Field report: app-deletion path leaves io.exo.networksetup daemon rewriting network config — 8 months on two Macs, detection + cleanup notes

[AlakazipLabs]

First, credit where due: app/EXO/uninstall-exo.sh in the current repo removes every component described below, cleanly — it even handles the legacy script filename our installs carried. This report is about the path where that script never runs: the app deleted the normal Mac way (dragged to Trash), or simply abandoned. Field data from one environment — two Macs, same household, same install vintage — so dataset of 1; calibrate accordingly.

What we observed

Two Apple-silicon Mac minis, EXO installed ~Dec 22 2025 (second machine five days later), EXO not used since shortly after. Discovered Aug 16 2026 — eight months later — both machines still carried:

• /Library/LaunchDaemons/io.exo.networksetup.plist — RunAtLoad plus every 1791 s
• /Library/Application Support/EXO/disable_bridge_enable_dhcp.sh (md5 f43695a9…, byte-identical on both machines)

Every ~30 minutes, on machines no longer running EXO, the script: destroys bridge0, edits /Library/Preferences/SystemConfiguration/preferences.plist via PlistBuddy, and runs networksetup -switchtolocation exo — which tears down and rebuilds the network stack. Both machines had been sitting on network location exo (not Automatic) the whole time. Log growth as a proxy for how long this runs unnoticed: 111 KB on the older install, 9.6 KB on the newer.

Why it stayed invisible

Nothing crashes and nothing errors — the network just misbehaves in ways that look like OS bugs. On our machines it produced service failures that were misdiagnosed for a week as a macOS Local Network Privacy problem, and one 14-hour outage. Removing the daemon fixed all of it immediately: local services that had been broken across three reboots came back clean on the next boot, zero further incidents in the ten days since.

Detection (10 seconds, for anyone who ever tried EXO on a Mac)

1. networksetup -getcurrentlocation → returns exo = affected
2. /var/log/io.exo.networksetup.log exists and is growing
3. Duplicate default routes (one per interface) in netstat -rn

Remedy: run uninstall-exo.sh from this repo. (We removed ours by hand before finding it: launchctl bootout system/io.exo.networksetup + moving the plist — note that stopping the daemon does NOT undo the config it already applied; switching the location back to Automatic is a separate step, and the uninstaller handles both.)

Suggestions, maintainer's call entirely

1. Have the daemon self-disable when the app is gone — a one-line existence check on EXO.app before acting would make the Trash-delete path safe retroactively for every future install.
2. Surface uninstall-exo.sh where a Trash-deleter will find it — README install section and/or the app itself. EXO macOS Uninstall Leaves APFS Container Behind #1386 shows the same class of issue for the APFS container; the daemon variant is quieter and more damaging.

Happy to answer questions about the field observations. n=1 environment, both machines now clean, so we can't re-test — but everything above was recorded at discovery time.