Add agent-night-watch extension

[Yuchen07569]

Description

Agent Night Watch adds a manual Raycast menu-bar control for MacBook closed-lid sleep.

• Click the menu-bar coffee cup once to toggle Night Watch in normal states.
• Steam means SleepDisabled=1; no steam means normal sleep.
• The state is read back from pmset -g instead of inferred from a cached PID.
• Enabling requires the normal macOS administrator authorization dialog.
• Disabling is manual and verifies that SleepDisabled returned to 0.
• If another tool owns SleepDisabled=1, the extension opens a safety/status menu instead of overriding it.
• No privileged helper, sudoers rule, password storage, background network service, timer, or low-battery automation is installed.

Public commands:

• Toggle Night Watch — no-view command intended for a user-assigned hotkey.
• Night Watch Menu Bar — direct coffee-cup toggle with live state feedback and a safety menu for exceptional states.

This differs from ordinary caffeinate extensions: it is specifically designed for the macOS closed-lid sleep setting and uses SleepDisabled as the status truth.

Security hardening

• The privileged guard program is embedded into the authorization command before the password dialog; no user-writable script pathname is executed as root.
• The root process never creates, replaces, deletes, or redirects output to user-session files. It only checks a randomized stop signal for existence.
• Privileged executable paths are restricted to /usr/bin/pmset, /usr/bin/grep, and /bin/sleep.
• Readiness and ownership use pmset -g plus verified launcher identity, and the previous session schema is invalidated.

Testing

• 24 automated tests pass, including repeated menu-bar clicks, authorization cancellation, stale state, external ownership, shell injection, privileged command allowlisting, and a symlink-target regression test.
• npm run lint, npm run build, ShellCheck, Skill validation, secret scanning, and high-severity dependency audit pass in public CI.
• Manual macOS regression passed for click-to-enable, administrator authorization, steaming status, click-to-disable without a second authorization, SleepDisabled=0, and no remaining owned session.
• Physical closed-lid A/B test passed: enabled for 241 seconds with a maximum heartbeat gap of 6 seconds; disabled entered Clamshell Sleep for 92 seconds with a corresponding 95-second heartbeat gap.

Screencast

Watch the 36-second interaction screencast

SHA-256: 8a291ad69d0895707a407c3d2ff336044a8d1212d6a19b84fc3e2700d2ce4ed1

Checklist

• I read the extension guidelines
• I read the documentation about publishing
• I ran npm run build and tested this distribution build in Raycast
• I checked that files in the assets folder are used by the extension itself
• I checked that assets used in the README are placed outside of the metadata folder

[raycastbot]

Congratulations on your new Raycast extension! 🚀

We're currently experiencing a high volume of incoming requests. As a result, the initial review may take up to 15 business days.

Once the PR is approved and merged, the extension will be available on our Store.

[greptile-apps]

Greptile Summary

The PR adds the Agent Night Watch extension for manually controlling macOS closed-lid sleep.

• Provides hotkey and menu-bar commands backed by live pmset state.
• Embeds the privileged guard in the authorization command rather than executing a mutable script.
• Restricts the privileged guard to reading a stop marker and invoking fixed absolute executable paths.
• Adds session ownership, lock recovery, status classification, and regression tests.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported privileged-path and symlink-write vulnerabilities are no longer present and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
extensions/agent-night-watch/src/night-watch.ts	Coordinates status reads, session ownership, authorization, locking, start/stop behavior, and recovery; the previously reported mutable-script execution path is absent.
extensions/agent-night-watch/src/privileged-command.ts	Embeds the fixed privileged guard directly into the authorized command and limits it to fixed absolute command paths and a read-only stop-file check.
extensions/agent-night-watch/src/toggle-lock.ts	Defines lock-owner serialization and stale-lease handling; no eligible follow-up defect was established.
extensions/agent-night-watch/src/night-watch-menu.tsx	Exposes direct toggling for normal states and confines forced restoration to the external-state recovery menu.
extensions/agent-night-watch/tests/privileged-command.test.ts	Adds regression coverage for guard embedding, command allowlisting, path quoting, and avoidance of privileged writes to session paths.
extensions/agent-night-watch/package.json	Declares the macOS-only extension metadata and its no-view and menu-bar commands.

_{Reviews (5): Last reviewed commit: "fix: harden privileged guard execution" | Re-trigger Greptile}

[greptile-apps]

Root follows user-controlled symlinks

When another user-level process substitutes original, ready, reason, or stopped with a symlink, the root guard follows it during redirection or touch, modifying a protected target and causing system-file corruption or local privilege escalation. How this was verified: The root-executed guard writes predictable names inside a session directory that remains owned and writable by the invoking user, without securely creating or rejecting symlinks.

Prompt To Fix With AI

This is a comment left during a code review.
Path: extensions/agent-night-watch/assets/night-watch-guard.sh
Line: 38-41

Comment:
**Root follows user-controlled symlinks**

When another user-level process substitutes `original`, `ready`, `reason`, or `stopped` with a symlink, the root guard follows it during redirection or `touch`, modifying a protected target and causing system-file corruption or local privilege escalation. **How this was verified:** The root-executed guard writes predictable names inside a session directory that remains owned and writable by the invoking user, without securely creating or rejecting symlinks.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.