Harden Vifty safety, diagnostics, and UI evidence

.gitignore

@@ -16,6 +16,7 @@ Package.resolved
 
 # Local agent workflow scratch
 .superpowers/
+.worktrees/
 
 # Machine-local native UI capture ledger (portable checkpoint is tracked separately)
 docs/ui-review/evidence-manifest.local.json

Makefile

@@ -18,6 +18,7 @@ RELEASE_SWIFT_PLATFORM_DIR ?= $(RELEASE_ARCHITECTURE)-apple-macosx
 SWIFT_TRIPLE_ARGS = $(if $(filter release,$(CONFIGURATION)),--triple "$(RELEASE_SWIFT_TRIPLE)",)
 SWIFT_PROVENANCE_ARGS = $(if $(SWIFT_BUILD_PROVENANCE_FILE),-Xlinker -sectcreate -Xlinker __TEXT -Xlinker __vifty_src -Xlinker "$(SWIFT_BUILD_PROVENANCE_FILE)",)
 SWIFT_BUILD_ARGS = $(if $(SWIFT_BUILD_PATH),--build-path "$(SWIFT_BUILD_PATH)",) $(SWIFT_TRIPLE_ARGS) $(SWIFT_PROVENANCE_ARGS) $(SWIFT_BUILD_EXTRA_ARGS)
+SWIFT_TEST_WARNING_ARGS = -Xswiftc -warnings-as-errors
 # SwiftPM's product layout is toolchain-dependent (for example, Xcode 26
 # places release products under .build/out/Products/Release). Ask SwiftPM for
 # the path it actually selected, while preserving explicit caller overrides.
@@ -264,10 +265,10 @@ source-first-readiness: ## Check published source-first release readiness
 test: test-full ## Run the full XCTest suite
 
 test-fast: check-toolchain ## Run the fast local XCTest suite
-	swift test $(SWIFT_BUILD_ARGS) $(SLOW_TEST_SKIP_ARGS)
+	swift test $(SWIFT_BUILD_ARGS) $(SLOW_TEST_SKIP_ARGS) $(SWIFT_TEST_WARNING_ARGS)
 
 test-full: check-toolchain ## Run the full XCTest suite, including slow evidence/release script tests
-	swift test $(SWIFT_BUILD_ARGS)
+	swift test $(SWIFT_BUILD_ARGS) $(SWIFT_TEST_WARNING_ARGS)
 
 verify: check-toolchain ## Run fast local trust gates without installing
 	/bin/bash -n scripts/*.sh scripts/lib/*.sh examples/viftyctl/*.sh

Sources/Vifty/AppModel+Control.swift

@@ -461,6 +461,16 @@ extension AppModel {
         }
     }
 
+    var agentAuditPersistenceMessage: String? {
+        guard let health = agentControlStatus?.persistenceHealth,
+              !health.auditStatusAvailable else { return nil }
+        let detail = health.auditError?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        guard !detail.isEmpty else {
+            return "Agent audit history unavailable; cooling control is unchanged."
+        }
+        return "Agent audit history unavailable; cooling control is unchanged. " + detail
+    }
+
     func setAgentCoolingEnabled(_ enabled: Bool) async {
         do {
             guard let status = try await agentPolicySetter(enabled) else { return }

Sources/Vifty/AppModel+MenuBar.swift

@@ -175,7 +175,7 @@ extension AppModel {
     }
 
     func persistAppPreferences() {
-        preferencesStore.save(AppPreferences(
+        let preferences = AppPreferences(
             menuBarDisplayMode: menuBarDisplayMode,
             menuBarCustomFields: menuBarCustomFields,
             startupMode: startupMode,
@@ -184,7 +184,17 @@ extension AppModel {
             usePerFanFixedRPM: usePerFanFixedRPM,
             fixedFanTargets: fixedFanTargets,
             codexUsageDisplayPreferences: codexUsageDisplayPreferences
-        ))
+        )
+        do {
+            try preferencesStore.saveThrowing(preferences)
+            appPreferencesPersistenceMessage = nil
+        } catch {
+            appPreferencesPersistenceMessage = "Settings were not saved: \(error.localizedDescription)"
+        }
+    }
+
+    func retryAppPreferencesSave() {
+        persistAppPreferences()
     }
 
