fix(darwin): use stable app path to prevent installs.ini accumulation

hm-module.nix

@@ -612,6 +612,9 @@ in {
                 ${optionalString (profile.spacesForce) deleteSpaces}
                 ${optionalString (profile.pins != {}) insertPins}
                 ${optionalString (profile.pinsForce) deletePins}
+
+                # Force WAL checkpoint to ensure changes are visible immediately
+                ${sqlite3} "${placesFile}" "PRAGMA wal_checkpoint(FULL);" || exit 1
               }
 
               error="$(update_places 2>&1 1>/dev/null)"

package.nix

@@ -71,9 +71,24 @@
     mkdir -p "$out/Applications/${applicationName}.app/Contents/Resources/distribution"
     ln -s ${policiesJson} "$out/Applications/${applicationName}.app/Contents/Resources/distribution/policies.json"
 
+    # Re-sign with correct identifier to maintain AdGuard compatibility
+    # AdGuard uses code signing identifier (not CFBundleIdentifier) to recognize apps
+    /usr/bin/codesign --force --deep --sign - \
+      --identifier "app.zen-browser.zen" \
+      "$out/Applications/${applicationName}.app"
+
+    # Use symlink path to avoid installs.ini accumulation on Nix rebuilds
+    # The symlink is created by home-manager and remains stable across rebuilds
     cat > "$out/bin/${binaryName}" << EOF
     #!/bin/bash
-    exec /usr/bin/open -na "$out/Applications/${applicationName}.app" --args "\$@"
+    # Use stable path from home-manager to avoid creating new install IDs
+    STABLE_PATH="\$HOME/Applications/Home Manager Apps/${applicationName}.app"
+    if [[ -e "\$STABLE_PATH" ]]; then
+      exec /usr/bin/open -na "\$STABLE_PATH" --args "\$@"
+    else
+      # Fallback to nix store path if symlink doesn't exist yet
+      exec /usr/bin/open -na "$out/Applications/${applicationName}.app" --args "\$@"
+    fi
     EOF
 
     chmod +x "$out/bin/${binaryName}"