v4.3.0

[4.3.0] - 2026-09-02

Highlights

• Credentials and provider authentication are safer. Secure prompts, stdin, and owner-only files keep secrets out of process lists, while Gemini, OAuth, clipboard, and editor workflows receive additional hardening.
• Window inspection explains which observation route actually works. Per-window eligibility distinguishes combined Accessibility capture, pixels-only recovery, and unknown evidence, with safe application-level partial tree context.
• Background automation is more capable and predictable. Verified non-modal SwiftUI actions, exact-target inventory isolation, and policy-filtered Agent and MCP catalogs avoid unrelated or foreground-only interference.
• CLI and MCP workflows start faster and recover more clearly. Deferred Agent startup, Bridge-bound capture, and precise browser, help, locked-session, and window-close guidance keep routine automation moving.

Added

• Add explicit foreground-only browser dom-click and MCP dom_click with receipt-bound page and document validation; dispatch one synthetic DOM activation without claiming trusted pointer input or a verified final page effect. #660.
• Let trusted MCP hosts explicitly authorize foreground UI for one server process while keeping background-only as the default. Thanks @Austin1serb for #612.
• Report per-window combined_eligible, pixels_only, or unknown observation eligibility in CLI and MCP, including screenshot-only recovery.
• Add an embedding-only Bridge protocol 1.32 API for signed, process-generation-bound observation.
• Add atomic exact-window pixel-focus typing to CLI, MCP, Agent, and Bridge, keeping the focus-only Accessibility write and every background keyboard unit under one target receipt and retry-safe prefix accounting.
• Add explicit foreground modifier-click with exact target preflight and compare-and-swap cursor and focus restoration, preserving newer user or application state instead of overwriting it.

Changed

• Require explicit checkout-local Swift workspace setup for direct source development, preserving live Commander source in standard gitfile-based submodules without conflicting dependency locations; build, release, and CI helpers own setup automatically.
• Share checked Accessibility timeout ownership with AXorcist across dialog, focus, and window-identity probes, rejecting overlapping scopes while retaining unchecked detached-worker scopes.
• Defer authenticated historical-daemon RPCs until a fallback is actually needed instead of serially probing every stale socket before ordinary CLI commands.
• Read config credential set secrets from no-echo prompts, stdin, or owner-only files; let config provider add also accept non-secret references; retain deprecated argv compatibility.
• Skip provider discovery and Agent construction for caller-local commands that cannot invoke the Agent.
• Avoid reopening and hashing Bridge screenshot artifacts twice before CLI or MCP consumption while retaining signed client verification and use-time publication checks.
• Skip the ScreenCaptureKit post-capture settlement delay for classic captures that never enter ScreenCaptureKit.
• Reuse validated classic PNG bytes when capture performs no transform instead of encoding the same image twice.

