[arwen96]

Part of #564, step 2 of 2. Stacked on #568 (the @Entry removal); this PR's base is that branch.

Why

In the macOS 27 SDK, SwiftUI's @State is a macro whose plugin ships only with Xcode, so the build refused every Mac without Xcode (assertFullXcodeToolchain). The Command Line Tools also ship the 26.5 SDK, where @State is still a property wrapper. With #568, the whole app builds against it.

What

• src/utils/macos/xcode.ts: resolveAppBuildSdk() returns one of:

  • { kind: "xcode" }: Xcode's own SDK, as before.
  • { kind: "command-line-tools", sdkRoot }: the newest versioned CLT SDK whose SwiftUI type-checks a one-view @State probe (xcrun swiftc -typecheck -sdk … -target <arch>-apple-macos14.0, ~1.2 s once).
  • { kind: "unsupported", toolchain }.

  The probe answer is cached per SDK in ~/.genesis-tools/app/sdk-probe.json, keyed by the SDK's SDKSettings.json time (3 ms after that). Symlinked (MacOSX27.sdk) and unversioned (MacOSX.sdk) names are skipped.

• app.ts: assertFullXcodeToolchain → requireAppBuildSdk(resolveAppBuildSdk()). It passes SDKROOT to swift build, and to the icon generator when it runs, and keeps the same Xcode hint when nothing can build.

• src/update/index.ts: an already-installed app is rebuilt on the CLT too, and skipped only when no SDK can build it.

• Tests: requireAppBuildSdk replaces the assertFullXcodeToolchain cases. New resolveAppBuildSdk and sdkVersion cases cover newest-first choice, all failing, no toolchain, and the symlink names.

Not changed on purpose (decisions for #564, see the issue)

• build-offer.ts (the automatic "build GenesisTools.app?" offer) still offers only with full Xcode.
• genesisAppBuildHint() still tells CLT users to install Xcode.

Both depend on the signing decision: without an Apple certificate a CLT build is ad-hoc, so macOS forgets the grants on every rebuild.

Verified (CLT only, Swift 6.4, no Xcode)

• Real probe on this Mac: {"kind":"command-line-tools","sdkRoot":".../MacOSX26.5.sdk"} in 1159 ms (27.0 → ok: false, 26.5 → ok: true), then 3 ms from the cache.
• Unmodified ./tools macos permissions build from this branch (no env tricks, GENESIS_TOOLS_HOME = a scratch home): exit 0 in 37 s. Every step ran (swift build 33.1 s, bundle, ad-hoc codesign, install, Launch Services). codesign --verify --deep --strict passes, and --version → 1.0. The scratch app was unregistered and removed.
• bun run test src/utils/macos/xcode.test.ts src/macos/lib/permissions/app.test.ts: 110 pass. lint-rules OK, Biome clean, and the pre-commit tsc passes.
• Not verified: the full Xcode path (no Xcode here). It is unchanged code: sdkRoot is unset for kind: "xcode".

🤖 Generated with Claude Code

[eve-bot-lovinka]

🐉 eve review — ✅ APPROVE · 0 findings

→ review · run

• Queued 05:04:29Z
• Reading diff — 130 files
• Building repo map
• Analyzing (find → verify) — 0 candidates → 0 survivors · reviewed by codex/gpt-6.1-sol + codex/gpt-6-luna
• Posting review
• Review posted 05:08:26Z (3m 57s)

_{run wrun_01M5V9H5RFP90B57GAZPDP73FP}

Previous runs (10)

run	head	outcome	findings	took
11	d9f371f	✅ APPROVE	0	5m 13s
10	91ff377	✅ APPROVE	0	5m 45s
9	452be55	✅ APPROVE	1	9m 39s
8	fcbf37c	✅ APPROVE	2	10m 42s
7	0a05bff	💬 COMMENT	2	17m 40s
7	0a05bff	🔁 deduped (run wrun_01M owns it)	—	—
6	5436633	⏭️ superseded	—	8m 49s
6	5436633	🔁 deduped (run wrun_01M owns it)	—	—
5	0af7157	⏭️ superseded	—	11m 22s
4	0af7157	⏳ refused	—	2m 29s

[coderabbitai]

Warning

Review limit reached

This review ran on the open-source allowance, not this organization's plan, because the pull request author doesn't have an assigned seat. Waiting won't change this — ask an organization admin to assign them a seat, or add seats in Billing if every seat is already assigned, then retry.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: genesiscz/GenesisTools
• Branch: fix/2026-10-25-app-build-command-line-tools-sdk
• File: .coderabbit.yaml
• Commit: c4513cc
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 69c85259-f5b7-48f8-8c4a-9524e134cc55

Commits

Reviewing files that changed from the base of the PR and between 0fa28de and c4513cc.

