (com.apple.MenuBarAgent) — macOS 27 moved menu-bar item offsets here: per-machine pixel values, and the key embeds a : so the emitted PlistBuddy path isn't even addressable. Same class as the already-filtered NSStatusItem Preferred Position.
• The NSToolbar Configuration … NOTE now warns that TB Is Shown can be rewritten by the app itself on window open/close — the flag stays unfiltered, so a deliberate ⌥⌘T still surfaces.
• Exclude com.apple.SpotlightKnowledge — the exclusion existed only in lowercase and zsh globs are case-sensitive, so the real CamelCase domain (hdbCutover.*.evaluationCount counters) still leaked. com.apple.Spotlight (real search settings) is untouched.
• Exclude com.apple.analyticsagent (Apple's analytics agent — sync timestamps and usage counters, e.g. AppUsageSyncTime).
• Filter com.apple.campo engagementCount*/engagementDate* — per-target usage tallies (telemetry), not settings.
• Exclude com.apple.DirectoryUtility (Directory Utility app UI state — toolbar layout, last-browsed perHost node; real AD/LDAP bindings live in OpenDirectory / config profiles, not this plist).
• Filter com.apple.iPod per-device sync churn nested under Devices:<id>: — the Connected timestamp and Use Count counter, rewritten on every connect (the existing top-level filter missed the nested form).
• Filter Date & Time picker breadcrumbs (com.apple.TimeZonePref.* city coords, com.apple.preferences.timezone.* AppleMapID, com.apple.AppleModemSettingTool.LastCountryCode) — none set the zone (the timezone watcher does) and they're not portable.
• Siri enable/disable churn: exclude com.apple.voiceservices, drop com.apple.Siri SiriPrefStashedStatusMenuVisible.
• Filter com.apple.voicetrigger internal state written when Siri is enabled — Remote Darwin VoiceTrigger Enabled (inter-device routing, no UI toggle) and Accessory <Alarm|Media|Timer> Playback Status (accessory runtime state); the real toggles (VoiceTrigger Enabled = Listen for "Hey Siri", UserPreferredVoiceTriggerPhraseType) stay.
• Filter com.apple.assistant.support Offline Dictation Status — per-locale offline-dictation model-download flags (Installed/High Quality/Continuous Listening/…), daemon-written, not settings; the real prefs (Assistant Enabled, Dictation Auto Punctuation Enabled) stay.
• Finder axTextSize — Accessibility Text Size writes a reproducible universalaccess FontSizeCategory; the ~18 derived per-view axTextSize writes are churn (real Cmd+J iconSize/textSize/FontSize stay).
• Exclude com.apple.security.sosaccount (iCloud Keychain sync-circle state, not settable via defaults).
• Exclude com.apple.filevault (ByHost daemon state written after enabling — no reproducible pref; the security watcher's FileVault NOTE is the signal).
• Filter NSToolbar Configuration <UUID> (per-instance, non-portable); named configs stay.
• Filter Trend Micro com.trendmicro.ztnasase agent state (*Version, DeviceId, *IsInvalid); real prefs stay.
• Filter com.apple.FolderActionsDispatcher launchd flap (system auto-toggles it).

Refactor

• Watcher subsystem restructured, no behavior change: a PID registry replaces the teardown trap that listed every PID twice, a declarative _WATCHERS table drives launch + the # Watchers active: summary from one source (adding a watcher is one line), and the nine state-polling watchers share one generic _snapshot_watch loop instead of near-identical copies. Every emitted command is unchanged.

PrefWatch v.1.3.3

1.3.3 — 2026-07-19

Feature

• Local user account add/remove emits a # NOTE: — the account lives in OpenDirectory, not a plist, so it isn't reproducible via defaults.
• A pure Dock reorder emits a # NOTE: — the order would need a full persistent-apps rewrite, so it previously produced no output at all.
• Adding an element to an existing array carries a # NOTE: — PlistBuddy addresses arrays by position, so the :N index may land wrong on a target whose array differs.
• Menu bar position changes emit a # NOTE: — pixel offsets, filtered as churn, so a Cmd+drag reorder emitted nothing; a display change recomputes them too, so the NOTE claims neither.
• NSToolbar Configuration (any app) carries a # NOTE: — the first window open dumps the whole toolbar layout; only later changes are real customizations. Kept visible, not filtered.
• A ColorSync display-profile change emits a # NOTE: — its Device.mntr.<UUID> is the monitor's own UUID (differs per physical display, not the Mac's), so --mdm can't templatize it; resolve it per target with defaults -currentHost read.