Fixed

• Honor the Mac app’s menu-bar-only preference while opening Settings, Inspector and session windows, preserving activation and background-host presentation rules. Thanks @anildigital for #676; fixed in #679.
• Exclude repeatedly permission-denied foreign prohibited helpers from mutation inventory without dropping readable targets or weakening accessory, unknown-metadata and process-generation checks. Thanks @jandubois for #677; fixed in #678.
• Bound image-file reads to 10 MiB on one validated descriptor and preserve byte-detected JPEG/WebP MIME for shared AI and MCP analysis, without changing data-only APIs. Thanks @SebTardif for #666 and #667.
• Validate realtime API base URLs before changing connection state, retaining the narrow Tachikoma maintenance update. Thanks @SebTardif for #675.
• Report failed unscoped browser status observations as unknown and retain bounded original diagnostics alongside target-attribution failures without making indeterminate actions safe to retry. #660.
• Give runtime fixtures explicit store and listener ownership, require real hosted configuration-restoration test execution, and keep ambient snapshot invalidation cases behind explicit opt-in. #662, #680.
• Bound application inventory from initial PID discovery through final generation validation, keep setup and validation reads off MainActor without queuing blocked native work, and reuse bound click metadata for result labels and diagnostics without post-action application or snapshot lookup.
• Keep daemon health responsive while browser discovery is blocked, report cached browser diagnostics as unconfirmed, and preserve daemon transport failures instead of reporting successful absence or cleanup.
• Reject late element-detection results and expired queued AX work against one absolute deadline, even when timeout delivery is delayed.
• Consume AXorcist 0.1.9 in internal automation and public SwiftPM packages, preserving versioned Commander dependencies with custom scratch paths and nonjoining timeout cancellation.
• Avoid main-thread LaunchServices stalls during global application lifecycle tracking, preserving process-instance identity, launch readiness, and stop/restart safety.
• Distinguish browser handoff parent and receipt metadata refusals from inspection failures, and document the unchanged zero-ACL/xattr requirements, including OS provenance, without fallback.
• Keep client, host, and certification Bridge socket waits off Swift's cooperative executor so concurrent requests can progress without changing deadlines, cancellation, or receipt validation.
• Preserve authenticated Bridge element-action refusals and partial failure details instead of treating their valid error receipts as indeterminate transport failures.
• Recognize the canonical signed OpenClaw Bridge socket for modern receipt-backed protocol negotiation while preserving signer validation and custom-socket protocol 1.28 compatibility.
• Bound debug CLI build-staleness config discovery to the starting directory's ancestors so missing or inaccessible Git metadata cannot cause an endless startup traversal.
• Share the owner-only credential file between app and CLI, trim surrounding whitespace in app edits and legacy imports, ignore unchanged Settings bindings, recover legacy app keys only on explicit import, and keep failed edits visibly unsaved without Keychain prompts. Thanks @vincentkoc for #651.
• Hide and pre-dispatch refuse every pinned browser-provider route that can grant browser user activation under default background authority, while explicit foreground calls report truthful foreground browser-protocol outcomes.
• Preserve exact-window foreground focus evidence under the native mutation lane for signed Bridge receipts, and refuse blind retries after accepted focus loses proof.
• Keep peekaboo learn on its injected main-actor service provider instead of crashing when no process-wide tool registry default exists.
• Keep default browser calls existing-receipt-only while restoring explicit-foreground standalone CLI root auto-connect; resolve filtered MCP and Agent catalogs before browser bootstrap while still consuming explicit signed handoffs; and give MCP, Bridge, and Agent sessions generation-safe scoped children whose confirmed cleanup or retained debt prevents shared-root fallback and unsafe reuse.
• Let explicitly browser-only MCP servers start without unrelated ScreenCaptureKit ownership preflight, while keeping unknown and capture-capable catalogs fail closed; reject receiptless isolated Chrome children before authenticated capability-session dispatch and direct headless callers to an exact loopback endpoint.
• Keep capture action sampling active across pre-roll, child execution, and post-roll, release only generation-attributed children after terminal-event admission, refuse pre-existing video outputs before child release, reserve startup and descendant-drain time inside the capture deadline, derive post-roll from the recorded child-completion boundary, clear inherited termination-signal masks, keep timeout escalation and cancellable validation off the cooperative/main executors, terminate surviving process-group descendants before validation, reject replaced artifacts, compose focus and child receipts without inventing partial effects, and require Apple-anchored source-stamped host provenance.
• Warm ScreenCaptureKit ownership validation off the main actor before Bridge socket/capability publication, with explicit publication and daemon-readiness reserves beyond the bounded scan.
• Claim and generation-check the host's ScreenCaptureKit lease before trying the concurrent engine first for background Bridge full-screen automatic capture, preserving legacy fallback after modern failure and automatic fallback on every claim failure or competing owner.
• Prevent agent-spawned exec children from retaining the global ScreenCaptureKit transaction lock after an interrupted capture owner exits.
• Return exit status 2 when verify cannot evaluate state because its underlying tool fails.
• Report background text, editable special keys, and clears with their actual AXValue, event, or composite delivery; count only real key events as key presses; preserve the planned receiver literal after escape processing; and require protocol 1.36 before AX-capable remote type requests.
• Revalidate exact-window focused elements and the application's internal key window before typing, reject parent targets with attached sheets while preserving independently identified exact sheet targets, confirm clear-plus-literal text only from a generation-bound value change after bounded event settlement, keep pixel-focus setup confirmation separate from its typing leaf, and stop reporting no-change, missing, or dispatched-but-unverified outcomes as typed characters.
• Require process-generation receipts for process-scoped action and set-value snapshots, revalidate them before dispatch, and preserve their canonical target metadata through MCP and signed Bridge results.
