Feat/remove quarantine for nix app

home-manager/profiles/base.nix

@@ -33,6 +33,10 @@ in
     neovim
   ];
 
+  # Stable path for macOS java_home and IDEA's JDK detection; JAVA_HOME's store path changes on every update
+  home.file."Library/Java/JavaVirtualMachines/zulu-25.jdk".source =
+    "${config.programs.java.package}/Library/Java/JavaVirtualMachines/zulu-25.jdk";
+
   home.sessionVariables = {
     EDITOR = "nvim";
     VISUAL = "nvim";

hosts/common/darwin/homebrew.nix

@@ -1,3 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+
+let
+  caskNames = lib.concatMapStringsSep " " (c: lib.escapeShellArg c.name) config.homebrew.casks;
+in
 {
   homebrew = {
     enable = true;
@@ -56,4 +67,18 @@
       "Xcode" = 497799835;
     };
   };
+
+  # Gatekeeper stays on (LSQuarantine default) for everything else; only apps from the casks
+  # declared above skip the "downloaded from the Internet" prompt. Homebrew removed --no-quarantine.
+  system.activationScripts.postActivation.text = lib.mkAfter ''
+    echo "❯❯❯❯ · Removing quarantine from declared Homebrew casks..."
+    apps=$(sudo --user=${username} --set-home env HOMEBREW_NO_AUTO_UPDATE=1 \
+      /opt/homebrew/bin/brew info --json=v2 --cask ${caskNames} 2>/dev/null \
+      | ${pkgs.jq}/bin/jq -r '.casks[].artifacts[] | select(has("app")) | .target // empty' || true)
+    while IFS= read -r app; do
+      if [ -d "$app" ] && xattr -p com.apple.quarantine "$app" >/dev/null 2>&1; then
+        xattr -dr com.apple.quarantine "$app" || true
+      fi
+    done <<< "$apps"
+  '';
 }

hosts/darwin/flow48/custom-dock.nix

@@ -4,6 +4,7 @@
       "/Applications/Zen.app"
 
       "/Applications/Zed.app"
+      "/Applications/IntelliJ IDEA.app"
       "/Applications/iTerm.app"
 
       "/Applications/Telegram.app"
@@ -12,6 +13,7 @@
       "/Applications/Claude.app"
 
       "/Applications/Spotify.app"
+      "/Applications/Notion.app"
     ];
   };
 }

hosts/darwin/mac-pro/custom-dock.nix

@@ -4,13 +4,16 @@
       "/Applications/Zen.app"
 
       "/Applications/Zed.app"
+      "/Applications/IntelliJ IDEA.app"
       "/Applications/iTerm.app"
 
       "/Applications/Telegram.app"
 
       "/Applications/Claude.app"
 
       "/Applications/Spotify.app"
+
+      "/Applications/Notion.app"
     ];
   };
 }