FyAgent v0.4.0

FyAgent v0.4.0

Important

FyAgent remains under active development. Back up important configuration
before upgrading, and review the trust and verification boundaries below
before installing.

The v0.4.0 publication contract requires exactly eight non-empty attachments:
four installers, three release-evidence JSON files, and one Sigstore bundle.
The workflow verifies that exact set before publication. This document does
not by itself claim that an independent post-publication re-download review
has been completed.

Warning

Do not infer Windows installer signing from the Release title or file name.
The formal workflow appends an evidence-backed signing table to the end of
these notes from the published signing-status.json.

If an installer row reports NotSigned, expect Windows SmartScreen to warn
and do not treat the file as Authenticode-signed. If it reports a verified
signature, confirm the publisher and timestamp status in the appended table,
then inspect signing-status.json for the signer- and timestamp-certificate
evidence. Verify the SHA-256 digest, source SHA, and attestation as well. Do
not disable SmartScreen or weaken organization-managed security policy.

Highlights

• V2 desktop shell: the production UI is a local desktop control center
  with six primary pages: Agent directory, Models, Skills, MCP, Prompts, and
  Memory. The previous leftover V1 renderer is not the shipped shell.
• Agent catalog v4: QoderWork CN, TRAE Work CN, WorkBuddy, Grok Build,
  Codex, Claude Code, and OpenCode share one product directory. Agent detail
  keeps official links and direct capability jumps; it does not impersonate
  each product's native settings UI.
• Models by product contract: WorkBuddy and OpenCode use dedicated model
  configuration. Claude Code, Codex, and Grok Build keep bounded Provider
  quick setup. QoderWork CN states that third-party model configuration is
  unsupported. TRAE Work CN observes vendor state and does not write custom
  models into TRAE sqlite.
• Skill 市场: Skills discovery pages the official Skill Hub catalog by
  category, shows full card copy from 详情, and asks which target app should
  receive the install. GitHub repository browsing is not part of this path.
• MCP discovery: a curated catalog, including China-region connectors,
  splits discover / configure / install. After a WorkBuddy connector is
  written, the UI tells the user to trust it inside WorkBuddy.
• Prompts and Memory: Prompts cover the existing native prompt
  applications; Memory manages the current OpenClaw and Hermes long-term
  resources. Browser preview remains native-only and does not seed business
  data.
• Shipped platforms: formal installers are Windows (x64 and ARM64 NSIS)
  and macOS Universal (DMG and ZIP). Current-host development checks are not a
  substitute for those installers.

Download and trust guidance

Windows

Choose the setup executable matching the machine architecture:

FyAgent-0.4.0-Windows-x64-setup.exe
FyAgent-0.4.0-Windows-arm64-setup.exe

Read the Windows installer signing status table appended to these notes and
verify the matching signing-status.json, SHA-256 digest, source SHA, and
attestation before installing.

macOS

Choose the DMG or ZIP; both contain the Universal application:

FyAgent-0.4.0-macOS.dmg
FyAgent-0.4.0-macOS.zip

The universal app is ad-hoc signed with no certificate identity and that
signature is verified before packaging. It is not signed with an Apple
Developer ID and is not notarized. The DMG container is unsigned. Gatekeeper
may therefore block the first launch. After first attempting to open FyAgent,
use System Settings → Privacy & Security → Open Anyway only after checking
the Release evidence. Do not disable Gatekeeper or remove quarantine metadata.

Exact Release attachment contract

The formal Release must contain exactly these four installer assets:

FyAgent-0.4.0-macOS.dmg
FyAgent-0.4.0-macOS.zip
FyAgent-0.4.0-Windows-x64-setup.exe
FyAgent-0.4.0-Windows-arm64-setup.exe

It must also contain exactly these four evidence attachments:

download-manifest.json
build-metadata.json
signing-status.json
artifact-attestation.sigstore.json

That is eight attachments total. The attestation has seven subjects: the four
installers plus download-manifest.json, build-metadata.json, and
signing-status.json. The copied Sigstore bundle is the eighth attachment and
does not attest itself. A missing, duplicate, renamed, empty, stale, or extra
attachment blocks publication.

