feat!: v3.0.0 -- safety watchdog fix and CLI cleanup (#46)

* fix: stop safety watchdog from re-enabling charging during sleep

The safety watchdog's stale PID file check used wall clock time to
detect hung daemons. During sleep the daemon's loop doesn't run, so
the PID file appears stale after 5 minutes. Every Power Nap wake, the
watchdog would re-enable charging, undoing the daemon's willSleep
handler. This caused overnight charging from 65% to 96%.

If the daemon process is alive, trust it. The willSleep handler has
already set the correct SMC state for sleep.

Bumps version to 2.1.3.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: add CodeRabbit configuration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat!: v3.0.0 -- safety watchdog fix and CLI cleanup

Fix safety watchdog sleep conflict by using system uptime for stale PID
detection and killing hung daemons instead of re-enabling charging.

Remove unused commands (schedule, ssd, reinstall, ssd-log, daily-log,
calibrate-log). Hide internal commands (charge, discharge, visudo).

Update changelog with all missing versions and reverse to chronological
order. Add CodeRabbit config with domain-specific review instructions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: consolidate ConfigStore instantiation, remove dead code

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: align calibrate_next with actual schedule fire date

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: always recreate schedule plist on longevity activation

Prevents permanently broken schedule when the plist is missing but
calibrate_schedule config is still set. Logs a warning if plist
creation fails.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: MoonBoi9001

.coderabbit.yaml

@@ -0,0 +1,106 @@
+language: "en-US"
+
+reviews:
+  profile: "assertive"
+  high_level_summary: true
+  sequence_diagrams: true
+  poem: false
+  auto_review:
+    enabled: true
+    base_branches:
+      - main
+    drafts: false
+    auto_incremental_review: true
+  path_instructions:
+    - path: "Sources/AppleJuice/Daemon/**"
+      instructions: >
+        apple-juice is a macOS battery charging manager that controls charging
+        via SMC (System Management Controller) keys. The maintain daemon runs
+        as a LaunchAgent with KeepAlive (SuccessfulExit: false) so launchd
+        restarts it on crash.
+
+        Critical safety invariant: the Mac must never be left with charging
+        disabled and no daemon running. Every code path that disables charging
+        must have a corresponding recovery mechanism. Three overlapping layers
+        provide this: (1) launchd KeepAlive auto-restart, (2) the safety
+        watchdog running every 30 minutes, (3) startup recovery before any CLI
+        command.
+
+        The daemon loop runs on a serial DispatchQueue (smcQueue) that
+        serialises all SMC reads/writes across the main loop, signal handlers,
+        and sleep/wake callbacks. Watch for thread safety -- any SMC access
+        outside smcQueue is a race condition.
+
+        Sleep/wake handling is critical. willSleep disables discharging and
+        either disables or enables charging depending on battery level, then
+        schedules a pmset wake if charging is needed. didWake cancels the
+        scheduled wake and resumes daemon control. The PID file is not updated
+        during sleep, so staleness checks must use system uptime (monotonic
+        clock that doesn't advance during sleep), not wall clock time.
+
+        SMC writes can fail silently during Power Nap partial-wake states.
+        The daemon tracks consecutive control failures and exits after 10 for
+        launchd restart. A 30s backoff applies when failures are occurring.
+
+        Signal-based IPC uses SIGUSR1 with a sig.pid file for commands like
+        suspend/recover. The daemon reads the command from sig.pid, executes
+        it under smcQueue, and sends SIGUSR1 back as ACK.
+
+        All PID files and state files must use atomic writes. The charge.state
+        file tracks active charge/discharge operations with format
+        "<PID> <operation> <maintain_status>" for orphan recovery.
+
+    - path: "Sources/AppleJuice/Commands/**"
+      instructions: >
+        CLI commands using swift-argument-parser. Key safety concerns:
+
+        Uninstall must verify charging is re-enabled via SMC readback BEFORE
+        deleting binaries. If verification fails, it must abort and tell the
+        user to reboot (SMC keys reset on boot).
+
+        Charge and discharge commands suspend the maintain daemon via SIGUSR1
+        IPC before starting, write a charge.state file for orphan detection,
+        and recover maintain on completion or failure. If the charge/discharge
+        process dies unexpectedly, the safety watchdog detects the orphaned
+        state file and re-enables charging.
+
+        The safety-check command (SafetyCheck.swift) is the periodic watchdog.
+        It must never re-enable charging while the daemon is running -- that
+        fights the daemon's own control loop. Stale PID detection uses a 120s
+        threshold against ProcessInfo.processInfo.systemUptime (not wall clock
+        time) because the PID file isn't updated during sleep.
+
+        Calibrate and balance are orchestrators that shell out to the charge
+        and discharge subcommands via ProcessRunner. They don't interact with
+        SMC directly. Sleep prevention (IOPMAssertion) and SIGTERM handling
+        live in the charge/discharge commands, not in calibrate/balance.
+
+    - path: "Sources/AppleJuice/Utilities/**"
+      instructions: >
+        Utility code for SMC access, battery info, and process management.
+
+        SMC access has two paths: IOKitSMCClient for fast kernel-level reads
+        (no sudo), and SMCBinaryClient for writes via a sudoers-allowlisted
+        smc binary. All SMC writes require sudo and go through the smc binary
+        at /usr/local/co.apple-juice/smc or the Homebrew bin directory.
+
+        SMCCapabilities.probe() detects which SMC keys exist on this machine.
+        Different Apple Silicon models use different keys (CH0B vs CH0C for
+        charge inhibit, CH0I vs CHIE for discharge control). Code must never
+        hardcode key assumptions -- always use the probed capabilities.
+
+        BatteryInfo reads from IOKit (AppleSmartBattery service) and provides
+        raw vs smoothed capacity, cell voltages, imbalance detection, and
+        charge/discharge currents. accuratePercentage uses raw values from
+        the BMS, not the smoothed macOS percentage.
+
+        ProcessHelper verifies PIDs by checking both process existence
+        (kill(pid, 0)) and that the process is actually apple-juice (not a
+        reused PID). All PID file reads must handle missing/malformed files.
+
+tools:
+  swiftlint:
+    enabled: true
+
+chat:
+  auto_reply: true

