@getrift/rift 0.1.0-beta.2 → 0.1.0-beta.20

package/operator/swiftbar/render-menu.py

@@ -0,0 +1,524 @@
+#!/usr/bin/env python3
+"""Render the friend-facing Rift SwiftBar menu.
+
+Pure formatting: reads structured state from the environment and prints a
+SwiftBar menu to stdout. No network, no clock except `now`, no CLI calls
+of its own. The shell wrapper (`rift.10s.sh`) gathers the inputs and the
+repair prompt always comes from `rift doctor` — this script never invents
+diagnosis or hardcodes a prompt.
+
+The menu answers one question by default: "Is Rift working?" Operator
+detail (MCP counters, launchd labels, Node versions, commits) is
+deliberately absent.
+
+Inputs (all via env, all optional — missing inputs degrade gracefully):
+  RIFT_DOCTOR_JSON   `rift doctor --json` output (the verdict + one fix).
+  RIFT_STATUS_JSON   `rift status --json` output (capture times, clients).
+  RIFT_MCP_JSON      `/stats/mcp-usage` body (Memory stats: today/month/all).
+  RIFT_HEALTH        "up" | "down" — coarse /health probe, used only when
+                     the doctor report is unavailable (CLI not resolvable).
+  RIFT_NODE_BIN      absolute node binary, for menu actions.
+  RIFT_JS            absolute path to the rift JS entrypoint.
+  RIFT_BIN           absolute rift launcher, fallback when RIFT_JS is unset.
+  RIFT_LOG_DIR       logs folder, for "Open logs".
+  RIFT_DATA_DIR      data folder, for "Open data folder".
+  RIFT_ABOUT_URL     About Rift URL (default https://getrift.dev/about).
+  RIFT_NOW_MS        injected clock for tests (epoch ms); defaults to now.
+"""
+import json
+import os
+import sys
+
+CLIENT_LABELS = {
+    "claude-desktop": "Claude Desktop",
+    "claude-code": "Claude Code",
+    "cursor": "Cursor",
+    "codex": "Codex",
+}
+
+ABOUT_DEFAULT = "https://getrift.dev/about"
+
+
+def env(key, default=""):
+    return os.environ.get(key, default)
+
+
+def parse_json(raw):
+    raw = (raw or "").strip()
+    if not raw:
+        return None
+    try:
+        return json.loads(raw)
+    except Exception:
+        return None
+
+
+def now_ms():
+    raw = env("RIFT_NOW_MS")
+    if raw:
+        try:
+            return int(raw)
+        except ValueError:
+            pass
+    import time
+
+    return int(time.time() * 1000)
+
+
+def parse_iso_ms(iso):
+    """Parse an ISO-8601 timestamp to epoch ms, or None."""
+    if not iso:
+        return None
+    s = iso.strip()
+    if s.endswith("Z"):
+        s = s[:-1] + "+00:00"
+    try:
+        from datetime import datetime
+
+        return int(datetime.fromisoformat(s).timestamp() * 1000)
+    except Exception:
+        return None
+
+
+def fmt_duration(seconds):
+    seconds = int(max(0, seconds))
+    if seconds < 60:
+        return f"{seconds}s"
+    minutes = seconds // 60
+    if minutes < 60:
+        return f"{minutes}m"
+    hours = minutes // 60
+    rem_min = minutes % 60
+    if hours < 24:
+        return f"{hours}h {rem_min}m" if rem_min else f"{hours}h"
+    days = hours // 24
+    rem_hours = hours % 24
+    return f"{days}d {rem_hours}h" if rem_hours else f"{days}d"
+
+
+def age_ago(iso, now):
+    ms = parse_iso_ms(iso)
+    if ms is None:
+        return None
+    return fmt_duration((now - ms) / 1000) + " ago"
+
+
+def time_until(iso, now):
+    ms = parse_iso_ms(iso)
+    if ms is None:
+        return None
+    delta = (ms - now) / 1000
+    if delta <= 0:
+        return "due now"
+    return "in " + fmt_duration(delta)
+
+
+def fmt_tokens(n):
+    if n >= 1_000_000:
+        return "~{:.1f}M context tokens".format(n / 1_000_000).replace(".0M", "M")
+    if n >= 1_000:
+        return "~{}k context tokens".format(round(n / 1_000))
+    return f"~{n} context tokens"
+
+
+# Friendly labels for the three Memory windows, mapped to their keys in the
+# /stats/mcp-usage payload. Order is the render order. We deliberately skip
+# `week` — three periods stay glanceable; a fourth turns the menu into a
+# dashboard. A period absent from the payload is simply not rendered (we never
+# fabricate a number the backend didn't report), so an older daemon that only
+# emits `today` still renders cleanly.