Compatibility and upgrade notes

• The database schema version is 19. Existing FyAgent databases migrate forward
  on first launch. Back up ~/.fyagent before upgrading.
• Existing provider, settings, Skills, backup, fyagent://v1/import, and
  third-party /v1 contracts remain owned by their current implementation.
• Installers from earlier 0.3.x Releases for operating systems outside this
  shipped pair are not part of this version and are not a supported upgrade
  path.
• The known v0.3.0 MSI product is still removed synchronously before the NSIS
  payload is written; unexpected migration results abort instead of continuing
  with a partially replaced installation.

See the
installation guide
for platform-specific installation steps.

Known verification and security boundaries

• No Windows HIL was run for this delivery. Available evidence covers
  executable contracts, portable tests, Windows-target compilation, native
  x64/ARM64 build and packaging, signing or unsigned proof, exact-asset
  verification, and review. It does not prove setup/uninstall behavior,
  Explorer/UAC token handling, WebView2 user-data paths, Windows registry
  behavior, PackageManager file-URI behavior, effective ACL enforcement or
  mutation denial, terminal cleanup, or orphan recovery on a real Windows
  10/11 x64 or ARM64 machine.
• The current-user helper is not a protected process. Code already running as
  the same Shell user can attempt memory, handle, or process manipulation within
  that user's existing PackageManager authority.
• The NSIS process lookup is a point-in-time safety check, not an atomic
  interlock against a new process launch immediately before filesystem
  mutation. Setup never force-terminates FyAgent or its helper.
• A NotSigned Windows result can trigger SmartScreen warnings. SHA-256,
  source-SHA binding, and attestation are not a substitute for Authenticode
  publisher trust.
• The macOS application has only an identity-free ad-hoc signature; the DMG is
  unsigned, and neither is Developer ID signed or notarized.
• This Release does not claim independent post-publication re-download
  verification, administrator-enforced repository rulesets, or a separate Main
  Provenance attestation.

Version provenance

The annotated v0.3.0 through v0.3.4 tags remain at their original commits
and are not moved, deleted, or reused. FyAgent v0.4.0 is a new annotated tag
on the exact main commit whose push CI / Required result succeeded. A
failed Release workflow does not move that tag; a later source fix requires a
new stable version.

Source and licensing

FyAgent-owned components and modifications remain under the repository's
published PolyForm Noncommercial terms. Upstream-derived material retains its
original notices and license ancestry.

See
LICENSE,
LICENSING.md,
and
THIRD_PARTY_NOTICES.md.

Windows installer signing status

Mode: unsigned; source: 520ddb78fe5415377bd4222c926cda840fdbdbdb. The installer rows below are backed by the published signing-status.json and artifact-attestation.sigstore.json evidence.

Architecture	Installer	Authenticode	Publisher	Timestamp	SHA-256	Source SHA	Attestation
x64	FyAgent-0.4.0-Windows-x64-setup.exe	NotSigned	Not signed	None	6e56e405957e7bee79d6bd933490190069d308a8786f802a4feff25c8af27e19	520ddb78fe5415377bd4222c926cda840fdbdbdb	artifact-attestation.sigstore.json subject FyAgent-0.4.0-Windows-x64-setup.exe digest sha256:6e56e405957e7bee79d6bd933490190069d308a8786f802a4feff25c8af27e19
arm64	FyAgent-0.4.0-Windows-arm64-setup.exe	NotSigned	Not signed	None	fd44d2a314a642f88b818428e34c1e155f081089bd8aa94c2f7dddfa040265ca	520ddb78fe5415377bd4222c926cda840fdbdbdb	artifact-attestation.sigstore.json subject FyAgent-0.4.0-Windows-arm64-setup.exe digest sha256:fd44d2a314a642f88b818428e34c1e155f081089bd8aa94c2f7dddfa040265ca

FyAgent v0.3.4

FyAgent v0.3.4

Important

FyAgent remains under active development. Back up important configuration
before upgrading, and review the trust and verification boundaries below
before installing.