CHANGELOG.md

@@ -1,76 +1,110 @@
 # Changelog
 
+## v1.0.0
+
+Initial release -- fork of BatteryOptimizer_for_Mac with full rebrand.
+
+- `battery` command renamed to `apple-juice`, config directory moved from `~/.battery` to `~/.apple-juice`
+- Removed Electron GUI app (CLI only) and donation prompts
+- Root-owned executables in `/usr/local/co.apple-juice` with symlinks in `/usr/local/bin`
+- mktemp for visudo temp files, `-h` flag on chown calls to prevent symlink attacks
+
+## v1.0.1
+
+- Auto-detect installation directory for Homebrew compatibility
+- Process detection fix (use `args` instead of `comm`)
+- osascript quote escaping fix in setup dialog
+- Removed Chinese language support (English only)
+- Status now shows "Longevity mode active" when using longevity preset
+
+## v1.0.2
+
+- Create config file automatically if missing (fixes brew installs)
+
 ## v2.0.0
 
 Complete rewrite from bash to Swift. Apple Silicon only.
 
-### Added
 - Native Swift binary via Swift Package Manager (no runtime dependencies)
 - LaunchAgent with `KeepAlive` for automatic daemon restart on crash/SIGKILL/OOM
-- IOKit direct battery reads (replaces all `ioreg | grep | awk` chains)
+- IOKit direct battery reads (replaces `ioreg | grep | awk` chains)
 - IOKit sleep/wake notifications with CHWA management (replaces sleepwatcher)
 - `IOPMAssertionCreateWithName` for sleep prevention (replaces caffeinate)
 - Startup recovery check: re-enables charging if daemon is not running
 - SMC write verification with consecutive failure detection
 - Serial dispatch queue for thread-safe SMC access across main loop, sleep/wake, and signal handlers
-- Daily log rotation (365 entries, ~1 year)
-- Main log rotation (5MB threshold)
-- PID file write error handling with stderr fallback
-- `ProcessType: Interactive` and `ExitTimeOut: 30` in LaunchAgent plist
-- LaunchAgent migration for v1.x users upgrading (auto-regenerates plist with KeepAlive)
-- Config key migration from old formats
+- Daemon lifecycle managed by `launchctl bootstrap`/`bootout` instead of `nohup`
+- Config uses file-per-key storage with atomic writes (replaces single parsed file)
+- Daily log rotation (365 entries), main log rotation (5MB threshold)
 - `status --csv` flag for machine-readable output
-- `advanceCalibrateNext` for proper `week_period`/`month_period` enforcement
-- Webhook events for calibration Method 2
 - CI/CD: GitHub Actions for build/test and release binary generation
+- Dropped Intel Mac support, bash script, sleepwatcher dependency, and sleep/wake hook scripts
 