+MEMORY_PERIODS = (("Today", "today"), ("This month", "month"), ("All time", "all_time"))
+
+
+def memory_window_row(label, hits, tokens):
+    """One '<Label>: N useful recalls · ~tokens' row, or a calm zero state."""
+    if hits <= 0:
+        return f"{label}: nothing yet"
+    parts = [f"{hits:,} useful recall" + ("" if hits == 1 else "s")]
+    if isinstance(tokens, int) and tokens > 0:
+        parts.append(fmt_tokens(tokens))
+    return f"{label}: " + " · ".join(parts)
+
+
+def memory_section(mcp):
+    """Friendly 'Memory' section lines (header + period rows), or [].
+
+    Reads today / month / all-time recall + context-token counts straight
+    from /stats/mcp-usage and prints them in plain language. Returns [] when
+    the stats payload is missing or carries none of the expected windows, so
+    the menu degrades gracefully (section omitted, Rift still healthy) rather
+    than showing an error. A history with no recalls anywhere collapses to a
+    single calm line instead of three empty rows.
+    """
+    if not isinstance(mcp, dict):
+        return []
+    present = []
+    any_activity = False
+    for label, key in MEMORY_PERIODS:
+        window = mcp.get(key)
+        if not isinstance(window, dict):
+            continue
+        hits = window.get("context_hits")
+        if not isinstance(hits, int):
+            continue
+        tokens = window.get("context_tokens_delivered_estimate")
+        present.append((label, hits, tokens))
+        if hits > 0:
+            any_activity = True
+    if not present:
+        return []
+    # Collapse to a single calm line ONLY when every period is present and all
+    # are zero — that genuinely is "nothing recalled, ever". A partial payload
+    # (e.g. a legacy daemon emitting only `today`) must not claim all-time
+    # emptiness it can't see, so it falls through to the per-period rows
+    # ("Today: nothing yet") instead.
+    if not any_activity and len(present) == len(MEMORY_PERIODS):
+        return ["Memory", "Nothing recalled yet — Rift learns as you use it"]
+    return ["Memory"] + [
+        memory_window_row(label, hits, tokens) for label, hits, tokens in present
+    ]
+
+
+# --- Menu-action line builders -------------------------------------------
+#
+# SwiftBar runs an item's `shell=` command with a stripped PATH, so every
+# action uses absolute binaries. rift subcommands run through node + the
+# resolved JS entrypoint (the npm `rift` symlink's `#!/usr/bin/env node`
+# shebang can't resolve `node` under a stripped PATH); when only RIFT_BIN
+# resolved we fall back to it directly.
+
+
+def sb_param(value):
+    """Quote a SwiftBar parameter value so paths with spaces or SwiftBar
+    separators survive parsing.
+
+    SwiftBar splits an item's parameters on whitespace and uses `|` to
+    separate the title from its params, so any value carrying a space, tab,
+    `|`, or a quote must be wrapped to stay one token. We only quote when
+    needed, leaving simple values (and flag args like `--target=claude`)
+    untouched.
+    """
+    s = str(value)
+    if s == "" or any(ch in s for ch in " \t|\"'"):
+        return '"' + s.replace('"', '\\"') + '"'
+    return s
+
+
+def rift_runnable():
+    node = env("RIFT_NODE_BIN")
+    js = env("RIFT_JS")
+    if node and js:
+        return [node, js]
+    rift = env("RIFT_BIN")
+    if rift:
+        return [rift]
+    return None
+
+
+def rift_action(label, args, terminal, refresh=False):
+    """A menu line that runs a rift subcommand, or None if rift is unresolved."""