The v0.3.4 publication contract requires exactly 14 non-empty attachments:
ten installers, three release-evidence JSON files, and one Sigstore bundle.
The workflow verifies that exact set before publication. This document does
not by itself claim that an independent post-publication re-download review
has been completed.

Warning

Do not infer Windows installer signing from the Release title or file name.
The formal workflow appends an evidence-backed signing table to the end of
these notes from the published signing-status.json.

If an installer row reports NotSigned, expect Windows SmartScreen to warn
and do not treat the file as Authenticode-signed. If it reports a verified
signature, confirm the publisher and timestamp status in the appended table,
then inspect signing-status.json for the signer- and timestamp-certificate
evidence. Verify the SHA-256 digest, source SHA, and attestation as well. Do
not disable SmartScreen or weaken organization-managed security policy.

Highlights

• Windows state follows the signed-in Explorer user: FyAgent freezes the
  active Explorer Shell identity and its Profile, LocalAppData, and
  RoamingAppData paths before user-owned application state is initialized.
  Approving UAC with a different administrator account no longer redirects
  configuration, database, logs, WebView data, Codex Desktop installation,
  restart, or launch into the elevation account.
• Protected current-user Codex Desktop installation: the elevated
  application verifies and pins the accepted MSIX, copies it into an immutable
  operation below a fixed Windows CommonApplicationData bridge, authenticates
  the exact asInvoker helper, and admits current-user PackageManager only
  after both sides agree on package identity.
• Architecture-specific Windows NSIS installers: v0.3.4 provides x64 and
  ARM64 payloads in per-machine setup executables built on matching native
  Windows runners. MSI, WiX, and portable ZIP are not release formats. Setup
  and uninstall check both FyAgent processes and never force-terminate them.
• Single-flight lifecycle and bounded cleanup: installation, exit, and
  restart share one process-lifetime claim. Unknown post-admission state is
  quarantined; normal cleanup requires a valid terminal result, its matching
  authenticated terminal frame, and a clean pipe close.
• Main-bound release authority: formal publication binds the annotated tag,
  canonical version, current remote main HEAD, and that exact SHA's successful
  CI / Required push result. A manual preflight remains optional and cannot
  publish; it is not required before the single formal native build.
• Resilient macOS packaging: the DMG creator now retries only the exact
  transient hdiutil Resource busy condition with a short, fixed bound.
  Unrelated errors still fail immediately, and all existing DMG verification,
  read-only remount, app digest, ad-hoc signature, and unsigned-container gates
  remain mandatory.

Windows current-user security boundary

The helper accepts one fixed current-user MSIX installation operation. It does
not accept an arbitrary executable, command, path, URI, host, package source,
bridge root, installer scope, or validation bypass. The parent authenticates
the helper process, session, user SID, and pinned executable before sending one
bounded bridge control. The helper independently verifies the bridge object and
package identity before waiting for explicit admission.

The retired all-users deployment DTOs, headless/runas helper path,
control/job-file interface, Stage and Provision operations, HTTP/network
package sources, Temp/cwd/install-root package fallbacks, and arbitrary
path/URI inputs are not part of the shipped path.

Interactive directory selection and silent /D= installation use standard
NSIS and Windows handling. Before setup, maintenance, migration, or uninstall
mutates payloads, it asks the user to close fyagent.exe and
fyagent-user-helper.exe; silent and passive modes abort while either process
is running. Uninstall preserves FyAgent databases, configuration, OAuth state,
backups, other user data, PackageBridge operations, and unrelated files in a
custom installation directory.