Fix

• --mdm left the capture machine's literal hardware UUID in the ByHost path, so PlistBuddy seeded a stray plist on every target — now .$UUID.plist.
• --mdm emits the $loggedInUser/$UUID resolvers as executable lines once at startup, so the whole block deploys as pasted.
• --mdm left the capture user's home literal in emitted VALUES (dock _CFURLString, path prefs) — now templatized to /Users/$loggedInUser.
• A kill/SIGHUP on the main pid orphaned the watcher and leaked its /tmp dir — the cleanup trap lived only in the child. The main shell now tears down the whole tree and clears the tmpdir.
• The sharing-exec ssh.plist label matched as a substring, so jamf's startssh.plist task load leaked as a Remote Login change — anchored to /ssh.plist (the real ssh LaunchDaemon).

Noise

• Drop the com.apple.preferences.accounts deletedUsers churn — replaying it created a phantom deleted-user record; the account NOTE reports the real removal instead.
• Filter geometry/telemetry churn: screencapture last-selection*, OmniGroup OSURunTimeStatistics/OSULastRun*, SketchUp WebDialog.* window positions.
• Filter com.apple.Passwords system state: WBSPrivacyProxyAvailability* (Private Relay availability, which flips with the network) and content-refresh stamps. The real toggles stay.
• Extend the com.apple.SoftwareUpdate daemon-result filter to AvailableUpdatesNotification* — the policy toggles stay.
• Exclude com.apple.AMPLibraryAgent (media-library daemon: migration flags, persistent IDs, store capability flags — no user prefs).
• Filter FortiClient launchd churn (com.fortinet.* re-bootstraps its daemons on wake) and NetworkExtension VPN internal markers (__NEVPN*, re-registered on wake).

PrefWatch v.1.3.2

1.3.2 — 2026-07-06

Feature

• Contextual NOTEs for Finder view settings (first "Use as Defaults" writes the full structure) and menu-bar extras (run killall SystemUIServer to apply).

Fix

• ByHost defaults write commands now place -currentHost before the verb — they were malformed and did nothing, affecting every ByHost pref (Control Center menu-bar modules, trackpad/mouse, screensaver, ColorSync).
• System-level pref changes (/Library/Preferences, seen when running as root) now emit commands targeting the system file by full path plus a root NOTE — a bare domain replayed into the console user's ~/Library copy instead.
• Emitted commands reproduce values faithfully: escape $/backticks/$VAR in -string values, single quotes in all PlistBuddy commands, and leading/trailing whitespace in PlistBuddy values.
• Array deletions: emitted highest-index-first so a batch runs safely in order, a nested-list element now emits its items, and the deletion WARNING is no longer dropped from ONLY_CMDS/Jamf output.
• NSTableViewDefaultSizeMode (sidebar icon size) is no longer dropped as noise.
• show_domain_diff no longer emits a spurious full-domain storm when defaults export transiently returns empty.
• launchd_state_watch no longer leaks plutil errors into the log (Sonoma).
• sharing_exec_watch drops read-only networksetup/systemsetup queries invoked without the leading dash.
• Jamf $7 (ONLY_CMDS) is no longer overridden by a stray environment variable.
• poll_watch flush watchdog: set -e no longer aborts the kill escalation on an already-reaped pid, so the straggler freeze-cap holds.
• Contextual NOTEs and the array-deletion WARNING dedup per burst — shown once for a rapid run of changes and re-shown after a quiet gap (_NOTE_BURST_GAP, default 15s), instead of once per session or on every single change.