+    base = rift_runnable()
+    if base is None:
+        return None
+    parts = base + args
+    line = f"{label} | shell={sb_param(parts[0])}"
+    for i, p in enumerate(parts[1:], start=1):
+        line += f" param{i}={sb_param(p)}"
+    line += f" terminal={'true' if terminal else 'false'}"
+    if refresh:
+        line += " refresh=true"
+    return line
+
+
+def open_action(label, path):
+    if not path:
+        return None
+    return f"{label} | shell=/usr/bin/open param1={sb_param(path)} terminal=false"
+
+
+def about_line():
+    return f"About Rift | href={sb_param(env('RIFT_ABOUT_URL', ABOUT_DEFAULT))}"
+
+
+# --- Verdict --------------------------------------------------------------
+
+
+def verdict_of(doctor, health):
+    """healthy | warning | broken | unknown."""
+    if isinstance(doctor, dict) and "healthy" in doctor:
+        if not doctor.get("healthy"):
+            return "broken"
+        issues = doctor.get("issues") or []
+        if any(i.get("severity") == "warning" for i in issues):
+            return "warning"
+        return "healthy"
+    # No diagnosis available — fall back to the coarse health probe.
+    if health == "up":
+        return "healthy"
+    if health == "down":
+        return "broken"
+    return "unknown"
+
+
+def has_doctor_report(doctor):
+    """True only when RIFT_DOCTOR_JSON parsed into a real doctor report.
+
+    Doctor-powered menu actions (`Copy fix prompt …`, `Troubleshooting`) are
+    gated on this, never on the rift binary merely resolving: if `rift doctor
+    --json` emitted nothing or failed, re-running doctor from the menu would
+    fail the same way, so we hide those actions and show friend-safe text.
+    """
+    return isinstance(doctor, dict) and "healthy" in doctor
+
+
+TITLES = {
+    "healthy": "Rift | sfimage=circle.fill sfcolor=systemGreen",
+    "warning": "Rift | sfimage=exclamationmark.circle.fill sfcolor=systemYellow",
+    "broken": "Rift | sfimage=exclamationmark.triangle.fill sfcolor=systemRed",
+    "unknown": "Rift | sfimage=questionmark.circle.fill sfcolor=systemGray",
+}
+
+
+# --- Section renderers ----------------------------------------------------
+
+
+def render_capture_rows(friend, now):
+    rows = []
+    capture = (friend or {}).get("capture") if isinstance(friend, dict) else None
+    if not isinstance(capture, dict):
+        return rows
+    last = age_ago(capture.get("last_run_at"), now)
+    rows.append(f"Last capture: {last}" if last else "Last capture: none yet")
+    nxt = time_until(capture.get("next_run_at"), now)
+    if nxt:
+        rows.append(f"Next capture: {nxt}")
+    return rows
+
+
+def render_client_rows(status, doctor):
+    """Connected-client rows + connect actions for missing ones."""
+    rows = []
+    clients = status.get("mcp_clients") if isinstance(status, dict) else None
+    if not isinstance(clients, list):
+        return rows
+    connected = [c for c in clients if c.get("installed")]
+    missing = [c for c in clients if not c.get("installed")]
+    for c in connected:
+        label = CLIENT_LABELS.get(c.get("client"), c.get("client"))
+        rows.append(f"{label} connected | sfimage=checkmark.circle sfcolor=systemGreen")
+    if not connected:
+        rows.append("No AI tools connected yet")
+    for c in missing:
+        cid = c.get("client")
+        label = CLIENT_LABELS.get(cid, cid)
+        action = rift_action(
+            f"Connect {label}", ["mcp", "install", f"--client={cid}"], terminal=True
+        )
+        rows.append(action if action else f"{label} not connected")
+    return rows
+
+
+def has_voyage_issue(doctor):
+    if not isinstance(doctor, dict):
+        return False
+    return any(
+        i.get("kind") in ("voyage_key_missing", "voyage_embed_errors", "index_write_errors")
+        for i in (doctor.get("issues") or [])
+    )
+
+
+# Warning kinds whose repair a non-technical user may want an AI to walk them
+# through. An explicit allowlist, not a blacklist: most warnings either carry
+# their own one-click action (update_available, mcp_not_installed) or have no
+# action at all (capture_daemon_stale's nextAction is literally "Nothing to
+# do") — offering "Copy fix prompt" for those would promise a fix that isn't
+# needed. Add a kind here only once `rift doctor --copy-prompt` produces a
+# genuinely useful repair prompt for it.
