diff --git a/apps/macos/Sources/Clawdis/GatewayDiscoveryModel.swift b/apps/macos/Sources/Clawdis/GatewayDiscoveryModel.swift
index 17d078447..82a03781c 100644
--- a/apps/macos/Sources/Clawdis/GatewayDiscoveryModel.swift
+++ b/apps/macos/Sources/Clawdis/GatewayDiscoveryModel.swift
@@ -327,10 +327,8 @@ final class GatewayDiscoveryModel {
             return true
         }
         if let service = normalizeServiceToken(serviceName) {
-            for token in local.hostTokens {
-                if service.contains(token) {
-                    return true
-                }
+            for token in local.hostTokens where service.contains(token) {
+                return true
             }
         }
         return false
@@ -456,8 +454,9 @@ final class GatewayTXTResolver: NSObject, NetServiceDelegate {
     func netServiceDidResolveAddress(_ sender: NetService) {
         let txt = Self.decodeTXT(sender.txtRecordData())
         if !txt.isEmpty {
+            let payload = self.formatTXT(txt)
             self.logger.debug(
-                "discovery: resolved TXT for \(sender.name, privacy: .public): \(self.formatTXT(txt), privacy: .public)")
+                "discovery: resolved TXT for \(sender.name, privacy: .public): \(payload, privacy: .public)")
         }
         self.finish(result: .success(txt))
     }
diff --git a/apps/macos/Sources/Clawdis/GeneralSettings.swift b/apps/macos/Sources/Clawdis/GeneralSettings.swift
index f53b7f8e5..f763b9566 100644
--- a/apps/macos/Sources/Clawdis/GeneralSettings.swift
+++ b/apps/macos/Sources/Clawdis/GeneralSettings.swift
@@ -585,7 +585,8 @@ extension GeneralSettings {
            trimmed.localizedCaseInsensitiveContains("host key verification failed")
         {
             let host = CommandResolver.parseSSHTarget(target)?.host ?? target
-            return "SSH check failed: Host key verification failed. Remove the old key with `ssh-keygen -R \(host)` and try again."
+            return "SSH check failed: Host key verification failed. Remove the old key with " +
+                "`ssh-keygen -R \(host)` and try again."
         }
         if let trimmed, !trimmed.isEmpty {
             if let message = response.message, message.hasPrefix("exit ") {
diff --git a/apps/macos/Sources/Clawdis/NodeMode/MacNodeRuntime.swift b/apps/macos/Sources/Clawdis/NodeMode/MacNodeRuntime.swift
index e69ab9091..4b6c8bbc8 100644
--- a/apps/macos/Sources/Clawdis/NodeMode/MacNodeRuntime.swift
+++ b/apps/macos/Sources/Clawdis/NodeMode/MacNodeRuntime.swift
@@ -7,7 +7,7 @@ actor MacNodeRuntime {
     private let cameraCapture = CameraCaptureService()
     @MainActor private let screenRecorder = ScreenRecordService()
 
-    // swiftlint:disable:next function_body_length
+    // swiftlint:disable:next function_body_length cyclomatic_complexity
     func handleInvoke(_ req: BridgeInvokeRequest) async -> BridgeInvokeResponse {
         let command = req.command
         if command.hasPrefix("canvas.") || command.hasPrefix("canvas.a2ui."), !Self.canvasEnabled() {
diff --git a/apps/macos/Sources/Clawdis/ShellExecutor.swift b/apps/macos/Sources/Clawdis/ShellExecutor.swift
index bb6d50b52..d3c65cabc 100644
--- a/apps/macos/Sources/Clawdis/ShellExecutor.swift
+++ b/apps/macos/Sources/Clawdis/ShellExecutor.swift
@@ -56,8 +56,8 @@ enum ShellExecutor {
             let err = stderrPipe.fileHandleForReading.readToEndSafely()
             let status = Int(process.terminationStatus)
             return ShellResult(
-                stdout: String(decoding: out, as: UTF8.self),
-                stderr: String(decoding: err, as: UTF8.self),
+                stdout: String(bytes: out, encoding: .utf8) ?? "",
+                stderr: String(bytes: err, encoding: .utf8) ?? "",
                 exitCode: status,
                 timedOut: false,
                 success: status == 0,