• Bind action and set-value snapshots, resolved AX elements, outcomes, and signed Bridge 1.37 results to one process generation; suppress their Bridge operations for unsupported providers, reject downgraded or receiptless sessions before provider dispatch, and refuse PID reuse, foreign elements, or targetless success before retry.
• Require explicit standalone CLI foreground consent for application focus/switch and Dock visibility changes, and reject contradictory app-switch selectors before runtime discovery.
• Scope persistent MCP and Agent browser refs to one caller, provider child epoch, page, snapshot, and document generation; require the pinned provider's structured capability data, reserve exact targets before permission-bearing setup, preserve post-dispatch failure evidence while withholding invalid refs, and let independent background session lanes overlap under origin-recoverable durable cross-process invalidation while same-target access and Bridge providers without authenticated scoped-session support remain fail closed; explicit signed handoffs transfer one exact connection into a current Bridge host's isolated opaque-reference session.
• Bind Bridge 1.34 Chrome channel connections to an exact live Chrome bundle, native process-owned DevTools listener, and approval-gated WebSocket under one 90-second deadline, verifying Browser.getVersion once without legacy HTTP discovery or repeated permission probes and failing closed on helper-service names, file, socket, generation, or endpoint drift.
• Authenticate native Chrome channels against Google Team ID EQHXZ8M8AV, pin the exact signed identifier and CDHash for the process generation, and enumerate the target process's complete listener inventory independently of Peekaboo's file-descriptor limit.
• Honor the configured default save directory for pathless pixel-only see captures and add collision-resistant generated filenames for concurrent callers, while preserving explicit paths and stdout streaming. Thanks @PollyBot13 for #607.
• Preserve the exact browser target-lock refusal so reconnecting to a different live Chrome channel or endpoint tells callers to disconnect first instead of reporting a generic unavailable target.
• Advertise only actions and input shapes reachable under immutable background-only authority, require background paste window selectors to include one app or PID owner, and keep foreground-capable app, Dock, Space, dialog, menu, browser, clipboard, and paste workflows explicit.
• Emit one lossless target identity and process-generation receipt across CLI envelopes and App MCP responses, preventing extra metadata from overriding the canonical target.
• Prefer a sole live child sheet or alert beneath its exact structural parent window, preserve multi-child ambiguity, and keep parent-window recovery guidance intact across remote dialog reads.
• Bind snapshots to cryptographically random ps1_ references owned by their creating local or Bridge host, route concrete references to one authenticated producer before normal host preference, and refuse malformed, stale, duplicated, incapable, or explicitly misrouted hosts before publication or input.
• Keep Bridge 1.34 snapshot ownership and Accessibility-value click policy independently capability-gated, preserve omitted-policy behavior for old clients, enforce explicit opt-outs before dispatch, and retain cleanup-only removal of legacy timestamp snapshot directories without making their IDs actionable.
• Pin background scrolls to negotiated protocol 1.35 exact-window receipts so legacy hosts refuse before dispatch and retry-unsafe failures retain their exact target.
• Resolve repeated stable window inventory rows consistently across CLI and MCP instead of falsely reporting ambiguity.
• Downscale straight-alpha legacy screenshots to logical 1x instead of silently returning Retina-sized pixels.
• Bound exclusive ScreenCaptureKit transaction-lock waits inside the Bridge request envelope so a wedged peer fails clearly instead of hanging capture indefinitely. Thanks @SebTardif for #599.
• Send Gemini API keys in request headers, require HTTPS OAuth endpoints, and redact OAuth state. Thanks Vincent Koc for #575 and Tachikoma #73.
• Enforce a 10 MiB clipboard and paste file payload limit on the opened descriptor to prevent file-replacement races. Thanks @SebTardif for #561.
• Prevent configured editors from injecting command-line options. Thanks @SebTardif for #562.
• Keep Agent traces privacy-safe and deterministic, and mark unknown mutation dispatch as unsafe to retry.
• Hide foreground-only pointer tools and unsupported input shapes from background Agent and MCP catalogs while preserving explicit CLI foreground consent.
• Reject foreground delivery reported by background CLI paste and preserve canonical target receipts for missing or conflicting results.
• Fall back to native app hiding when Accessibility proves AXHide was rejected before dispatch.
• Keep verified non-modal SwiftUI actions available, isolate exact targets from unrelated incomplete inventory, and recognize fresh inspect_ui observations.
• Preserve process-scoped Accessibility receipts and return read-only application_partial trees without reusable snapshots or mutation authority.
• Bind persistent MCP capture to its selected Bridge, keep classic capture request-local, and preserve precise signed refusals, causes, and recovery hints.
• Bind set-value results to the exact requested element and refuse incompatible Bridge hosts before dispatch.
• Treat confirmed window disappearance after window close as success.
• Fail MCP see when element detection did not run while accepting genuine empty scans. Thanks @SebTardif for #563.
• Require HTTP 200 responses when testing provider connectivity. Thanks @SebTardif for #560.
• Explain why locked macOS sessions cannot be captured even when screen list still reports connected displays.
• Restore terminal echo when credential prompts receive signals and reject background prompts or insecure credential files.
• Deduplicate runtime flags and improve unknown-command, browser reconnect, help, learn, schema, and background-automation guidance.
• Validate contradictory window and Space selectors before runtime-host discovery so malformed requests cannot start support services or mask the actionable error.
• Explain that exact transient sheets may require read-only owning-process Accessibility inspection before screenshot/OCR fallback, without granting partial app trees mutation authority.
• Bound retained native application metadata to eight operations per host process through timeout/cancellation and autorelease cleanup, shed overload as partial rows, and keep exact-target AX reads independent.
• Include nested dialog static text and nonblank AX text metadata fallbacks in dialog list, preserving dialog scope and control order.
• Accept canonical v2 prebuilt Playground fixtures in native validation with strict source, lock, toolchain, bundle, and Foundation signature checks, retaining v1 only for the current invocation's local build.