     var codexUsageDisplayPreferences: CodexUsageDisplayPreferences {

Sources/Vifty/AppModel.swift

@@ -30,6 +30,8 @@ final class AppModel: ObservableObject {
     }
     @Published var lastError: String?
     @Published var curveProfilePersistenceError: String?
+    @Published var appPreferencesPersistenceMessage: String?
+    @Published var appPreferencesRecoveryMessage: String?
     @Published var fanAccessMessage: String?
     @Published var daemonResponding = false
     @Published var daemonReachable = false
@@ -318,7 +320,15 @@ final class AppModel: ObservableObject {
         self.agentRestore = agentRestore
         self.profileStore = profileStore
         self.preferencesStore = preferencesStore
-        let appPreferences = self.preferencesStore.load()
+        let appPreferences: AppPreferences
+        do {
+            let result = try self.preferencesStore.loadResult()
+            appPreferences = result.preferences
+            appPreferencesRecoveryMessage = result.recoveryMessage
+        } catch {
+            appPreferences = self.preferencesStore.load()
+            appPreferencesPersistenceMessage = "Settings were not saved: \(error.localizedDescription)"
+        }
         menuBarDisplayMode = appPreferences.menuBarDisplayMode
         menuBarCustomFields = MenuBarField.normalized(appPreferences.menuBarCustomFields)
         startupMode = appPreferences.startupMode

Sources/Vifty/AppPreferencesStore.swift

@@ -59,6 +59,11 @@ struct AppPreferences: Codable, Equatable {
     }
 }
 
+struct AppPreferencesLoadResult: Equatable {
+    var preferences: AppPreferences
+    var recoveryMessage: String?
+}
+
 final class AppPreferencesStore: @unchecked Sendable {
     static let legacyMenuBarDisplayModeDefaultsKey = "menuBarDisplayMode"
     static let legacyNotificationHelperFailureDefaultsKey = "notification.helperFailure"
@@ -76,38 +81,132 @@ final class AppPreferencesStore: @unchecked Sendable {
     }
 
     func load() -> AppPreferences {
-        if let data = try? Data(contentsOf: url),
-           let preferences = try? JSONDecoder().decode(AppPreferences.self, from: data) {
-            return preferences
-        }
+        (try? loadResult().preferences) ?? migratedPreferences()
+    }
 
-        // Preserve the unreadable original before any overwrite so a decode
-        // failure never silently destroys the last recoverable copy.
-        if FileManager.default.fileExists(atPath: url.path) {
-            let backup = url.appendingPathExtension("bak")
-            try? FileManager.default.removeItem(at: backup)
-            try? FileManager.default.copyItem(at: url, to: backup)
+    func loadResult() throws -> AppPreferencesLoadResult {
+        let primary = decodePreferences(at: url)
+        switch primary {
+        case .success(let preferences):
+            try restrictDirectoryPermissions()
+            try restrictFilePermissions(at: url)
+            if case .success = decodePreferences(at: backupURL) {
+                try restrictFilePermissions(at: backupURL)
+            }
+            return AppPreferencesLoadResult(preferences: preferences, recoveryMessage: nil)
+        case .missing, .failure:
+            break
         }
 
