Bump IBM Notifier to 3.2.4 (fixes user auth failing when login files print output)

[alex-straw-avantia]

TLDR: IBM Notifier 3.2.3 launches its UI helper via su -l, so anything the console user's login files print (.zprofile etc.) gets mixed into the dialog output. super reads that output as the password, so the user authentication dialog rejects a correct password every time. IBM Notifier 3.2.4 launches the helper with launchctl asuser instead (no login shell), which fixes it.

Background

When super runs as root, IBM Notifier 3.2.3 starts the popup helper as the console user with su -l <user> -c '<helper path>' <payload> (TaskManager.swift in v-3.2.3-b-135).

su -l runs a login shell, so .zprofile / .zlogin / .profile get sourced, and anything they print lands in the helper's stdout. IBM Notifier returns that stdout as the dialog response, and super then runs dscl /Local/Default -authonly "${current_user_account_name}" "${dialog_response}". The user sees "User authentication failed." no matter what they type.

It also shows up in the unified log as IBM Notifier: TERM environment variable not set. when a login file runs clear.

IBM fixed this in 3.2.4 (IBM/mac-ibm-notifications@a0ed60e) - the helper is now started with launchctl asuser <uid> <helper> <payload>, no shell involved.

What changed

1. Bump IBM_NOTIFIER_DOWNLOAD_URL to the v-3.2.4-b-136 release.
2. Bump IBM_NOTIFIER_MINIMUM_VERSION to 3.2.4 so existing 3.2.3 installs fail check_ibm_notifier, get removed and re-downloaded.
3. Update super.checksum.txt for the new script hash.

Testing

All on Apple silicon, macOS 26.6, running IBM Notifier as root with the same secure input dialog super builds for the AUTH dialog (same accessory + -position center -always_on_top -disable_quit), then checking the response with super's dscl -authonly call.

Repro + fix - with a one-line ~/.zlogin (echo "NOISE: simulated chatty login file"), real 19 char password pasted into each dialog:

	IBM Notifier 3.2.3	IBM Notifier 3.2.4
chars returned	54	19
login file output in response	yes	no
dscl -authonly on full response (what super does)	rejected	accepted

Same dialog run as the user (not root) on 3.2.3 returns 19 chars and is accepted, so it's only the root -> su -l path. Also confirms paste still works in the 3.2.4 helper now that it's launched via launchctl asuser.

Install / upgrade - ran super's own get_ibm_notifier + check_ibm_notifier against a scratch folder:

1. Upgrade: existing 3.2.3 -> flagged below minimum -> removed -> 3.2.4 installed, valid.
2. Fresh install: 3.2.4 installed, valid.

3.2.4 is notarized with the same Team ID (PETKK2G752). bash -n super clean.

Notes

1. Left CHANGELOG.md alone so you can word it however you like.
2. 6.0.0 moves to swiftDialog, so this only matters for the 5.1.x line.
3. Possible extra hardening (not in this PR): for the AUTH dialog super could use only the last line of the response, since a secure input can't contain a newline. In the test above that would have made 3.2.3 work too (last line of the 54 char response was accepted). Happy to add it if you want it.
4. Workaround for anyone stuck on 5.1.2: only print from login files in an interactive terminal, e.g., wrap the output in if [[ -o interactive && -t 1 ]]; then ... fi in .zprofile.

🤖 Generated with Claude Code

[Macjutsu]

Thanks for this!

I probably won't merge directly from this because there are other changes I want to incorporate in the next build of v5. That being said I will happily credit your changes in the changelog and release notes.