App Auto-Patch

The number of days after the patching cadence start date (Zero Date) that the patching complete status will reset from TRUE to FALSE

The day of the week to force the patching cadence start date (Zero Date) to go back to in order to have the patch cadence start the same day of the week for all users

Range: Monday - 1 (1), Tuesday - 2 (2), Wednesday - 3 (3), Thursday - 4 (4), Friday - 5 (5), Saturday - 6 (6), Sunday - 7 (7)

The maximum number of automatic deferrals allowed if the system is in user-enabled Focus/Do Not Disturb or when a process has requested that the display not go to sleep

The maximum number of user selected deferrals allowed before App Auto-Patch will no longer allow deferrals and will automatically patch when the timer expires

The maximum number of days that automatic deferrals are allowed if the system is in user-enabled Focus/Do Not Disturb or when a process has requested that the display not go to sleep

The maximum number of days deferrals allowed before App Auto-Patch will no longer allow deferrals and will automatically patch when the timer expires

The number of minutes to defer until the next update workflow attempt if a user choses not install updates

The number of minutes to defer if AAP detects an error in the workflow

The number of minutes to defer the update restart dialog automatically if a process has prevented display sleep (for example, during an active meeting) or the user has Focus or Do Not Disturb enabled

Display a deferral time pop-up menu in the non-deadline install dialog that allows the user to override the Deferral Timer Default timer

Amount of time in minutes until AAP is relaunched after a workflow. This timer results in AAP acting as a permanent agent that checks for app updates on a regular basis

Week of the month you want AAP to be scheduled

Range: First Week (first), Second Week (second), Third Week (third), Fourth Week (fourth), Fifth Week (fifth), Final Week (final)

Day of the week you want AAP to be scheduled

Range: Sunday (sunday), Monday (monday), Tuesday (tuesday), Wednesday (wednesday), Thursday (thursday), Friday (friday), Saturday (saturday)

Local time you want AAP to be scheduled

The number of hours since the last successful App Discovery before App Auto-Patch will run discovery again. If the workflow resets and re-runs (e.g. after a deferral) within this window, discovery is skipped and the previously discovered queue is reused. A value of 0 forces discovery to run on every workflow execution

Default: 24

When enabled, AAP will automatically skip updating Zoom if a call is active

Forces the AAP dialogs to stay on top of all other windows

Range: Force Dialog On Top (TRUE), Do Not Force Dialog On Top (FALSE)

When true, workflow swiftDialog windows show the App Auto-Patch logo in the macOS Dock (requires swiftDialog 3.0+). Deferral dialogs badge the pending update count; the installation dialog counts the badge down as updates finish. Default true.

Default: true

What happens if the user quits the discovery or staging window (Dock Quit / menu Quit / ⌘Q). PROMPT (default) asks whether to Keep Running in the background or Stop App Auto-Patch until the next scheduled run. CONTINUE keeps the workflow running with no prompt (previous implicit behavior). STOP ends the current run cleanly and preserves NextAutoLaunch. Stop is ignored when a hard deadline is already due or Install Now is running — the workflow continues instead.

Default: "PROMPT"

Range: PROMPT — Keep Running or Stop (PROMPT), CONTINUE — keep running, no prompt (CONTINUE), STOP — stop until next scheduled run (STOP)

Master switch for banner-style swiftDialog notifications. When true (default), every notification type is shown and individual ShowNotifications* keys are ignored. When false, enable specific types with ShowNotificationsSilentUpdated, ShowNotificationsAppsQueued, and/or ShowNotificationsSilentAndQueued. Does not itself enable discovery during Business Hours.

Default: true

When ShowNotificationsAll is false, enable the banner that reports successful silent closed-app updates (e.g. “updated {count} application(s) in the background”). Ignored when ShowNotificationsAll is true.

Default: false

When ShowNotificationsAll is false, enable the banner that reports pending updates with Install Now / Dismiss (including after BusinessHoursAllowDiscovery). Ignored when ShowNotificationsAll is true.

