Fix black PNG exports from usage share cards

[Chipagosfinest]

Summary

• render usage share cards with SwiftUI ImageRenderer instead of an offscreen NSHostingView.cacheDisplay
• preserve the exact 1200×630 PNG contract
• strengthen the renderer regression test so a valid-but-uniform black PNG fails

Fixes #2286.
Part of #2291.

Production evidence

The installed 0.44.0 (build 106) app returned a structurally valid 1200×630 PNG from Copy Image, but every pixel was black:

size=1200x630 colors=1 min=0 max=0 mean=0

The final renderer tree (ddd39620, unchanged by tree-identical CI retry head d4e836fb) rendered the same synthetic payload through ShareStatsRenderer.pngData(for:) as visible, non-uniform output:

size=1200x630 colors=1032 min=4112 max=65535 mean=21126.8

The screenshot uses synthetic fixture data only. It was freshly generated from the final renderer path after the maintainer's no-Metal revision.

Verification

• swift test --filter ShareStatsTests — 12 tests passed on the unchanged renderer tree
• file / sips — RGBA PNG, exactly 1200×630
• ImageMagick pixel inspection — 1,032 colors; non-uniform visible output
• make check — passed, including SwiftFormat and SwiftLint
• make test — 715/715 selections passed across 60/60 groups, with zero retries and zero timeouts

CI evidence

d4e836fb is an empty, tree-identical retry commit because contributor permissions cannot rerun a failed GitHub job directly.

• exact-head Linux x64 passed the full test and CLI smoke steps: https://github.com/steipete/CodexBar/actions/runs/29659631050/job/88119915545
• exact-head Linux arm64 passed: https://github.com/steipete/CodexBar/actions/runs/29659631050/job/88119915479
• exact-head Linux musl build passed: https://github.com/steipete/CodexBar/actions/runs/29659631050/job/88119934685
• both macOS shards passed on the identical renderer tree before the retry commit: https://github.com/steipete/CodexBar/actions/runs/29657985495/job/88115675488 and https://github.com/steipete/CodexBar/actions/runs/29657985495/job/88115675496

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 18, 2026, 5:18 PM ET / 21:18 UTC.

Summary
The branch changes share-card PNG capture from cacheDisplay to an alpha-capable bitmap graphics context, adds sampled pixel-color regression coverage, and adds a synthetic rendered-output screenshot.

Reproducibility: no. independent current-main live reproduction was run in this read-only review, but the reported failure has a concrete base-path explanation: the old renderer captured an offscreen hosting view and only tested the PNG signature; the branch exercises that renderer path with sampled visible-pixel coverage.

Review metrics: 2 noteworthy metrics.

• Patch scope: 25 added, 3 removed, 3 files affected. The change is narrowly limited to the renderer, its regression test, and after-fix visual proof.
• Pending required gates: 2 macOS shards in progress. The owner requested a stable exact head specifically so those final platform checks can decide merge readiness.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #2286
Summary: This PR is the concrete fix candidate for the black share-card PNG export reported in the canonical bug.

Members:

• canonical: Fix black PNG exports from usage share cards #2286 - The PR targets the same Copy Image all-black PNG behavior and explicitly links the bug as its implementation target.
• partial_overlap: Track Usage & Spend production hardening and sharing follow-ups #2291 - The tracker lists this renderer fix as one production-hardening dependency among several separate Usage & Spend follow-ups.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Wait for swift-test-macos (0, 2) and swift-test-macos (1, 2) to complete successfully on d4e836fb2e9393c4aaac03f4dd3420ed0f269a27.

Risk before merge

• [P1] The two required macOS CI shards are still in progress on the exact stable head, so merging should wait for those gates to finish successfully.

Maintainer options:

1. Decide the mitigation before merge
   Merge the stable exact head after both macOS shards pass, retaining the RGBA AppKit rendering path and sampled-pixel regression test for the existing 1200×630 export contract.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No mechanical repair remains; the repository owner should confirm the two queued macOS checks on the stable exact head, then merge if they pass.

Security
Cleared: The renderer, focused test, and screenshot-only diff introduces no dependency, permission, secret, workflow, or supply-chain change.

Review details

Best possible solution:

Merge the stable exact head after both macOS shards pass, retaining the RGBA AppKit rendering path and sampled-pixel regression test for the existing 1200×630 export contract.

Do we have a high-confidence way to reproduce the issue?

No independent current-main live reproduction was run in this read-only review, but the reported failure has a concrete base-path explanation: the old renderer captured an offscreen hosting view and only tested the PNG signature; the branch exercises that renderer path with sampled visible-pixel coverage.

Is this the best way to solve the issue?

Yes. Replacing the brittle offscreen capture path with explicit bitmap-context drawing while retaining the existing payload and 1200×630 contract is a narrow, maintainable regression fix.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d2a3da910477.

