Update patch policy logic when OR is used

[fleet-release]

This pull request improves the safety and correctness of SQL query generation for patch policies, particularly when handling complex WHERE clauses that include OR conditions. It also updates the application manifests for Cursor and Codex CLI to their latest versions.

SQL Query Generation Improvements:

• The logic for generating patch queries now wraps the body of the WHERE clause in parentheses when appending version checks. This ensures correct SQL operator precedence, especially when the original condition contains OR.
• Unit tests for query generation and ingester validation have been updated to expect the new parenthesized WHERE clause conditions, and a new test case was added for queries with OR conditions. [1] [2] [3] [4] [5]

Application Manifest Updates:

• Updated Cursor for macOS (cursor/darwin.json) and Windows (cursor/windows.json) to version 3.4.20, including new installer URLs, hashes, and patch queries. [1] [2]
• Updated Codex CLI for Windows (codex-cli/windows.json) to version 0.130.0, with new installer URL, hash, and a corrected patch query that now uses the safer query generation logic.

These changes make the patch policy system more robust against SQL logic bugs and keep the application manifests up to date.

Summary by CodeRabbit

• Chores

  • Updated Codex CLI Windows metadata to 0.130.0.
  • Updated Cursor macOS and Windows metadata to 3.4.20.

• Bug Fixes

  • Improved install/patch detection logic so version checks behave correctly for complex install conditions.

• Tests

  • Updated test expectations to reflect the new query formatting and version-check behavior.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Walkthrough

This PR updates installer metadata in three maintained-app JSON files. Codex CLI Windows is updated from version 0.116.0 to 0.130.0, including the installer URL, patched-query version comparison, and sha256 checksum. Cursor is updated to version 3.4.20 on both Windows (from 3.4.16) and macOS (from 3.4.17), with corresponding updates to the version-comparison queries, installer URLs, and checksums across both platforms. Install and uninstall script references remain unchanged.

Possibly related PRs

• fleetdm/fleet#42397: Adds a Codex CLI-specific exists_query path used by patch policy generation; relates to the Codex CLI JSON and patch SQL changes in this PR.
• Update Fleet-maintained apps #44914: Updates the same Cursor maintained-app JSON files (ee/maintained-apps/outputs/cursor/darwin.json and ee/maintained-apps/outputs/cursor/windows.json) with version and checksum changes.
• Update Fleet-maintained apps #45120: Also updates Cursor maintained-app manifest metadata for darwin and windows (version/queries.patched thresholds and checksums).

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The PR title accurately summarizes the main change: wrapping WHERE clause body in parentheses for correct SQL operator precedence when OR is used in patch policy queries.
Description check	✅ Passed	The PR description comprehensively explains the SQL query generation improvements and application manifest updates with clear examples and context.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2605151820

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/codex-cli/windows.json`:
- Line 7: The patched SQL string's boolean precedence is wrong: the OR between
the two path checks is evaluated after the AND, so the machine path is not
subjected to the version check. Update the "patched" value (the SQL in the
patched field) so the version_compare(...) < 0 is applied to both install
paths—either by grouping the two path checks in parentheses and then ANDing the
version check, or by applying version_compare to each path expression
separately—so both 'C:\Program Files\Codex CLI\codex.exe' and the AppData path
are only considered unpatched when their version is < 0.130.0.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a599809f-8acd-47f1-840f-0f39b63a1794

📥 Commits

Reviewing files that changed from the base of the PR and between 9afdb43 and 8af974c.

📒 Files selected for processing (3)

• ee/maintained-apps/outputs/codex-cli/windows.json
• ee/maintained-apps/outputs/cursor/darwin.json
• ee/maintained-apps/outputs/cursor/windows.json

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.75%. Comparing base (9afdb43) to head (b651d47).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #45622   +/-   ##
=======================================
  Coverage   66.74%   66.75%           
=======================================
  Files        2744     2744           
  Lines      219316   219320    +4     
  Branches    10831    10831           
=======================================
+ Hits       146393   146401    +8     
+ Misses      59697    59693    -4     
  Partials    13226    13226           

Flag	Coverage Δ
backend	68.58% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Closing in favor of #45646.