-### Changed
-- Daemon lifecycle managed by `launchctl bootstrap`/`bootout` instead of `nohup`
-- `maintain stop` uses `launchctl bootout` for clean daemon shutdown
-- `uninstall` properly unloads LaunchAgent before removing plist
-- Signal ACK setup occurs before sending SIGUSR1 (fixes race condition)
-- Clean stop exits with code 0 (KeepAlive does not restart); crashes exit non-zero (restart)
-- Config uses file-per-key storage with atomic writes (replaces single parsed file)
-- All curl calls have `--max-time` timeouts with exponential backoff
+## v2.0.1
 
-### Removed
-- Intel Mac support (Apple Silicon M1+ only)
-- Bash script (`apple-juice.sh`)
-- sleepwatcher dependency
-- `setup.sh` (installation via Homebrew)
-- Sleep/wake hook scripts (`.sleep`, `.wakeup`, `.reboot`, `.shutdown`)
-- `notification_permission.scpt`
-- `shutdown.sh` and `apple-juice_shutdown.plist`
+- Resolve binary path when invoked via PATH
 
-## v1.0.2
+## v2.0.2
 
-### Fixed
-- Create config file automatically if missing (fixes brew installs)
+- Register maintain-daemon as top-level subcommand
 
-## v1.0.1
+## v2.0.3
 
-### Fixed
-- Auto-detect installation directory for Homebrew compatibility
-- Process detection now works correctly (use `args` instead of `comm`)
-- osascript quote escaping in setup dialog
+- Daemon startup, cell voltage reading, and launchctl logging fixes
 
-### Changed
-- Removed Chinese language support (English only)
-- Status now shows "Longevity mode active" when using longevity preset
-- Clean up orphaned language config on update
+## v2.0.4
 
-## v1.0.0
+- Use stable symlink path in LaunchAgent plists (survives Homebrew upgrades)
+
+## v2.0.5
+
+- Redesigned status output with extended battery telemetry: capacity (mAh), adapter details, battery current draw, time estimates
+- Cell imbalance warnings at >20mV and >=50mV
+- Calibration skipped when cells are balanced (<50mV imbalance)
+
+## v2.0.6
+
+- Version line in status output with update check and brew upgrade command
+
+## v2.0.7
+
+- Safety recovery and watchdog now attempt to restart the daemon before falling back to re-enabling charging
+
+## v2.0.8
+
+- Status power description uses IOKit instead of lagging SMC keys
+- Daemon applies charging control immediately on startup
+- Status warns when longevity is configured but daemon isn't running
+
+## v2.0.9
+
+- `startDaemon()` ensures the LaunchAgent service is enabled before bootstrap, preventing `Input/output error` after `maintain stop` + `maintain longevity` cycle
+- Suppressed expected launchctl bootout errors from user-facing output
+
+## v2.1.0
+
+- Added `aj` as a shorthand alias for the `apple-juice` CLI
+
+## v2.1.1
+
+- Safety watchdog switched from `StartInterval` (affected by kqueue sleep bug) to `StartCalendarInterval`, which coalesces missed intervals and fires on wake
+- Always run launchctl enable/bootout/bootstrap for the safety daemon, even when the plist is unchanged on disk
+- SMC failure backoff increased to 30s with threshold raised to 10 consecutive failures, preventing premature daemon exits during Power Nap
+
+## v2.1.2
+
+- Added delay and retry between launchd `bootout` and `bootstrap` calls, preventing bootstrap race conditions during daemon startup
+- Removed immediate kickstart of the safety watchdog during daemon startup (was causing false "daemon not running" detection)
+- `maintain` now waits up to 5s for the old daemon process to exit before starting the new one
 
-Initial release - fork of BatteryOptimizer_for_Mac with full rebrand.
+## v3.0.0
 
-### Security
-- Root-owned executables in `/usr/local/co.apple-juice`
-- Symlinks in `/usr/local/bin` for PATH accessibility
-- mktemp for visudo temp files (isolated from user config)
-- `-h` flag on chown calls to prevent symlink attacks
+Safety watchdog fix and CLI cleanup. **Breaking**: six commands removed (see below). Scripts referencing `aj schedule`, `aj ssd`, `aj dailylog`, `aj calibratelog`, `aj ssdlog`, or `aj reinstall` will fail with an unknown-command error.
 