+REPAIRABLE_WARNINGS = {"capture_quarantined"}
+
+
+def has_repairable_warning(doctor):
+    """A warning whose repair the user may want an AI to walk them through."""
+    if not isinstance(doctor, dict):
+        return False
+    return any(
+        i.get("severity") == "warning" and i.get("kind") in REPAIRABLE_WARNINGS
+        for i in (doctor.get("issues") or [])
+    )
+
+
+def copy_prompt_actions():
+    """The 'Copy fix prompt for Claude/Codex' menu rows (no embedded prompt)."""
+    out = []
+    for label, target in (("Claude", "claude"), ("Codex", "codex")):
+        action = rift_action(
+            f"Copy fix prompt for {label}",
+            ["doctor", "--copy-prompt", f"--target={target}"],
+            terminal=False,
+        )
+        if action:
+            out.append(action)
+    return out
+
+
+def render_advisories(doctor):
+    """Warning-level issues that aren't already shown as client rows."""
+    rows = []
+    if not isinstance(doctor, dict):
+        return rows
+    for issue in doctor.get("issues") or []:
+        if issue.get("severity") != "warning":
+            continue
+        if issue.get("kind") == "mcp_not_installed":
+            continue  # already surfaced as a "Connect …" client row
+        rows.append(f"{issue.get('title', 'Heads up')}")
+        action = issue.get("nextAction")
+        if action:
+            rows.append(f"--{action}")
+        if issue.get("kind") == "update_available":
+            menu_action = rift_action("Update Rift", ["update"], terminal=True, refresh=True)
+            if menu_action:
+                rows.append(menu_action)
+    return rows
+
+
+def render_footer_actions(broken, doctor_ok, offer_copy_prompt=False):
+    """Common Rift-owned actions. Order differs by state per the plan.
+
+    `doctor_ok` gates the doctor-powered actions (`Copy fix prompt …` and
+    `Troubleshooting`): they appear only when the CLI actually produced a
+    report, never merely because the rift binary resolved.
+
+    `offer_copy_prompt` extends the AI repair prompt to the non-broken
+    (warning) state: a warning with a repair action (e.g. large sessions
+    parked) gets the same one-click Claude/Codex help a broken state does.
+    """
+    lines = ["---"]
+    if broken:
+        if doctor_ok:
+            lines += copy_prompt_actions()
+        logs = open_action("Open logs", env("RIFT_LOG_DIR"))
+        if logs:
+            lines.append(logs)
+    else:
+        if doctor_ok and offer_copy_prompt:
+            lines += copy_prompt_actions()
+        cap = rift_action("Capture now", ["capture"], terminal=False, refresh=True)
+        if cap:
+            lines.append(cap)
+        st = rift_action("Open status", ["status"], terminal=True)
+        if st:
+            lines.append(st)
+        data = open_action("Open data folder", env("RIFT_DATA_DIR"))
+        if data:
+            lines.append(data)
+    lines.append("---")
+    lines.append(about_line())
+    if doctor_ok:
+        trouble = rift_action("Troubleshooting", ["doctor"], terminal=True)
+        if trouble:
+            lines.append(trouble)
+    lines.append("---")
+    lines.append("Refresh | refresh=true")
+    return lines
+
+
+# --- Top-level render -----------------------------------------------------
+
+
+def render_attention(doctor, health, lines):
+    """Render the 'needs attention' / indeterminate states.