Default: false

When ShowNotificationsAll is false, enable the combined banner after Business Hours Silent During (“{count} updated… {remaining} remain queued”). Ignored when ShowNotificationsAll is true.

Default: false

Time given to the user to respond to deferral prompt if enabled

What happens when the deferral timer expires

Range: Defer after timer expires (Defer), Continue after timer expires (Continue)

The number of seconds given to the user to respond to the "Are you sure?" confirmation dialog shown after clicking Install Now on the deferral dialog. If the timer expires with no response, App Auto-Patch defaults to continuing with the install

Default: 15

Deterines if the Dialog should automatically close after completion if there is no response from the end-user

Range: Auto Close Dialog (TRUE), Do Not Auto Close Dialog (FALSE)

The number of seconds the AAP dialog will automatically close if UnattendedExit is set to TRUE

Toggles swiftDialog to use an overlay icon

Range: Use Overlay Icon (TRUE), Do Not Use Overlay Icon (FALSE)

Allows you to set a custom icon for the dialog vs. the default Laptop/Desktop symbol

Displays a swiftDialog banner image in place of the standard title text. Accepts a filepath, a URL, a solid colour (colour=#hex), or a gradient (gradient=colour,colour). When set, this replaces the standard --title text banner and hides the standard dialog icon area, matching swiftDialog's own banner behavior. Not applied to the App Discovery or "All Apps Up To Date" mini dialogs, which are too small to display a banner

The text displayed within the banner image set by BannerImage. Falls back to AppTitle if left blank. Has no effect unless BannerImage is also configured

Overrides the default height, in points, of the banner image set by BannerImage. Invalid (non-integer) values are ignored. Has no effect unless BannerImage is also configured

A space-separated list of Installomator labels to ignore for the AAP workflow. Supports wildcards, for example "microsoft*". A single "*" ignores every Installomator label except those listed in Required Labels and Optional Labels.

A space-separated list of Installomator labels to discover and report, but not update during fully-silent runs (InteractiveMode 0 / --workflow-install-now-silent) or Background Patch Closed Apps. Interactive Install Now and hard-deadline installs still update them. Supports wildcards. Unlike Ignored Labels, these apps stay visible in discovery, logs, and inventory.

a space-separated list of Installomator labels that are required, regardless if the app is installed or or the latest version. Supports wildcards.

A space-separated list of optional Installomator labels. Labels in this category are only included if the app exists on the end-users device and will force install even if its the latest version. Does Not Support Wildcards

Allows you to customize the name of App Auto-Patch to something else

Default: "App Auto-Patch"

This will convert any apps found in the users home folder to the /Applications folder

Default: "TRUE"

Range: Convert Apps (TRUE), Do Not Convert Apps (FALSE)

Ignore apps found in '/Users/'. If an update is found in '/Users/' and variable is set to false, the app will be updated into the application's default path

Default: "FALSE"

Range: Ignore Apps in Home Folder (TRUE), Move Apps to the Default Path (FALSE)

When true, discovery skips the local Gatekeeper (spctl) / Team ID pre-update check for already-installed apps. Use this when spctl assessment intermittently fails for a valid app and would otherwise exclude it from discovery/updates. Installomator still validates the downloaded package after download. Default false.

Default: false

A space-separated list of options to override default Installomator options (i.e., BLOCKING_PROCESS_ACTION=prompt_user NOTIFY=silent LOGO=appstore)

This will prevent Installomator from automatically updating. If Installomator does not exist in the working folder, it will still download from GitHub to prevent script failure

Default: "FALSE"

Range: Disable Installomator Updates (TRUE), Enable Installomator Updates (FALSE)

When TRUE, App Auto-Patch authenticates GitHub REST API requests (api.github.com) with the personal access token in GitHubAPIToken, raising the rate limit from 60 to 5,000 requests per hour. Managed preferences only - the token is never written to the local preference file and is never logged. If this key is TRUE, GitHubAPIToken is required or startup validation fails.