Files selected for processing: 5

• src/macos/lib/permissions/app.test.ts
• src/macos/lib/permissions/app.ts
• src/update/index.ts
• src/utils/macos/xcode.test.ts
• src/utils/macos/xcode.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[eve-bot-lovinka]

🐉 eve review — 🟡 Review comments

5406754 · 2 actionable findings · reviewed by find codex/gpt-6.1-sol + codex/gpt-6-luna, verify codex/gpt-6-luna · view run ↗

Severity	Count
🟡 Medium	2

ℹ️ Claims vs diff — Claim c5 'The automatic app-build offer still requires full Xcode, and genesisAppBuildHint() stil…' is not supported: src/utils/macos/xcode.ts and src/update/index.ts change, contradicting the claim that the hint and automatic-offer areas are unchanged.
7 claims could not be checked from the diff (c1, c2, c3, c4, c6, c7, c8).

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

65180da · 0 actionable findings · reviewed by find codex/gpt-6.1-sol + codex/gpt-6-luna, verify codex/gpt-6-luna · view run ↗

[genesiscz]

Review fixes 2026-10-26 02:23 from GPT-6.1 Sol judged by Claude Opus 5.5 (fable-judge)

Round 1. 2 open threads (eve 2, CodeRabbit 0). Full PR diff and affected callers reviewed; no additional defect found. Fixed in 32c574c; the lead ran the tests and committed.

Bound the Swift SDK probe and allow retry after timeout (eve-bot-lovinka)

• Context: The synchronous compiler probe could stall before the build's streaming timeout began, blocking update preflight or holding the app build lock indefinitely. The reviewer labels this Medium.
• Commit(s): 32c574ccb
• Verdict: accepted
• Code before:

  const proc = Bun.spawnSync(
      ["xcrun", "swiftc", "-typecheck", "-sdk", sdkRoot, "-target", `${arch}-apple-macos14.0`, probeFile],
      { stdout: "pipe", stderr: "pipe" }
  );
  const ok = proc.exitCode === 0;

• Code after:

  const proc = spawnSync(
      "xcrun",
      ["swiftc", "-typecheck", "-sdk", sdkRoot, "-target", `${arch}-apple-macos14.0`, "-"],
      { input: STATE_PROBE, timeout: 30_000, killSignal: "SIGKILL", stdio: "pipe" }
  );

• How was this fixed: Use node:child_process.spawnSync with a 30-second deadline and SIGKILL. Failed launches, signal termination and timeout return false with a warning and are not persisted as SDK incompatibility, so a later run can retry. Added regression coverage in the existing xcode.test.ts for the deadline options and timeout followed by success, alongside completed-probe positive and negative controls. Verification:.
• Confidence: 90%

Make SDK probe cache reads and writes optional (eve-bot-lovinka)

• Context: Valid JSON null and invalid cache-entry shapes could throw or bypass the actual compiler result. Cache directory creation, probe-source writes and persistence failures could escape the SDK resolver and abort the rest of an update. The reviewer labels this Medium.
• Commit(s): 32c574ccb
• Verdict: accepted
• Code before:

  cache = existsSync(cacheFile) ? SafeJSON.parse(readFileSync(cacheFile, "utf8"), { strict: true }) : {};
  const hit = cache[sdkRoot];
  // ...
  mkdirSync(dirname(probeFile), { recursive: true });
  writeFileSync(probeFile, STATE_PROBE);
  // ...
  writeFileSync(cacheFile, SafeJSON.stringify(cache, null, 2));

• Code after:

  try {
      mkdirSync(dirname(cacheFile), { recursive: true });
      writeFileSync(cacheFile, SafeJSON.stringify(cache, null, 2));
  } catch (error) {
      logger.debug({ error, cacheFile }, "sdk probe cache unwritable; using probe result");
  }
  return ok;

