Skip to content

v4.9.1

Choose a tag to compare

View all tags
@steipete steipete released this 11 Oct 20:14
· 66 commits to main since this release
v4.9.1
e060b6b
This commit was signed with the committer’s verified signature.
steipete Peter Steinberger
SSH Key Fingerprint: 0R9sOfREAbuojItYW9O6fvh2RHbgqVJyvk8FBS/35dk
Verified
Learn about vigilant mode.

4.9.1 - 2026-10-10

Highlights: Stop idle peekaboo mcp servers from burning CPU whenever other applications launch or quit, accept renamed or symlinked CLI executables, refuse to overwrite configuration files that cannot be read, and keep capture output intact at the retention limit.

  • Stop an idle peekaboo mcp (and other window-tracking hosts) from burning CPU whenever unrelated applications launch or quit: AXorcist now indexes workspace applications by identity and stops re-reading resolved PIDs, cutting the cost from ~0.68 s to ~0.02 s of CPU per launch and quit on a Mac with ~600 running applications. Thanks @coygeek for the detailed report! #1005.
  • Accept renamed or symlinked CLI executables when routing commands, normalizing agent tasks, and classifying JSON result envelopes.
  • Refuse configuration mutations (custom provider add/remove, configuration updates) when an existing config file cannot be read, instead of overwriting it with defaults or cached data. Thanks @rudycelekli! #1007.
  • Retain capture-action child stdout/stderr when the 64 KiB retention limit splits a trailing UTF-8 scalar, instead of discarding the whole valid prefix and recording an empty stream receipt. Thanks @rudycelekli! #1006.
  • Accept signed global coordinates for foreground MCP move and drag within existing magnitude bounds, preserving target guards and before-delivery validation. Thanks @rudycelekli! #963.
  • Update AXorcist to 0.2.2 so SwiftPM consumers of Peekaboo's library products get the idle-observer CPU fix, plus collectAll request-timeout handling, complete observation subscriptions, and fast observer-removal failure reporting.
  • Update the shared Swift Log lock to 1.16.1 and Swift Configuration to 1.2.2 for corrected multiplexed log metadata and empty configuration values, preserving the supported Swift and macOS baselines.
  • Preserve documentation source text through syntax highlighting, parse CRLF metadata, render unfinished EOF fences, retain link entities/query parameters, and assign unique heading targets. Thanks @rudycelekli! #931, #939, #940, #969, #971.
  • Link the npm version page from the published GitHub release body, keeping scoped package paths literal and requiring the registry package name to match the local package before rendering.
  • Publish the Sparkle minimum macOS version as the item element Sparkle reads, migrating existing feed entries whose enclosure attribute Sparkle ignored.

Verification

Proof

Peekaboo 4.9.1 is built from the frozen source commit recorded in release-plan.json: e060b6ba21792b327ce2a10368f57c8e569dc712.

  • Release preparation: 4.9.1 publishes from release/4.9.1 (#1015), created from main at e59c220d with the driver's --release-branch mode. The branch adds chore(release): prepare Peekaboo 4.9.1. AXorcist 0.2.2 (https://github.com/openclaw/AXorcist/releases/tag/v0.2.2) was published first, with signed and notarized axorc archives and the Homebrew formula reconciled, and #1014 aligned the public Package.swift pin and the submodule on it. The SwiftPM consumer contract resolved 0.2.2 from the published tag. An independent Codex P0–P2 review of the preparation passed with no findings: all 10 root changelog entries survive verbatim with contributor credits, the release notes equal the root 4.9.1 section, the CLI section mirrors its 7 CLI-facing entries, and the highlights and README claims are supported by the entries. Version-surface, docs-lint and release-preflight contract checks, plus a deterministic prepare-release --dry-run against the freshly built CLI, passed on the branch. The publication preflight runs the complete prepare-release against the freshly built CLI. A first publication attempt from d7c9c319 stopped before any public action. Apple's notarization upload for the built CLI repeatedly aborted on a saturated uplink. Separately, that commit's supplemental release validation failed twice in the AXorcist dependency suite: the new resolved-wrapper regression asserted exact read counts that raced flushMetadata's fence snapshot on the hosted runner (99 reads). The test-only fix (openclaw/AXorcist#99) counts only already-resolved wrapper reads, and its assertions still fail with the production skip disabled. The branch picks it up in build(deps): pick up AXorcist's deterministic monitor regression, leaving the public Package.swift pin at exact 0.2.2, and was rebuilt from that head.
  • Headline fix (#1005/#1013): measured with release builds of Peekaboo main, using the issue's methodology (idle peekaboo mcp --no-remote after the MCP handshake, ~594 running applications, 60 short-lived titled processes, two interleaved rounds per build), CPU per unrelated launch and quit dropped from 0.668/0.684 s to 0.025/0.021 s. Idle CPU was unchanged.
  • Native toolchains: the universal CLI was built, signed and notarized on clawstudio (Xcode 27.2 (27B5019j), Swift 6.4 (swiftlang-6.4.0.34.1), macOS SDK 27.2, macOS 27.0.1). It was then copied byte-for-byte to megaclaw, which builds, signs and notarizes the app and DMG and runs publication from a relocated staging clone of release/4.9.1 with the pinned release helper (Xcode 27.0 (27A266a), the same Swift 6.4 compiler build, macOS SDK 27.0, macOS 27.0, Node 26.11.1, pnpm 11.28.4). The driver's --reuse-built-cli re-verifies that CLI's signature, version, source commit and Swift runtime imports before preflight.
  • Publication host relocation: on clawstudio, dozens of concurrent agent processes saturated the uplink, and Apple notarization uploads aborted for about 10 hours (single-stream uploads ran at about 47 KB/s). The CLI was notarized through Apple's Notary REST API with a parallel S3 upload (submission f9b5f55d-b09d-4fc6-b47c-db7d7e1b076b, Accepted), and the remaining uploads moved to megaclaw. Relaunches on clawstudio stopped before any public action; some also hit load-sensitive preflight tests, which are being hardened separately. The release source is unchanged.
  • The publication driver runs the complete native preflight on the frozen source before packaging, then builds, signs, and notarizes the universal CLI, app, and DMG.
  • npm publication runs through the Publish npm release tarball workflow, the registered npm trusted publisher for @steipete/peekaboo. It publishes the exact tarball uploaded to this release, after checking it against checksums.txt and its embedded name and version, with signed provenance. The driver's resume then verifies registry integrity against the retained tarball.

Older-runtime qualification

  • The driver's Swift runtime import audit verifies every CLI slice against the macOS 26.5 SDK runtime baseline (minimum macOS 15.0). It rejects unsupported strong runtime imports, including _swift_initBorrow, before packaging.
  • Before publication is confirmed, the packaged arm64, x86_64, and universal archives are independently audited against the same SDK's Swift runtime export lists (following re-exports), then launched with all Xcode, Command Line Tools, and cryptex toolchain paths denied.

Exact-source hosted validation

Coverage limits: no physical macOS 26 or macOS 15 machine ran the 4.9.1 bytes. SwiftLint reports existing non-serious violations; the hosted SwiftLint gate passes. The renamed-executable fix was proven with a copied binary and a real pb symlink running --version and see --help only, with no capture or input. Window tracking for newly launched applications is covered by AXorcist's monitor tests rather than live desktop proof.

Publication source: e060b6ba21792b327ce2a10368f57c8e569dc712. Publication requires successful completion of the linked exact-source workflows.

Contributors

rudycelekli and coygeek
Assets 13
Loading