Verification

• Source commit: 44eff916c3330739108cc1d73683338d4250503a
• Release plan SHA-256: d3f50d50ec938b27d5c6cf40e13b370a576f423f34fa556c69a3b2efddf10a57
• Checksums SHA-256: 13e009c82146b4a92c480a09e20953420614df7140aa400e988fb63a8f7d6346
• npm version: 4.3.0
• npm tarball: https://registry.npmjs.org/@steipete/peekaboo/-/peekaboo-4.3.0.tgz
• npm integrity: sha512-x9d0Uq0rMTihlMKouIiRkcUacKYPfg1DrkZumq/WQceDG2tAOhK04WjmiCw0ue3IPkZ2uJWouhh42Qf/7e4qeQ==
• npm published: 2026-09-02T21:13:28.686Z

Proof

Source and validation evidence

The publication source is 44eff916c3330739108cc1d73683338d4250503a, tree e5c739ad8de0f720f110a7e115e0662a73a80ea1, on synchronized, clean main. It includes final release notes at 83fdb98a9e78bdbe857fc8264cc3fca09d5eac03 and reviewed test-only followups for host metadata, DMG fixture copy modes, browser handoff fixtures, owned menu services, bounded daemon smoke-test readiness, sole-parent PTY process-group ownership, and bounded capability-marker fixture readiness. These followups do not relax production artifact validators, signing, notarization, browser authority, or daemon defaults. Root and CLI changelogs are dated 2026-09-02; tracked release notes exactly match the root 4.3.0 section (SHA-256 87dd8ab9169bc738d5bf625b6596433aa217cf96b1010945f4293b4a34c4db96). No next-version Unreleased section is included.

