fix: close generation races and tighten execution boundaries

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -52,5 +52,5 @@ body:
   - type: textarea
     id: context
     attributes:
-      label: Additional context
-      description: Add sanitized logs or screenshots if useful.
+      label: Logs and screenshots
+      description: Sanitized logs or screenshots, if they help.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,5 +1,5 @@
 name: Feature request
-description: Suggest a focused product improvement
+description: Request a product improvement
 title: "[Feature]: "
 labels: [enhancement]
 body:

CHANGELOG.md

@@ -1,30 +1,33 @@
 # Changelog
 
-All notable user-visible changes are recorded here. Bar Tender follows semantic versioning.
+User-visible changes go here. Bar Tender follows semantic versioning.
 
 ## Unreleased
 
 - Added Gemini CLI (`gemini`) and Antigravity CLI (`agy`) as generation providers, with install/auth probing, model catalogs, and branded icons.
 - Fixed GitHub update pagination to accumulate every `Link: rel="next"` page before semantic ranking.
 - Moved the update channel out of the version string into explicit `BarTenderUpdateChannel` bundle metadata (`prerelease` / `stable`).
 - Product version and release tags no longer include an `adhoc` suffix (`1.0.1`, `v1.0.1+build.N`).
+- Hardened HTTP, git, shell, approval, and update execution boundaries: re-validate probe URLs, treat 3xx as unhealthy unless an expected status is set, allowlist environments for approved shell and git probes, reject NUL in command/cwd fingerprints, and pin GitHub pagination and release-page hosts.
+- Cancelled generation now cancels the exact runner that was in flight, and first-run repair no longer silently skips when another generation is already active.
+- Removed unused bundled Inter fonts; the UI keeps compact system typography.
 
-## 1.0.1 — 2026-08-04
+## 1.0.1 (2026-08-04)
 
 - Diagnostic menu-bar release: only `AppDelegate` attaches status items; reattach is ignored while the delayed first registration is pending (avoids racing Control Center).
 - Default to one square, icon-only individual applet status item so clipping is less likely; raise the cap in Settings when needed.
 - Migrated bundle identifier to `io.github.aforno.bartender.v2` (build 2) so macOS 26 Control Center host tracking starts clean. Applet library under Application Support is unchanged; preferences and Launch at Login reset.
 - Removed unsupported `NSStatusItem Visible*` / `VisibleCC*` UserDefaults resets and `orderFrontRegardless()` workarounds.
 
-## 1.0.0 — 2026-07-24
+## 1.0.0 (2026-07-24)
 
-- Published the first downloadable universal ZIP/DMG as a prerelease (no Developer ID signature or notarization). Install requires a one-time Gatekeeper bypass (Control-click → Open).
+- Published the first downloadable universal ZIP/DMG as a prerelease, with no Developer ID signature or notarization. Install requires a one-time Gatekeeper bypass: Control-click, then Open.
 - Added an opt-in setting to automatically approve provider-written edits to previously approved generated tools. New tools, imports, and automatic repairs still require review.
-- Added Mac component temperature readings for generated tools. Tools can run `"$BARTENDER_CLI" --sensors` (key=value lines) or `"$BARTENDER_CLI" --sensors-json` (per-sensor detail) to get CPU, GPU, SoC, battery, ambient, memory, and storage temperatures in °C — no extra software or elevated privileges needed, on Apple silicon and Intel.
+- Added Mac component temperature readings for generated tools. Tools can run `"$BARTENDER_CLI" --sensors` (key=value lines) or `"$BARTENDER_CLI" --sensors-json` (per-sensor detail) to get CPU, GPU, SoC, battery, ambient, memory, and storage temperatures in °C. No extra software or elevated privileges. Works on Apple silicon and Intel.
 - Added generated menu bar tools through local Codex, Claude, and Grok CLIs, with provider and model selection.
-- Added bounded validation retries and first-run diagnostic feedback so providers can repair generated tools instead of leaving them at “Needs Attention.”
+- Added bounded validation retries and first-run diagnostic feedback so providers can repair generated tools instead of leaving them at "Needs Attention."
 - Fixed newly enabled tools showing stale placeholder data until their second scheduled refresh.
-- Fixed in-app notification banners remaining visible indefinitely; they now dismiss automatically after five seconds.
+- Fixed in-app notification banners remaining visible indefinitely; they now dismiss automatically after eight seconds.
 - Added exact-source approval, automatic approval invalidation on edits, generated-tool environment minimization, and explicit local-code trust disclosures.
 - Removed the AI generation timeout. Generation continues until the provider finishes or the user cancels it.
 - Added provider brand icons throughout setup and model selection, plus a dedicated Bar Tender application icon.

