v1.1.48: Sprite Shift race on Mission Control + version stamping fixed

The race board ships to everyone (K.: 'I don't want the sprite race to
stay private'): Mission Control renders the REAL /v1/leaderboard —
proportional lane (miles / leader), rank list, invite-a-friend — fetched
natively off the state-push path; the card hides until real data loads.
Preview: onboarding.html?race=1.

Version stamping: releases 1.1.45-47 shipped bundles self-identifying
as 1.1.24 (three hand-synced version copies drifted). Now heard/
__init__.py is the one source (setup.py derives from it) and the
release workflow refuses to publish when the tag, __init__, and
pyproject disagree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015291sbAoHDRCaem2jQda3B

Author: sodiumsun

.github/workflows/release.yml

@@ -25,6 +25,17 @@ jobs:
           # Install Heard + its runtime deps so py2app can collect them.
           pip install -e ".[dev]"
 
+      - name: Version gate (tag must match the code)
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          TAG="${GITHUB_REF#refs/tags/v}"
+          CODE=$(python -c "import re; print(re.search(r'__version__ = \"([^\"]+)\"', open('heard/__init__.py').read()).group(1))")
+          PYPROJ=$(python -c "import re; print(re.search(r'^version = \"([^\"]+)\"', open('pyproject.toml').read(), re.M).group(1))")
+          if [ "$TAG" != "$CODE" ] || [ "$TAG" != "$PYPROJ" ]; then
+            echo "::error::tag v$TAG vs __init__.py $CODE vs pyproject $PYPROJ — all three must match (releases 1.1.45-47 shipped self-identifying as 1.1.24)"
+            exit 1
+          fi
+
       - name: Test gate (don't ship a broken build)
         run: |
           ruff check heard/ tests/

heard/__init__.py

@@ -10,7 +10,7 @@
 # bundle the updater reads CFBundleShortVersionString from Info.plist
 # instead, so a missed bump here won't trigger a phantom "update"
 # banner — see heard.updater.resolved_current_version.)
-__version__ = "1.1.24"
+__version__ = "1.1.48"
 
 # The frozen Python inside Heard.app has no system CA path, so any
 # HTTPS call (urllib voice download, anthropic SDK, elevenlabs SDK)

heard/home_window.py

@@ -95,6 +95,98 @@ def show_home(start: str | None = None) -> None:
         pass
 
