Audit finalization: Track A hardening + Track B features, presentation-tested share, durable pre-commit gate - #44
Merged
Merged
Conversation
… default, history cap, native share) Branch audit-a-plus-2026-07. Closes the Track A code-review findings, adds three Track B features, and fixes the local XcodeGen pinning drift. Track A (24 findings, 11 medium + 13 low) — correctness/crash-vector, concurrency, DRY, and release-readiness fixes across the capture pipeline, overlays, cursor state, and tooling. Highlights: - Extracted shared MetricSampleWindow (bounded ring buffer + nearest-rank percentile) used by every recorder; removed the duplicated private copies. - Drift gate: ci.yml + release_ready.sh regenerate the project with the PINNED XcodeGen (2.45.4) then `git diff --exit-code` the 3 xcodegen-owned files; scripts/install_xcodegen.sh is the single pinned-installer source of truth. - Removed the dead custom URL-scheme handler (caloura://) + its tests — it bypassed OS routing and never worked. Deleted the no-op entitlements file (non-sandboxed Developer-ID build; app-sandbox=false was already implied) and the Brewfile (superseded by install_xcodegen.sh). Track B: - B1: autoDetectPII now defaults ON. Detect-only (surfaces a PII badge + a manual redact action); it does NOT auto-redact. Strictly on the deferred enrichment path, so no capture-path latency. On-device, no PII egress, no raw-PII logging. - B2: history item cap is configurable (100/200/500/Unlimited). Unlimited = Int.max sentinel with no overflow/allocation path. Lowering the cap prunes items + embeddings + preview/PII side-state (on-disk PNGs intentionally kept). - B3: native macOS Share Sheet. Overflow-menu "Share" presents an NSSharingServicePicker anchored to the overlay panel (saved capture -> file URL, unsaved -> NSImage); the history grid gains a file-existence-guarded ShareLink. Picker + delegate are retained for the menu's lifetime; a shareGeneration guard rejects a superseded share's completion callback; dismiss() fully resets share state and logs when a hover is suppressed mid-share so a stuck flag is visible. pbxproj/scheme regenerated with pinned XcodeGen 2.45.4 (objectVersion 77, scheme parallelizable="NO"); output verified idempotent + machine-independent. Verification: xcodebuild build SUCCEEDED; swift test 817 passed / 8 skipped / 0 failures; swiftlint clean; drift gate proven idempotent. CAVEATS (not resolved in this commit): - The full `xcodebuild test` suite shows 5 assertion failures across 4 CalouraSystemTests methods, all from `isKeyWindow` reading 0 when the CLI test host isn't frontmost. Proven environmental via git (key-window code unchanged), expected green on CI but NOT yet observed on this un-pushed branch. - The B3 share picker was unit-tested at the item-resolution seam only; the live NSSharingServicePicker presentation was NOT launched/clicked in a running app. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0173csq1QXWXzzMQExDmzdjC
…ode update) Documents the toolchain obstacle hit while landing the audit commit: Apple's /usr/bin/git shim injects a CommandLineTools SDKROOT (Swift 6.4) into hook subprocesses that mismatches the selected Xcode compiler (6.2.3) after a partial macOS-27 toolchain update, so the pre-commit `swift build` fails while the same build passes in-shell. Fix applied to .git/hooks/pre-commit (unset SDKROOT + pin DEVELOPER_DIR); the .git/ hook itself is untracked so only the lesson is committed here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0173csq1QXWXzzMQExDmzdjC
…e-commit gate Closes the last audit caveat and hardens the local gate to predict CI. - B3: add CaptureSharePickerPresentationTests — drives the app's resolved share items through the real NSSharingServicePicker(items:) the overlay uses and asserts an enabled, titled standardShareMenuItem, covering both the file-URL branch (saved capture + history item) and the NSImage branch (unsaved capture). CaptureShareItemsTests only checked item shape; this proves they are an actionable share payload. Deterministic and headless-safe (no windowserver dependency, no deprecated sharingServices(forItems:)). - Track the pre-commit gate at .githooks/pre-commit (was untracked in .git/hooks — lost on any fresh clone, and it carried the SDKROOT toolchain fix). Run swiftlint --quiet --strict per staged file so line-length and other default-warning rules fail here the same way they fail CI. Activation (git config core.hooksPath .githooks) documented in README. - Regenerate project.pbxproj with the pinned xcodegen 2.45.4 to include the new test (4 additive lines; regeneration is deterministic, so CI's drift gate stays green). - Docs: CLAUDE.md points TCC/cursor/overlay/stateful-flag work at the swift-macos-integration skill; tasks/todo.md + tasks/lessons.md record the full-confidence phase, the hook-strictness lesson, and the isKeyWindow refinement. Verified: the entire CI pipeline reproduced locally green on this tree — swift build, swiftlint --strict (0 violations), swift test (820, 0 failures), python unittest, xcodebuild test unit+system (TEST SUCCEEDED, 0 failures), and the 8 coverage floors. All 4 isKeyWindow system tests pass under a detached xcodebuild run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0173csq1QXWXzzMQExDmzdjC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Finalizes the multi-dimensional codebase audit of Caloura to an A+ bar. Three commits (squash on merge):
f01c2a8) — Track A hardening across 24 findings (crash vectors, state-machine/flag recovery, error surfacing) plus Track B features: PII auto-detect default, screenshot-history cap, native share flow.7101440) — records the git-hookSDKROOTpoisoning root-cause (documentation only).a9f5ef2) — closes the last caveat and hardens the local gate (details below).What's in the finalization commit
CaptureSharePickerPresentationTests): drives the app's resolved share items through the realNSSharingServicePicker(items:)the overlay uses and asserts an enabled, titledstandardShareMenuItem. Covers both branches — file-URL (saved capture + history item) and NSImage (unsaved capture).CaptureShareItemsTestsonly checked item shape; this proves they are an actionable share payload. Deterministic and headless-safe (no windowserver dependency, no deprecated API)..githooks/pre-commit(was untracked in.git/hooks, lost on any fresh clone) and runsswiftlint --quiet --strictper staged file so default-warning rules (e.g. line-length) fail locally exactly as they fail CI. Activation documented in the README.project.pbxprojregenerated with the pinned xcodegen 2.45.4 to include the new test (additive; drift gate stays green).swift-macos-integrationskill;tasks/records the full-confidence phase and two new lessons.Verification
The entire CI pipeline was reproduced locally and is green on this tree:
swift buildswiftlint --quiet --strict(project-wide)swift testpython3 -m unittest(release tooling)xcodebuild test(unit + system,CODE_SIGNING_ALLOWED=NO)git diff --exit-code)All 4
isKeyWindowsystem tests pass under a detachedxcodebuildrun. CI is the authoritative confirmation this PR gates.🤖 Generated with Claude Code
https://claude.ai/code/session_0173csq1QXWXzzMQExDmzdjC