Skip to content

FyAgent v0.3.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 18:05
v0.3.4
f424cef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FyAgent v0.3.4

Important

FyAgent remains under active development. Back up important configuration
before upgrading, and review the trust and verification boundaries below
before installing.

The v0.3.4 publication contract requires exactly 14 non-empty attachments:
ten installers, three release-evidence JSON files, and one Sigstore bundle.
The workflow verifies that exact set before publication. This document does
not by itself claim that an independent post-publication re-download review
has been completed.

Warning

Do not infer Windows installer signing from the Release title or file name.
The formal workflow appends an evidence-backed signing table to the end of
these notes from the published signing-status.json.

If an installer row reports NotSigned, expect Windows SmartScreen to warn
and do not treat the file as Authenticode-signed. If it reports a verified
signature, confirm the publisher and timestamp status in the appended table,
then inspect signing-status.json for the signer- and timestamp-certificate
evidence. Verify the SHA-256 digest, source SHA, and attestation as well. Do
not disable SmartScreen or weaken organization-managed security policy.

Highlights

  • Windows state follows the signed-in Explorer user: FyAgent freezes the
    active Explorer Shell identity and its Profile, LocalAppData, and
    RoamingAppData paths before user-owned application state is initialized.
    Approving UAC with a different administrator account no longer redirects
    configuration, database, logs, WebView data, Codex Desktop installation,
    restart, or launch into the elevation account.
  • Protected current-user Codex Desktop installation: the elevated
    application verifies and pins the accepted MSIX, copies it into an immutable
    operation below a fixed Windows CommonApplicationData bridge, authenticates
    the exact asInvoker helper, and admits current-user PackageManager only
    after both sides agree on package identity.
  • Architecture-specific Windows NSIS installers: v0.3.4 provides x64 and
    ARM64 payloads in per-machine setup executables built on matching native
    Windows runners. MSI, WiX, and portable ZIP are not release formats. Setup
    and uninstall check both FyAgent processes and never force-terminate them.
  • Single-flight lifecycle and bounded cleanup: installation, exit, and
    restart share one process-lifetime claim. Unknown post-admission state is
    quarantined; normal cleanup requires a valid terminal result, its matching
    authenticated terminal frame, and a clean pipe close.
  • Main-bound release authority: formal publication binds the annotated tag,
    canonical version, current remote main HEAD, and that exact SHA's successful
    CI / Required push result. A manual preflight remains optional and cannot
    publish; it is not required before the single formal native build.
  • Resilient macOS packaging: the DMG creator now retries only the exact
    transient hdiutil Resource busy condition with a short, fixed bound.
    Unrelated errors still fail immediately, and all existing DMG verification,
    read-only remount, app digest, ad-hoc signature, and unsigned-container gates
    remain mandatory.

Windows current-user security boundary

The helper accepts one fixed current-user MSIX installation operation. It does
not accept an arbitrary executable, command, path, URI, host, package source,
bridge root, installer scope, or validation bypass. The parent authenticates
the helper process, session, user SID, and pinned executable before sending one
bounded bridge control. The helper independently verifies the bridge object and
package identity before waiting for explicit admission.

The retired all-users deployment DTOs, headless/runas helper path,
control/job-file interface, Stage and Provision operations, HTTP/network
package sources, Temp/cwd/install-root package fallbacks, and arbitrary
path/URI inputs are not part of the shipped path.

Interactive directory selection and silent /D= installation use standard
NSIS and Windows handling. Before setup, maintenance, migration, or uninstall
mutates payloads, it asks the user to close fyagent.exe and
fyagent-user-helper.exe; silent and passive modes abort while either process
is running. Uninstall preserves FyAgent databases, configuration, OAuth state,
backups, other user data, PackageBridge operations, and unrelated files in a
custom installation directory.

Download and trust guidance

Windows

Choose the setup executable matching the machine architecture:

FyAgent-0.3.4-Windows-x64-setup.exe
FyAgent-0.3.4-Windows-arm64-setup.exe

Read the Windows installer signing status table appended to these notes and
verify the matching signing-status.json, SHA-256 digest, source SHA, and
attestation before installing.

macOS

Choose the DMG or ZIP; both contain the Universal application:

FyAgent-0.3.4-macOS.dmg
FyAgent-0.3.4-macOS.zip

The universal app is ad-hoc signed with no certificate identity and that
signature is verified before packaging. It is not signed with an Apple
Developer ID and is not notarized. The DMG container is unsigned. Gatekeeper
may therefore block the first launch. After first attempting to open FyAgent,
use System Settings → Privacy & Security → Open Anyway only after checking
the Release evidence. Do not disable Gatekeeper or remove quarantine metadata.

Linux

Choose the architecture and package format matching the host:

FyAgent-0.3.4-Linux-x86_64.AppImage
FyAgent-0.3.4-Linux-x86_64.deb
FyAgent-0.3.4-Linux-x86_64.rpm
FyAgent-0.3.4-Linux-arm64.AppImage
FyAgent-0.3.4-Linux-arm64.deb
FyAgent-0.3.4-Linux-arm64.rpm

Flatpak remains a local diagnostic conversion and is not a formal v0.3.4
installer.