Download and trust guidance

Windows

Choose the setup executable matching the machine architecture:

FyAgent-0.3.4-Windows-x64-setup.exe
FyAgent-0.3.4-Windows-arm64-setup.exe

Read the Windows installer signing status table appended to these notes and
verify the matching signing-status.json, SHA-256 digest, source SHA, and
attestation before installing.

macOS

Choose the DMG or ZIP; both contain the Universal application:

FyAgent-0.3.4-macOS.dmg
FyAgent-0.3.4-macOS.zip

The universal app is ad-hoc signed with no certificate identity and that
signature is verified before packaging. It is not signed with an Apple
Developer ID and is not notarized. The DMG container is unsigned. Gatekeeper
may therefore block the first launch. After first attempting to open FyAgent,
use System Settings → Privacy & Security → Open Anyway only after checking
the Release evidence. Do not disable Gatekeeper or remove quarantine metadata.

Linux

Choose the architecture and package format matching the host:

FyAgent-0.3.4-Linux-x86_64.AppImage
FyAgent-0.3.4-Linux-x86_64.deb
FyAgent-0.3.4-Linux-x86_64.rpm
FyAgent-0.3.4-Linux-arm64.AppImage
FyAgent-0.3.4-Linux-arm64.deb
FyAgent-0.3.4-Linux-arm64.rpm

Flatpak remains a local diagnostic conversion and is not a formal v0.3.4
installer.

Exact Release attachment contract

The formal Release must contain exactly these ten installer assets:

FyAgent-0.3.4-macOS.dmg
FyAgent-0.3.4-macOS.zip
FyAgent-0.3.4-Windows-x64-setup.exe
FyAgent-0.3.4-Windows-arm64-setup.exe
FyAgent-0.3.4-Linux-x86_64.AppImage
FyAgent-0.3.4-Linux-x86_64.deb
FyAgent-0.3.4-Linux-x86_64.rpm
FyAgent-0.3.4-Linux-arm64.AppImage
FyAgent-0.3.4-Linux-arm64.deb
FyAgent-0.3.4-Linux-arm64.rpm

It must also contain exactly these four evidence attachments:

download-manifest.json
build-metadata.json
signing-status.json
artifact-attestation.sigstore.json

That is 14 attachments total. The attestation has 13 subjects: the ten
installers plus download-manifest.json, build-metadata.json, and
signing-status.json. The copied Sigstore bundle is the fourteenth attachment
and does not attest itself. A missing, duplicate, renamed, empty, stale, or
extra attachment blocks publication.

Compatibility and upgrade notes

• The database schema remains at version 16. This release introduces no
  database schema or user-data migration.
• Existing provider, settings, Skills, backup, fyagent://v1/import, and
  third-party /v1 contracts remain owned by their current implementation.
• The minimum supported Windows version is unchanged.
• The known v0.3.0 MSI product is removed synchronously before the new NSIS
  payload is written; unexpected migration results abort instead of continuing
  with a partially replaced installation.

See the
installation guide
for platform-specific installation steps.

Known verification and security boundaries

• No Windows HIL was run for this delivery. Available evidence covers
  executable contracts, portable tests, Windows-target compilation, native
  x64/ARM64 build and packaging, signing or unsigned proof, exact-asset
  verification, and review. It does not prove setup/uninstall behavior,
  Explorer/UAC token handling, WebView2 user-data paths, Windows registry
  behavior, PackageManager file-URI behavior, effective ACL enforcement or
  mutation denial, terminal cleanup, or orphan recovery on a real Windows
  10/11 x64 or ARM64 machine.
• The current-user helper is not a protected process. Code already running as
  the same Shell user can attempt memory, handle, or process manipulation within
  that user's existing PackageManager authority.
• The NSIS process lookup is a point-in-time safety check, not an atomic
  interlock against a new process launch immediately before filesystem
  mutation. Setup never force-terminates FyAgent or its helper.
• A NotSigned Windows result can trigger SmartScreen warnings. SHA-256,
  source-SHA binding, and attestation are not a substitute for Authenticode
  publisher trust.
• The macOS application has only an identity-free ad-hoc signature; the DMG is
  unsigned, and neither is Developer ID signed or notarized.
• This Release does not claim independent post-publication re-download
  verification, administrator-enforced repository rulesets, or a separate Main
  Provenance attestation.

