I'm working on a Mac app that receives a process ID via NSXPCConnection, and I'm trying to figure out the best way to determine whether that process is a native macOS app like Safari—with bundles and all—or just a script launched by something like Node or Python. The executable is signed with a Team ID using codesign. I was thinking about getting the executable's path as one way to handle it, but I’m wondering if there’s a more reliable method than relying on the folder structure.

I have an App with bundleId in Xcode as "com.companyname.abc.123" when using ASAuthorizationProviderExtensionAuthorizationRequest with Enterprise Sso plugin feature, the callerBundleIdentifier shows a different (com.companyname.abc without 123 in the end) which failed our validation. Do we know where the callerBundleIdentifier comes from? I noticed something called audittoken as well from console logs, but no idea how it is generated.