chore: bump to v0.18.2

Fix security scan cache so NEW MCP badges do not reappear after reload.
Fix Backup Center scheduler UX and restore macOS launchd path detection.
Refresh E2E coverage for sessions, effective-scope badges, conflicts, and sidebar collapse.
Update README privacy, platform, scheduler, and test-count docs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ithiria894

README.md

@@ -17,15 +17,15 @@ English | [简体中文](README.zh-CN.md) | [繁體中文](README.zh-TW.md) | [
 
 **Claude Code Organizer (CCO)** is a free, open-source dashboard that lets you manage all Claude Code configuration — memories, skills, MCP servers, settings, agents, rules, and hooks — across global and project scopes. It includes a security scanner for MCP tool poisoning and prompt injection, a per-item context token budget tracker, per-project MCP enable/disable controls, and bulk cleanup for duplicate configs. All without leaving the window.
 
-> **v0.18.0** — Backup Center: one click backs up every memory, skill, MCP config, rule, plan, agent, and session to a private GitHub repo. Auto-runs every 4 hours via systemd. See git history. Never lose your Claude setup again.
+> **v0.18.0** — Backup Center: one click backs up every memory, skill, MCP config, rule, plan, agent, and session to a private GitHub repo. Auto-runs every 4 hours with the native scheduler on your platform. See git history. Never lose your Claude setup again.
 
 > Scan for poisoned MCP servers. Reclaim wasted context tokens. Disable MCP servers per-project. Find and delete duplicate memories. Move misplaced configs where they belong.
 
-> **Privacy:** CCO reads Claude Code config files on your machine (global and project-level). Nothing is sent externally. Zero telemetry.
+> **Privacy:** CCO reads Claude Code config files on your machine (global and project-level). It does not send usage telemetry. It does check the npm registry for version updates unless network access is blocked.
 
 ![Claude Code Organizer Demo](docs/demo.gif)
 
-<sub>297 tests (124 unit + 173 E2E) | Zero dependencies | Demo recorded by AI using [Pagecast](https://github.com/mcpware/pagecast)</sub>
+<sub>324 tests (124 unit + 200 E2E) | Zero dependencies | Demo recorded by AI using [Pagecast](https://github.com/mcpware/pagecast)</sub>
 
 > 100+ stars in 5 days. Built by a CS dropout who found 140 invisible config files controlling Claude and decided no one should have to `cat` each one. First open source project — thank you to everyone who starred, tested, and reported issues.
 
@@ -219,9 +219,11 @@ Every constant, merge rule, and policy check cites the specific source file it w
 |----------|:------:|
 | Ubuntu / Linux | Supported |
 | macOS (Intel + Apple Silicon) | Supported |
-| Windows 11 | Supported |
+| Windows 11 | Partial (dashboard yes, backup scheduler no) |
 | WSL | Supported |
 
+Automatic Backup Center scheduling currently uses `systemd` on Linux/WSL and `launchd` on macOS.
+
 ## Roadmap
 
 | Feature | Status | Description |

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpware/claude-code-organizer",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Organize all your Claude Code memories, skills, MCP servers, commands, agents, rules, and hooks — see what loads globally vs per-project, then move items between scopes",
   "type": "module",
   "files": [

package.json

@@ -3,7 +3,7 @@
  * Used by Backup Center in CCO and by the standalone claude-code-backup CLI.
  */
 
-import { writeFile, mkdir, unlink, access } from "node:fs/promises";
+import { writeFile, mkdir, unlink, access, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir, platform } from "node:os";
 import { execFile } from "node:child_process";
@@ -169,6 +169,18 @@ async function isInstalledLaunchd() {
   }
 }
 
