PrefWatch v.1.3.0

1.3.0 — 2026-06-05

Feature

• Sharing-panel capture (ALL/root): captures toggles stored outside plists and emits the matching command — Remote Login / Screen Sharing / Remote Management (launchctl/kickstart/systemsetup/sharing/networksetup) and Printer Sharing (cupsctl), via eslogger, launchd disabled.plist, and cupsd.conf.
• Faster detection: a default "hot" set of the common System Settings panels is flushed every 0.5s so changes surface in ~1-2s instead of ~10s. Override via --hot-domains (Jamf $10); NONE disables.

Fix

• com.apple.loginwindow un-excluded to surface admin policies (GuestEnabled, LoginwindowText, autoLoginUser, …); per-session churn filtered key-by-key instead.
• Guard set -e pipeline assignments (dscl home, version header) with || true so a non-zero exit can't abort startup under Jamf/root.
• Guaranteed tmpdir cleanup on exit + reclaim of orphan tmpdirs/locks from crashed prior runs.

Noise

• Newly excluded domains: com.apple.facetime.bag, com.apple.gridDataServices, com.adobe.AdobeGenuineService, com.apple.weather*, com.apple.inputAnalytics*, com.apple.appstored, com.apple.security.cloudkeychainproxy3*.
• New global key filters: CKPerBootTasks, DDMPersisted*, *-analytics-stamp, *FlushThumbnailCache, *_frame/SidebarWidth (window geometry), *last*Date (timestamps), recentlyPlayed*/NSOSPLastRootDirectory.
• New per-domain filters: SoftwareUpdate daemon results, smb.server NetBIOSName, HIToolbox AppleInputSourceHistory, Bartender TerminationReasons, AudioMIDISetup audioDevice.selected, iStat menubar Updates/Status, cloud.quota _ICQ*, AssetCache cache-size, ARDAgent/RemoteDesktop daemon-init values.
• Sharing watchers: drop read-only networksetup/systemsetup queries, VM/container launchd helpers, and auto-flapping bootpd/dhcp6d.