chore(deps): refresh compatible Swift packages and checkout action

[steipete]

Update the existing compatible Swift dependencies: Commander 0.2.2 → 0.2.4, Sparkle 2.9.3 → 2.9.6, swift-log 1.13.2 → 1.15.0, and swift-asn1 1.7.1 → 1.7.2. Update all nine checkout action pins from 7.0.0 to 7.0.1. Manifest floors and lockfile agree; the current major-version constraints stay intact.

Sparkle 2.9.6 includes installer archive-moving and package-signature validation hardening. The remaining updates are compatible maintenance releases. KeyboardShortcuts 3 and Swift Crypto 4 remain separate migration work.

Release notes are collected only in #3488, after #3485 and this PR. This branch changes only the package manifest, lockfile and three workflow pins; it does not change CHANGELOG.md, a version or publication state.

Validation: the production, test, package and workflow tree is byte-for-byte identical to tested commit 3315604; the sole follow-up change moves changelog text to #3488. That tested tree passed all 1,031 selections / 86 groups without retries or timeouts, make check with zero violations, the built CLI 1,100-token/$0.0045 fixture, and Developer ID-signed app startup/Settings with mapped Sparkle 2.9.6. Independent P0–P2 review is clean. The final exact-head CI passes all jobs, including both macOS shards, all three Linux builds, lint and aggregate. This PR is land-ready.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 11:03 PM ET / September 8, 2026, 03:03 UTC.

ClawSweeper review

What this changes

Updates four existing Swift packages and nine checkout-action pins across three workflows while preserving dependency sources and major-version constraints.

Merge readiness

✅ Ready for maintainer review

Still useful and ready for ordinary maintainer consideration: current main retains the older dependencies, and this review found no actionable defect. The recorded runtime validation remains applicable to the reviewed head.

Priority: P2
Reviewed head: 7d2fe40f0fdc9d8e8e2656363b5ec58b26dfd582

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with applicable runtime evidence, successful recorded validation, and no actionable findings.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The captured owner report exercises Commander's real CLI dispatch with an exact cost result and native app startup/Settings with Sparkle 2.9.6 mapped into the process; tree identity preserves that evidence at this head. This establishes integration smoke coverage, not an end-to-end updater security test.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The captured owner report exercises Commander's real CLI dispatch with an exact cost result and native app startup/Settings with Sparkle 2.9.6 mapped into the process; tree identity preserves that evidence at this head. This establishes integration smoke coverage, not an end-to-end updater security test.
Evidence reviewed	12 items	Policy and ownership boundary: Read the complete root AGENTS.md and verified the origin repository. No nested AGENTS.md or maintainer-note files were found under .github or .agents. Applied guidance on small changes, validation, release boundaries, and avoiding credential-accessing probes. Complete introduced patch: The independently inspected merge-base-to-head diff matches the supplied introduction evidence: five files, 21 additions and 21 deletions. Dependency URLs, workflow permissions, event triggers, signing configuration, application code, and persisted settings are unchanged. Current main still needs the refresh: Fetched main still pins Commander 0.2.2, Sparkle 2.9.3, swift-log 1.13.2, and swift-asn1 1.7.1. The supplied related PRs concern an independent timestamp repair and release notes, not a replacement dependency update.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar uses Swift packages for command parsing, logging, cryptography, and native app updates. Its GitHub workflows check out the repository to test and package the app and CLI.

flowchart TD
  A[Package manifest and lockfile] --> B[Swift package resolution]
  B --> C[CLI parsing and shared services]
  B --> D[Native app updater]
  E[Pinned checkout action] --> F[CI and packaging workflows]
  F --> G[Validated app and CLI artifacts]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency refresh scope	4 packages; 9 checkout pins across 3 workflows	The update stays within existing dependencies and automation integrations.

Technical review

Best possible solution:

Land the scoped dependency refresh in the owner's stated sequence, keeping release notes in #3488 and publication checks in the release process.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance, with recorded CLI and native integration checks rather than a reported CodexBar failure.

Is this the best way to solve the issue?

Yes: refreshing the existing manifest floors and resolved pins is a focused approach, with major migrations kept separate and no competing implementation added.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9810f24b0609.

