chore(deps): update KeyboardShortcuts and Linux toolchains

[steipete]

Updates KeyboardShortcuts and the Linux toolchains while preserving the Swift 6.2/macOS 14 package floors.

KeyboardShortcuts 3.1.0 defers recorder cleanup, which could overwrite CodexBar's translated placeholder with “Record Shortcut” after editing ends. Observe placeholder writes and restore the selected app-language prompt, replacing the competing deferred task. Reattachment releases the prior recorder observation. The existing lifecycle test reproduces the regression; it and the new detached-recorder test now pass.

Dependency	Before → after
KeyboardShortcuts, both SwiftPM lockfiles	3.0.1 → 3.1.0
Linux release/static Swift toolchain and SDK	6.2.4 → 6.3.3
Linux desktop CI Node.js	22 → 26

The Swift static SDK checksum matches swift.org's published manifest, and its musl layout matches the existing build scripts. Xcode stays at 26.3 on macOS 15 release runners because that is their newest available Xcode; macOS CI already uses 26.6.

QuickJS stays at 0.15.1: all newer stable releases violate the enforced 2 MiB tracked-file limit (quickjs.c: 0.16.0 = 2,143,761 bytes; 0.16.1 = 2,143,873; 0.16.2 = 2,144,977). The attempted update was removed without changing the size check. Other stable dependencies, Sucrase, lint/typecheck tools, SQLite and Actions are current. No open Dependabot PRs overlap.

Recorder proof

Signed synthetic AppKit fixtures use the before/after coordinator source with KeyboardShortcuts 3.1.0 and a fixed Chinese translation. Both run the dependency's actual deferred end-editing callback and assert the resulting placeholder. These captures contain no account or desktop data.

Before	After

Validation

Validated head: 9d873edbffb4c6515b083646b78fb48bec24d620.

• swift package update and Xcode widget dependency resolution; both lockfiles agree exactly.
• Frozen build: swift build --force-resolved-versions -j 4 builds all products successfully.
• make check passes, including SwiftFormat and SwiftLint with zero violations in 2,276 files.
• Full make test passes all 1,132 selections across 104 groups: zero failed groups, retries, or timeouts.
• All five recorder tests pass, including the existing lifecycle regression and the new reattachment case.
• All 15 Omarchy integration tests pass under Node 26.8.2.
• Signed native AppKit fixtures run the real before/after coordinator and dependency cleanup, asserting the English regression before and the preserved Chinese prompt after.
• Built CLI --version, --help, config inspection and JSON usage pass with explicit disabled-provider fixture config and Keychain access suppressed. A foreground loopback server successfully serves /health, /usage, and dashboard HTML at /, then exits cleanly.
• Independent Codex autoreview of the complete corrected diff is scoped-clean through P2.

Exact-head GitHub proof:

• Full CI, both macOS test shards, glibc Linux on both architectures, musl and aggregate: https://github.com/steipete/CodexBar/actions/runs/34772133009
• Linux desktop and Omarchy on both architectures: https://github.com/steipete/CodexBar/actions/runs/34772133036
• Six-target release build/CLI smoke matrix in manual non-publishing mode: https://github.com/steipete/CodexBar/actions/runs/34772158107

The original dependency attempt exposed the recorder localization regression in CI and locally; this PR fixes it without removing or weakening tests. An earlier local PTY cleanup timeout passed on an unchanged 57-test focused rerun and in the complete clean run above. Local checks used system Bash after Homebrew Bash stalled in heredoc setup. No releases, tags, version bumps, or manual deployments were made.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 13, 2026, 1:43 PM ET / 17:43 UTC (Revision 4).

ClawSweeper review

What this changes

Updates KeyboardShortcuts and Linux build toolchains while preserving translated shortcut-recording prompts and adding recorder reattachment coverage.

Merge readiness

✅ Ready for maintainer review

This remains a useful dependency update beyond current main and v0.60.1. The recorder adjustment addresses the upstream lifecycle change, and no blocking correctness or security defect was found.

Priority: P3
Reviewed head: 9d873edbffb4c6515b083646b78fb48bec24d620

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, source-supported update with relevant native proof and regression coverage; unfinished routine checks do not lower patch quality.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): The inspected before-and-after AppKit captures, tied to the coordinator source and actual dependency cleanup callback, show the English overwrite replaced by the expected Chinese prompt; the owner-authored PR requires no additional external-contributor proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (screenshot): The inspected before-and-after AppKit captures, tied to the coordinator source and actual dependency cleanup callback, show the English overwrite replaced by the expected Chinese prompt; the owner-authored PR requires no additional external-contributor proof.
Evidence reviewed	8 items	Repository policy and review scope: Read the complete root AGENTS.md; no nested AGENTS.md or maintainer-notes directory was found. Applied focused-change, localization, concurrency, and safe-validation guidance. Builds and tests were not executed during this read-only review. Recorder implementation and regression coverage: The coordinator observes placeholder writes, avoids redundant assignments, and drops the prior observation before reattachment. Existing lifecycle coverage invokes the dependency’s end-editing callback; the added test checks that detached recorders are left alone. Direct dependency contract verified: The target imports RecorderCocoa and tests its callback directly. At the pinned dependency commit, controlTextDidEndEditing schedules main-actor cleanup, and endRecording writes the dependency-localized placeholder. Its package retains Swift tools 6.2, and the 3.1.0 annotated tag resolves to the pinned commit.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s settings wrap a native shortcut recorder and translate its prompts into the selected app language. Separate CI and release workflows use the pinned toolchains to build Linux desktop and CLI artifacts.

