`brew bundle` with `masApps` fails during nix-darwin activation — "Unable to install" even when apps are already installed

[Shabashe]

Configuration

mas ▁▁▁▁ 6.0.1
slice ▁▁ arm64
slices ▁ arm64
dist ▁▁▁ homebrew/core/mas
origin ▁ https://github.com/mas-cli/mas.git
swift ▁▁ 6.2.4 (swiftlang-6.2.4.1.4 clang-1700.6.4.2)
driver ▁ 1.127.15
store ▁▁ US
region ▁ US
macos ▁▁ 26.4 (25E246)
mac ▁▁▁▁ Macmini9,1
cpu ▁▁▁▁ Apple M1
arch ▁▁▁ arm64

Bug description

When using nix-darwin with the homebrew.masApps option, brew bundle is invoked during system activation (via sudo darwin-rebuild switch --flake ...). The masApps entries consistently fail with:

Error: Unable to install <AppName>. mas installation failed.

This happens even when the apps are already installed and up to date. Running mas install <id> directly in a user terminal works fine and correctly reports Warning: Already installed <AppName> (<id>).

Steps to reproduce

1. Install nix-darwin with the nix-homebrew module
2. Add masApps entries to the homebrew configuration in flake.nix:

homebrew = {
  enable = true;
  brews = [ "mas" ];
  masApps = {
    "Xcode" = 497799835;
    "Logic" = 634148309;
    "Final" = 424389933;
  };
};

3. Run sudo darwin-rebuild switch --flake ~/.config/nix-darwin
4. Observe the activation output:

Using cloudmounter
Using ipfs-desktop
Using betterdisplay
Using cameracontroller
Using vcam
Error: Unable to install Final app. mas installation failed.

The error appears for one or more of the masApps entries on every activation.

5. Verify mas install works directly:

$ mas install 424389933
Warning: Already installed Final Cut Pro (424389933)

Expected behavior

brew bundle should succeed for masApps entries when the apps are already installed, similar to how mas install correctly handles this case when run directly.

Actual behavior

brew bundle reports mas installation failed during nix-darwin activation, even for already-installed apps.

Analysis

The likely cause is a session mismatch: nix-darwin runs brew bundle under sudo during system activation. The installd / App Store service requires the logged-in user's session context. When brew bundle invokes mas under sudo, the connection to the installation service fails because the root session cannot talk to the user-session installd.

Running mas install directly in a user terminal (same user, same session) works without issue.

Workaround

Comment out masApps in the nix-darwin flake and manage Mac App Store apps manually via the App Store or by running mas install directly. The cleanup = "zap" option in nix-darwin's homebrew module only affects brews, casks, and taps — it does not uninstall MAS apps.

Possibly related

• purchase/install/upgrade fail with PKInstallErrorDomain 201 on macOS 26.1, 15.7.2 & 14.8.2 #1029 (purchase/install/upgrade fail with PKInstallErrorDomain 201) — fixed in 4.0.0, but the brew bundle / sudo context issue persists on 6.0.1

[sbarton20]

I am experiencing the same issue, and have for the last week or so.

I have tried commenting out mas from the list of brews I have installed: same result. I used the nix pkgs mas version instead of the homebrew one: same result. I ran: mas signout and signed back into the app store, with a restart of my device: same result.

The only other thing I did notice is if I did not install mas (neither within brews nor pkgs) and the masApps option is present but empty masApps = { };, then the system will still show that mas was installed and uninstalled for the purposes of installing apps listed under masApps. Therefore, nix-darwin is still accessing homebrew and mas in a way that you would expect at the beginning and the end , but it is unable to install anything.

Lastly, if mas is not set to be installed but masApps does have apps listed for installation, when darwin-rebuild switch is run and fails, with the noted failure message, mas remains installed on the system and works as expected.

As noted in the original posting, mas install and mas upgrade work as expected on their own.

I am running an M4 device.

[rgoldberg]

@Shabashe Thanks for reporting this issue.

I'm not familiar with how nix works.

Can sudo darwin-rebuild switch --flake … output the mas (& brew bundle) stdout & stderr output? Maybe via --verbose?

Homebrew brew bundle cannot be called with root privileges (at least in my testing):

$ sudo brew bundle
Password:
Error: Running Homebrew as root is extremely dangerous and no longer supported.
As Homebrew does not drop privileges on installation you would be giving all
build scripts full access to your system.