Noise

• Excluded daemon / non-reproducible domains: MobileMeAccounts, com.apple.ShazamKit, com.apple.mobiletimerd, com.apple.parsecd.
• Filtered internal keys: VisibleNetworkSRLocaleIdentifiers (speech), version (Spotlight), hudNotifiedConstrast (universalaccess).

PrefWatch v.1.3.1

1.3.1 — 2026-06-18

Feature

• ard_privs_watch: capture per-user Remote Management (ARD) privileges (the naprivs bitmask, set via XPC outside any plist) — emits the dscl -create/-delete + kickstart -restart -agent to apply.

Fix

• sharing_exec_watch: capture kickstart (a Perl script, so its exec reports perl — now resolved from args for interpreters, not launchers like sudo).
• launchd_state_watch: pair enable/disable with bootstrap/bootout so socket-activated sharing toggles (SMB/SSH/Screen Sharing) replay; plist resolved by label (com.openssh.sshd→ssh.plist).

Noise

• Global key filter BIT*Time (HockeyApp / App Center session timestamps).
• sharing_exec_watch: whitelist launchctl to Apple sharing labels (smbd/screensharing/sshd/ARD) — drops third-party LaunchAgent churn (Zoom/MS/Adobe/VM updaters).

PrefWatch v.1.3.0

1.3.0 — 2026-06-05

Feature

• Sharing-panel capture (ALL/root): captures toggles stored outside plists and emits the matching command — Remote Login / Screen Sharing / Remote Management (launchctl/kickstart/systemsetup/sharing/networksetup) and Printer Sharing (cupsctl), via eslogger, launchd disabled.plist, and cupsd.conf.
• Faster detection: a default "hot" set of the common System Settings panels is flushed every 0.5s so changes surface in ~1-2s instead of ~10s. Override via --hot-domains (Jamf $10); NONE disables.

Fix

• com.apple.loginwindow un-excluded to surface admin policies (GuestEnabled, LoginwindowText, autoLoginUser, …); per-session churn filtered key-by-key instead.
• Guard set -e pipeline assignments (dscl home, version header) with || true so a non-zero exit can't abort startup under Jamf/root.
• Guaranteed tmpdir cleanup on exit + reclaim of orphan tmpdirs/locks from crashed prior runs.

Noise

• Newly excluded domains: com.apple.facetime.bag, com.apple.gridDataServices, com.adobe.AdobeGenuineService, com.apple.weather*, com.apple.inputAnalytics*, com.apple.appstored, com.apple.security.cloudkeychainproxy3*.
• New global key filters: CKPerBootTasks, DDMPersisted*, *-analytics-stamp, *FlushThumbnailCache, *_frame/SidebarWidth (window geometry), *last*Date (timestamps), recentlyPlayed*/NSOSPLastRootDirectory.
• New per-domain filters: SoftwareUpdate daemon results, smb.server NetBIOSName, HIToolbox AppleInputSourceHistory, Bartender TerminationReasons, AudioMIDISetup audioDevice.selected, iStat menubar Updates/Status, cloud.quota _ICQ*, AssetCache cache-size, ARDAgent/RemoteDesktop daemon-init values.
• Sharing watchers: drop read-only networksetup/systemsetup queries, VM/container launchd helpers, and auto-flapping bootpd/dhcp6d.

PrefWatch v.1.2.1

1.2.1 — 2026-04-23

Feature

• Pre-flight confirmation now shown only when Python3/CLT is missing. prompt_yn adds an osascript GUI fallback via launchctl asuser for Jamf Self Service / launchd sessions (5-min timeout → auto-continue so policies never hang).

Fix

• poll_watch could freeze when cfprefsd hung on a domain (parallel flush → unbounded wait). Added a 3s watchdog that SIGTERM/SIGKILLs stragglers so the loop always advances.

Note

• Reworded the "new top-level key" NOTE: parent dict must exist before Set, so Add commands must run in order.

