Add curated Windows open-query process names for 33 high-value Fleet-maintained apps

[allenhouchins]

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Details

Follow-up to #50825. The Windows "app open" pre-install query (the patch_when_closed gate) only works when it names the app's real process image name. For multi-word catalog names the generated <title>.exe guess almost never does — 'mozilla firefox.exe' vs. the real firefox.exe — so the gate silently never blocks and Fleet will patch the app while it's running.

This PR adds 33 curated windowsOpenQueryOverrides entries (51 → 84) so the gate actually works for the highest-value affected apps:

App(s)	Process match	Note
Mozilla Firefox / Developer Edition / ESR / Nightly	firefox.exe	all channels use the same image name
VLC media player	vlc.exe
SQL Server Management Studio	ssms.exe
MySQL Workbench	mysqlworkbench.exe
Power BI	pbidesktop.exe	Power BI Desktop
Visual Studio Community / Professional / Enterprise 2022	devenv.exe	shared IDE shell
GitHub Desktop	githubdesktop.exe
Docker Desktop	docker desktop.exe
Adobe Acrobat Pro	acrobat.exe
Adobe Acrobat Reader	acrord32.exe, acrobat.exe	legacy 32-bit Reader + unified 64-bit app
Azure Data Studio	azuredatastudio.exe	VS Code fork naming
MongoDB Compass	mongodbcompass.exe, mongodb compass.exe	both packaging-era names
Epic Games Launcher	epicgameslauncher.exe
GOG Galaxy	galaxyclient.exe
eM Client	mailclient.exe	vendor's long-standing image name
Git Extensions	gitextensions.exe
Google Drive	googledrivefs.exe
Tableau Desktop	tableau.exe
Directory Opus	dopus.exe
Cisco Jabber	ciscojabber.exe
TeamViewer Host	teamviewer.exe
Elgato Stream Deck	streamdeck.exe
Podman Desktop, Rancher Desktop, Proton Drive, Standard Notes, Mozilla VPN	<catalog name>.exe	Electron/desktop apps whose executable keeps the spaced product name — restores the gate these apps had before #50825 removed guessed queries
Genesys Cloud	genesys cloud.exe, genesyscloud.exe	registry DisplayName is unspaced, so both candidates listed

Failure-mode asymmetry, for review calibration: an override that names a process that never runs is a no-op — osquery reports "not open" and behavior is identical to having no gate (today's state). The only dangerous mistake is naming a process that belongs to a different, commonly-running app, which would block patching indefinitely; none of the names above are generic enough to collide. Where the exact image name is ambiguous, the entry lists both candidates with IN.

Persistent-agent apps (Google Drive, Docker Desktop, TeamViewer Host, Mozilla VPN) will report "open" whenever their resident process is running — that is the honest semantic for patch_when_closed, and matches the existing precedent (OneDrive has had a LIKE 'onedrive%' override).

Independent of #50825 (either can merge first; overrides take precedence over the fallback in both worlds). The two branches touch adjacent lines in patch_policy_test.go, so whichever merges second may need a trivial rebase. Like #50825, outputs are not regenerated here — the daily ingest run rewrites every unfrozen output, so these queries reach ee/maintained-apps/outputs/ on the next "Update Fleet-maintained apps" PR after this merges.

Remaining ~150 affected apps (runtimes/redists/drivers with no user-facing process, plus lower-value or unverifiable apps) intentionally stay without a gate; entries can be added incrementally as process names are verified.

Summary by CodeRabbit

• Bug Fixes

  • Improved Windows app-open checks for a broader range of applications, including Adobe products, browsers, developer tools, VPN clients, productivity software, and Visual Studio editions.
  • Pre-install checks now more reliably recognize applications by their actual running process names.

• Tests

  • Added coverage for Firefox, Adobe Acrobat Reader, and Visual Studio Community 2022 detection.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c66d960-89dc-4799-afb4-9cfe08a42859

📥 Commits

Reviewing files that changed from the base of the PR and between bc537a3 and 8517f8f.

📒 Files selected for processing (3)

• changes/windows-open-query-overrides-high-value
• pkg/patch_policy/patch_policy.go
• pkg/patch_policy/patch_policy_test.go

---

Walkthrough

The change adds curated Windows process-name mappings for 33 applications. The mappings support equality, LIKE, and IN predicates during patch-policy app-open checks. Existing mappings remain unchanged. Tests verify process resolution for Mozilla Firefox, Adobe Acrobat Reader, and Visual Studio Community 2022, including multi-word titles and IN predicates.

Possibly related PRs

• fleetdm/fleet#50424: Updates Windows application detection and query matching for patch policies.
• fleetdm/fleet#50825: Modifies windowsOpenQueryOverrides and Windows GenerateOpenQuery behavior and tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the addition of curated Windows process-name overrides for 33 Fleet-maintained applications.
Description check	✅ Passed	The description explains the problem, lists the covered applications, documents testing, and confirms the changes file and automated tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch windows-open-query-overrides-high-value

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR expands Fleet’s Windows “app open” (pre-install) query overrides so patch_when_closed can correctly detect when certain high-value Fleet-maintained apps are running, avoiding patching while the app is open.

Changes:

• Added curated windowsOpenQueryOverrides entries for 33 additional Windows app titles in pkg/patch_policy.
• Expanded TestGenerateOpenQuery to assert correct override behavior for representative multi-word titles.
• Added a user-visible changes entry (file contents excluded by policy).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/patch_policy/patch_policy.go	Adds additional Windows process-name predicates keyed by maintained-app “name” so the open-query gate matches real executables.
pkg/patch_policy/patch_policy_test.go	Adds test coverage to ensure new overrides generate the expected SQL for multi-word titles.
changes/windows-open-query-overrides-high-value	User-visible changes entry (not reviewable here due to content exclusion policy).

Files excluded by content exclusion policy (1)

• changes/windows-open-query-overrides-high-value

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.53%. Comparing base (bc537a3) to head (8517f8f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #50826      +/-   ##
==========================================
- Coverage   68.53%   68.53%   -0.01%     
==========================================
  Files        3977     3977              
  Lines      256168   256168              
  Branches    13818    13818              
==========================================
- Hits       175566   175563       -3     
- Misses      64982    64986       +4     
+ Partials    15620    15619       -1     

Flag	Coverage Δ
backend	69.63% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.