@lamalibre/create-lamaste 4.3.0 → 4.3.1

package/vendor/docs/06-reference/troubleshooting.md

@@ -217,7 +217,7 @@ The agent's sync timer applies tunnel changes within about 30 seconds. If that d
 lamaste-agent update     # apply now and (re)install the sync timer
 ```
 
-`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.3.0`); an agent originally set up with `npx` must be installed first.
+`update` needs the agent installed globally (`npm install -g @lamalibre/lamaste-agent@4.3.1`); an agent originally set up with `npx` must be installed first.
 
 **Cause 3: The agent does not carry the tunnel.**
 
@@ -320,7 +320,7 @@ ls -la /usr/local/bin/authelia
 | Missing `panel.json`            | `Config file not found`                 | Re-run installer or create the file manually                                                                                   |
 | Invalid JSON in `panel.json`    | `contains invalid JSON`                 | Fix the JSON syntax                                                                                                            |
 | Port 3100 in use                | `EADDRINUSE`                            | Find and stop the conflicting process: `sudo ss -tlnp sport = :3100`                                                           |
-| Missing Node.js modules         | `Cannot find module`                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
+| Missing Node.js modules         | `Cannot find module`                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.1 --yes`); `/opt/lamalibre/lamaste` is root-owned and redeployed as a whole |
 | Permission denied writing state | `EACCES` under `/etc/lamalibre/lamaste` | Re-run the installer; the redeploy re-applies the ownership of the config and PKI directories                                  |
 
 ### chisel fails to start
@@ -329,7 +329,7 @@ ls -la /usr/local/bin/authelia
 
 | Cause                      | Log Message                                                                           | Fix                                                                                                                                                                                                                               |
 | -------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Binary missing             | `exec format error` or `not found`                                                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries                                                 |
+| Binary missing             | `exec format error` or `not found`                                                    | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.1 --yes`) — it installs the pinned, checksum-verified release for the server's architecture; the panel cannot install binaries                                                 |
 | Not the pinned release     | (panel log) `The installed chisel is not the pinned release — run create-lamaste ...` | Re-run the installer. Until then the panel restarts Chisel on every authfile change                                                                                                                                               |
 | Authfile or key unreadable | `permission denied` on `chisel-users` or `chisel-server.key`                          | Both must be `0640 lamaste:lamaste-chisel` and the unit `Group=lamaste-chisel`; restart the panel, which re-applies the authfile's. If the group, the unit or the key's ownership is wrong, re-run the installer in redeploy mode |
 | Stopped by the panel       | (panel log) `Chisel stopped: ...`; unit disabled, `chisel-failed-closed` present      | Reconciliation failed closed; see [Tunnel Client Cannot Connect](#tunnel-client-cannot-connect), Cause 1                                                                                                                          |
@@ -343,7 +343,7 @@ ls -la /usr/local/bin/authelia
 | --------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Invalid `configuration.yml` | `configuration: error`                  | Check YAML syntax with `authelia validate-configuration --config /etc/authelia/configuration.yml`                                                                                                                                                                                                                                                         |
 | Missing `users.yml`         | `cannot open file`                      | Create an initial users file (see [Config Files](config-files.md))                                                                                                                                                                                                                                                                                        |
-| Binary missing              | `not found`                             | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`); it installs the pinned release                                                                                                                                                                                                                                                              |
+| Binary missing              | `not found`                             | Re-run the installer (`npx @lamalibre/create-lamaste@4.3.1 --yes`); it installs the pinned release                                                                                                                                                                                                                                                              |
 | Wrong permissions           | `permission denied`                     | Authelia runs as `lamaste-authelia`: `/etc/authelia` must be `lamaste:lamaste-authelia 2770`, `configuration.yml` `0640`, `users.yml` `0660`, `db.sqlite3` owned by `lamaste-authelia`. Re-run the installer to re-apply (a root-owned `/etc/authelia` from an older version is converted), or see [Config Files](config-files.md#file-permissions-table) |
 | Database newer than binary  | storage schema version error at startup | A newer Authelia ran against this database and was replaced by an older one; the installer never downgrades an installed Authelia, so reinstall that newer release by hand                                                                                                                                                                                |
 
@@ -516,14 +516,14 @@ sudo systemctl restart authelia
 
 ## Onboarding Fails: "Chisel is not installed" / "Authelia is not installed"
 
-**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.3.0` on the server to repair the installation." (or the same for Authelia).
+**Symptom:** The **Starting Chisel** or **Configuring Authelia** provisioning task fails with "Chisel is not installed. Run `npx @lamalibre/create-lamaste@4.3.1` on the server to repair the installation." (or the same for Authelia).
 
 **Cause:** Onboarding downloads nothing: the installer installs both binaries (pinned releases), their systemd units and the `lamaste-authelia` account. The binary at `/usr/local/bin/chisel` or `/usr/local/bin/authelia` is missing — the installer was interrupted, or the file was removed.
 
 **Fix:** Re-run the installer on the server, then start provisioning again from the wizard:
 
