fix(ai-quotas): place readout left of system icons + harden codex fetch

1. Menu-bar placement. The AI Quotas readout forced "Preferred Position"
   0 (far right), landing it to the RIGHT of Spotlight, among the system
   icons. Place it just inside Ice's Visible control item instead — the
   leftmost always-visible slot — so it sits to the LEFT of the system
   icons (Spotlight, Control Center, clock) while staying on-screen.
   (Left of the Visible control item is Ice's wide divider → off-screen,
   so that is the limit.) Also stop clobbering the position on every
   launch: the old ">100 → reset to 0" rule snapped any manual drag back
   to the far right. A one-time migration now relocates existing installs,
   then manual drags are respected and only an off-screen position
   self-heals.

2. Codex "?" robustness. runProcess resumed from the terminationHandler
   using a snapshot that could race the readabilityHandler's final chunk
   → empty/truncated stdout → spurious "?". Read stdout to EOF after exit
   instead (codexbar output is a few KB, no deadlock risk). Also
   defensively trim any non-JSON prefix before decoding.

Bump to 0.11.13-fire.9.7 (build 1143).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: pdurlej

Ice.xcodeproj/project.pbxproj

@@ -520,7 +520,7 @@
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1142;
+				CURRENT_PROJECT_VERSION = 1143;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "";
 				ENABLE_APP_SANDBOX = NO;
@@ -536,7 +536,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = "0.11.13-fire.9.6";
+				MARKETING_VERSION = "0.11.13-fire.9.7";
 				PRODUCT_BUNDLE_IDENTIFIER = com.jordanbaird.Ice;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -553,7 +553,7 @@
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1142;
+				CURRENT_PROJECT_VERSION = 1143;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "";
 				ENABLE_APP_SANDBOX = NO;
@@ -569,7 +569,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = "0.11.13-fire.9.6";
+				MARKETING_VERSION = "0.11.13-fire.9.7";
 				PRODUCT_BUNDLE_IDENTIFIER = com.jordanbaird.Ice;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_EMIT_LOC_STRINGS = YES;

Ice/AIQuotas/AIQuotaStatusItemController.swift

@@ -41,6 +41,18 @@ final class AIQuotaStatusItemController {
     /// control items and makes its window title recognizable.
     static let autosaveName = "Ice.ControlItem.AIQuotas"
 
+    /// UserDefaults flag: set once we've moved the item to the leftmost
+    /// visible slot (fire.9.7). Older builds forced position 0 (far right,
+    /// right of Spotlight); this one-time migration relocates existing
+    /// installs, after which manual drags are respected.
+    private static let positionMigratedKey = "AIQuotasPositionLeftOfSystemV1"
+
+    /// UserDefaults key holding Ice's own Visible control item position —
+    /// the left edge of the always-visible zone. We read it to place AI
+    /// Quotas just inside it. (We run inside Ice, so it's our own domain.)
+    private static let visibleControlItemPositionKey =
+        "NSStatusItem Preferred Position Ice.ControlItem.Visible"
+
     private var statusItem: NSStatusItem?
     private let logger = Logger(category: "AIQuota.StatusItem")
 
@@ -53,16 +65,40 @@ final class AIQuotaStatusItemController {
     private func ensureStatusItem() -> NSStatusItem {
         if let statusItem { return statusItem }
 
-        // STEP 1 — force a low preferred position BEFORE creation. macOS
-        // places items with a lower preferred position toward the
-        // trailing (visible, clock-adjacent) edge. Ice's visible control
-        // item uses 0 for exactly this reason. We set it if unset or if
-        // a previous build left it parked far left (a large value).
+        // STEP 1 — choose the preferred position BEFORE creation (setting
+        // it afterward is a no-op). macOS places lower preferred positions
+        // toward the trailing/right (visible) edge, higher ones toward the
+        // leading/left edge.
+        //
+        // Goal: land AI Quotas as the LEFTMOST always-visible element, just
+        // inside Ice's Visible control item (the "•••"), so it sits to the
+        // LEFT of the system icons (Spotlight, Control Center, clock) yet
+        // stays on-screen. Left of the Visible control item is Ice's wide
+        // section divider, which pushes items off-screen — so this is as
+        // far left as a visible item can go.
         let defaults = UserDefaults.standard
+        let visiblePos = defaults.object(forKey: Self.visibleControlItemPositionKey) as? Double
+        // Just inside the Visible control item. Fall back to 0 (guaranteed
+        // visible, far right) only if Ice hasn't persisted its own position
+        // yet — the self-heal below corrects it on a later launch.
+        let target = visiblePos.map { $0 - 1 } ?? 0
         let current = defaults.object(forKey: preferredPositionKey) as? Double
-        if current == nil || (current ?? 0) > 100 {
-            defaults.set(0.0, forKey: preferredPositionKey)
-            logger.debug("Forced AI Quotas preferred position to 0 (was \(String(describing: current)))")
+
+        let needsPlacement: Bool
+        if !defaults.bool(forKey: Self.positionMigratedKey) {
+            needsPlacement = true                       // one-time migration
+            defaults.set(true, forKey: Self.positionMigratedKey)
+        } else if let current {
+            // Re-place only if parked off-screen (left of the Visible
+            // control item, behind Ice's divider). Otherwise respect the
+            // user's manual placement so drags stick.
+            needsPlacement = visiblePos.map { current > $0 } ?? false
+        } else {
+            needsPlacement = true                       // unset
+        }
+        if needsPlacement {
+            defaults.set(target, forKey: preferredPositionKey)
+            logger.debug("Set AI Quotas preferred position to \(target) (was \(String(describing: current)))")
         }
 
         let item = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)

