id       = "keka"
name     = "Keka"
homepage = "https://www.keka.io"
description = "Keka, the macOS file archiver."
# The square app icon published on keka.io.
icon     = "https://www.keka.io/img/Keka-Square-192x192.png"
# Keka has a command line mode, and the Homebrew cask exposes it under the name
# a user types: command_wrapper ["keka", { executable:
# "$APPDIR/Keka.app/Contents/MacOS/Keka", args: ["--cli"] }] with target
# "$HOMEBREW_PREFIX/bin/keka" (https://formulae.brew.sh/api/cask/keka.json).
# The bundle identifier behind it is com.aone.keka, confirmed on a Mac with
# Keka installed: `osascript -e 'id of app "Keka"'` → com.aone.keka.
executables   = ["keka"]
platforms = ["macos"]

[dotfiles]

# Keka is sold two ways and the settings land in a different place for each.
#
# The direct download from keka.io is not sandboxed, so it writes the ordinary
# preferences domain — ~/Library/Preferences/com.aone.keka.plist, which the
# cask's zap list names.
#
# The Mac App Store build is sandboxed, so the same domain is redirected into
# its container. Verified on this Mac, which has the App Store build: the
# settings are in
# ~/Library/Containers/com.aone.keka/Data/Library/Preferences/com.aone.keka.plist,
# and reading it back shows Keka's own options — DefaultFormat,
# AlwaysAskCompressionPassword, ApplyQuarantineAfterExtraction, ArchiveSingle,
# AskZipUsingAES, CalculateMD5, CreateSFX, ColorIcons,
# DefaultExtractLocationController, the Appearance* dock settings and the
# 7zz composition flags — while the non-container plist left over from the
# direct build holds only NSNav and Sparkle keys. A consumer skips whichever
# build is not installed.
paths = [
  "[preferences]/com.aone.keka.plist",
  "~/Library/Containers/com.aone.keka/Data/Library/Preferences/com.aone.keka.plist",
]

exclude = []

# Keka asks for an archive password when it needs one rather than storing it:
# AlwaysAskCompressionPassword is a setting, not a stored secret, and nothing
# in the zap list is a credential file. The Bookmarks array in the container
# plist is macOS security-scoped bookmark data for folders the user granted
# access to — machine-local rather than secret, and unreachable by a rule since
# a plist has no matcher in this schema.
secret = []

# No machine_lines, for the reason just given: the machine-local part of this
# domain is inside a plist, which `match` cannot read.