The final browser candidate fbbb1b38a894a77aeffc945a1c0410660fa9a594 passed macOS CI, full supplemental validation, and CodeQL. Supplemental full-safe, dependencies, libraries/apps and Core groups passed. The actual hosted Core log records four reporting functions and eight parameterized cases executed and passing. Local Xcode 27 proof reproduced five failing cases and 21 reporting assertions on old production code, then passed all eight cases after exact restoration, twice again on repeat, plus ten adjacent connect-outcome tests. The earlier focused DOM/browser selection passed 128 tests; the pinned provider contract was exercised without connecting Chrome.

The separate ambient-test correction passed macOS CI and CodeQL. Its hosted CLI log explicitly reports the two ambient mutation bodies skipped, not passed. Nine policy/parser checks pass, including old-source and independent missing-gate negative controls. The two reviewed patches touch disjoint files; their combined tree e348d173f8e5b9f4bf1ef51ab90c7e0ea0dca679 was verified against the actual merged main tree. CI commit identities are not relabelled as the publication source.

The unchanged release driver must complete and record its full local preflight on the publication source before artifacts are eligible for publication. The maintainer explicitly authorized that preflight on the publishing Mac. Ambient-state opt-outs and secret-environment sanitization remain in effect; local execution is not claimed to be a hermetic OS account. No reduced-preflight or publication-bypass flags are used. The results below are prior recorded runs, not a claim that this final full-driver attempt has already passed.

Toolchain and dependencies

Publication uses Xcode 27.0 build 27A5237l, Apple Swift 6.4 and macOS SDK 27.0. Hosted Xcode 26.x compatibility runs are separate from the Xcode 27 release build.

Both AXorcist dependency paths consume the already published AXorcist 0.1.9, tag commit 37d7ae82ff1443b4b36344ca6f3bf0ad33f13b12. Its universal archive SHA-256 is 80f6d6faf5b753e54282abc6158a3c2f52a13dcb72b8f055e917b85d2a918852; public download, strict Foundation signature, accepted notarization, version/help and Homebrew installation were verified. Tachikoma is pinned to 6ef3ab785abc0d32ea826ef231ae458d230dd86a, the narrow URL-validation and timeout-fixture maintenance update.

Local preflight repairs and recorded execution

The first post-triage full local attempt passed metadata, documentation, formatting, lint and a warning-free Xcode 27 analyzer build, then stopped because this host adds protected 11-byte com.apple.provenance metadata to fresh synthetic fixtures. Ordinary cleanup cannot remove it. The test-only adaptation keeps clean-host coverage, fails on unexpected metadata or inspection errors, and explicitly skips 11 native zero-metadata artifact cases unavailable here. They are not counted as passes. Six focused commands passed with 113 executed controls; the parent repeated all four corrected fixtures. Fake-notary providers remain explicitly fake; arbitrary-xattr and injected AppleDouble rejection still execute. All 81 production scripts were verified byte-identical for this adaptation. Syntax, ShellCheck, whitespace validation and scoped Codex P0 review passed.

The next full-driver attempt passed those repaired fixtures but failed the DMG test because mock cp -R under the release runner's private umask lost executable permission bits. The test now enforces that umask and preserves copy modes with cp -pR; old source reproduced the intended failure. A subsequent full safe-suite run passed all release-script contracts and Foundation (81 tests in 15 suites), but failed browser handoff metadata assumptions and one menu-window fixture. That failed run is retained, not relabelled as green.

Handoff tests now separate pure parsing, canonical bytes, path and symlink checks from native zero-metadata positive fixtures. Exact metadata classification, unexpected attributes, ACLs, inspection errors and real production provenance rejection remain checked. Targeted execution passed 12 declarations / 16 cases; 12 native declarations / 15 cases were explicitly skipped. No native positive handoff proof is claimed for this host. The menu fixture now uses an owned mutation journal and in-process service-backed focus stubs, preserving PID/generation, planned-window and decoy-window assertions. Two controlled red runs exposed the fixture dependencies; the corrected regression and all seven adjacent menu tests passed. The original full-run ambient trigger remains unknown. Neither repair changes production behavior.

