fix: extract macos_prefs from nested snapshot on config import

Exported configs from the dashboard nest macos_prefs inside the snapshot
object rather than at the top level. Import/install only read the
top-level field, so macos_prefs were silently dropped.

Add backfillMacOSPrefsFromSnapshot fallback that reads from
snapshot.macos_prefs when the top-level field is empty. Top-level
macos_prefs take precedence when both are present.

Author: fullstackjam

internal/config/config.go

@@ -111,6 +111,7 @@ func UnmarshalRemoteConfigFlexible(data []byte) (*RemoteConfig, error) {
 	// Try direct unmarshal first (flat string arrays).
 	var rc RemoteConfig
 	if err := json.Unmarshal(data, &rc); err == nil {
+		backfillMacOSPrefsFromSnapshot(&rc, data)
 		return &rc, nil
 	}
 
@@ -177,9 +178,31 @@ func UnmarshalRemoteConfigFlexible(data []byte) (*RemoteConfig, error) {
 	if err := json.Unmarshal(normalised, &result); err != nil {
 		return nil, err
 	}
+	backfillMacOSPrefsFromSnapshot(&result, data)
 	return &result, nil
 }
 
+// backfillMacOSPrefsFromSnapshot copies macos_prefs from the embedded snapshot
+// object when the top-level field is empty. This handles exported configs where
+// macos_prefs are nested under "snapshot" rather than at the top level.
+// Callers are responsible for calling Validate() on the returned RemoteConfig.
+func backfillMacOSPrefsFromSnapshot(rc *RemoteConfig, data []byte) {
+	if len(rc.MacOSPrefs) > 0 {
+		return
+	}
+	var wrapper struct {
+		Snapshot struct {
+			MacOSPrefs []RemoteMacOSPref `json:"macos_prefs"`
+		} `json:"snapshot"`
+	}
+	// Unmarshal error is intentionally ignored: data was already successfully
+	// parsed once, so failure here means the snapshot sub-object is malformed
+	// and we simply skip backfill rather than failing the entire load.
+	if err := json.Unmarshal(data, &wrapper); err == nil && len(wrapper.Snapshot.MacOSPrefs) > 0 {
+		rc.MacOSPrefs = wrapper.Snapshot.MacOSPrefs
+	}
+}
+
 var (
 	pkgNameRe = regexp.MustCompile(`^[a-zA-Z0-9@/_.-]+$`)
 	tapNameRe = regexp.MustCompile(`^[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+$`)

internal/config/config_test.go

@@ -426,6 +426,51 @@ func TestUnmarshalRemoteConfigFlexible_PreservesOtherFields(t *testing.T) {
 	assert.Len(t, rc.MacOSPrefs, 1)
 }
 
+func TestUnmarshalRemoteConfigFlexible_MacOSPrefsFromSnapshot(t *testing.T) {
+	data := []byte(`{
+		"name": "test config",
+		"packages": [
+			{"name": "git", "type": "formula"}
+		],
+		"snapshot": {
+			"version": 1,
+			"packages": {"formulae": ["git"], "casks": [], "taps": [], "npm": []},
+			"macos_prefs": [
+				{"domain": "com.apple.dock", "key": "autohide", "type": "bool", "value": "true", "desc": "Auto-hide dock"},
+				{"domain": "NSGlobalDomain", "key": "AppleShowScrollBars", "type": "string", "value": "Always", "desc": ""}
+			]
+		},
+		"visibility": "unlisted"
+	}`)
+
+	rc, err := UnmarshalRemoteConfigFlexible(data)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"git"}, rc.Packages)
+	require.Len(t, rc.MacOSPrefs, 2)
+	assert.Equal(t, "com.apple.dock", rc.MacOSPrefs[0].Domain)
+	assert.Equal(t, "autohide", rc.MacOSPrefs[0].Key)
+	assert.Equal(t, "bool", rc.MacOSPrefs[0].Type)
+	assert.Equal(t, "true", rc.MacOSPrefs[0].Value)
+	assert.Equal(t, "NSGlobalDomain", rc.MacOSPrefs[1].Domain)
+}
+
+func TestUnmarshalRemoteConfigFlexible_TopLevelMacOSPrefsNotOverridden(t *testing.T) {
+	data := []byte(`{
+		"packages": ["git"],
+		"macos_prefs": [{"domain": "com.apple.dock", "key": "autohide", "type": "bool", "value": "true"}],
+		"snapshot": {
+			"macos_prefs": [
+				{"domain": "other.domain", "key": "k", "type": "string", "value": "v"}
+			]
+		}
+	}`)
+
+	rc, err := UnmarshalRemoteConfigFlexible(data)
+	require.NoError(t, err)
+	require.Len(t, rc.MacOSPrefs, 1)
+	assert.Equal(t, "com.apple.dock", rc.MacOSPrefs[0].Domain, "top-level macos_prefs should take precedence")
+}
+
 func TestUnmarshalRemoteConfigFlexible_InvalidJSON(t *testing.T) {
 	data := []byte(`not json`)
 	_, err := UnmarshalRemoteConfigFlexible(data)