Default: "FALSE"

Range: Enable GitHub API Authentication (TRUE), Disable GitHub API Authentication (FALSE)

GitHub personal access token (classic or fine-grained) used when GitHubAPIAuthEnabled is TRUE. Sent as Authorization: Bearer on api.github.com requests for Installomator and swiftDialog lookups. Prefer a fine-grained token with Contents: Read on the repositories AAP queries. Managed preferences only - never stored in the local preference file or written to logs.

Absolute path to a root-owned executable script run once before Installomator installations in a patch run. Must live under /Library/Management/AppAutoPatch/Hooks/, must not be a symlink, and must not be group/world-writable. Managed preferences only - never accepted from CLI or the local preference file. Never evaluated as a shell string.

Absolute path to a root-owned executable script run once after Installomator installations complete in a patch run (for example jamf recon). Same security requirements as PrePatchScript. Managed preferences only.

What to do if PrePatchScript is missing/invalid or exits non-zero. ABORT stops the install run; CONTINUE logs the failure and proceeds with patching.

Default: "ABORT"

Range: ABORT, CONTINUE

What to do if PostPatchScript is missing/invalid or exits non-zero. ABORT exits AAP with an error after installs; CONTINUE (default) logs the failure and proceeds with webhook/relaunch.

Default: "CONTINUE"

Range: ABORT, CONTINUE

Maximum seconds allowed for a PrePatchScript or PostPatchScript run before AAP terminates it (treated as failure).

Default: 300

Seconds of missing heartbeat after which a leftover App Auto-Patch process is treated as hung and recovered (graceful TERM, then KILL if needed). The PID file is also validated so a recycled PID is not mistaken for a live AAP run. Default 3600 (1 hour). 0 disables timeout-based stale-process killing (dead/reused PID cleanup still runs). Any other value below 300 is raised to 300.

Default: 3600

Determines if the AAP script should use the Main, Release, or Custom version of Installomator. The version from the Main branch typically includes more recent updates from PR's to fix issues or add new labels. If using Custom, you must also set the InstallomatorVersionCustomRepoPath and InstallomatorVersionCustomBranchName keys

Default: "Main"

Range: Main, Release, Custom

If InstallomatorVersion is set to Custom, enter the Github Site and Repository name in the following format: site_name/repo_name . For example, if the custom fork is located at https://github.com/TechTrekkie/Installomator, you would set this key to techtrekkie/installomator

The name of the branch you want to use in your custom repo, typically main.

0 (Completely Silent) | 1 (Silent Discovery, Interactive Patching) | 2 (Full Interactive) (default)

Default: 2

Range: 0 - Completely Silent (0), 1 - Silent Discovery, Interactive Patching (1), 2 - Full Interactive (2)

Remove Installomator after App Auto-Patch is completed

Default: "FALSE"

Range: Remove Installomator (TRUE), Do Not Remove Installomator (FALSE)

For the Support Team details that display in the Help Message

For the Support Team details that display in the Help Message

For the Support Team details that display in the Help Message

For the Support Team details that display in the Help Message

Determines if Webhooks are sent when patching is completed

Default: "FAILURES"

Range: FALSE, ALL, FAILURES

The Slack Webhook URL to use if WebhookFeature is set to TRUE

The Teams Webhook URL to use if WebhookFeature is set to TRUE

Disables the discovery of applications that require patching. If a list of labels from a previous discovery exists, AAP will use that list for the workflow

Default: "FALSE"

Range: Disable App Discovery (TRUE), Enable App Discovery (FALSE)

When InteractiveMode is 1 or 2, silently pre-patches apps that are not currently open immediately after discovery and before any deferral/deadline dialog is shown. Apps that are open (blocking process detected) remain in the queue and are presented to the user as normal

