chore(release): Peekaboo 4.9.0

[steipete]

Release branch for Peekaboo 4.9.0, published from this branch's head with the driver's --release-branch mode. Do not squash or rebase-merge — after publication this lands with a merge commit so the v4.9.0 tag stays in main's history.

Changes

• chore(release): prepare Peekaboo 4.9.0 — version surfaces to 4.9.0; dated 4.9.0 sections in both changelogs (63 root, 40 CLI entries) with highlights and a Compatibility note for capability-gated scoped menu-bar clicks and exact file-dialog execution; release notes; README What's new.

Verification

• Version-surface validation, publication-mode changelog contracts, tracked release-notes contract, docs lint, release-preflight and guidance contract tests (42): pass.
• main at the cut passed the full serial package suites (Supplemental release validation).
• Codex autoreview (P0–P2): no findings.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 10:57 AM ET / 14:57 UTC (Revision 6).

ClawSweeper review

What this changes

Updates Peekaboo’s version metadata to 4.9.0, prepares release documentation, and adds the published macOS app to the update feed.

Merge readiness

✅ Ready for maintainer review

This release reconciliation PR remains necessary: 4.9.0 is published, but current main still carries 4.8.0 metadata. The previous publication/draft blocker is resolved, and no actionable introduced defect was found.

Priority: P3
Reviewed head: e3e8204750bb9a1ee62c4092803aa37a618d6043

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent release reconciliation with consistent metadata, published assets, and no actionable introduced findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored release PR is exempt from external contributor runtime proof. Published release and npm metadata corroborate the changed distribution surfaces; this does not claim independent native execution or live desktop coverage. No stored-data contract changes are introduced.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored release PR is exempt from external contributor runtime proof. Published release and npm metadata corroborate the changed distribution surfaces; this does not claim independent native execution or live desktop coverage. No stored-data contract changes are introduced.
Evidence reviewed	10 items	Pinned introduced change: Inspected the pinned main-to-head delta across all 14 files. Changes are version metadata, release documentation, and an appcast entry; no automation implementation, dependency pointer, authorization logic, or stored-data schema changes are introduced. Still necessary on main: The pinned current main version.json reports 4.8.0, while the PR's root, npm, and CLI resource versions report 4.9.0. Publication does not make this branch reconciliation redundant. Publication completed: https://github.com/openclaw/Peekaboo/releases/tag/v4.9.0 is a non-draft stable release published at 2026-10-07T14:47:38Z. Its body records source 7020aed and publication proof; assets include the app ZIP, DMG, CLI archives, npm tarball, checksums, and release proof. Supplied current PR context confirms draft=false, resolving the prior review's draft/publication concern.
Findings	None	None.
Security	None	None.

How this fits together

Peekaboo’s release metadata identifies the CLI, macOS apps, and MCP server version. Its Sparkle update feed connects installed macOS apps to published release downloads.

flowchart TD
 A[Release version] --> B[CLI and app metadata]
 A --> C[Changelogs and release notes]
 D[Published app archive] --> E[Signed update feed]
 E --> F[Installed macOS app]
 C --> G[Release information]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Preserve the published 4.9.0 source history by landing this release branch with a merge commit and retaining its aligned metadata.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is release preparation and publication reconciliation, rather than a bug report.

Is this the best way to solve the issue?

Yes: the metadata matches the published release, and the documented merge-commit procedure preserves the existing release tag.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 159412696b72.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This PR reconciles published release metadata without introducing a runtime behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored release PR is exempt from external contributor runtime proof. Published release and npm metadata corroborate the changed distribution surfaces; this does not claim independent native execution or live desktop coverage. No stored-data contract changes are introduced.

Evidence

What I checked:

• Pinned introduced change: Inspected the pinned main-to-head delta across all 14 files. Changes are version metadata, release documentation, and an appcast entry; no automation implementation, dependency pointer, authorization logic, or stored-data schema changes are introduced. (e3e8204750bb)
• Still necessary on main: The pinned current main version.json reports 4.8.0, while the PR's root, npm, and CLI resource versions report 4.9.0. Publication does not make this branch reconciliation redundant. (version.json:2, 159412696b72)
• Publication completed: https://github.com/openclaw/Peekaboo/releases/tag/v4.9.0 is a non-draft stable release published at 2026-10-07T14:47:38Z. Its body records source 7020aed and publication proof; assets include the app ZIP, DMG, CLI archives, npm tarball, checksums, and release proof. Supplied current PR context confirms draft=false, resolving the prior review's draft/publication concern. (7020aedd3620)
• Publication tag identity: GitHub's tag reference resolves v4.9.0 directly to the frozen publication source commit. (7020aedd3620)
• Published npm identity: The npm registry returns @steipete/peekaboo version 4.9.0 with the same tarball integrity recorded in the release body. The trusted publishing workflow completed successfully: https://github.com/openclaw/Peekaboo/actions/runs/37638677225. (package.json:3, e3e8204750bb)
• Release documentation and feed consistency: Read-only parsing confirmed release/release-notes.md equals the root 4.9.0 section. The XML parses, its newest build increases from 4080099 to 4090099, and the app ZIP URL and length 23285783 match GitHub's published asset metadata. Signature presence was inspected; cryptographic signature verification was not performed. (appcast.xml:8, e3e8204750bb)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-10-07T05:16:21.006Z sha 025f482 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T05:23:25.977Z sha 4137c46 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T06:45:08.793Z sha 5a8f894 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T09:46:15.388Z sha 409c270 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T10:53:45.861Z sha 7020aed :: needs changes before merge. :: none

[cursor]

PR Summary

Low Risk
Version and release-metadata edits only; main user-facing risk is upgrading CLI without a matching 4.9.0 Bridge host for scoped menubar clicks and exact file-dialog flows, as documented in Compatibility.

Overview
Release cut for 4.9.0 — bumps every published version surface from 4.8.0 to 4.9.0 (npm package.json, root and CLI version.json, CLI Info.plist, TestHost, PeekabooMCPVersion, and MARKETING_VERSION in Mac/Inspector/Playground Xcode projects).

Documentation and distribution metadata are aligned with that release: root and CLI changelogs close Unreleased into 4.9.0 - 2026-10-06 (highlights, full entry lists, and a Compatibility note for Bridge protocol 1.43), README.md “What’s new” points at 4.9.0, release/release-notes.md is rewritten for this version, and appcast.xml adds a Sparkle enclosure for Peekaboo-4.9.0.app.zip. Unreleased root changelog still carries at least one pending item (e.g. npm release-body link) separate from the shipped 4.9.0 section.

No application logic changes appear in this diff beyond the MCP server version string; behavior described in the new changelog entries is assumed to land via earlier commits on the release branch.

^{Reviewed by Cursor Bugbot for commit e3e8204. Bugbot is set up for automated code reviews on this repo. Configure here.}