 
+# Sprite Shift board cache — fetched in a background thread when the window
+# loads (and after an invite), never on the state-push path, so _current_state
+# stays network-free. None until the first successful fetch; the page hides
+# the race card while it's None (no fake data, ever).
+_LEADERBOARD: dict[str, Any] | None = None
+
+
+def _cloud_auth() -> tuple[str, str] | None:
+    cfg = config.load()
+    token = (cfg.get("heard_token") or "").strip()
+    if not token:
+        return None
+    base = (cfg.get("heard_api_base") or "https://api.heard.dev").rstrip("/")
+    return base, token
+
+
+def _fetch_leaderboard(on_done) -> None:
+    """GET /v1/leaderboard on a worker thread → cache → on_done() on the main
+    thread. Best-effort: any failure leaves the cache as-is."""
+    auth = _cloud_auth()
+    if auth is None:
+        return
+
+    def work():
+        global _LEADERBOARD
+        import ssl
+        import urllib.request
+
+        base, token = auth
+        try:
+            try:
+                import certifi  # type: ignore
+
+                ctx = ssl.create_default_context(cafile=certifi.where())
+            except ImportError:
+                ctx = ssl.create_default_context()
+            req = urllib.request.Request(
+                f"{base}/v1/leaderboard",
+                headers={"Authorization": f"Bearer {token}"},
+            )
+            with urllib.request.urlopen(req, timeout=8.0, context=ctx) as resp:
+                data = json.loads(resp.read().decode("utf-8") or "{}")
+            if isinstance(data, dict) and isinstance(data.get("standings"), list):
+                _LEADERBOARD = data
+                from PyObjCTools import AppHelper
+
+                AppHelper.callAfter(on_done)
+        except Exception:
+            pass
+
+    import threading
+
+    threading.Thread(target=work, daemon=True).start()
+
+
+def _send_invite(email: str, on_done) -> None:
+    """POST /v1/referrals/invite on a worker thread, then refresh the board."""
+    auth = _cloud_auth()
+    if auth is None:
+        return
+
+    def work():
+        import ssl
+        import urllib.request
+
+        base, token = auth
+        try:
+            try:
+                import certifi  # type: ignore
+
+                ctx = ssl.create_default_context(cafile=certifi.where())
+            except ImportError:
+                ctx = ssl.create_default_context()
+            req = urllib.request.Request(
+                f"{base}/v1/referrals/invite",
+                data=json.dumps({"email": email}).encode(),
+                method="POST",
+                headers={
+                    "Authorization": f"Bearer {token}",
+                    "Content-Type": "application/json",
+                },
+            )
+            urllib.request.urlopen(req, timeout=10.0, context=ctx).close()
+        except Exception:
+            pass
+        _fetch_leaderboard(on_done)
+
+    import threading
+
+    threading.Thread(target=work, daemon=True).start()
+
+
 def _current_state() -> dict[str, Any]:
     """Snapshot the real app state the page renders from. Pure config reads +
     cheap filesystem checks — no network. Never includes anything analytics
@@ -136,6 +228,9 @@ def _current_state() -> dict[str, Any]:
         },
         "micGranted": _mic_granted(),
         "axGranted": _ax_granted(),
+        # Sprite Shift race — REAL standings from /v1/leaderboard (async cache;
+        # None hides the card). Same board the Power app renders.
+        "leaderboard": _LEADERBOARD,
         "voice": cfg.get("voice") or None,
         "speed": float(cfg.get("speed") or 1.0),
         "verbosity": cfg.get("verbosity") or "normal",
@@ -661,6 +756,12 @@ def _push_state(self):
         # WKNavigationDelegate — push state once the page is ready
         def webView_didFinishNavigation_(self, web, nav):
             self._push_state()
+            _fetch_leaderboard(self._push_state)
+
+        def _act_invite_friend(self, body):
+            email = str(body.get("email") or "").strip()
+            if "@" in email and "." in email:
+                _send_invite(email, self._push_state)
 