-        let migrated = migratedPreferences()
-        if migrated != .defaults {
-            try? saveThrowing(migrated)
+        let backup = decodePreferences(at: backupURL)
+        switch backup {
+        case .success(let preferences):
+            try restrictDirectoryPermissions()
+            try restrictFilePermissions(at: backupURL)
+            if case .failure = primary {
+                quarantinePrimaryIfPossible()
+            }
+            return AppPreferencesLoadResult(
+                preferences: preferences,
+                recoveryMessage: "Vifty loaded its private app-preferences backup."
+            )
+        case .missing, .failure:
+            let migrated = migratedPreferences()
+            if migrated != .defaults {
+                try saveThrowing(migrated)
+            }
+            let recoveryMessage: String?
+            switch (primary, backup) {
+            case (.failure, _), (_, .failure):
+                recoveryMessage = "Vifty could not recover its private app preferences; defaults are in use."
+            default:
+                recoveryMessage = nil
+            }
+            return AppPreferencesLoadResult(preferences: migrated, recoveryMessage: recoveryMessage)
         }
-        return migrated
-    }
-
-    func save(_ preferences: AppPreferences) {
-        try? saveThrowing(preferences)
     }
 
     func saveThrowing(_ preferences: AppPreferences) throws {
         let directory = url.deletingLastPathComponent()
         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
         try FileManager.default.setAttributes([.posixPermissions: NSNumber(value: 0o700)], ofItemAtPath: directory.path)
 
+        if case .success = decodePreferences(at: url) {
+            let primaryData = try Data(contentsOf: url)
+            try replaceBackup(with: primaryData)
+        }
+
         let data = try JSONEncoder().encode(preferences)
         try data.write(to: url, options: .atomic)
         try restrictFilePermissions(at: url)
+
+        if case .success = decodePreferences(at: backupURL) {
+            try restrictFilePermissions(at: backupURL)
+        } else {
+            try replaceBackup(with: data)
+        }
+    }
+
+    private var backupURL: URL {
+        url.appendingPathExtension("bak")
+    }
+
+    private enum DecodeResult {
+        case success(AppPreferences)
+        case missing
+        case failure
+    }
+
+    private func decodePreferences(at fileURL: URL) -> DecodeResult {
+        guard FileManager.default.fileExists(atPath: fileURL.path) else { return .missing }
+        do {
+            return .success(try JSONDecoder().decode(AppPreferences.self, from: Data(contentsOf: fileURL)))
+        } catch {
+            return .failure
+        }
+    }
+
+    private func replaceBackup(with data: Data) throws {
+        let temporaryURL = backupURL.deletingLastPathComponent().appendingPathComponent(
+            ".\(backupURL.lastPathComponent).\(UUID().uuidString).tmp"
+        )
+        do {
+            try data.write(to: temporaryURL, options: .withoutOverwriting)
+            try restrictFilePermissions(at: temporaryURL)
+            if FileManager.default.fileExists(atPath: backupURL.path) {
+                _ = try FileManager.default.replaceItemAt(
+                    backupURL,
+                    withItemAt: temporaryURL,
+                    backupItemName: nil,
+                    options: []
+                )
+            } else {
+                try FileManager.default.moveItem(at: temporaryURL, to: backupURL)
+            }
+            try restrictFilePermissions(at: backupURL)
+        } catch {
+            try? FileManager.default.removeItem(at: temporaryURL)
+            throw error
+        }
+    }
+
+    private func quarantinePrimaryIfPossible() {
+        let quarantineURL = url.deletingLastPathComponent().appendingPathComponent(
+            ".\(url.lastPathComponent).corrupt.\(UUID().uuidString)"
+        )
+        do {
+            try FileManager.default.moveItem(at: url, to: quarantineURL)
+            try restrictFilePermissions(at: quarantineURL)
+        } catch {
+            // Recovery from a valid backup must not depend on quarantine I/O.
+        }
+    }
+
+    private func restrictDirectoryPermissions() throws {
+        try FileManager.default.setAttributes(
+            [.posixPermissions: NSNumber(value: 0o700)],
+            ofItemAtPath: url.deletingLastPathComponent().path
+        )
     }
 
     private func migratedPreferences() -> AppPreferences {

Sources/Vifty/DaemonInstallService.swift

@@ -24,6 +24,20 @@ struct DaemonInstallProcessOutput: Equatable, Sendable {
     var standardError: String
 }
 