The combined CLI gate then passed CoreCLI (reported 1202 tests in 134 suites, including the declared skips), configuration (50 tests in 12 suites), and automation (545 tests in 68 suites). Runtime integration failed three previously passing cases. All 14 credential/terminal tests passed on an unchanged focused rerun; the daemon readiness test still expired at five seconds. Its test-only startup allowance is now bounded at 30 seconds, without changing production defaults, stop timeout, identity/status assertions or cleanup. The real daemon start/status/stop smoke test passed in 5.415 seconds total; that total does not establish startup duration. The complete runtime selection subsequently reported 139 tests in 14 suites passed in 46.533 seconds, with the existing ambient clipboard case skipped. Earlier failures are preserved; their exact historical scheduling cause is not claimed. All followup diffs received scoped-clean Codex P0 review and focused formatting/lint/whitespace validation. The installed/configured SwiftLint version warning was retained; no linter configuration was relaxed.

These group results come from separate recorded runs. This final publication attempt still performs the unchanged complete preflight; the evidence above does not substitute for it.

Final terminal fixture followup

The preceding full publication attempt on 9b173b25ea2a6b6123982a02648918abfc65ea20 passed the release-script contracts, Foundation (81), CoreCLI (1202 reported with declared skips), configuration (50), and automation (545), but the runtime group failed one background-process terminal case with two assertions: SIGPIPE termination and missing credential-input error. Nothing was published by that attempt. The real daemon smoke passed.

The PTY test supervisor and child both assigned the child process group before their release-pipe barrier. Instrumentation observed child setpgid failure with EPERM; the original fixture failed 5 of 64 fixed-count real-CLI launches. A diagnostic-only barrier reproduced three actual SIGPIPE failures with PID-marker-only output, establishing the mechanism without claiming the exact historical scheduling of the failed publication attempt. The test-only repair in 221b9daf3d86c6575d1ded39db1fde6b4d830267 gives process-group assignment solely to the parent; the existing pipe still prevents child execution before terminal setup. Production code, Swift assertions, signal forwarding, echo/secrecy checks and cleanup are unchanged. Both corrected boundary batches passed 64/64. The affected case passed, all 14 terminal tests passed, and the runtime selection reported 139 tests in 14 suites passed in 37.123 seconds with its existing ambient clipboard skip. C warning-as-error compilation, whitespace checks and scoped Codex P0 review passed. Earlier diagnostic setup attempts with zero tests or a wrong binary path are retained and excluded from proof. No sleeps, retries, test disabling, or new production seams were added.

This final source still goes through the normal full release driver; preceding group results do not replace that gate.

Capability-marker fixture readiness

The subsequent full preflight on 221b9daf3d86c6575d1ded39db1fde6b4d830267 passed all release-script contracts, Foundation (81), CoreCLI (1202 reported with declared skips), configuration (50), automation (545), and the repaired terminal suite. Its runtime selection failed only the native capability-marker fixture when its five-second readiness deadline expired. This attempt also stopped before artifacts or publication. The test protects registration, held ownership and clean shutdown, not a startup-latency SLA. The final test-only followup allows up to 30 seconds for readiness while preserving all marker, socket, identity, exclusion, graceful shutdown and cleanup assertions, plus the separate five-second shutdown cap. The real affected test passed in 7.752 seconds total; the full runtime selection reported 139 tests in 14 suites passed in 53.778 seconds, with its existing ambient clipboard skip. Total test duration is not startup duration. Scoped Codex P0 review, formatting, canonical lint and whitespace checks passed. The exact historical scheduling cause is not claimed, and production behavior is unchanged.

Completed preflight and app-release parser repair

The full normal release preflight on 7b95c46e4d73e1a0d1bf67f6f7355c9cc7e333cf passed: all release-script contracts; Foundation (81); CoreCLI (1202 reported with declared skips); configuration (50); runtime (139 reported with the existing ambient clipboard skip, 48.076 seconds); and automation (545, 30.633 seconds). The compiler analyzer was warning-free. Both arm64 and Intel builds, Foundation signing, version/help and command-inventory contracts passed. Its retained release plan records completed full preflight and publication eligibility, not a reduced-check promotion.