         # WKScriptMessageHandler — web → native
         def userContentController_didReceiveScriptMessage_(self, ucc, message):

heard/onboarding.html

@@ -403,6 +403,11 @@
   if(q.get('plan')){ S.plan=q.get('plan'); S.signedIn=q.get('plan')!=='free'; S.email='you@example.com'; }
   if(q.get('upgrade')){ S.plan='power'; S.onboardedPlan='pro'; S.signedIn=true; }
   if(q.get('trial')){ S.trialDaysLeft=14; }
+  if(q.get('race')){ S.leaderboard={clubSize:4,currentRank:2,standings:[
+    {name:'#1 power user',running_seconds:22095,isCurrent:false,rank:1},
+    {name:'You',running_seconds:18000,isCurrent:true,rank:2},
+    {name:'Kelly (Founder)',running_seconds:18000,isCurrent:false,rank:3},
+    {name:'Maya',running_seconds:0,isCurrent:false,rank:4}]}; }
   // ?view=home&connect=codex|claude|both — preview the "installed but not
   // connected" nudge without a backend.
   if(q.get('connect')){ const c=q.get('connect');
@@ -465,6 +470,7 @@
 const HOME_PANES = ['mission','transcript','settings'];
 const _initialPane = new URLSearchParams(location.search).get('pane');
 let navHome = HOME_PANES.includes(_initialPane) ? _initialPane : 'mission';
+let raceListOpen = false, raceInviteOpen = false, raceInviteSent = false;
 let forceHome = HOME_PANES.includes(_initialPane);
 window.__heard.openHome = function(pane){
   forceHome = true;
@@ -620,6 +626,82 @@
   ],
 };
 const PILL = {speaking:'SPEAKING',building:'BUILDING',await:'AWAITING YOU',blocked:'BLOCKED',idle:'IDLE'};
+const RACE_PAL = ['#7898C8','#9A82C2','#5CA4AA','#C4B25E','#7D8EA5','#A89B8E'];
+function raceSlime(color, size){
+  return `<svg viewBox="0 0 16 13" style="width:${size}px;height:${Math.round(size*13/16)}px;display:block" aria-hidden="true">
+    <path fill="${color}" d="M5 1h6v1h2v1h1v2h1v5H1V5h1V3h1V2h2z"/>
+    <rect x="2" y="11" width="4" height="1.6" fill="${color}" opacity=".5"/>
+    <rect x="10" y="11" width="4" height="1.6" fill="${color}" opacity=".5"/>
+    <rect x="5" y="5" width="2" height="2.6" fill="#20242b"/>
+    <rect x="9" y="5" width="2" height="2.6" fill="#20242b"/>
+  </svg>`;
+}
+function raceCard(){
+  const LB = S.leaderboard;
+  if(!LB || !Array.isArray(LB.standings) || !LB.standings.length) return '';
+  const mono = "font-family:var(--mono);letter-spacing:.12em;text-transform:uppercase";
+  const sec = s => Number(s.running_seconds)||0;
+  const mi = s => (sec(s)/3600*5.2);
+  const mtxt = s => mi(s).toFixed(1)+' mi';
+  const you = LB.standings.find(s=>s.isCurrent) || LB.standings[0];
+  const yh = sec(you)/3600;
+  const hours = Math.floor(yh)+'h '+String(Math.round((yh%1)*60)).padStart(2,'0')+'m';
+  const visible = LB.standings.slice(0,6);
+  const maxSec = Math.max(1, ...visible.map(sec));
+  const seen=[]; let fp=0;
+  const sprites = visible.map(s=>{
+    // A true running lane: position = miles / leader's miles; exact ties get a
+    // tiny stagger so overlapping sprites both stay visible.
+    let p = 0.05 + 0.86*(sec(s)/maxSec);
+    while(seen.some(q=>Math.abs(q-p)<0.012)) p-=0.028;
+    p=Math.max(0.01,p); seen.push(p);
+    const color = s.isCurrent? RACE_PAL[0] : RACE_PAL[1+(fp++)%(RACE_PAL.length-1)];
+    const chip = s.isCurrent
+      ? `<span style="position:absolute;bottom:34px;left:50%;transform:translateX(-50%);white-space:nowrap;background:var(--ink);color:#fff;${mono};font-size:8.5px;font-weight:700;padding:4px 7px;border-radius:5px">You · ${mtxt(s)}</span>`
+      : '';
+    return `<span title="${s.name} · ${mtxt(s)}" style="position:absolute;left:${(p*100).toFixed(1)}%;bottom:2px;width:36px;margin-left:-18px;z-index:${s.isCurrent?3:2}">${chip}${raceSlime(color,36)}</span>`;
+  }).join('');
+  const rows = LB.standings.map(s=>`<div style="display:flex;align-items:center;gap:10px;padding:8px 2px;border-top:1px solid var(--line)">
+      <span style="${mono};font-size:9px;font-weight:700;color:var(--terra)">${String(s.rank).padStart(2,'0')}</span>
+      <span style="font-size:12.5px;font-weight:600">${s.isCurrent?s.name+' · you':s.name}</span>
+      <span style="margin-left:auto;font-size:12px;color:var(--ink-2)">${mtxt(s)}</span>
+    </div>`).join('');
+  return `<section style="margin-top:18px;background:var(--card);border:1px solid var(--line);border-radius:14px;padding:20px 22px">
+    <div style="display:flex;align-items:flex-start;gap:12px">
+      <div style="flex:1;min-width:0">
+        <div style="${mono};font-size:10px;font-weight:500;color:var(--ink-3)">Sprite shift</div>
+        <div style="font-family:var(--serif);font-size:20px;margin-top:2px">Blue’s monthly run</div>
+        <div style="font-size:12px;color:var(--ink-3);margin-top:2px">Compare running hours with friends. Who worked hardest?</div>
+      </div>
+      <button style="${mono};font-size:8.5px;font-weight:700;color:var(--ink-2);background:none;border:1px solid var(--line);border-radius:6px;padding:0 10px;height:30px;cursor:pointer" onclick="raceListOpen=!raceListOpen;raceInviteOpen=false;renderHome()">Rank ${LB.currentRank} / ${LB.clubSize}</button>
+      <button style="${mono};font-size:8.5px;font-weight:700;color:#fff;background:var(--ink);border:none;border-radius:6px;padding:0 10px;height:30px;cursor:pointer" onclick="raceInviteOpen=!raceInviteOpen;raceListOpen=false;raceInviteSent=false;renderHome()">+ Invite friends</button>
+    </div>
+    <div style="display:flex;gap:22px;align-items:center;margin-top:15px">
+      <div><div style="font-size:23px;font-weight:700;letter-spacing:-.5px">${hours}</div><div style="font-size:9.5px;color:var(--ink-3)">estimated running</div></div>
+      <div style="width:1px;height:36px;background:var(--line)"></div>
+      <div><div style="font-size:23px;font-weight:700;letter-spacing:-.5px">${mtxt(you)}</div><div style="font-size:9.5px;color:var(--ink-3)">miles covered</div></div>
+    </div>
+    <div style="position:relative;height:74px;margin-top:8px">
+      <div style="position:absolute;left:0;right:14px;bottom:14px;border-top:2px dashed var(--line)"></div>
+      <svg viewBox="0 0 8 24" style="position:absolute;right:0;bottom:8px;width:9px;height:27px"><path fill="var(--ink)" d="M1 0h1v24H1zM2 0h3v3H2zM5 3h3v3H5zM2 6h3v3H2zM5 9h3v3H5z"/></svg>
+      ${sprites}
+    </div>
+    ${raceListOpen?`<div style="margin-top:10px">${rows}</div>`:''}
+    ${raceInviteOpen?`<div style="margin-top:12px;padding-top:12px;border-top:1px solid var(--line)">
+      ${raceInviteSent
+        ? `<div style="font-size:12.5px;font-weight:600">Challenge sent 💪 <span style="font-weight:400;color:var(--ink-3)">They’ll show up on your board once they join.</span></div>`
+        : `<div style="display:flex;gap:8px"><input id="race-invite-email" type="email" placeholder="friend@email.com" style="flex:1;padding:9px 12px;border:1px solid var(--line);border-radius:8px;font-size:13px;background:#fff" onkeydown="if(event.key==='Enter')sendRaceInvite()"><button class="brand-button" onclick="sendRaceInvite()">Send</button></div>
+           <div style="font-size:10px;color:var(--ink-3);margin-top:7px">We’ll email them your invite link and dare them to out-work you. Only rank, miles, and running hours are shared.</div>`}
+    </div>`:''}
+  </section>`;
+}
+function sendRaceInvite(){
+  const el=document.getElementById('race-invite-email');
+  const v=(el&&el.value||'').trim();
+  if(!v||v.indexOf('@')<0||v.indexOf('.')<0) return;
+  bridge('invite_friend',{email:v});
+  raceInviteSent=true; renderHome();
+}
 function renderHome(){
   // In the app S.home is REAL (daemon + history). Only use the design sample
   // when it's absent (browser preview) — never show fake projects to the user.
@@ -671,6 +753,11 @@
           </div>`).join('')}</div>`
       : (recap?'':empty('No agents working right now', 'Mission Control lights up when your agents are running.'))}`;
 