+private actor BoundedProcessOutput {
+    static let maximumBytesPerStream = 64 * 1_024
+    private var data = Data()
+
+    func append(_ chunk: Data) {
+        guard data.count < Self.maximumBytesPerStream else { return }
+        data.append(chunk.prefix(Self.maximumBytesPerStream - data.count))
+    }
+
+    func snapshot() -> Data {
+        data
+    }
+}
+
 struct DaemonInstallProcessRunner: Sendable {
     let run: @Sendable (URL, [String], Data) async throws -> DaemonInstallProcessOutput
 
@@ -45,26 +59,68 @@ struct DaemonInstallProcessRunner: Sendable {
             let inputPipe = Pipe()
             let outputPipe = Pipe()
             let errorPipe = Pipe()
+            let inputHandle = inputPipe.fileHandleForWriting
+            let outputHandle = outputPipe.fileHandleForReading
+            let errorHandle = errorPipe.fileHandleForReading
             process.standardInput = inputPipe
             process.standardOutput = outputPipe
             process.standardError = errorPipe
+            defer {
+                try? inputHandle.close()
+                try? outputHandle.close()
+                try? errorHandle.close()
+            }
             try process.run()
+            let output = BoundedProcessOutput()
+            let error = BoundedProcessOutput()
+            let outputReader = Task.detached(priority: .userInitiated) {
+                do {
+                    while let chunk = try outputHandle.read(upToCount: 64 * 1_024), !chunk.isEmpty {
+                        await output.append(chunk)
+                    }
+                } catch {
+                    return
+                }
+            }
+            let errorReader = Task.detached(priority: .userInitiated) {
+                do {
+                    while let chunk = try errorHandle.read(upToCount: 64 * 1_024), !chunk.isEmpty {
+                        await error.append(chunk)
+                    }
+                } catch {
+                    return
+                }
+            }
             do {
-                try inputPipe.fileHandleForWriting.write(contentsOf: standardInput)
-                try inputPipe.fileHandleForWriting.close()
+                try inputHandle.write(contentsOf: standardInput)
+                try inputHandle.close()
             } catch {
                 process.terminate()
+                try? inputHandle.close()
+                try? outputHandle.close()
+                try? errorHandle.close()
+                let deadline = Date().addingTimeInterval(0.25)
+                while process.isRunning && Date() < deadline {
+                    usleep(10_000)
+                }
+                if process.isRunning {
+                    kill(process.processIdentifier, SIGKILL)
+                }
+                outputReader.cancel()
+                errorReader.cancel()
                 throw error
             }
             process.waitUntilExit()
+            _ = await outputReader.value
+            _ = await errorReader.value
             return DaemonInstallProcessOutput(
                 terminationStatus: process.terminationStatus,
                 standardOutput: String(
-                    decoding: outputPipe.fileHandleForReading.readDataToEndOfFile(),
+                    decoding: await output.snapshot(),
                     as: UTF8.self
                 ),
                 standardError: String(
-                    decoding: errorPipe.fileHandleForReading.readDataToEndOfFile(),
+                    decoding: await error.snapshot(),
                     as: UTF8.self
                 )
             )

Sources/Vifty/SettingsAgentWorkflowView.swift

@@ -32,6 +32,17 @@ struct SettingsAgentWorkflowView: View {
                     )
                     .disabled(model.agentCoolingEnabled == nil)
                     .accessibilityIdentifier(ViftyAccessibilityIdentifier.agentCoolingEnabled)
+
+                if let message = model.agentAuditPersistenceMessage {
+                    Label {
+                        Text(message)
+                    } icon: {
+                        Image(systemName: "exclamationmark.triangle")
+                    }
+                    .foregroundStyle(.orange)
+                    .fixedSize(horizontal: false, vertical: true)
+                    .accessibilityLabel("Agent audit persistence needs attention")
+                }
             }
 
             Section("Commands") {