Mac Health Check (4.0.0)

A major update to the practical, MDM-agnostic, user-friendly approach to surfacing Mac compliance information directly to end-users — and now enterprise reporting data warehouses — via your MDM's self-service app

Splunk Dashboard

Health Checks

Reporting

---

16-Jul-2026

• Raised the minimum required swiftDialog version to 3.1.0.4994 and refactored pre-flight checks to skip redundant production package downloads when the installed release already matches the latest production build
• Added JSON health reporting with optional Splunk HTTP Event Collector (HEC) delivery, plus stricter cached-report validation so failed cached uploads no longer look like successful report generation
• Added the Inspect Mode-flavored end-user report (inspectSummaryPreset="on") for Self Service, including cached replay via inspectReplayMaximumAgeSeconds, Next Steps, Quick Actions, a conditional Remediation Guide, status-aware bento-grid cards, and a stronger unhealthy-results hierarchy
• Updated the generated and detached Preset 6 Inspect configs and demo assets for swiftDialog 3.1.0.4979 compliance findings with live compliance plist sources, trigger/readiness/result control paths, source-level labels, plist-backed detail sheets, non-plist detailOverlay support, renderer-owned 6 / 12 / 24 / 36pt spacing, an explicit 12-point bento-grid gap, and stricter validation for highlight content
• Refactored full Silent health-check runs to write /var/tmp/MacHealthCheck-Inspect-Config.json and /var/tmp/MacHealthCheck-Inspect-Compliance.plist without launching swiftDialog
• Refactored Silent with splunkOperationMode=production to suppress non-Splunk console output while still logging fully to scriptLog, skip jamf recon, and return success when local report generation plus Splunk HEC delivery succeed regardless of recorded health findings
• Added Force Fresh Run support for Silent with splunkOperationMode=production, including the /var/tmp/MacHealthCheck-Force-Fresh-Run one-shot trigger file, Script Parameter 11 forceFreshRun, source-level reportDebug, and cached local Splunk report removal before fresh report generation
• Added Client-Side Cache nightly report generation, Jamf Pro cached Splunk upload optimization, LaunchDaemon deployment for daily Silent report refresh with deterministic per-Mac jitter around 1:23 a.m., and LaunchDaemon-only loginwindow lastUserName fallback for user-scoped checks when no GUI user is active
• Sanitized the client-side script copy so it does not perform Jamf inventory submission, routed LaunchDaemon stdout/stderr to /dev/null to prevent duplicate prefixed Silent log lines, and normalized client-side cache, LaunchDaemon validation/loading, external-check helper, and user-context command-preview logging
• Added checkWiFiStrength() and enhanced Wi-Fi Strength test reporting; thanks, @kgolden-code and thanks for PR #90, @HowardGMac!
• Added checkEntraIDRegistration() to Jamf Pro-specific checks and included identity.entraIDRegistration in JSON reports and Inspect Mode summaries
• Refactored Palo Alto GlobalProtect-related code to support connected-non-pa status, safe plist reads, disconnected-as-warning behavior, and normalized external-check output; inspired by @kgolden-code's PR #88
• Refactored checkHomebrewStatus() to more accurately reflect Homebrew's actual installation status and checkElectronCornerMask to reduce execution time
• Updated Free Disk Space and folder size/item count reporting info; thanks for PR #89, @HowardGMac!
• Refactored updateComputerInventory() to warn end users when jamf recon fails and added a 90-second timeout with timeout-specific logging and messaging
• Refactored the final standard dialog to distinguish warning-only results from failures, showing Computer Needs Attention with an amber exclamation mark and returning exit code 0 when no checks failed
• Removed displayFailureNotification() in favor of the Inspect Mode-flavored report
• Improved external-check result parsing, logging, and client-side cache installs
• Documented PR #684 tolerant scalar decoding while continuing to emit strictly typed JSON, and refreshed tracked Preset 6 demo assets and Inspect Mode documentation

---

What's Changed

• Add repo-specific security scan workflow and security policy by @dan-snelson in #85
• 3.2.0 by @dan-snelson in #86
• 4.0.0 by @dan-snelson in #98

Full Changelog: v3.2.0...v4.0.0