+  // Sprite Shift — the monthly race, REAL data only (S.leaderboard is fetched
+  // natively from /v1/leaderboard; while absent the card simply isn't shown).
+  // Same board + proportional lane as the Power app's native panel.
+  document.getElementById('v-mission').insertAdjacentHTML('beforeend', raceCard());
+
   // Transcript
   document.getElementById('v-transcript').innerHTML = `<div class="h-pad"><div class="h-h">Transcript</div>
     ${transcript.length

packaging/setup.py

@@ -24,7 +24,15 @@
 from setuptools import setup  # noqa: E402
 
 APP_NAME = "Heard"
-APP_VERSION = "1.1.24"
+# Version comes from heard/__init__.py — the ONE source of truth. The bundle's
+# CFBundleShortVersionString is stamped from here, and the release workflow
+# refuses to publish when the pushed tag disagrees, so tag / bundle / code can
+# never drift again (releases v1.1.45-47 all shipped self-identifying as
+# 1.1.24, which would have broken the min_app_version forced-update handshake).
+import re as _re
+
+with open(os.path.join(os.path.dirname(HERE), "heard", "__init__.py")) as _fh:
+    APP_VERSION = _re.search(r'__version__ = "([^"]+)"', _fh.read()).group(1)
 APP_BUNDLE_ID = "dev.heard.menubar"
 
 APP = [os.path.join(HERE, "app_entry.py")]

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "heard"
-version = "1.1.24"
+version = "1.1.48"
 description = "A voice companion for your AI coding agents. Heard speaks your agent's replies so you can keep working."
 readme = "README.md"
 license = { text = "Apache-2.0" }