+async function getNodeAndCliPathLaunchd() {
+  try {
+    const plistPath = join(launchdDir(), `${plistLabel()}.plist`);
+    const content = await readFile(plistPath, "utf-8");
+    const block = content.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
+    if (!block) return null;
+    const args = [...block[1].matchAll(/<string>([^<]+)<\/string>/g)].map((m) => m[1]);
+    if (args.length >= 2) return { nodePath: args[0], cliPath: args[1] };
+  } catch {}
+  return null;
+}
+
 // ── Public API ──────────────────────────────────────────────────────
 
 export async function install(nodePath, cliPath, intervalHours = 4) {
@@ -192,6 +204,6 @@ export async function isInstalled() {
 }
 
 export async function getNodeAndCliPath() {
-  if (platform() === "darwin") return null; // not implemented for macOS
+  if (platform() === "darwin") return getNodeAndCliPathLaunchd();
   return getNodeAndCliPathSystemd();
 }

src/backup-scheduler.mjs

@@ -882,7 +882,7 @@ function renderSidebarScope(scope, overrideChildHtml) {
           ${childHtml ? `<div class="s-children">${childHtml}</div>` : ""}
         </div>` : (hasNestedContent && !showBody ? `
         <div class="s-scope-body collapsed">
-          ${categoryRows ? `<div>${categoryRows}</div>` : ""}
+          ${(!isDragMode && categoryRows) ? `<div>${categoryRows}</div>` : ""}
           ${childHtml ? `<div class="s-children">${childHtml}</div>` : ""}
         </div>` : "")}
     </div>`;
@@ -1748,7 +1748,7 @@ async function openBackupModal() {
     document.getElementById("bkpSchedDesc").textContent =
       status.schedulerInstalled ? `Every ${status.interval || 4} hours + on boot` : "Not running";
     document.getElementById("bkpSchedNext").textContent =
-      status.schedulerInstalled ? "systemd timer active" : "";
+      status.schedulerInstalled ? "Background scheduler active" : "";
 
     // Set interval selector to current value
     const sel = document.getElementById("bkpInterval");
@@ -3995,12 +3995,27 @@ function renderSecurityResults(scanData) {
   footerNote.textContent = `${scanTime}`;
 }
 
+/**
+ * The baseline file is updated during a successful scan, so "first scan"
+ * is only meaningful for the active in-memory result. If we persist it into
+ * cache, reopening the app will incorrectly resurrect stale NEW badges.
+ */
+function getPersistableSecurityScanData(scanData) {
+  if (!scanData || typeof scanData !== "object") return scanData;
+  return {
+    ...scanData,
+    baselines: Array.isArray(scanData.baselines)
+      ? scanData.baselines.map((b) => b?.isFirstScan ? { ...b, isFirstScan: false } : b)
+      : scanData.baselines,
+  };
+}
+
 /** Save security scan results to server for persistence across sessions. */
 function saveSecurityResults(scanData) {
   fetch("/api/security-cache", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(scanData),
+    body: JSON.stringify(getPersistableSecurityScanData(scanData)),
   }).catch(() => {}); // Fire and forget
 }
 
@@ -4013,8 +4028,9 @@ async function loadCachedSecurityResults() {
 
     securityScanResults = cached.data;
 
-    // Rebuild badge map (don't reset baselineStatus — checkForNewMcpServers may have set it)
+    // Rebuild badge map from cached results.
     securityBadges = {};
+    securityBaselineStatus = {};
     for (const server of (cached.data.servers || [])) {
       if (server.findings?.length > 0) {
         const maxSev = server.findings.reduce((max, f) => {
@@ -4026,9 +4042,11 @@ async function loadCachedSecurityResults() {
         securityBadges[server.serverName] = "unreachable";
       }
     }
+    // Never restore NEW from cache. "New since last scan" must be computed
+    // against the current baseline file on startup, otherwise stale cache
+    // keeps re-flagging servers that were already acknowledged by a scan.
     for (const b of (cached.data.baselines || [])) {
-      if (b.isFirstScan) securityBaselineStatus[b.serverName] = "new";
-      else if (b.hasChanges) securityBaselineStatus[b.serverName] = "changed";
+      if (b.hasChanges && !b.isFirstScan) securityBaselineStatus[b.serverName] = "changed";
     }
 
     // Hide intro (results will render when user opens security panel)