Labels

Label justifications:

• P2: Bounded dependency maintenance includes upstream updater hardening without evidence of an urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The captured owner report exercises Commander's real CLI dispatch with an exact cost result and native app startup/Settings with Sparkle 2.9.6 mapped into the process; tree identity preserves that evidence at this head. This establishes integration smoke coverage, not an end-to-end updater security test.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured owner report exercises Commander's real CLI dispatch with an exact cost result and native app startup/Settings with Sparkle 2.9.6 mapped into the process; tree identity preserves that evidence at this head. This establishes integration smoke coverage, not an end-to-end updater security test.

Evidence

What I checked:

• Policy and ownership boundary: Read the complete root AGENTS.md and verified the origin repository. No nested AGENTS.md or maintainer-note files were found under .github or .agents. Applied guidance on small changes, validation, release boundaries, and avoiding credential-accessing probes. (AGENTS.md:1, 7d2fe40f0fdc)
• Complete introduced patch: The independently inspected merge-base-to-head diff matches the supplied introduction evidence: five files, 21 additions and 21 deletions. Dependency URLs, workflow permissions, event triggers, signing configuration, application code, and persisted settings are unchanged. (Package.swift:46, 7d2fe40f0fdc)
• Current main still needs the refresh: Fetched main still pins Commander 0.2.2, Sparkle 2.9.3, swift-log 1.13.2, and swift-asn1 1.7.1. The supplied related PRs concern an independent timestamp repair and release notes, not a replacement dependency update. (Package.resolved:1, 9810f24b0609)
• Latest release comparison: The v0.56.8 lockfile also contains the older four package versions; this refresh is not established as shipped. (Package.resolved:1, 6ef82690b4a7)
• Validation transfers to the final head: Tree comparison reports only CHANGELOG.md changed after tested commit 3315604. Separate ls-tree reads confirmed identical Sources, Tests, .github, Package.swift, and Package.resolved objects at both revisions. (7d2fe40f0fdc)
• Recorded production-path validation: The captured owner comment reports the built CLI cost command producing 1,100 tokens and $0.0045 from an isolated fixture, plus signed native app startup, Settings interaction, and process mapping of Sparkle 2.9.6. It also reports 1,031 passing test selections, make check, and successful final-head CI. Source inspection confirms CLIEntry resolves the cost command through Commander and CodexbarApp constructs the Sparkle updater. These are contributor observations, not reviewer-executed tests. Source: chore(deps): refresh compatible Swift packages and checkout action #3487 (comment). (Sources/CodexBarCLI/CLIEntry.swift:46, 7d2fe40f0fdc)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-08T01:11:47.826Z sha 3315604 :: needs changes before merge. :: none
• reviewed 2026-09-08T01:29:10.587Z sha 3315604 :: blocked before merge. :: none
• reviewed 2026-09-08T02:35:11.231Z sha 7d2fe40 :: needs maintainer review before merge. :: none

[steipete]

Validation for 7d2fe40f0fdc9d8e8e2656363b5ec58b26dfd582: its production, test, package and workflow tree is byte-for-byte identical to tested 33156041808010f25e53d0ff77534992539da0ec. The only follow-up change removes changelog text now collected in #3488.

• make test: all 1,031 selections / 86 groups passed on the first attempt, with zero failures, retries, or timeouts (1,110.6 seconds including discovery). The runner applied its existing Sparkle runtime-link repair before retrying discovery; no test group needed a retry.
• make check: passed, zero SwiftLint violations, with macOS system Bash selected for the existing signing fixture.
• Independent local and committed-branch autoreview through P2: no actionable findings.
• SwiftPM resolved Commander 0.2.4, Sparkle 2.9.6, swift-log 1.15.0 and swift-asn1 1.7.2. The unchanged major constraints and other pins remain intact.

Live proof: the freshly built CLI executes --help and cost --provider claude --days 1 --format json --refresh. An isolated compact JSONL fixture with 1,000 input and 100 output tokens produced exactly 1,100 tokens and a $0.0045 list-price estimate. The real Developer ID-signed app launched with the bundled Sparkle 2.9.6 framework; native automation opened its Settings menu and verified General, and process mapping confirmed the new bundled framework was loaded. The app then quit successfully. No real provider credentials, cookies or personal history were used.

Exact-head CI passed every required job on 7d2fe40, including both macOS shards, all three Linux builds, lint and the aggregate. This dependency PR is land-ready. Land #3485, this dependency PR, and then the separate final notes PR #3488. This is dependency maintenance and release-note preparation, not authorization to tag or publish.