Default: true

Pre-downloads (stages) installers for queued updates to a local staging folder immediately after discovery, before the deferral/deadline dialog is shown to the user. This makes the later install step nearly instantaneous for staged updates. Works alongside Background Patch Closed Apps without downloading the same update twice

Default: false

A comma-separated list of app/process names to exclude from display-sleep assertion (Focus/Do Not Disturb) detection. Useful for background utilities that permanently hold display assertions (e.g. Logi Options+, Amphetamine) that should not block interactive patching. Process names must match exactly as pmset reports them, including spaces

When WorkflowDisableRelaunch is also enabled, keep periodic headless discovery runs active using DiscoveryFrequency. These runs refresh the pending-app report, optionally stage updates, and can notify users, but never silently patch, show deferral or deadline dialogs, or install apps. Users initiate installation from the pending-apps dialog, Support App, notification action, or another explicit Install Now trigger

Default: false

Disable the automatic relaunch of AAP after the current workflow successfully completes

Default: "FALSE"

Range: Disable Automatic Relaunch (TRUE), Enable Automatic Relaunch (FALSE)

Weekday time windows when interactive App Auto-Patch must NOT run (blocked / do-not-disturb hours). Format: DAY:hh:mm-hh:mm, comma-separated, no spaces (MON-SUN, 24-hour). Multiple windows per day are allowed — for example MON:09:00-11:59,MON:13:00-17:00 blocks morning and afternoon but leaves lunch clear. Same-day ranges only — split overnight spans into two windows. Empty/unset = always allowed. During a window, AAP reschedules NextAutoLaunch to the next clear time and exits without interactive patching unless BusinessHoursSilentDuring or BusinessHoursAllowDiscovery is true. Local Mac timezone. Intentionally bypassed by --workflow-install-now / --workflow-install-now-silent / --preview-deferral-dialog. Overdue hard deadlines bypass BusinessHours by default unless BusinessHoursRespectHardDeadline is true.

When true, even an overdue hard deadline (days or count) waits until BusinessHours clear. When false (default), an overdue hard deadline bypasses BusinessHours so mandatory installs are not delayed by days.

Default: false

When true and during BusinessHours, AAP still runs discovery and silently patches closed apps only — no dialogs even if InteractiveMode is 1 or 2. Open or blocked apps remain queued and are deferred until BusinessHours clear. When false (default), during BusinessHours AAP only reschedules NextAutoLaunch and exits — unless BusinessHoursAllowDiscovery is true.

Default: false

When true and during BusinessHours without BusinessHoursSilentDuring, AAP runs discovery then defers until the window clears (no interactive dialogs or silent patching). Notification prefs independently control whether pending apps get a banner with Install Now. When false (default), AAP exits immediately during BusinessHours without discovery — matching historical behavior.

Default: false

Determines if the Patching Completion Status is set to true when using the --workflow-install-now trigger

Default: "SUCCESS"

Range: NEVER, ALWAYS, SUCCESS

Determines if the Self Update feature is enabled. this will automatically update App Auto-Patch if a new version is posted on github

The frequency to check for updates to the App Auto-Patch script

Range: Daily (daily), Weekly (weekly), Monthly (monthly)

Determines the version comparison method used when checking for updates

Range: Is At Least (IS_AT_LEAST), Equal To (EQUAL_TO)

When enabled, if version comparison fails, AAP will fall back to using Installomator for version checking

All features related to how App Auto Patch defines the user interface.

The individual buttons and text elements that can be customized. This includes per country localization.

The targeted language locale for the user interface. Note: For a list of locales, please run the following command in Terminal: /usr/bin/locale -a

Language for the defer button in dialogs when the deferral time is sometime today.

Language for the defer button in dialogs when the deferral time is tomorrow

Language for the defer button in dialogs when the deferral time is in the future.