+
+    Friend-safe by contract: the concrete repair always comes from the
+    doctor report (and the redacted prompt from `rift doctor --copy-prompt`,
+    wired into the footer). Doctor-powered actions are gated on a real report
+    existing — not on the rift binary resolving — so a present-but-broken CLI
+    never offers a fix it can't produce. We never emit launchd labels,
+    kickstart commands, or other operator internals.
+    """
+    doctor_ok = has_doctor_report(doctor)
+    broken_issues = []
+    if isinstance(doctor, dict):
+        broken_issues = [
+            i for i in (doctor.get("issues") or []) if i.get("severity") == "broken"
+        ]
+
+    if broken_issues:
+        # The doctor diagnosed something concrete — name it and surface the
+        # single repair action it chose.
+        lines.append("Rift needs attention")
+        lines.append("---")
+        for issue in broken_issues:
+            lines.append(f"✗ {issue.get('title', 'Something is wrong')}")
+        primary = doctor.get("primary") or broken_issues[0]
+        if primary.get("nextAction"):
+            lines.append("---")
+            lines.append(f"Fix: {primary['nextAction']}")
+    elif health == "down":
+        # Background engine isn't answering. Stay friend-safe: no launchctl,
+        # no daemon label. With no doctor report we also can't build a repair
+        # prompt, so say so plainly rather than offer dead doctor actions.
+        lines.append("Rift needs attention")
+        lines.append("---")
+        lines.append("Rift's background engine is not responding")
+        if not doctor_ok:
+            lines.append("Rift couldn't run a self-check — reopen Rift, then check below")
+    else:
+        # verdict unknown: couldn't even confirm health.
+        lines.append("Rift status unavailable")
+        lines.append("---")
+        lines.append("Rift couldn't reach its own tools to check")
+
+    lines += render_footer_actions(broken=True, doctor_ok=doctor_ok)
+    return lines
+
+
+def render(doctor, status, mcp, health, now):
+    friend = status.get("friend") if isinstance(status, dict) else None
+    verdict = verdict_of(doctor, health)
+    lines = [TITLES[verdict], "---"]
+
+    if verdict in ("broken", "unknown"):
+        return render_attention(doctor, health, lines)
+
+    # healthy or warning
+    lines.append("Rift is working")
+    lines += render_capture_rows(friend, now)
+
+    mem_rows = memory_section(mcp)
+    if mem_rows:
+        lines.append("---")
+        lines += mem_rows
+
+    client_rows = render_client_rows(status, doctor)
+    if client_rows:
+        lines.append("---")
+        lines += client_rows
+        if not has_voyage_issue(doctor):
+            lines.append("Search index healthy")
+
+    advisories = render_advisories(doctor)
+    if advisories:
+        lines.append("---")
+        lines.append("Heads up:")
+        lines += advisories
+
+    lines += render_footer_actions(
+        broken=False,
+        doctor_ok=has_doctor_report(doctor),
+        offer_copy_prompt=has_repairable_warning(doctor),
+    )
+    return lines
+
+
+def main():
+    doctor = parse_json(env("RIFT_DOCTOR_JSON"))
+    status = parse_json(env("RIFT_STATUS_JSON"))
+    mcp = parse_json(env("RIFT_MCP_JSON"))
+    health = env("RIFT_HEALTH")
+    for line in render(doctor, status, mcp, health, now_ms()):
+        print(line)
+
+
+if __name__ == "__main__":
+    main()

package/operator/swiftbar/rift.10s.sh

@@ -0,0 +1,176 @@
+#!/usr/bin/env bash
+#
+# SwiftBar plugin — Rift friend-facing heartbeat.
+#
+# Answers one question at a glance: "Is Rift working?" Operator telemetry
+# (MCP counters, launchd labels, Node versions, commits) is intentionally
+# absent — run `rift status` / `rift doctor` for that. The verdict and the
+# one repair action come from `rift doctor`; the repair PROMPT is generated
+# by `rift doctor --copy-prompt` (never hardcoded here), so redaction and
+# diagnosis stay centralized in the CLI.
