Add preferred runtime onboarding (#2040)

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Pinky <44b8e82baa6e0e254e0208d68f335c283c94e7b78dd1fa10d5a49d3f13dd0435@sprout-oss.stage.blox.sqprod.co>

scripts/reset-desktop-standalone-state.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Reset only one standalone desktop development instance.
+set -euo pipefail
+
+instance_id="${1:-}"
+keyring_service="${2:-}"
+
+if [[ "$instance_id" != "xyz.block.buzz.app.dev" && "$instance_id" != xyz.block.buzz.app.dev.* ]]; then
+    echo "reset-desktop-standalone-state: refusing non-dev bundle identifier: $instance_id" >&2
+    exit 1
+fi
+if [[ "$keyring_service" != "buzz-desktop-dev" && "$keyring_service" != buzz-desktop-dev.* ]]; then
+    echo "reset-desktop-standalone-state: refusing non-dev keyring service: $keyring_service" >&2
+    exit 1
+fi
+
+remove_path() {
+    local path="$1"
+    if [[ -e "$path" || -L "$path" ]]; then
+        echo "Removing $path"
+        rm -rf -- "$path"
+    fi
+}
+
+case "${BUZZ_TEST_PLATFORM:-$(uname -s)}" in
+    Darwin)
+        remove_path "$HOME/Library/Application Support/$instance_id"
+        remove_path "$HOME/Library/Caches/$instance_id"
+        remove_path "$HOME/Library/WebKit/$instance_id"
+        remove_path "$HOME/Library/HTTPStorages/$instance_id"
+        remove_path "$HOME/Library/Saved Application State/$instance_id.savedState"
+        remove_path "$HOME/Library/Preferences/$instance_id.plist"
+        if command -v security >/dev/null 2>&1; then
+            while security delete-generic-password -s "$keyring_service" >/dev/null 2>&1; do :; done
+        fi
+        ;;
+    Linux)
+        remove_path "${XDG_DATA_HOME:-$HOME/.local/share}/$instance_id"
+        remove_path "${XDG_CONFIG_HOME:-$HOME/.config}/$instance_id"
+        remove_path "${XDG_CACHE_HOME:-$HOME/.cache}/$instance_id"
+        ;;
+    *)
+        echo "reset-desktop-standalone-state: unsupported platform" >&2
+        exit 1
+        ;;
+esac
+
+echo "Standalone state removed for $instance_id; relay and database data were not touched"

scripts/test-reset-desktop-standalone-state.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+export HOME="$tmp/home"
+export BUZZ_TEST_PLATFORM=Darwin
+mkdir -p "$HOME/Library/Application Support/xyz.block.buzz.app.dev.example"
+mkdir -p "$HOME/Library/Application Support/xyz.block.buzz.app.dev.other"
+mkdir -p "$HOME/Library/Application Support/xyz.block.buzz.app"
+mkdir -p "$HOME/.buzz-dev"
+touch "$HOME/.buzz-dev/keep"
+mkdir -p "$tmp/bin"
+cat > "$tmp/bin/security" <<'MOCK'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >> "$HOME/security-calls"
+exit 1
+MOCK
+chmod +x "$tmp/bin/security"
+export PATH="$tmp/bin:$PATH"
+
+"$repo_root/scripts/reset-desktop-standalone-state.sh" \
+    xyz.block.buzz.app.dev.example buzz-desktop-dev.example
+
+[[ ! -e "$HOME/Library/Application Support/xyz.block.buzz.app.dev.example" ]]
+[[ -d "$HOME/Library/Application Support/xyz.block.buzz.app.dev.other" ]]
+[[ -d "$HOME/Library/Application Support/xyz.block.buzz.app" ]]
+[[ -f "$HOME/.buzz-dev/keep" ]]
+grep -Fx -- "delete-generic-password -s buzz-desktop-dev.example" "$HOME/security-calls" >/dev/null
+
+if "$repo_root/scripts/reset-desktop-standalone-state.sh" \
+    xyz.block.buzz.app buzz-desktop >/dev/null 2>&1; then
+    echo "expected production scope guard to reject reset" >&2
+    exit 1
+fi
+
+echo "standalone desktop reset scope test passed"