CITATION.cff

@@ -7,7 +7,7 @@ authors:
     given-names: Afonso
 repository-code: https://github.com/Aforno/Bartender
 url: https://github.com/Aforno/Bartender
-abstract: A native macOS app that turns natural-language descriptions into reviewable menu bar tools.
+abstract: A macOS menu bar app that turns a plain-language request into a reviewable local zsh tool using an already installed AI CLI.
 keywords:
   - macOS
   - menu bar

CONTRIBUTING.md

@@ -1,11 +1,11 @@
 # Contributing to Bar Tender
 
-Thanks for helping improve Bar Tender.
+Thanks for helping with Bar Tender.
 
 ## Before you start
 
 - Search existing issues before opening a new one.
-- For a substantial feature or architectural change, open an issue first so the approach can be discussed.
+- For a large feature or architectural change, open an issue first so the approach can be discussed.
 - Never include API keys, CLI credentials, private prompts, generated tools containing personal data, or other secrets in an issue or pull request.
 
 ## Local development
@@ -20,7 +20,7 @@ swift test
 ./script/build_and_run.sh --verify
 ```
 
-The run script builds a local app bundle in `dist/`. That directory is intentionally ignored by Git.
+The run script builds a local app bundle in `dist/`. That directory is ignored by Git on purpose.
 
 ## Pull requests
 
@@ -30,13 +30,13 @@ The run script builds a local app bundle in `dist/`. That directory is intention
 4. Run `./script/check_repository.sh`, `swift test`, and `swift build -c release`.
 5. Describe the user-visible result, test evidence, and any security implications in the pull request.
 
-Changes to generated-tool execution, approval, provider invocation, persistence, or process handling require regression tests. Generated tools must remain inert until their exact source and working directory have been approved by the user.
+Changes to generated-tool execution, approval, provider invocation, persistence, or process handling need regression tests. Generated tools must stay inert until their exact source and working directory have been approved by the user.
 
 ## Style
 
 - Follow the existing Swift and SwiftUI conventions.
 - Prefer small, explicit types and testable services.
-- Surface failures to the user instead of silently discarding them.
-- Preserve macOS 26 compatibility unless a deliberate platform change has been agreed upon.
+- Show failures to the user. Do not swallow them.
+- Keep macOS 26 compatibility unless a platform change has been agreed upon.
 
 By participating, you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md).

PRIVACY.md

@@ -1,23 +1,25 @@
 # Privacy
 
-Bar Tender is a local macOS utility. The project does not operate an analytics, advertising, account, or telemetry service.
+Bar Tender is a local macOS utility. It does not run analytics, advertising, accounts, or telemetry.
 
 ## Data stored on this Mac
 
-Bar Tender stores the tool library, preferences, source-bound approval fingerprints, and generated executable artifacts in the user's local Application Support and preferences locations. Exported libraries contain manifests and generated source, but never approval fingerprints. Imported executable tools always require fresh approval.
+Bar Tender stores the tool library, preferences, source-bound approval fingerprints, and generated executable artifacts in the user's local Application Support and preferences locations.
 
-Sanitized diagnostics include app/system/provider status and counts. They exclude prompts, generated source, filesystem paths, credentials, provider output, and tool output.
+Exported libraries contain manifests and generated source. They never contain approval fingerprints. Imported executable tools always require fresh approval.
+
+Sanitized diagnostics include app, system, and provider status, plus counts. They exclude prompts, generated source, filesystem paths, credentials, provider output, and tool output.
 
 ## Network and subprocess behavior
 
-- Generation launches the locally installed provider CLI selected by the user. That CLI may communicate with its provider under the provider's own terms and privacy policy.
+- Generation launches the locally installed provider CLI you selected. That CLI may talk to its provider under the provider's own terms and privacy policy.
 - Approved generated tools may use the network or local resources according to their exact approved source.
-- Built-in HTTP monitors contact the URL configured by the user.
-- **Check for Updates** makes a user-initiated request to the public GitHub Releases API for `Aforno/Bartender`.
-- Bar Tender does not request or store provider API keys. Provider authentication remains owned by each local CLI.
+- Built-in HTTP monitors contact the URL you configured.
+- Check for Updates makes a user-initiated request to the public GitHub Releases API for `Aforno/Bartender`.
+- Bar Tender does not request or store provider API keys. Provider authentication stays with each local CLI.
 
 ## Permissions
 
-Notification permission is requested only when the user enables an alert. Launch at login is controlled by the user in Settings and may require confirmation in macOS System Settings. Apple Events entitlement is included because approved local tools may launch commands or apps; generated code remains subject to macOS permission prompts and the user's source approval or opt-in auto-approval preference.
+Notification permission is requested only when you enable an alert. Launch at login is controlled in Settings and may need confirmation in macOS System Settings. Apple Events entitlement is included because approved local tools may launch commands or apps. Generated code still hits macOS permission prompts, plus your source approval or the opt-in auto-approval preference.
 
 For questions or deletion guidance, use the routes in [SUPPORT.md](SUPPORT.md).