+#
+# Install:
+#   rift menubar install
+#
+# Overrides:
+#   RIFT_BASE_URL   default http://127.0.0.1:3577
+#   RIFT_LOG_DIR    default ~/Library/Application Support/Rift/logs
+#   RIFT_DATA_DIR   default ~/Library/Application Support/Rift/data
+#   RIFT_ABOUT_URL  default https://getrift.dev/about
+#
+# Reads live daemon state on every tick. Never caches.
+
+set -u
+
+BASE_URL="${RIFT_BASE_URL:-http://127.0.0.1:3577}"
+ABOUT_URL="${RIFT_ABOUT_URL:-https://getrift.dev/about}"
+
+# Resolve script path even when invoked via symlink, so the plugin can
+# sit in SwiftBar's plugins dir and still open the repo's logs/data dirs
+# and find render-menu.py next to itself.
+SOURCE="${BASH_SOURCE[0]}"
+while [[ -L "$SOURCE" ]]; do
+  DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
+  SOURCE="$(readlink "$SOURCE")"
+  [[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE"
+done
+SCRIPT_DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
+RIFT_HOME_DEFAULT="${HOME}/Library/Application Support/Rift"
+
+# Packaged (.pkg) install layout — bundled Node + app tree under Rift home,
+# a bash CLI shim at ~/.rift/bin/rift, daemon logs under ~/Library/Logs/Rift.
+# Detect it so the menu bar works on a BARE Mac with NO env injection: the
+# `rift menubar install` env (RIFT_BIN/NODE_BIN) does NOT persist into the
+# installed plugin, so the plugin must self-resolve these paths every tick.
+PACKAGED_NODE="${RIFT_HOME_DEFAULT}/node/bin/node"
+PACKAGED_JS="${RIFT_HOME_DEFAULT}/app/dist/src/cli/index.js"
+PACKAGED_SHIM="${HOME}/.rift/bin/rift"
+if [[ -f "$PACKAGED_JS" && -x "$PACKAGED_NODE" ]]; then
+  PACKAGED_LOG_DIR="${HOME}/Library/Logs/Rift"
+else
+  PACKAGED_LOG_DIR=""
+fi
+
+LOG_DIR="${RIFT_LOG_DIR:-${PACKAGED_LOG_DIR:-${RIFT_HOME_DEFAULT}/logs}}"
+DATA_DIR="${RIFT_DATA_DIR:-${RIFT_HOME_DEFAULT}/data}"
+RENDERER="$SCRIPT_DIR/render-menu.py"
+
+# Resolve the rift CLI. SwiftBar invokes shell commands with a stripped
+# PATH, so menu actions need absolute paths end-to-end. We resolve:
+#   - NODE_BIN: an absolute node binary (bundled Node preferred), so actions
+#     don't depend on PATH and work on a Mac with no system Node.
+#   - RIFT_JS:  the real JS entrypoint to pass as node's first arg. NEVER the
+#     bash shim — `node <bash-file>` fails — so we accept only a *.js target
+#     and prefer the packaged app entrypoint directly.
+#   - RIFT_BIN: an executable `rift` launcher (diagnostics + fallback). The
+#     packaged shim is a valid launcher when run DIRECTLY (it is not JS).
+# REPO_ROOT only resolves to anything in a dev checkout; default it to empty
+# so the dev-only candidate below is a harmless no-op under `set -u` on
+# packaged/npm installs, where it is never set.
+REPO_ROOT="${REPO_ROOT:-}"
+
+NODE_BIN="${NODE_BIN:-}"
+if [[ -z "$NODE_BIN" ]]; then
+  for candidate in \
+    "$PACKAGED_NODE" \
+    "/opt/homebrew/bin/node" \
+    "/usr/local/bin/node" \
+    "/usr/bin/node"; do
+    if [[ -x "$candidate" ]]; then
+      NODE_BIN="$candidate"
+      break
+    fi
+  done
+fi
+
+RIFT_BIN="${RIFT_BIN:-}"
+if [[ -z "$RIFT_BIN" ]]; then
+  for candidate in \
+    "$PACKAGED_SHIM" \
+    "/opt/homebrew/bin/rift" \
+    "/usr/local/bin/rift" \
+    "$HOME/.npm-global/bin/rift" \
+    "$HOME/.local/bin/rift" \
+    "$REPO_ROOT/node_modules/.bin/rift"; do
+    if [[ -x "$candidate" ]]; then
+      RIFT_BIN="$candidate"
+      break
+    fi
+  done
+fi
+
+RIFT_JS="${RIFT_JS:-}"
+# Packaged app entrypoint is authoritative when present.