Noise

• Add *TimeStamp* to global timestamp noise — zsh glob case sensitivity made *Timestamp* miss camelCase like SuspendHelperActivityTimeStamp.
• com.apple.CharacterPicker: filter State (per-app emoji picker UI keyed by bundle ID).
• com.apple.quicklook.ThumbnailsAgent: filter QLMTCacheSize*LastCheck* (periodic cache-size check).
• com.bjango.istatmenus.menubar.*: filter License (periodic license re-validation).
• com.apple.wifi.WiFiAgent: filter UserDismissedLimitedNetworkFirstJoins (per-SSID "don't show again" bookkeeping).
• Exclude com.apple.CloudSubscriptionFeatures* (iCloud+ geo cache with UUID-keyed binary entries — caused multi-second pauses in show_plist_diff on each cache refresh).

CI

• validate.yml: drop bash -n prefwatch.sh — script is #!/bin/zsh and uses zsh-only constructs (*(N) glob qualifier failed under bash). zsh check on prefwatch.sh + bash check on release.sh are kept.

PrefWatch v.1.2.0

1.2.0 — 2026-04-17

Feature

• New --hot-domains <list> CLI flag / Jamf $10 parameter: comma-separated list of domains kept permanently "active" so their first change is detected without waiting for the fs_usage→poll round-trip. Defaults: com.apple.finder, .GlobalPreferences. Pass NONE to disable.
• Contextual # NOTE: for Finder PreviewPaneSettings — first-open writes the full attribute list; only subsequent toggles reflect actual user modifications.
• README: new Security section flagging that /var/log/prefwatch-v*.log may contain user-specific data.

Fix

• start_watch single-domain mode missed any change that happened within the same second as its initial baseline: stat -f %m has 1-second granularity, so the current_mtime != last_mtime check never fired for same-second writes and the change remained invisible until a later-second write occurred. Now forces a full show_domain_diff every 4 poll iterations (~2s) regardless of mtime; defaults export reads cfprefsd directly and catches same-second writes the mtime check missed.
• Detect Finder column view settings (StandardViewOptions:ColumnViewOptions) — previously filtered out.
• Finder NOTE clarified: View Options (Cmd+J) require 'Use as Defaults' for detection (icon/list view); column view writes directly.

Performance

• Preemptive cfprefsd flush in fs_watch: spawn defaults read $dom in the background before invoking show_plist_diff, giving the retry loop a better chance of seeing up-to-date data.
• New active-domains registry: fs_watch and poll_watch mark each touched domain in $PREFWATCH_TMPDIR/active-domains/; every poll iteration pre-flushes cfprefsd for those domains in parallel via defaults read. Non-destructive alternative to killall cfprefsd.
• HOT_DOMAINS are seeded into the active-domains registry at startup and auto-refreshed each poll cycle so they never expire — first change detected near-instantly.
• Tighter show_plist_diff retry schedule 0.1 0.2 0.3 0.5 0.7 (total 1.8s) replacing the previous 0.5 + 1.5 (2s). More frequent flush hints catch cfprefsd sync faster in the fs_usage path.
• show_plist_diff retry loop skips dump_plist when file mtime is unchanged (up to 5× per event saved). A final unconditional dump on the last retry ensures same-second writes are still caught, since stat -f %m has 1-second granularity.
• Skip dump_plist_json during retries in show_plist_diff — JSON is only needed after a change is confirmed.
• Reduce poll_watch cadence from 1s to 0.5s — halves the worst-case latency when the fs_usage path misses a flush.
• Debounce fs_usage events per-plist at 300ms using $EPOCHREALTIME (fork-free via zsh/datetime). cfprefsd emits multiple fs_usage events per logical write (observable via fs_usage); collapsing them avoids redundant show_plist_diff passes.
• Force line-buffered I/O in the fs_watch pipeline (sed -l + awk fflush()) — prevents block buffering between sed/awk/while read from holding back events on quiet pipelines.
• Run the 3 Python diff invocations (emit_array_additions, emit_array_deletions via new _py_deletions_raw helper, emit_nested_dict_changes) in parallel in both show_plist_diff and show_domain_diff.
• Reduce forks in _log (called for every output line): use zsh/datetime strftime instead of /bin/date in get_timestamp; replace two printf | sed pipelines with zsh [[ =~ ]] + ${match[1]} capture on defaults write messages.

