Surface unmanaged .app bundles during sync as Markdown report

`ssr sync` now scans /Applications (and ~/Applications, configurable via
SSR_APP_DIRS) for top-level .app bundles that are neither Mac App Store
installs (Contents/_MASReceipt/receipt) nor Homebrew Cask installs, and
writes <backup_dir>/unmanaged-apps.md alongside the Brewfile. This closes
a long-standing gap in the restore story: such apps need manual reinstall
on a fresh machine, and were previously invisible to the sync workflow.

Cask detection runs fully offline against the local Caskroom and unions
four complementary strategies:

  1. Caskroom walk for .app symlinks/bundles under
     $(brew --caskroom)/<cask>/<version>/.
  2. `app "Foo.app"` declarations parsed from .rb formula receipts.
  3. `name "Foo"` field from .rb receipts (handles pkg-based casks like
     Microsoft Edge, Teams, Zoom, Google Drive, etc., that never drop
     a .app under the caskroom).
  4. `"name":["Foo"]` field from modern .json receipts (multi-line aware).

For each unmanaged app the report includes version and bundle id from the
Info.plist plus a best-effort installer link, in preference order:

  1. Sparkle SUFeedURL → derive the vendor homepage from the URL host.
  2. Bundle-id prefix match against a curated vendor map (Adobe,
     Microsoft, Docker, Cursor, Anthropic, OpenAI, JetBrains,
     GitKraken, Signal, Zoom, Telegram, Slack, Synology, Jabra, ...).
  3. DuckDuckGo search fallback (`<App name> macOS download`).

Toggles in ssr.conf.example: SSR_SCAN_UNMANAGED_APPS=true (default),
SSR_APP_DIRS=/Applications:~/Applications.

ssr-status gains a one-line summary referencing the report file.

Co-authored-by: Cursor <cursoragent@cursor.com>

bin/ssr-status

@@ -30,6 +30,13 @@ else
     echo "  last sync:  never"
 fi
 
+# Surface unmanaged-app count from the last sync, if a report exists.
+if backup_dir="$(ssr::cloud::backup_dir 2>/dev/null)" \
+   && [[ -f "$backup_dir/unmanaged-apps.md" ]]; then
+    n="$(grep -cE '^\| \[' "$backup_dir/unmanaged-apps.md" 2>/dev/null || echo 0)"
+    echo "  unmanaged:  $n app(s) (see $backup_dir/unmanaged-apps.md)"
+fi
+
 label="${SSR_LAUNCHD_LABEL:-de.surke.ssr.sync}"
 service_target="gui/$(id -u)/${label}"
 if launchctl print "$service_target" >/dev/null 2>&1 \

bin/ssr-sync

@@ -11,6 +11,8 @@ source "$SSR_ROOT/lib/cloud.sh"
 source "$SSR_ROOT/lib/brew.sh"
 # shellcheck source=../lib/mackup.sh
 source "$SSR_ROOT/lib/mackup.sh"
+# shellcheck source=../lib/apps.sh
+source "$SSR_ROOT/lib/apps.sh"
 
 ssr::require_macos
 ssr::load_config
@@ -34,6 +36,24 @@ ssr::mackup::backup
 ssr::brew::dump "$backup_dir"
 ssr::brew::cleanup
 
+# Surface .app bundles that aren't covered by brew cask or the App Store —
+# they would otherwise be missed on `ssr restore` and need manual reinstall.
+if [[ "${SSR_SCAN_UNMANAGED_APPS:-true}" == "true" ]]; then
+    ssr::log "Scanning for unmanaged .app bundles"
+    report_path="$(ssr::apps::write_report "$backup_dir")"
+    # Each row in the Markdown table starts with `| [`; count those.
+    count="$(grep -cE '^\| \[' "$report_path" 2>/dev/null || echo 0)"
+    if [[ "$count" -gt 0 ]]; then
+        ssr::warn "Found $count unmanaged app(s) — manual reinstall on restore:"
+        # Extract the linked app name from each table row for a quick console summary.
+        grep -E '^\| \[' "$report_path" \
+            | sed -E 's/^\| \[([^]]+)\].*/  - \1/'
+        ssr::log "Full report: $report_path"
+    else
+        ssr::ok "No unmanaged apps detected."
+    fi
+fi
+
 # Record sync time so `ssr status` can report freshness.
 state_dir="${SSR_STATE_DIR:-$HOME/.local/state/ssr}"
 ssr::ensure_dir "$state_dir"