• How was this fixed: Validate the parsed cache as an object, copy only entries containing a string stamp and boolean ok, and treat malformed data as a miss. Pass the Swift source over stdin, eliminating the probe-file and directory writes before compilation. Make cache directory creation and persistence best effort after compilation and return the actual compatibility result even when persistence fails. Extended the existing xcode.test.ts with malformed JSON and null/array/scalar/invalid-entry cases, valid true/false cache hits, and blocked parent/cache paths. No files outside the original PR diff were needed. Verification:.
• Confidence: 90%

_{Threads: t1 accepted · t2 accepted}

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

32c574c · 0 actionable findings · reviewed by codex/gpt-6.1-sol · view run ↗

Blast radius

• resolveAppBuildSdk (+) → 4 dependent(s) outside this PR: src/update/index.ts, src/macos/lib/permissions/app.ts
• AppBuildSdk (+) → 2 dependent(s) outside this PR: src/macos/lib/permissions/app.ts

[eve-bot-lovinka]

🐉 eve review — 🟡 Review comments

0a05bff · 2 actionable findings · ⚠️ degraded pass · reviewed by find codex/gpt-6.1-sol + codex/gpt-6-luna, verify codex/gpt-6-luna · view run ↗

Severity	Count
🟡 Medium	2

⚠️ Degraded pass — this review did not run at full strength; treat the verdict as partial.

• 277 changed patch(es) were omitted by the diff budget.

ℹ️ This pass reviewed the full PR diff: the incremental delta since 32c574cc was unusable after a base-branch merge saturated GitHub's compare API (300+ files, 0 of them merge noise, list truncated).

Blast radius

• AgentSessionRow (Δsig) → 10 dependent(s) outside this PR: src/question/lib/inbox/load.ts, src/hub/lib/agents/index.ts, src/hub/lib/widget/roster-index.ts, +2 more
• has (+) → 10 dependent(s) outside this PR: native/ax-tool/Fixtures/ControlFixture.swift, native/ax-tool/Tests/PermissionRefusalTests.swift, native/ax-tool/Tests/SnapshotSupportTests.swift, +7 more
• apply (+) → 9 dependent(s) outside this PR: native/ax-tool/Sources/SnapshotWorkflow.swift, native/ax-tool/SnapshotSupport/ContextMenu.swift, native/ax-tool/SnapshotSupport/VisualCapture.swift, +6 more
• play (+) → 9 dependent(s) outside this PR: src/macos/GenesisTools/Sources/Parts/Hub/Hub/HubTimeline.swift, src/macos/GenesisTools/Sources/Host/App/Views.swift, src/macos/GenesisKit/Tests/GenesisKitTests/NativeSettingsRowsTests.swift, +6 more
• Request (+) → 9 dependent(s) outside this PR: src/macos/GenesisTools/Tests/HubLogicTests.swift, src/macos/GenesisTools/Sources/Parts/Hub/Hub/HubWindow.swift, src/macos/GenesisTools/Sources/Parts/Hub/Hub/HubMainMenu.swift, +6 more
• scrollOverflowContent (−) → 8 dependent(s) outside this PR: src/macos/GenesisTools/Sources/Parts/Hub/Hub/HubDigest.swift, src/macos/GenesisTools/Sources/Parts/Hub/Hub/HubWorktrees.swift, src/macos/GenesisKit/Sources/GenesisKit/Media/ImageViewerView.swift, +5 more
• ChartJs (~) → 7 dependent(s) outside this PR: src/artifact/runtime/kit/chartjs.test.tsx, src/artifact/runtime/kit/index.ts, src/artifact/gallery/charts.tsx, +1 more
• cmux (+) → 7 dependent(s) outside this PR: native/ax-tool/Tests/SnapshotSupportTests.swift, native/ax-tool/Sources/CursorOverlay.swift, native/ax-tool/SnapshotSupport/CursorFeedback.swift, +4 more
• codexDriver (~) → 7 dependent(s) outside this PR: src/codex/lib/message-delivery.ts, src/codex/commands/queue.ts, src/codex/lib/spec.ts
• +30 more changed symbol(s) with outside dependents
• 82 compiler diagnostic(s) on the PR head touch this diff (graph truncated)

ℹ️ Claims vs diff — 8 claims could not be checked from the diff (c1, c2, c3, c4, c5, c6, c7, c8).

