CLI: `codexbar` prints ungated `[codex notify]` debug lines to stderr

[urda]

Running any codexbar command that probes Codex prints this to stderr:

[codex notify] remoteControl/status/changed

It comes from debugWriteStderr in Sources/CodexBarCore/UsageFetcher.swift:848, which despite the name has no debug gate. It fires on every JSON-RPC notification (line 995) and every child stderr line (line 946).

Harmless (the branch continues, stdout is untouched), just noisy.

Fix: route both to Self.log.debug. The CLI already defaults to log level .error with a stderr destination (CLIEntry.swift:416-421), so the lines would disappear by default and return under --verbose. That also drops the #if !os(Linux) compile guard and routes untrusted child stderr through LogRedactor.

CodexBar 0.50.0, Codex CLI 0.147.0, macOS 26.6.1.

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed August 15, 2026, 5:12 AM ET / 09:12 UTC.

Summary
Keep open and route as a narrow repair: current main still writes Codex RPC notifications and child stderr directly to stderr, bypassing the CLI’s normal error-level default and log redaction path.

Reproducibility: yes. —source inspection gives a high-confidence path: any Codex app-server notification reaches the unconditional stderr helper, while the CLI’s normal default log level is .error. A repair worker should establish the failing regression with the existing stub app-server harness rather than a live account.

Next step
Current source proves an ungated stderr path, and the existing stubbed Codex app-server tests provide a bounded regression harness.

Review details

Best possible solution:

Use the existing Codex RPC logger for both diagnostic paths and add a stubbed app-server regression test proving default CLI output stays clean while debug logging remains available.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection gives a high-confidence path: any Codex app-server notification reaches the unconditional stderr helper, while the CLI’s normal default log level is .error. A repair worker should establish the failing regression with the existing stub app-server harness rather than a live account.

Is this the best way to solve the issue?

Yes—the requested reuse of Self.log.debug is the narrowest maintainable repair because it honors CLI verbosity and applies the established redaction pipeline without adding configuration.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f15f142a7787.

Label changes

Label changes:

• add P2: This is a source-proven CLI output defect with limited blast radius and a focused repair path.
• add impact:ux-friction: Unexpected diagnostic lines on ordinary CLI stderr create avoidable confusion and interfere with clean command output workflows.
• add issue-rating: 🦞 diamond lobster: Current issue advisory state selects this label.
• add clawsweeper:source-repro: Current issue advisory state selects this label.
• add clawsweeper:queueable-fix: Current issue advisory state selects this label.
• add clawsweeper:fix-shape-clear: Current issue advisory state selects this label.

Label justifications:

• P2: This is a source-proven CLI output defect with limited blast radius and a focused repair path.
• impact:ux-friction: Unexpected diagnostic lines on ordinary CLI stderr create avoidable confusion and interfere with clean command output workflows.

Evidence reviewed

Acceptance criteria:

• swift test --filter CodexBaselineCharacterizationTests
• swift test --filter CLIArgumentParsingTests
• make check
• make test

What I checked:

• Current source bypasses log gating: The RPC client calls a helper that invokes fputs on the parent stderr; that helper is used for every decoded child stderr line and every JSON-RPC notification. (Sources/CodexBarCore/UsageFetcher.swift:848, f15f142a7787)
• CLI default is error-only logging: CLI logging defaults to .error unless --verbose is present, so replacing direct writes with Self.log.debug has the requested default-silent and verbose-visible behavior. (Sources/CodexBarCLI/CLIEntry.swift:411, f15f142a7787)
• Logger redacts messages before delivery: The standard logger runs messages and metadata through LogRedactor, while the direct fputs helper does not. (Sources/CodexBarCore/Logging/CodexBarLog.swift:112, f15f142a7787)
• Focused test seam exists: The Codex baseline suite already launches a stub app-server through the production usage-fetcher boundary, providing a safe place to inject a notification and stderr line without probing a real account. (Tests/CodexBarTests/CodexBaselineCharacterizationTests.swift:240, f15f142a7787)
• History and release check: Blame attributes the current direct-write lines to the v0.50.0 tree commit; current main is one changelog-only commit ahead, and the current source path has no diff from v0.50.0. (Sources/CodexBarCore/UsageFetcher.swift:995, 0e453c4a5b2a)
• Vision fit: VISION.md explicitly lists clear, bounded bug fixes under “Merge by Default,” and this changes neither provider data nor the CLI’s public output contract except to restore its existing logging gate. (VISION.md:5, f15f142a7787)

Likely related people:

• Peter Steinberger: Blame and line history attribute the current RPC stderr and notification handling, as well as the adjacent CLI logging configuration, to the v0.50.0 tree commit; the feature history available locally is otherwise shallow. (role: current implementation and release-tree author; confidence: high; commits: 0e453c4a5b2a; files: Sources/CodexBarCore/UsageFetcher.swift, Sources/CodexBarCLI/CLIEntry.swift)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.