flowchart LR
  A[Selected app language] --> B[Recorder coordinator]
  C[Native recorder lifecycle] --> B
  B --> D[Localized shortcut prompt]
  E[Pinned build toolchains] --> F[Linux CI and release builds]
  F --> G[Desktop and CLI artifacts]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Recorder code and coverage	Production +20/-10 lines; tests +16/-0 lines	The small production increase replaces deferred-task ordering with observation and adds detached-recorder coverage.

Technical review

Best possible solution:

Keep the dependency upgrade paired with the localized-placeholder repair while retaining existing deployment floors and artifact verification.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the dependency refresh as a whole. The supplied native fixture demonstrates the upgrade-specific prompt regression and its repair; this review did not execute a current-main reproduction.

Is this the best way to solve the issue?

Yes. Observing subsequent placeholder writes directly addresses the dependency’s deferred cleanup without adding another competing task or changing stored shortcut preferences.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against caad1ca38c23.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The inspected before-and-after AppKit captures, tied to the coordinator source and actual dependency cleanup callback, show the English overwrite replaced by the expected Chinese prompt; the owner-authored PR requires no additional external-contributor proof.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The inspected before-and-after AppKit captures, tied to the coordinator source and actual dependency cleanup callback, show the English overwrite replaced by the expected Chinese prompt; the owner-authored PR requires no additional external-contributor proof.

Label justifications:

• P3: This is routine dependency maintenance with a bounded localization compatibility adjustment.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The inspected before-and-after AppKit captures, tied to the coordinator source and actual dependency cleanup callback, show the English overwrite replaced by the expected Chinese prompt; the owner-authored PR requires no additional external-contributor proof.
• proof: sufficient: Contributor real behavior proof is sufficient. The inspected before-and-after AppKit captures, tied to the coordinator source and actual dependency cleanup callback, show the English overwrite replaced by the expected Chinese prompt; the owner-authored PR requires no additional external-contributor proof.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The inspected before-and-after AppKit captures, tied to the coordinator source and actual dependency cleanup callback, show the English overwrite replaced by the expected Chinese prompt; the owner-authored PR requires no additional external-contributor proof.

Evidence

What I checked:

• Repository policy and review scope: Read the complete root AGENTS.md; no nested AGENTS.md or maintainer-notes directory was found. Applied focused-change, localization, concurrency, and safe-validation guidance. Builds and tests were not executed during this read-only review. (AGENTS.md:1, 9d873edbffb4)
• Recorder implementation and regression coverage: The coordinator observes placeholder writes, avoids redundant assignments, and drops the prior observation before reattachment. Existing lifecycle coverage invokes the dependency’s end-editing callback; the added test checks that detached recorders are left alone. (Sources/CodexBar/PreferencesComponents.swift:134, 9d873edbffb4)
• Direct dependency contract verified: The target imports RecorderCocoa and tests its callback directly. At the pinned dependency commit, controlTextDidEndEditing schedules main-actor cleanup, and endRecording writes the dependency-localized placeholder. Its package retains Swift tools 6.2, and the 3.1.0 annotated tag resolves to the pinned commit. (Sources/KeyboardShortcuts/RecorderCocoa.swift:336, 772133d9dbe8)
• Official static SDK checksum: The official Swift 6.3.3 release metadata lists static SDK 0.1.0 with checksum 87c3eaf908e67c0e13a84367119e12273cec1d2cd3d81f7d74bb36722d6b607b, matching both changed workflows. (_data/builds/swift_releases.yml:2863)
• Native before-and-after evidence inspected: Inspected both prepared images from the captured PR body, sourceRevision da6f306d162e2a5c016778edfa38981a67417abf44398350cf0a44098a9c0d99. The described signed AppKit fixtures use the coordinator source and actual KeyboardShortcuts 3.1.0 deferred callback; the before image displays the English idle prompt and the after image displays the expected Chinese prompt. This supports the visible localization result, not unrelated CLI behavior. (9d873edbffb4)
• Still distinct from main and the latest release: Both pinned current main and v0.60.1 retain KeyboardShortcuts 3.0.1. The merged build: refresh dependencies and pinned validation toolchains #3602 intentionally stopped at that version and older Linux toolchains, so it does not supersede this update. (Package.resolved:14, 0b79c8edec8b)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-13T17:07:40.022Z sha 65c28ad :: needs maintainer review before merge. :: none
• reviewed 2026-09-13T17:13:17.890Z sha c6bab21 :: needs maintainer review before merge. :: none
• reviewed 2026-09-13T17:20:33.262Z sha c6bab21 :: needs maintainer review before merge. :: none