Version provenance

The existing annotated v0.3.1, v0.3.2, and v0.3.3 tags remain at their
original commits and are not moved, deleted, or reused. Their failed or
unpublished workflows did not create a stable Release. FyAgent v0.3.4 is the
recovery publication of the Windows current-user runtime, NSIS installer, CI,
release, tooling, and documentation changes described above, including the
bounded macOS disk-image creation recovery.

Source and licensing

FyAgent-owned components and modifications remain under the repository's
published PolyForm Noncommercial terms. Upstream-derived material retains its
original notices and license ancestry.

See
LICENSE,
LICENSING.md,
and
THIRD_PARTY_NOTICES.md.

Windows installer signing status

Mode: unsigned; source: `f424ceff8f085673d00b8fd...

FyAgent v0.3.0

FyAgent v0.3.0

简体中文 |
日本語

Warning

FyAgent v0.3.0 is intentionally unsigned. Windows executables and MSI
packages must report Authenticode NotSigned. The macOS app is not Developer
ID signed or notarized. Windows SmartScreen and macOS Gatekeeper may therefore
warn or block the first launch. Verify the exact attachment names and evidence
described below before installing.

Important

Verification status: this document is both the frozen v0.3.0 publication
contract and the English GitHub Release body. Before installing, verify that
the Release exposes the exact 13 attachments below and validate its manifest,
metadata, and attestation evidence. Independent post-publication re-download
results are recorded in closeout evidence only after that review occurs; this
body does not itself claim that closeout verification has completed.

Highlights

• CC Switch v3.19.2 source integration: FyAgent merged the complete
  upstream ancestry from annotated tag v3.19.2 in an isolated two-parent
  merge. The product version remains FyAgent 0.3.0; it is not renamed to the
  upstream version. See the
  provenance ledger.
• Native build boundary: retired local Linux/WSL-to-Windows and
  Linux/WSL-to-macOS cross-build paths. Local development builds only the
  current host. Formal Windows x64/ARM64, Linux x64/ARM64, and macOS Universal
  artifacts come from their native GitHub runners without QEMU fallback.
• mise + uv development environment: introduced a canonical, documented
  mise run task API; exact Node 24.19.0, pnpm 10.12.3, Rust 1.97.1, and Python
  3.14.7 sources; a checksum-locked uv selector; and an uv-owned .venv and
  Python dependency lock.
• Automatic CI and Labeler: restored automatic PR/main CI, a stable
  CI / Required aggregate, and a base-repository Labeler that does not check
  out or execute pull-request code. Remote trigger/run evidence remains part of
  the release gate.
• Native Fetch and DEP0040: removed cross-fetch and its legacy
  node-fetch@2 → whatwg-url@5 → tr46@0.0.3 → punycode chain. Tests exercise
  Node's native Fetch through MSW and Tauri mocks, including error, empty-body,
  and cross-realm behavior, with deprecations promoted to failures.
• Fail-closed release transaction: manual preflight builds and attests the
  full matrix without publishing. The formal v0.3.0 path binds tag, product
  version, source, trusted workflow, origin/main ancestry, and same-SHA
  Required CI; verifies exact artifacts and evidence; then uses a verified
  draft-to-stable publication transaction.

Download and unsigned-install guidance

Windows

Choose the MSI that matches the machine architecture. The application and MSI
are intentionally unsigned, so SmartScreen may show an unknown-publisher
warning. Confirm the exact file name, download-manifest.json digest, build
metadata, and attestation evidence before continuing. Do not disable
SmartScreen or weaken organization-managed security policy.

macOS

Choose the DMG or ZIP; both contain the same Universal app. Because v0.3.0 is
not Developer ID signed or notarized, macOS may block first launch. After
attempting to open FyAgent once, use Apple's supported System Settings →
Privacy & Security → Open Anyway flow and confirm the prompt. Do not disable
Gatekeeper or strip quarantine metadata.

Linux

Choose the x86_64 or arm64 package matching the host. AppImage, DEB, and RPM are
all mandatory formal formats. Flatpak is a local diagnostic conversion and is
not a formal v0.3.0 installer.