Noise

• Exclude com.apple.metrickitd (MetricKit daemon — MXClient* keys are per-app diagnostic bookkeeping touched whenever Outlook, Teams, Edge, etc. query MetricKit, not user preferences)
• Exclude com.apple.imessage.bag (Apple service config bag: CacheTime TTL + Date refresh timestamp, server-controlled)
• Filter LastIMDNotificationPostedDate for com.apple.iChat (Instant Messaging Daemon notification timestamp)
• Filter *lastAppUpdateCheck*|*LastAppUpdateCheck* globally (auto-update check timestamps, e.g. Raycast raycast-updates-lastAppUpdateCheckDate)
• Filter *lastProcessed*|*LastProcessed* (processing timestamps like lastProcessedDate)
• Filter *LastBackup*|*lastBackup* (TimeMachine daemon state like LastBackupActivity)
• Filter CloudKitAccountInfoCache|*CloudKitAccountInfo* globally (hash-keyed CloudKit account cache)
• Filter TimeMachine Destinations:N: daemon sub-keys (BytesAvailable, BytesUsed, NumberOfSnapshots, SnapshotDates, ConsistencyScanDate, FilesystemTypeName, LastKnownEncryptionState, LastKnownVolumeName, ReferenceLocalSnapshotDate, attemptDate, backupOfVolumeUUIDs) — keeps user config (ID, Kind, QuotaGB, Name)
• Filter PreviewOptionsWindow.Location for Finder (Cmd+J panel window position)

Prevent masking real user preferences

Narrowed overly-broad global patterns in is_noisy_key() that could hide real prefs:

• *History* → *HistoryItems*|*HistoryMetadata*|*HistoryList*|NSRecentDocumentsHistory|*HistoryDatabase* (keeps HistoryAgeInDaysLimit, EnableHistory)
• *Cache* → *CacheData*|*CachedBy*|*CacheVersion*|*CacheKey*|*CacheEntry* (keeps CacheSize, EnableCache, DiskCacheSize)
• *Temp* → removed (kept *-temp|*-tmp|*TempFile*|*TempPath*) — avoid catching Template*, ColorTemperature
• *ViewOptions* → *ViewOptionsFrame*|*ViewOptionsWindow* (suffix-specific window state)
• FK_SidebarWidth* → removed (real user preference)
• *Analytics*|*Telemetry* → *AnalyticsQueue/Session/Event*|*TelemetryQueue/Session/Event* (keeps AnalyticsEnabled, SendAnalytics)
• SUSendProfileInfo → removed (Sparkle opt-in toggle)
• flags exact → removed (too generic)
• uses / *donate* → removed/narrowed to launchCount, *donateDialogShown*, *lastDonateDate*
• state|status|State|Status exact → removed
• *ConnectionState* → removed
• *Date|Date exact suffix → removed (specific date noise already covered)
• last-selection → removed from global
• ALL_CAPS regex → removed (could catch real prefs like SHOW_HIDDEN_FILES)

Narrowed DEFAULT_EXCLUSIONS that hid entire domains with real user preferences:

• com.apple.SoftwareUpdate → removed (AutomaticDownload, AutomaticallyInstallMacOSUpdates, AutomaticCheckEnabled)
• com.apple.TimeMachine → narrowed to .helper/.agent (keeps AutoBackup, ExcludedPaths)
• com.apple.security* → narrowed to known daemon sub-domains

PrefWatch v.1.1.6

1.1.6 — 2026-04-11

Fixed

• Stop filtering Finder view settings (FK_StandardViewSettings) — showIconPreview, iconSize, gridSpacing, column/list view settings are real user preferences
  • Removed overly broad *"ViewSettings"* sub-key filter in PlistBuddy commands
  • Removed global *IconViewSettings* key filter