The following findings could not be anchored inline (the diff line was not resolvable):

• src/control/commands/capture-session.ts:221 — 🧹 Quality | 🟡 Medium · confidence 98/100

⚠️ Potential issue

End the headless session when its final save attempt fails

EOF and host loss enqueue stop, then this command waits on active.finished. However, RecordingSession.finish() handles a save failure by returning to paused without settling finished, to allow an interactive retry. After EOF there can be no further stdin commands, and after host loss there is no UI to retry or discard. For example, --output pointing into a nonexistent directory leaves the CLI alive indefinitely after its host exits (with its ticker still installed). Preserve the segments, but provide an explicit terminal failed outcome for a headless save failure, rather than waiting forever for an impossible retry. This also violates the project rule requiring every wait to have a deadline and expiry outcome.

🧩 Analysis

Grep evidence: onEnd: \(\) => void active.command|await active.finished|The recording could not be saved|setState\("paused", "recorder"\)

- **src/du/lib/index/volume.ts:46** — ⚡ Performance | 🟡 Medium · confidence 90/100

⚠️ Potential issue

Bound the synchronous volume identity subprocesses

Both df and diskutil are invoked synchronously without a timeout. volumeUuidAt() now runs during every index build and during moved-fsid updates; diskutil can wait on an unresponsive disk-management service, and df can wait on an unavailable mount. Either case blocks the Bun event loop indefinitely, including cancellation handling. The project review rule says every wait must have a deadline and expiry outcome. Give both subprocesses bounded execution and return the existing unknown-UUID fallback with a diagnostic on timeout.

🧩 Analysis

Grep evidence: Bun.spawnSync\(\["/bin/df"|Bun.spawnSync\(\["/usr/sbin/diskutil"

[eve-bot-lovinka]

🐉 eve review — 🟡 Review comments

fcbf37c · 2 actionable findings · reviewed by find codex/gpt-6.1-sol + codex/gpt-6-luna, verify codex/gpt-6-luna · view run ↗

Severity	Count
🟡 Medium	1
🔵 Low	1

ℹ️ This pass reviewed the full PR diff: the incremental delta since 32c574cc was unusable after a base-branch merge saturated GitHub's compare API (300+ files, 300 of them merge noise, list truncated).

ℹ️ Claims vs diff — Claim c5 'The automatic app-build offer still requires full Xcode, and genesisAppBuildHint() stil…' is not supported: The no-change claim concerns app-build offers and hints, while src/macos/lib/permissions/app.ts and src/utils/macos/xcode.ts changed.
7 claims could not be checked from the diff (c1, c2, c3, c4, c6, c7, c8).

[genesiscz]

Review fixes 2026-10-26 04:28 from GPT-6.1 Sol judged by Claude Opus 5.5 (fable-judge)

Round 2 at fcbf37c. Historical review-body findings on older heads were not reopened. Checks and the commit are left to the lead at integration. Fixed in 452be55; the lead ran the tests and committed.

Contain SDK discovery exceptions before they abort optional update rebuilds (eve-bot-lovinka)

• Context: The update preflight invokes resolveAppBuildSdk outside the rebuild error handler. Directory reads, lstat and SDKSettings.json stat can throw, allowing an optional rebuild to reject updateAfterPull and skip later update steps. The reviewer labels this Medium.
• Commit(s): 452be55f4
• Verdict: accepted
• Code before:

  const sdks = (options?.listSdks ?? listCommandLineToolsSdks)(toolchain.developerDir);
  const probe = options?.probe ?? swiftUiStateIsPlainWrapper;
  const sdkRoot = sdks.find((sdk) => probe(sdk));
  result = sdkRoot ? { kind: "command-line-tools", sdkRoot } : { kind: "unsupported", toolchain };

• Code after:

  } catch (error) {
      logger.warn({ error, toolchain }, "app build SDK discovery failed; retry on next run");
      return { kind: "unsupported", toolchain };
  }

• How was this fixed: Handle discovery errors at their shared source in resolveAppBuildSdk: the directory listing and every SDK probe are inside a try/catch. An exception logs its cause and returns unsupported without caching that transient failure. The existing update preflight therefore skips the optional rebuild and continues with later update steps; direct builds still receive the normal refusal. Changed the shared resolver and its existing test file rather than patching each caller. Added tests for listing and probing exceptions, successful discovery after a failure, and an actual ENOTDIR directory-read error. Verification:.
• Confidence: 95%

Use named subprocess execution options (eve-bot-lovinka)