Label changes

Label justifications:

• P2: This fixes a bounded but user-visible PNG export regression in the Usage & Spend sharing flow.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The contributor supplies an after-fix synthetic renderer screenshot and pixel analysis showing a non-uniform 1200×630 PNG; the fixture data avoids exposing account information.
• proof: sufficient: Contributor real behavior proof is sufficient. The contributor supplies an after-fix synthetic renderer screenshot and pixel analysis showing a non-uniform 1200×630 PNG; the fixture data avoids exposing account information.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The contributor supplies an after-fix synthetic renderer screenshot and pixel analysis showing a non-uniform 1200×630 PNG; the fixture data avoids exposing account information.

Evidence reviewed

What I checked:

• Focused renderer change: The PR changes the bitmap representation to RGBA and renders the hosting view into an explicit NSGraphicsContext, addressing the black image produced by the previous offscreen cache path. (Sources/CodexBar/ShareStatsRenderer.swift:14, d4e836fb2e93)
• Regression coverage: The updated renderer test verifies the 1200×630 dimensions and samples rendered RGB values, so a structurally valid but uniform black PNG fails the test. (Tests/CodexBarTests/ShareStatsTests.swift:232, d4e836fb2e93)
• Maintainer review direction: The repository owner verified that the retry commit is empty and tree-identical to the reviewed renderer head, then asked that the head stay stable while the required exact-head CI run completes. (d4e836fb2e93)
• Real behavior proof: The PR body provides a synthetic after-fix share-card screenshot and measured non-uniform PNG output (1,032 colors) while preserving the 1200×630 export contract. (docs/screenshots/share-stats-renderer-after.png, ddd3962062ba)

Likely related people:

• steipete: The repository owner authored the no-Metal renderer revision in this PR and is actively reviewing the stable exact head before merge. (role: reviewer and recent area contributor; confidence: high; commits: c53e65166623; files: Sources/CodexBar/ShareStatsRenderer.swift, Tests/CodexBarTests/ShareStatsTests.swift)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (6 earlier review cycles)

• reviewed 2026-07-18T07:16:14.433Z sha 4d0dcc8 :: needs changes before merge. :: [P2] Validate visible pixel colors instead of raw component bytes
• reviewed 2026-07-18T18:20:28.393Z sha c53e651 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-18T19:34:42.687Z sha ddd3962 :: needs maintainer review before merge. :: none
• reviewed 2026-07-18T20:16:48.231Z sha ddd3962 :: needs maintainer review before merge. :: none
• reviewed 2026-07-18T20:26:51.277Z sha d4e836f :: needs maintainer review before merge. :: none
• reviewed 2026-07-18T20:36:27.048Z sha d4e836f :: needs maintainer review before merge. :: none

[Chipagosfinest]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29659401270
• Updated: 2026-07-18T20:19:52.944Z

[Chipagosfinest]

CI note: the exact-head Linux x64 failure is unrelated to this macOS renderer diff. The two parameterized PlatformGatingTests cases started concurrently and both failed their otherwise stable per-case invocation assertion; each case already uses a UUID-scoped file, so the deeper shared runtime boundary still needs isolation. Linux arm64 passed on this head and Linux x64 passed on current main. Tracked separately in #2309. I will rerun the failed job when the currently queued macOS shards let this workflow complete.

[Chipagosfinest]

The unrelated Linux x64 flake is now isolated in test-only PR #2311 (fixes #2309). Its focused PlatformGatingTests, make check, and full 716-selection make test gate pass locally. I am keeping that containment out of this renderer PR; once #2292’s current workflow completes I will rerun the failed Linux job for clean exact-head evidence.

[steipete]

Thanks for retrying the flaky Linux shard. I verified d4e836fb2e9393c4aaac03f4dd3420ed0f269a27 is an empty commit and its tree is byte-identical to the reviewed head. I’m watching the new required CI run now. Please hold the head stable while it completes so I can merge the exact tested SHA.

[Chipagosfinest]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29661360453
• Updated: 2026-07-18T21:22:05.509Z

[steipete]

Merged after exact-head verification.

Verification:

• Reviewed the full external diff and final head d4e836fb2e9393c4aaac03f4dd3420ed0f269a27; no suspicious URLs, exfiltration, or scope creep. The final retry commit was tree-identical to its parent.
• Confirmed the renderer uses NSHostingView + NSBitmapImageRep + NSGraphicsContext and does not reintroduce ImageRenderer/Metal, preserving Intel CI compatibility.
• swift test --jobs 4 --filter ShareStatsTests: 12 tests passed.
• make check: passed.
• make test: 715 selections, 60/60 groups, zero failures or retries.
• Generated and visually inspected the final 1200×630 PNG; decoded RGB content was non-uniform and all synthetic labels rendered.
• Autoreview found no actionable defects; exact-head required CI passed.

Merge SHA: 6ba3d19575fd43958b4f930c6ca5b08f71a650b3.