Noise

• Fix *ScrollPosition pattern to also match scrollPositionX/Y (add trailing wildcard + lowercase variant)
• Filter scrollPosition sub-keys in PlistBuddy commands (nested scroll state in view settings)
• Filter Finder column :width sub-keys in PlistBuddy commands (column resize noise)
• Update Finder contextual NOTE: View Options (Cmd+J) require 'Use as Defaults' for detection; column view has no global default (always .DS_Store)

PrefWatch v1.1.5

1.1.5 — 2026-03-30

Noise

• Exclude TokenBucketRateLimiter (ML embedding rate limiter counters/timestamps)
• Widen com.apple.bird exclusion to com.apple.bird* to also catch com.apple.bird.containers.notifications
• Filter controllers:tombstones, *:modifiedDate for com.apple.GameController (internal sync metadata, not user preferences)
• Exclude com.apple.EmojiCache (auto-generated emoji locale cache)
• Filter Scrutiny, CKBackgroundSettingsLastReportHour for com.apple.MobileSMS (iMessage analytics/telemetry)
• Filter CharacterPaletteIM sub-key for com.apple.HIToolbox (transient emoji viewer open/close)
• Filter lastFireDate sub-key for com.rogueamoeba.loopbackd (scheduler timestamp)
• Filter uret-init for com.native-instruments.* (telemetry init flag)
• Filter shouldUpdateAccessory for com.apple.PersonalAudio (AirPods firmware state toggle)
• Filter ZMJoinMeetingFlowAnchor for us.zoom.xos (window position)
• Exclude Avatar Cache* (avatar cache index, hash keys with timestamps)
• Exclude com.apple.diagnosticd* (system logging subsystem filter config)
• Filter FXConnectToLastURL for com.apple.finder (last connected server history)
• Filter mailShortcuts, reloadShortcuts for com.apple.Spotlight (auto-learned shortcuts, reload trigger)
• Exclude com.apple.textunderstanding* (NLP runtime model version counters)
• Filter WindowBounds, WindowState sub-keys in PlistBuddy commands (window position/size in nested dicts)

PrefWatch v1.1.4

1.1.4 — 2026-03-12

Noise

• Filter CRDialogShown_*, lastCrash_*, SuppressCrash_* for com.adobe.crashreporter (crash dialog state and crash metadata, not user preferences)
• Filter NSDisabledCharacterPaletteMenuItem, NSFullScreenMenuItemEverywhere globally (app-controlled macOS menu item overrides, not user preferences)
• Filter butler.*, VMMemoryUsagePercent*, paletteEnhancedFontTypeKey* for com.adobe.Photoshop (internal app state, not user preferences)
• Filter DNSA*, StartupScriptsLoadedSuccessfully, FeatureMapExpiryTime for com.adobe.bridge* (dialog suppression state, startup load result, feature flag expiry)
• Filter SessionDuration globally (session duration telemetry counter, seen in Adobe After Effects, Premiere Pro, etc.)
• Filter FirstLaunch*, firstLaunch* globally (version-stamped first-launch flags, internal app state)
• Filter RecoveryOpenProjectInfos for com.Adobe.Premiere Pro* (crash recovery project list, session state)
• Exclude com.apple.universalaccessAuthWarning (accessibility authorization state, not user preferences)
• Filter RecentMoveAndCopyDestinations for com.apple.finder (recent copy/move destination history)
• Filter preferredLocalizations globally (system-managed localization, not user preferences)
• Filter SystemInfoDynamic.* globally (internal system state, not user preferences)
• Exclude com.apple.remindd* (Reminders daemon CloudKit sync state, replaces babysitter-only exclusion)

Fix

• Python3 warning now written to log file (previously stdout only) — visible when checking /var/log/prefwatch-*.log directly
• Python3 prompt unified for CLI and Jamf: same interactive prompt in both modes, auto-continues ("y") when no TTY (Jamf)
• Python3 warning visible in Jamf output even in ONLY_CMDS mode (prefixed with Cmd: #)

Note

• Add inline NOTE for com.apple.prodisplaylibrary: defaults write alone does not apply display presets — alternative third-party tools exist