$ brew --version
Homebrew 5.1.6-22-g95c3115
Homebrew/homebrew-core (git revision cd3586223e4; last commit 2026-04-13)
Homebrew/homebrew-cask (git revision 0651124d953; last commit 2026-04-14)

Do you know exactly how brew bundle / mas are being called?

If mas is called with a root effective user, mas expects SUDO_UID & SUDO_GID to be set to the uid & gid of the logged in macOS user. Maybe those aren't set, or are set incorrectly.

Whatever more info you can provide will be useful. Also, you might want to open an issue with nix, then post a link to that issue in a comment here.

Thanks for any more info you can provide.

[rgoldberg]

@sbarton20 Thanks for the info.

I have tried commenting out mas from the list of brews I have installed: same result.

brew "mas" in a Brewfile instructs brew bundle to install mas, like all other formulae.

Commenting it out just removes the explicit instruction to install/update mas; entries in the Brewfile like mas "App Name", id: 123 instruct brew bundle to use mas to install/update the referenced App Store apps. If a Brewfile contains entries like mas "App Name", id: 123, and If mas isn't already installed, brew bundle automatically installs mas.

Lastly, if mas is not set to be installed but masApps does have apps listed for installation, when darwin-rebuild switch is run and fails, with the noted failure message, mas remains installed on the system and works as expected.

That is expected, because masApps content presumably maps to Brewfile entries like mas "App Name", id: 123, which cause mas to be installed if it wasn't already.

[rgoldberg]

@Shabashe @sbarton20 I don't know anything about nix. If I do not receive answers to my questions sometime soon, I will close this as "Can't reproduce". If this issue gets closed, and if you subsequently provide answers, this issue can then be reopened.

[DWSR]

Looks like this has something to do with apps having updates available when nix-darwin invokes brew / mas. The error message in question @rgoldberg:

Installing Clocker
Error: Download request failed: The operation couldn’t be completed. (mas.MASError error 5.)
Upgrading 1 outdated application:
Clocker (26.6) -> (26.7)
==> Downloading Clocker (26.7)
Installing Clocker has failed!

When I manually update the apps in the app store (or outside of nix-darwin), things then work fine.

[rgoldberg]

@DWSR Thanks for the info.

Current mas (6.0.1) does not output Upgrading 1 outdated application:.

Are you running mas 2.2.2 (which outputs a line like that)?

mas 2.2.2 will not get, install, or update apps for macOS 26.1+, 15.7.2+, or 14.8.2+ due to Apple securing installd.

Can you provide the output of mas config, which includes the mas version & other pertinent info?

What errors, if any, do you get after updating mas to 6.0.1?

FYI: finding or implementing the solution might require nix personnel debugging and/or modifying their code / scripts, or Homebrew personnel their code / scripts.

Thanks.

[DWSR]

@rgoldberg Was just looking at nix-darwin/nix-darwin#1722 and confirmed that nix-darwin was running 2.2.2 in my configuration. After overlaying nix 6.0.1 from unstable things are now working as expected. Looks like this is entirely due to nix-darwin using a very old version of mas and likely this issue can be closed.

For other nix users: If you're running nixpkgs =<25.11, you'll need to overlay mas from unstable in order to get it upgraded. Snippet for creating the overlay below

  fixed-packages = final: _prev: {
    inherit ((import inputs.nixpkgs-unstable { inherit (final.stdenv.hostPlatform) system; })) mas;
  };

[rgoldberg]

@DWSR Thanks for the confirmation.

Can you post your overlay solution in nix-darwin/nix-darwin#1722 & encourage nix to update mas to current wherever they can?

In one of the nix issues, someone seemed to be planning to back port mas 6.0.1 to 25.11 (I doubt further back, but maybe).

You might want to follow up with whoever that was.

I will close this issue now, but am happy to reopen if anyone finds anything at fault or potentially at fault in mas.

Thanks.

I just noticed that OP seemed to be running 6.0.1 instead of 2.2.2, but given that 6.0.1 works for @DWSR, maybe nix was running mas 2.2.2 while OP manually ran 6.0.1, or something else is wrong in OP's nix setup. Again, I'm happy to reopen if anything might be amiss in mas.

[rgoldberg]

An overview of known problems for nix using mas can be found here nix-darwin/nix-darwin#1722 (comment).

None of the known problems are caused by mas.