• Context: The expanded run helper has three positional arguments, two optional, contrary to the project rule requiring an options object. Icon generation depends on callers preserving the ordering of cwd and extraEnv. The reviewer labels this Low.
• Commit(s): 452be55f4
• Verdict: accepted
• Code before:

  const icon = run(
      ["swift", join(APP_SOURCE_DIR, ICON_GENERATOR)],
      APP_SOURCE_DIR,
      sdkRoot ? { SDKROOT: sdkRoot } : undefined
  );

• Code after:

  const icon = run({
      cmd: ["swift", join(APP_SOURCE_DIR, ICON_GENERATOR)],
      cwd: APP_SOURCE_DIR,
      extraEnv: sdkRoot ? { SDKROOT: sdkRoot } : undefined,
  });

• How was this fixed: Converted the private run helper to a single object containing cmd, cwd and extraEnv and converted all eight callers, including signing, chmod and Launch Services operations. The command, working directory, environment merging and result handling retain their existing behavior. No behavioral test was added for this mechanical signature conversion; the existing app tests remain available for integration. Verification:.
• Confidence: 95%

_{Threads: t1 accepted · t2 accepted}

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

452be55 · 1 actionable finding · reviewed by find codex/gpt-6.1-sol + codex/gpt-6-luna, verify codex/gpt-6-luna · view run ↗

Severity	Count
🔵 Low	1

[genesiscz]

Review fixes 2026-10-26 04:49 from GPT-6.1 Sol judged by Claude Opus 5.5 (fable-judge)

Round 3 at 452be55. 1 unresolved Eve thread, fixed as a cheap test-only change under the round policy. Fixed in 91ff377; the lead ran the tests and committed.

Exercise filesystem SDK discovery ordering and symlink exclusion (eve-bot-lovinka)

• Context: The existing selection test injects a preordered list, while sdkVersion tests only name parsing. Neither exercises real discovery, so reversed numeric ordering or removal of the lstat symlink guard would escape those assertions. The reviewer labels this Low.
• Commit(s): 91ff3775b
• Verdict: accepted
• Code before:

  const sdk = resolveAppBuildSdk({
      toolchain: clt,
      listSdks: sdks,
      probe: (sdkRoot) => {
          probed.push(sdkRoot);
          return sdkRoot.endsWith("MacOSX26.5.sdk");
      },
  });

• Code after:

  symlinkSync(join(sdkDir, names[0]), join(sdkDir, "MacOSX99.0.sdk"), "dir");
  
  expect(listCommandLineToolsSdks(developerDir)).toEqual(
      ["MacOSX27.0.sdk", "MacOSX26.10.sdk", "MacOSX26.9.sdk"].map((name) => join(sdkDir, name))
  );

• How was this fixed: Added one test in the existing xcode.test.ts file, retaining the injected resolver test. The fixture creates SDK directories in an unsorted order, including 26.9, 26.10 and 27.0, unversioned and major-only names, plus a versioned 99.0 symlink to a real SDK directory. It calls listCommandLineToolsSdks directly and asserts the complete result: 27.0, 26.10, 26.9, with every alias excluded. The test is designed to fail if sorting is reversed, minor versions are compared lexically, or the symlink guard is removed. This is a cheap test-only fix under round 3 policy. Verification:.
• Confidence: 95%

_{Threads: t1 accepted}

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

91ff377 · 0 actionable findings · reviewed by codex/gpt-6.1-sol + codex/gpt-6-luna · view run ↗

ℹ️ Claims vs diff — Claim c5 'The automatic app-build offer still requires full Xcode, and genesisAppBuildHint() still …' is not supported: src/utils/macos/xcode.ts changes genesisAppBuildHint, contradicting the claim that this area is unchanged.
7 claims could not be checked from the diff (c1, c2, c3, c4, c6, c7, c8).

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

d9f371f · 0 actionable findings · reviewed by codex/gpt-6.1-sol + codex/gpt-6-luna · view run ↗

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

c4513cc · 0 actionable findings · reviewed by codex/gpt-6.1-sol + codex/gpt-6-luna · view run ↗

ℹ️ Claims vs diff — Claim c5 'The automatic app-build offer still requires full Xcode, and genesisAppBuildHint() stil…' is not supported: src/utils/macos/xcode.ts adds genesisAppBuildHint(), contradicting the claim that this area is unchanged.
7 claims could not be checked from the diff (c1, c2, c3, c4, c6, c7, c8).