[adamXbot]

Follows #26, which brought the shared surface code into the repository without changing a screen. This change moves the app's Settings, About, menus, Help and the watch-mode menu bar item onto that code, refreshes the copy to version 6, and adds the bundled manual.

What changed per surface

Settings — Settings { SurfaceSettings(app:panes:) } with the four panes the standard keeps for this app: General, Helper, VM agent, Updates. Each is grouped-form sections; the scaffold adds the About button to General.

• General: run history (auto-save toggle with ⓘ, saved-run count, Show in Finder, Delete All Runs… now gated by a confirmation and a typed DELETE), analysis cache (Clear Cache… behind a confirmation), and the standard Menu bar section with the watch-mode icon picker reading the existing watchModeIconStyle key, plus a live status row. The onboarding replay row moved to Help.
• Helper: the same status, version and actions, with the "how it works" text behind ⓘ and Uninstall Helper… behind a confirmation.
• VM agent: the same functional rows (build/reveal/rebuild the installer image, detected VM tools and their VMs, guest agent address and test, run in VM, decompile in VM) on four sections; the walkthrough prose moved into ⓘ popovers and the manual's VM mode chapter.
• Updates: SurfacePane.updates(SurfaceUpdates(driver: updater, releaseNotes:)), automatic checks off until turned on (SUEnableAutomaticChecks was already false). A Homebrew Cask install gets a section above it with the brew upgrade --cask command; automatic checks are still forced off at launch on those installs.
• The About tab is gone.

About — SurfaceAboutWindow: icon, two-tone wordmark, version and build provenance, summary, a six-row capability grid, Source on GitHub and Report an Issue, Help and Keyboard Shortcuts links, Acknowledgements (Sparkle's licence text and the CC0 tools catalogue), and the MIT License · © 2026 privacykey line. The custom About window scene and AboutSettingsView/WordmarkView are removed, as is the now-unused GitHub image asset. NSHumanReadableCopyright is now a real © line.

Menus — SurfaceCommands(app:help:updates:) supplies About, Check for Updates… (below Settings…, no shortcut; ⌘U is dropped) and the three Help items. File is restored with Open .app… (⌘O), Scan Installed Apps… (⇧⌘B) and the three Save Run Report… exports, replacing the separate Export menu. Knowledge Base… (⇧⌘K) moved from Help into View. Run keeps its four commands. Refresh Helper Status is gone (the Helper pane refreshes itself).

Help — privacycommand Help opens the bundled manual (Resources/Manual, nine pages: getting started, static analysis, monitored runs, VM mode, batch scan, history and compare, reports, settings, troubleshooting), Keyboard Shortcuts (⌘?) lists every shortcut after the standard group, and Welcome to privacycommand replays the onboarding. The Manual folder is a folder reference in Copy Bundle Resources, so it lands at Contents/Resources/Manual.

Menu bar item — the watch-mode popover now has the standard header (mark, name, elapsed time) and footer (Open privacycommand, Settings gear, Quit). The app's own content is unchanged: watched app, change log, Clear Log, and Stop Watching as the primary action (⌘↩). The item still appears only while watching, and the status item's accessibility label states its state.

Shared copy — version 3 → 6 (adds SurfaceManual.swift and SurfaceShortcuts.swift). UpdateController shrinks to owning the Sparkle updater and the stable channel; UpdatesSettingsView is deleted. privacycommandSurface.swift defines the app's SurfaceApp, shortcuts and acknowledgements once.

Validation

• Unsigned Debug build (CODE_SIGNING_ALLOWED=NO CODE_SIGN_IDENTITY=-) succeeds; the bundle contains Contents/Resources/Manual with the nine pages.
• just check passes (lint, security check, docs check, tooling tests including the surfaces copy check, and the package tests).
• The surface audit reports nothing to fix. Its six review items are ⌘O (a real Open) and ⌘R for Start Monitored Run and the batch Scan, which the standard's per-app row does not ask to free.

🤖 Generated with Claude Code