Exact Release attachment contract

The formal Release must contain exactly these ten installer assets:

FyAgent-0.3.4-macOS.dmg
FyAgent-0.3.4-macOS.zip
FyAgent-0.3.4-Windows-x64-setup.exe
FyAgent-0.3.4-Windows-arm64-setup.exe
FyAgent-0.3.4-Linux-x86_64.AppImage
FyAgent-0.3.4-Linux-x86_64.deb
FyAgent-0.3.4-Linux-x86_64.rpm
FyAgent-0.3.4-Linux-arm64.AppImage
FyAgent-0.3.4-Linux-arm64.deb
FyAgent-0.3.4-Linux-arm64.rpm

It must also contain exactly these four evidence attachments:

download-manifest.json
build-metadata.json
signing-status.json
artifact-attestation.sigstore.json

That is 14 attachments total. The attestation has 13 subjects: the ten
installers plus download-manifest.json, build-metadata.json, and
signing-status.json. The copied Sigstore bundle is the fourteenth attachment
and does not attest itself. A missing, duplicate, renamed, empty, stale, or
extra attachment blocks publication.

Compatibility and upgrade notes

  • The database schema remains at version 16. This release introduces no
    database schema or user-data migration.
  • Existing provider, settings, Skills, backup, fyagent://v1/import, and
    third-party /v1 contracts remain owned by their current implementation.
  • The minimum supported Windows version is unchanged.
  • The known v0.3.0 MSI product is removed synchronously before the new NSIS
    payload is written; unexpected migration results abort instead of continuing
    with a partially replaced installation.

See the
installation guide
for platform-specific installation steps.

Known verification and security boundaries

  • No Windows HIL was run for this delivery. Available evidence covers
    executable contracts, portable tests, Windows-target compilation, native
    x64/ARM64 build and packaging, signing or unsigned proof, exact-asset
    verification, and review. It does not prove setup/uninstall behavior,
    Explorer/UAC token handling, WebView2 user-data paths, Windows registry
    behavior, PackageManager file-URI behavior, effective ACL enforcement or
    mutation denial, terminal cleanup, or orphan recovery on a real Windows
    10/11 x64 or ARM64 machine.
  • The current-user helper is not a protected process. Code already running as
    the same Shell user can attempt memory, handle, or process manipulation within
    that user's existing PackageManager authority.
  • The NSIS process lookup is a point-in-time safety check, not an atomic
    interlock against a new process launch immediately before filesystem
    mutation. Setup never force-terminates FyAgent or its helper.
  • A NotSigned Windows result can trigger SmartScreen warnings. SHA-256,
    source-SHA binding, and attestation are not a substitute for Authenticode
    publisher trust.
  • The macOS application has only an identity-free ad-hoc signature; the DMG is
    unsigned, and neither is Developer ID signed or notarized.
  • This Release does not claim independent post-publication re-download
    verification, administrator-enforced repository rulesets, or a separate Main
    Provenance attestation.

Version provenance

The existing annotated v0.3.1, v0.3.2, and v0.3.3 tags remain at their
original commits and are not moved, deleted, or reused. Their failed or
unpublished workflows did not create a stable Release. FyAgent v0.3.4 is the
recovery publication of the Windows current-user runtime, NSIS installer, CI,
release, tooling, and documentation changes described above, including the
bounded macOS disk-image creation recovery.

Source and licensing

FyAgent-owned components and modifications remain under the repository's
published PolyForm Noncommercial terms. Upstream-derived material retains its
original notices and license ancestry.

See
LICENSE,
LICENSING.md,
and
THIRD_PARTY_NOTICES.md.

Windows installer signing status

Mode: unsigned; source: f424ceff8f085673d00b8fd191045cb965987408. The installer rows below are backed by the published signing-status.json and artifact-attestation.sigstore.json evidence.

Architecture Installer Authenticode Publisher Timestamp SHA-256 Source SHA Attestation
x64 FyAgent-0.3.4-Windows-x64-setup.exe NotSigned Not signed None e3fa630df4c28532bd584eb2993df64e81ff8bcb6aeeea5690be9aa7949983f4 f424ceff8f085673d00b8fd191045cb965987408 artifact-attestation.sigstore.json subject FyAgent-0.3.4-Windows-x64-setup.exe digest sha256:e3fa630df4c28532bd584eb2993df64e81ff8bcb6aeeea5690be9aa7949983f4
arm64 FyAgent-0.3.4-Windows-arm64-setup.exe NotSigned Not signed None 1774ad67522861c8f895915ef740cf631a19abbdf024104686d275211ad9c99e f424ceff8f085673d00b8fd191045cb965987408 artifact-attestation.sigstore.json subject FyAgent-0.3.4-Windows-arm64-setup.exe digest sha256:1774ad67522861c8f895915ef740cf631a19abbdf024104686d275211ad9c99e
Assets 16
Loading