+if [[ -z "$RIFT_JS" && -f "$PACKAGED_JS" ]]; then
+  RIFT_JS="$PACKAGED_JS"
+fi
+# Otherwise follow RIFT_BIN's symlink chain to the real entrypoint — but
+# only accept a *.js target, so a bash launcher (the packaged shim, or an
+# on-PATH wrapper) is never handed to `node` as a script.
+if [[ -z "$RIFT_JS" && -n "$RIFT_BIN" ]]; then
+  target="$RIFT_BIN"
+  while [[ -L "$target" ]]; do
+    link_dir="$(cd -P "$(dirname "$target")" && pwd)"
+    link_target="$(readlink "$target")"
+    if [[ "$link_target" = /* ]]; then
+      target="$link_target"
+    else
+      target="$link_dir/$link_target"
+    fi
+  done
+  if [[ -f "$target" && "$target" == *.js ]]; then
+    RIFT_JS="$target"
+  fi
+fi
+
+# Run a rift subcommand, preferring node + JS entrypoint (PATH-independent),
+# falling back to the launcher. Prints stdout; swallows stderr. Returns the
+# command's exit code, or 127 when rift can't be resolved at all.
+run_rift() {
+  if [[ -n "$RIFT_JS" && -n "$NODE_BIN" ]]; then
+    "$NODE_BIN" "$RIFT_JS" "$@" 2>/dev/null
+    return $?
+  fi
+  if [[ -n "$RIFT_BIN" ]]; then
+    "$RIFT_BIN" "$@" 2>/dev/null
+    return $?
+  fi
+  return 127
+}
+
+# --- Gather state ---
+# doctor --json is the canonical verdict + one fix (exits non-zero when
+# broken, but still prints a valid report on stdout — capture regardless).
+RIFT_DOCTOR_JSON="$(run_rift doctor --json || true)"
+RIFT_STATUS_JSON="$(run_rift status --json --no-capability-map || true)"
+# Memory-today is a delight metric from an unauthenticated endpoint.
+RIFT_MCP_JSON="$(curl -fsS -m 2 "$BASE_URL/stats/mcp-usage" 2>/dev/null || true)"
+# Coarse health probe — only consulted by the renderer when the doctor
+# report is unavailable (rift CLI not resolvable on this machine).
+if curl -fsS -m 2 "$BASE_URL/health" >/dev/null 2>&1; then
+  RIFT_HEALTH="up"
+else
+  RIFT_HEALTH="down"
+fi
+
+export RIFT_DOCTOR_JSON RIFT_STATUS_JSON RIFT_MCP_JSON RIFT_HEALTH
+export RIFT_NODE_BIN="$NODE_BIN" RIFT_JS RIFT_BIN
+export RIFT_LOG_DIR="$LOG_DIR" RIFT_DATA_DIR="$DATA_DIR" RIFT_ABOUT_URL="$ABOUT_URL"
+
+# --- Render ---
+if [[ -f "$RENDERER" ]]; then
+  /usr/bin/python3 "$RENDERER"
+else
+  # Renderer missing (broken install). Degrade to a minimal, honest menu
+  # rather than a blank one.
+  if [[ "$RIFT_HEALTH" == "up" ]]; then
+    echo "rift | sfimage=circle.fill sfcolor=systemGreen"
+  else
+    echo "rift | sfimage=exclamationmark.triangle.fill sfcolor=systemRed"
+  fi
+  echo "---"
+  echo "Menu renderer missing — reinstall Rift menu bar"
+  echo "Open logs | shell=/usr/bin/open param1=\"$LOG_DIR\" terminal=false"
+  echo "About Rift | href=$ABOUT_URL"
+  echo "Refresh | refresh=true"
+fi