Exact Release attachment contract

The formal Release must contain exactly these 10 installer assets:

FyAgent-0.3.0-macOS.dmg
FyAgent-0.3.0-macOS.zip
FyAgent-0.3.0-Windows.msi
FyAgent-0.3.0-Windows-arm64.msi
FyAgent-0.3.0-Linux-x86_64.AppImage
FyAgent-0.3.0-Linux-x86_64.deb
FyAgent-0.3.0-Linux-x86_64.rpm
FyAgent-0.3.0-Linux-arm64.AppImage
FyAgent-0.3.0-Linux-arm64.deb
FyAgent-0.3.0-Linux-arm64.rpm

It must also contain exactly these 3 evidence attachments:

download-manifest.json
build-metadata.json
artifact-attestation.sigstore.json

That is 13 attachments total. download-manifest.json records the SHA-256,
size, platform, architecture, format, source, tag, and final URL for every
installer. build-metadata.json binds the five native target groups to runner,
toolchain, container, workflow, source, and Required-CI evidence. The Sigstore
bundle covers the ten installers plus both JSON evidence files. There is no
fourteenth standalone checksum file; a missing, duplicate, renamed, empty, or
extra attachment fails the publication contract.

Compatibility

FyAgent v0.3.0 does not introduce a runtime API, database, or user-data
migration. The following contracts remain compatible:

• database schema 16 and ~/.fyagent/fyagent.db;
• ~/.fyagent settings, skills, and automatic backup behavior;
• the fyagent:// deep-link boundary and bundle identifier
  com.fyagent.desktop;
• existing FYAGENT_* environment contracts and native Windows protected
  installation behavior.

Back up important configuration before any application upgrade. A failed
native build, incomplete attachment set, identity/data-path drift, or missing
attestation is a release blocker rather than permission to publish a reduced
matrix.

Supply-chain model and accepted residual risk

v0.3.0 has no Windows/macOS signing credentials, notarization, staple step,
signed mode, protected Release environment, branch protection, or branch/tag
ruleset. Eligibility and least privilege are enforced by workflow code: default
read-only contents, narrowly scoped CI/Labeler/attestation/publication
permissions, full-SHA Actions, exact repository/workflow/source checks, and an
exact attachment allowlist.

This workflow-only model is intentionally weaker than administrator-enforced
rules and environment approval. That residual supply-chain risk is explicitly
accepted for v0.3.0; this project does not claim that main, the tag, or the
Release is administrator-protected. Signing or stronger repository governance
requires a separate future decision.

Verification boundary

Local contract checks prove source and workflow structure only. A conforming
Release requires all of the following real evidence from one exact main
source SHA:

1. successful automatic CI / Required;
2. successful unsigned five-target-group preflight that creates no Release;
3. exact v0.3.0 tag-triggered formal workflow;
4. stable, non-prerelease public Release with exactly 13 attachments;
5. independent re-download and verification of names, counts, versions,
   architectures, sizes, SHA-256 values, Windows NotSigned, macOS unsigned /
   non-notarized state, and the attestation bundle.

Items 1–4 are publication gates. Item 5 is an independent post-publication
closeout check and is recorded only after it is performed. Whether this text is
read in the repository before publication or as the formal Release body, it
does not by itself prove any item above. Before installing, verify the exact 13
attachments and their evidence; do not infer that independent closeout review
has completed until the project records that result.

Source and licensing

The upstream tag object is
f6882b69f0a30968dcc6dbb1153b6b12b50e6b1a, peeled to
43eaf07355af145aebfee301801779e824d4c221; the isolated FyAgent merge commit is
f4462765e9b3a2efd1deb13aabf3ce349166a058. Upstream-derived material retains
its MIT ancestry and notices. FyAgent-owned components and modifications remain
under the repository's published PolyForm Noncommercial terms; see
LICENSE,
LICENSING.md,
and
THIRD_PARTY_NOTICES.md.