Language for deferral timer durations - Minutes

Language for deferral timer durations - Hour

Language for deferral timer durations - Hours

Language for deferral timer durations - and

Language for deferral timer durations - days

Language for deferral timer durations - times

Language for deferral timer durations - There are

Language for the message displayed during App Discovery

Language for the action message during App Discovery

Langauge for the progress message during App Discovery

Language for the message shown on the progress dialog covering the update staging and background-patch-closed-apps phases (InteractiveMode 2 only)

Language for the progress text shown while an update is being staged (downloaded ahead of time). The app display name is appended (e.g. "Staging Google Chrome …").

Language for the progress text shown while a closed app is being silently patched in the background. The app display name is appended (e.g. "Installing Google Chrome …").

Language for Button1 of the Deferral Dialog

Language for Button1 of the Deferral Dialog

Language for the Later / dismiss button on the pending-apps dialog (--pending-apps-dialog and queued-apps notification Install Now action)

Language for the message on the "Install Now" confirmation dialog shown after clicking Install Now on the Deferral Dialog

Language for Button1 (confirm) of the "Install Now" confirmation dialog

Language for Button2 (cancel, returns to Deferral Dialog) of the "Install Now" confirmation dialog

Language for the first part of the countdown text on the "Install Now" confirmation dialog, shown before the remaining number of seconds

Language for the suffix of the countdown text on the "Install Now" confirmation dialog, shown after the remaining number of seconds

Language for the message on the dialog shown when the patching progress window was closed (Dock Quit / menu Quit) while updates are still running

Language for Button1 (Show Progress) on the dialog shown when the patching progress window was closed while updates are still running

Language for Button2 (Continue in Background) on the dialog shown when the patching progress window was closed while updates are still running

Language for the message on the dialog shown when the discovery or staging window was closed (Dock Quit / menu Quit) while App Auto-Patch is still preparing. Default explains Keep Running vs Stop App Auto-Patch.

Language for Button1 (Keep Running) on the discovery/staging quit prompt

Language for Button2 (Stop App Auto-Patch) on the discovery/staging quit prompt

Banner notification message when silent background patching updates apps. Use {count} for the number of apps updated.

Banner notification message when apps require updates (e.g. during Business Hours). Use {count} for the number of apps queued. Includes Install Now / Dismiss actions.

Banner notification message when silent patching updated some apps and others remain queued. Use {count} for updated and {remaining} for still-queued apps. Includes Install Now / Dismiss when remaining > 0.

Label for the Install Now action on banner notifications that offer starting --workflow-install-now

Label for the Dismiss action on banner notifications

Langauge for part 1 of the infobox on the Deferral Dialog

Langauge for part 2 of the infobox on the Deferral Dialog

Langauge for part 3 of the infobox on the Deferral Dialog

Langauge for part 1 of the message on the Deferral Dialog

Language for part 2 of the message on the Deferral Dialog

Langauge for unlimited deferrals

Langauge for deferral select title

Language for the "Current Version" prefix shown under each app in the deferral/hard deadline dialog patch lists

Language for the "New Version" prefix shown under each app in the deferral/hard deadline dialog patch lists

Language for the "Later" button shown by the aap_pending_apps_dialog.zsh Root3 Support App Extension example script (Resources/SupportApp-Extension/) - not used by App Auto-Patch itself

Deferral Deadline Dialog button1

Deferral Deadline Dialog button2

Deferral Deadline Dialog infbox

Deferral Deadline Dialog Message

Patching Dialog button1

Patching Dialog Checking

Patching Dialog Progress

Patching Dialog Infobox Computer Name

Patching Dialog Infobox macOS Version

Patching Dialog infobox updates

Patching Dialog Message

Patching Complete Progress Message

All Apps Up To Date Button 1

All Apps Up To Date Message

Help Message - Intro

Help Message - Telephone

Help Message - Email

Help Message - Help Website

Help Message - Computer Info

Help Message - Operating System

Help Message - Serial Number

Help Message - Dialog

Help Message - Started

Help Message - Script Version