The universal CLI then received accepted Apple notarization (00e1b266-f507-4660-a905-732a1d93c11b). App packaging stopped before GitHub/npm publication because two helper-hash comparisons split a Bash equality operand across a newline without continuation. The final release fix adds those two continuation characters, preserving the exact helper integrity checks. The existing signing-policy safe-suite test now parses the complete real app release entrypoint with privileged Bash without executing credentials or packaging. The new guard fails original source with the intended syntax error and exit 2; the corrected complete signing-policy test passes. Bash 3 and Bash 5 parse the correction; ShellCheck, whitespace validation and scoped Codex P0 review passed. Prior notarized CLI artifacts and source-bound evidence were archived with verified hashes; they are not relabelled as artifacts of this new commit.

The unchanged full driver is run again for the final source, rebuilding and verifying its own source-bound artifacts. No full-preflight, helper-integrity, signing, notarization, or publication checks are bypassed.

App ZIP producer and real signed-app preservation

The next full normal preflight on 838637fe40345ff7b80702fccfb48b3c81e528a5 also passed all five Swift groups, release contracts, architecture builds and command checks. Apple accepted its CLI notarization (11b3385d-27c8-486e-965b-4bcfeacba257) and app notarization (7585fb4c-a710-4c9d-8dd6-6cec1dfdd39e). The app was stapled and passed strict signature and Gatekeeper checks. Final Sparkle ZIP verification then correctly rejected 261 outside-root metadata members among 437 members: the producer's sequestered resource metadata emitted __MACOSX/AppleDouble entries. This attempt did not publish to GitHub or npm; its artifacts and source-bound proof were preserved.

The final producer repair uses one small production helper for notarization ZIPs, final Sparkle ZIPs and the existing terminal packager, omitting resource forks, extended attributes and quarantine rather than emitting metadata entries. Both strict archive validators and the terminal packager's stricter source-xattr guard remain unchanged. A real-producer synthetic regression failed on the original command (25 members, 15 outside-root metadata entries) and passed after the correction (10 members, none outside-root or AppleDouble), preserving exact file bytes, modes, symlinks and source state. Synthetic signature/ticket-shaped bytes are explicitly not native signing proof. Existing archive-validator, terminal-policy, full signing-policy, Bash syntax, contextual ShellCheck and whitespace checks passed, with pre-existing unavailable terminal-native fixtures still explicitly skipped. Scoped Codex P0 review was clean, and release documentation now describes the shared ZIP owner.

Separately, the parent repackaged the retained actual signed/stapled R7 app with the new producer. Both strict archive validators passed; the complete extracted byte/mode/symlink tree matched; the source was unchanged; all seven Mach-O payloads retained strict OpenClaw Foundation signatures. Deep signature validation, online notarization, the stapled ticket and Gatekeeper assessment all passed. The app was not launched. This establishes preservation of the real retained artifact, not publication or a claim that it came from the final commit. The full driver rebuilds, signs, notarizes and validates its own exact-source artifacts for this publication attempt.

Coverage boundaries

Signed exact-owner menu-bar fixtures on macOS 27 reproduced baseline Dock appearance and verified that the candidate remained accessory and absent from actual Dock inventory while opening a key Settings window. Independent text replacement/readback passed without moving the cursor or losing focus. Partial content-view exports were rejected as complete visual proof. Native inventory probing confirmed repeated foreign-prohibited EPERM classification; remaining accessory and missing-name uncertainty correctly refused mutation, with unchanged target readback. Successful native name/bundle hiding is not claimed.

Native DOM-click final-effect proof remains unavailable: one real-profile connection attempt was indeterminate and not retried; a subsequent status timeout was not confirmed disconnection. No page mutation was performed. PR648 remains open and excluded from 4.3. Fresh-VM qualification, exhaustive live/custom-provider matrices and repeated broad native lifecycle matrices remain deferred at the maintainer's direction, not counted as passes. Earlier failed or zero-execution attempts remain preserved.

This is pre-publication evidence. The normal driver separately enforces and records completed preflight, artifact source binding, signing, notarization, checksums, registry integrity and publication eligibility. Published-install checks must use a neutral directory. No production OpenClaw deployment or restart is part of this release.