-### Changes
-- Full rebrand: `battery` command is now `apple-juice`
-- Config directory: `~/.battery` is now `~/.apple-juice`
-- Removed Electron GUI app (CLI only)
-- Removed donation prompts
+- Safety watchdog stale PID detection now uses system uptime (monotonic clock) instead of wall clock time, preventing false triggers after sleep
+- When a hung daemon is detected, the watchdog kills it for launchd restart instead of re-enabling charging (which fought the daemon's own control loop)
+- Stale PID threshold tightened from 5 minutes to 2 minutes of awake time
+- Removed commands: `schedule`, `ssd`, `ssd-log`, `daily-log`, `calibrate-log`, `reinstall`
+- Hidden commands: `charge`, `discharge`, `visudo` (still functional, used internally)
+- Longevity mode schedule setup no longer depends on the `schedule` command
+- Added CodeRabbit configuration for automated PR reviews

Sources/AppleJuice/AppleJuice.swift

@@ -1,7 +1,7 @@
 import ArgumentParser
 import Foundation
 
-let appVersion = "2.1.2"
+let appVersion = "3.0.0"
 
 @main
 struct AppleJuice: ParsableCommand {
@@ -16,14 +16,8 @@ struct AppleJuice: ParsableCommand {
             Discharge.self,
             Calibrate.self,
             Balance.self,
-            Schedule.self,
             Logs.self,
-            DailyLog.self,
-            CalibrateLog.self,
-            SSD.self,
-            SSDLog.self,
             Update.self,
-            Reinstall.self,
             Uninstall.self,
             Visudo.self,
             Changelog.self,
@@ -58,7 +52,6 @@ extension Charge: StartupAware {}
 extension Discharge: StartupAware {}
 extension Calibrate: StartupAware {}
 extension Balance: StartupAware {}
-extension Schedule: StartupAware {}
 extension Update: StartupAware {}
 extension Uninstall: StartupAware {}
 
@@ -107,8 +100,6 @@ enum Paths {
     static let calibratePidFile = (configFolder as NSString).appendingPathComponent("calibrate.pid")
     static let dailyLogFile = (configFolder as NSString).appendingPathComponent("daily.log")
     static let calibrateLogFile = (configFolder as NSString).appendingPathComponent("calibrate.log")
-    static let ssdLogFile = (configFolder as NSString).appendingPathComponent("ssd.log")
-
     static let daemonPath = (NSHomeDirectory() as NSString)
         .appendingPathComponent("Library/LaunchAgents/apple-juice.plist")
     static let schedulePath = (NSHomeDirectory() as NSString)

Sources/AppleJuice/Commands/Charge.swift

@@ -4,7 +4,8 @@ import Foundation
 struct Charge: ParsableCommand {
     static let configuration = CommandConfiguration(
         commandName: "charge",
-        abstract: "Charge battery to a target percentage"
+        abstract: "Charge battery to a target percentage",
+        shouldDisplay: false
     )
 
     @Argument(help: "Target percentage (1-100) or 'stop'")
@@ -123,7 +124,8 @@ struct Charge: ParsableCommand {
 struct Discharge: ParsableCommand {
     static let configuration = CommandConfiguration(
         commandName: "discharge",
-        abstract: "Discharge battery to a target percentage"
+        abstract: "Discharge battery to a target percentage",
+        shouldDisplay: false
     )
 
     @Argument(help: "Target percentage (1-100) or 'stop'")

Sources/AppleJuice/Commands/Logs.swift

@@ -17,54 +17,3 @@ struct Logs: ParsableCommand {
         print(result.stdout, terminator: "")
     }
 }
-
-struct DailyLog: ParsableCommand {
-    static let configuration = CommandConfiguration(
-        commandName: "dailylog",
-        abstract: "Show the daily battery log"
-    )
-
-    func run() throws {
-        let path = Paths.dailyLogFile
-        if FileManager.default.fileExists(atPath: path) {
-            let contents = try String(contentsOfFile: path, encoding: .utf8)
-            print(contents, terminator: "")
-        } else {
-            print("No daily log found at \(path)")
-        }
-    }
-}
-
-struct CalibrateLog: ParsableCommand {
-    static let configuration = CommandConfiguration(
-        commandName: "calibratelog",
-        abstract: "Show the calibration log"
-    )
-
-    func run() throws {
-        let path = Paths.calibrateLogFile
-        if FileManager.default.fileExists(atPath: path) {
-            let contents = try String(contentsOfFile: path, encoding: .utf8)
-            print(contents, terminator: "")
-        } else {
-            print("No calibration log found at \(path)")
-        }
-    }
-}
-
-struct SSDLog: ParsableCommand {
-    static let configuration = CommandConfiguration(
-        commandName: "ssdlog",
-        abstract: "Show the SSD health log"
-    )
-
-    func run() throws {
-        let path = Paths.ssdLogFile
-        if FileManager.default.fileExists(atPath: path) {
-            let contents = try String(contentsOfFile: path, encoding: .utf8)
-            print(contents, terminator: "")
-        } else {
-            print("No SSD log found at \(path)")
-        }
-    }
-}