Ice/AIQuotas/CodexBarCLIQuotaBackend.swift

@@ -121,32 +121,23 @@ struct CodexBarCLIQuotaBackend: AIQuotaBackend {
         process.standardOutput = stdout
         process.standardError = stderr
 
-        // Read pipes on background queues to avoid a deadlock when the
-        // child writes more than a pipe buffer's worth before exit.
-        let stdoutData = LockedData()
-        stdout.fileHandleForReading.readabilityHandler = { handle in
-            let chunk = handle.availableData
-            if chunk.isEmpty {
-                handle.readabilityHandler = nil
-            } else {
-                stdoutData.append(chunk)
-            }
-        }
-        // Drain stderr so the child never blocks on a full stderr pipe.
-        stderr.fileHandleForReading.readabilityHandler = { handle in
-            if handle.availableData.isEmpty { handle.readabilityHandler = nil }
-        }
-
         return try await withThrowingTaskGroup(of: Data.self) { group in
             group.addTask {
-                try await withCheckedThrowingContinuation { continuation in
+                try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Data, Error>) in
                     process.terminationHandler = { proc in
-                        // Give the readability handler a beat to flush.
-                        let status = proc.terminationStatus
-                        if status == 0 {
-                            continuation.resume(returning: stdoutData.snapshot())
+                        // Read stdout to EOF *after* the process exits, so we
+                        // never resume on a partially-flushed pipe. The old
+                        // readabilityHandler + snapshot path could race the
+                        // final chunk and resume with empty/truncated JSON →
+                        // a spurious "?" in the menu bar. codexbar's output is
+                        // a few KB, well under the 64KB pipe buffer, so reading
+                        // post-exit cannot deadlock.
+                        let out = stdout.fileHandleForReading.readDataToEndOfFile()
+                        _ = stderr.fileHandleForReading.readDataToEndOfFile()  // drain
+                        if proc.terminationStatus == 0 {
+                            continuation.resume(returning: out)
                         } else {
-                            continuation.resume(throwing: ProcessError.nonZeroExit(status))
+                            continuation.resume(throwing: ProcessError.nonZeroExit(proc.terminationStatus))
                         }
                     }
                     do {
@@ -172,25 +163,16 @@ struct CodexBarCLIQuotaBackend: AIQuotaBackend {
         }
     }
 
-    /// Thread-safe accumulator for piped stdout chunks.
-    private final class LockedData: @unchecked Sendable {
-        private let lock = NSLock()
-        private var data = Data()
-        func append(_ chunk: Data) {
-            lock.lock(); defer { lock.unlock() }
-            data.append(chunk)
-        }
-        func snapshot() -> Data {
-            lock.lock(); defer { lock.unlock() }
-            return data
-        }
-    }
-
     // MARK: Parsing (pure, unit-testable)
 
     /// Parses CodexBar CLI JSON (object or array) into a snapshot.
     /// Pure function: no I/O, so tests can feed it fixtures.
-    static func parse(data: Data, provider: AIQuotaProvider) -> AIQuotaSnapshot {
+    static func parse(data rawData: Data, provider: AIQuotaProvider) -> AIQuotaSnapshot {
+        // Defensive: trim any non-JSON noise before the first top-level
+        // opener. Status lines like "[codex notify] …" belong on stderr
+        // (which we drop), but if one ever lands on stdout this keeps the
+        // decode from failing.
+        let data = Self.jsonSlice(of: rawData)
         guard !data.isEmpty else {
             return .failure(provider, "empty CLI output")
         }
@@ -238,6 +220,32 @@ struct CodexBarCLIQuotaBackend: AIQuotaBackend {
         )
     }
 
+    /// Returns the data starting at the first byte that actually begins
+    /// JSON: a '[' or '{' whose next non-whitespace byte is JSON-structural
+    /// (so a log line such as "[codex notify] …", where '[' is followed by a
+    /// letter, is skipped). Returns the input unchanged if none is found.
+    static func jsonSlice(of data: Data) -> Data {
+        let bytes = [UInt8](data)
+        func isWS(_ b: UInt8) -> Bool { b == 0x20 || b == 0x09 || b == 0x0A || b == 0x0D }
+        func looksLikeJSONStart(after i: Int) -> Bool {
+            var j = i + 1
+            while j < bytes.count, isWS(bytes[j]) { j += 1 }
+            guard j < bytes.count else { return false }
+            let b = bytes[j]
+            return b == UInt8(ascii: "{") || b == UInt8(ascii: "[")
+                || b == UInt8(ascii: "\"") || b == UInt8(ascii: "}") || b == UInt8(ascii: "]")
+                || (b >= UInt8(ascii: "0") && b <= UInt8(ascii: "9")) || b == UInt8(ascii: "-")
+                || b == UInt8(ascii: "t") || b == UInt8(ascii: "f") || b == UInt8(ascii: "n")
+        }
+        for i in bytes.indices {
+            let b = bytes[i]
+            if (b == UInt8(ascii: "[") || b == UInt8(ascii: "{")), looksLikeJSONStart(after: i) {
+                return Data(bytes[i...])
+            }
+        }
+        return data
+    }
+
     private static let isoFormatter = ISO8601DateFormatter()
 
     static func parseDate(_ string: String?) -> Date? {