 ```bash
-npx @lamalibre/create-lamaste@4.3.0 --yes
+npx @lamalibre/create-lamaste@4.3.1 --yes
 ```
 
 If provisioning then fails writing Authelia's configuration with `/etc/authelia is not writable by the panel — run create-lamaste to repair the installation`, the directory's ownership is wrong; the same command repairs it.
@@ -538,7 +538,7 @@ If provisioning then fails writing Authelia's configuration with `/etc/authelia
 
 **Fix:**
 
-1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.3.0 --yes`
+1. Re-run the installer so the helper matches the panel: `npx @lamalibre/create-lamaste@4.3.1 --yes`
 2. If it persists on a current install, it is a bug: the vhost generators (`packages/server/daemon/src/lib/nginx.js`) and the allow-list (`packages/provisioners/server/scripts/lamaste-priv`) must change together — `npm test` checks every generated vhost against the allow-list. Do not work around it by editing files in `/etc/nginx` by hand.
 
 `sudo: a password is required` for `lamaste-priv` means the helper or the sudoers file is missing or outdated: re-run the installer.
@@ -621,7 +621,7 @@ df -h /
 
 **Cause 3: The web root is not writable by the panel (`EACCES`).**
 
-The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.3.0 --yes`); the redeploy converts the tree.
+The panel writes `/var/www/lamaste` itself: it must be `lamaste:www-data`, directories `2750`, files `0640`. An install from before this layout had it owned by `www-data`. Re-run the installer (`npx @lamalibre/create-lamaste@4.3.1 --yes`); the redeploy converts the tree.
 
 ---
 

package/vendor/docs/gatekeeper-design.md

@@ -2,9 +2,9 @@
 
 ## Overview
 
-`@lamalibre/lamaste-gatekeeper@4.3.0` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
+`@lamalibre/lamaste-gatekeeper@4.3.1` is a standalone authorization package for Lamaste. It manages **groups** and **grants**, enforces tunnel access control via a lightweight Fastify service, and serves user-friendly "request access" pages when access is denied.
 
-It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.3.0` — a solid library at the core, with a service, CLI, and desktop as consumers.
+It follows the same architectural pattern as `@lamalibre/lamaste-tickets@4.3.1` — a solid library at the core, with a service, CLI, and desktop as consumers.
 
 ---
 
@@ -204,7 +204,7 @@ The grant system is resource-agnostic. It doesn't know what a "tunnel" or "plugi
 
 ```js
 import { createGroup, listGroups, getGroup, updateGroup, deleteGroup,
-         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.3.0';
+         addMembers, removeMembers, getGroupsForUser } from '@lamalibre/lamaste-gatekeeper@4.3.1';
 
 createGroup(name, { description?, createdBy? })
   // → { name, description, members: [], createdAt, createdBy }
@@ -240,7 +240,7 @@ getGroupsForUser(username)
 ### Grants
 
 ```js
-import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.3.0';
+import { createGrant, listGrants, getGrant, revokeGrant } from '@lamalibre/lamaste-gatekeeper@4.3.1';
 
 createGrant({ principalType, principalId, resourceType, resourceId, context? })
   // → grant object
@@ -267,7 +267,7 @@ revokeGrant(grantId)
 ### Authorization
 
 ```js
-import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.3.0';
+import { checkAccess } from '@lamalibre/lamaste-gatekeeper@4.3.1';
 
 checkAccess(username, resourceType, resourceId);
 // 1. Find direct user grants: principalType='user', principalId=username
@@ -282,7 +282,7 @@ checkAccess(username, resourceType, resourceId);
 ### Templates
 
 ```js
-import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.3.0';
+import { getAccessRequestTemplates } from '@lamalibre/lamaste-gatekeeper@4.3.1';
 
 getAccessRequestTemplates(username, resourceName, { adminContact?, domain? })
   // → {
@@ -864,14 +864,14 @@ On first startup, gatekeeper checks for legacy files:
 
 ### Panel-Server Refactoring
 
-- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.3.0`)
+- `lib/user-access.js` → delegates to gatekeeper library (import from `@lamalibre/lamaste-gatekeeper@4.3.1`)
 - `lib/access-control-sync.js` → removed (gatekeeper handles authorization at nginx layer, no more Authelia config rewriting for per-user access rules)
 - `routes/user-access.js` → simplified, delegates grant CRUD to gatekeeper
 - Tunnel creation/update routes → call gatekeeper for access mode changes
 
 ### Installer Updates (create-lamaste)
 
-- Install `@lamalibre/lamaste-gatekeeper@4.3.0` package
+- Install `@lamalibre/lamaste-gatekeeper@4.3.1` package
 - Create `/etc/lamalibre/lamaste/groups.json` (empty initial state)
 - Create `/etc/lamalibre/lamaste/access-grants.json` (empty or migrated)
 - Create `lamalibre-lamaste-gatekeeper.service` systemd unit

package/vendor/docs/identity-directory-design.md

@@ -1,7 +1,7 @@
 # Lamaste Identity Directory — Design Document
 
 > **Status:** design, 2026-10-13. Nothing here is implemented yet.
-> **Package:** `@lamalibre/lamaste-identity@4.3.0` (completes the existing SDK).
+> **Package:** `@lamalibre/lamaste-identity@4.3.1` (completes the existing SDK).
 > **Companions:** `gatekeeper-design.md` (authorization),
 > `plugin-development/design/agent-hosted-app-plugins.md` (app plugins).
 
@@ -178,7 +178,7 @@ and compares it with the local projection (by `userId` and `version`). It
 applies differences and logs how many it found — a non-zero count on a
 healthy system is a bug in the change feed and is reported to the panel.
 
-## SDK (`@lamalibre/lamaste-identity@4.3.0`)
+## SDK (`@lamalibre/lamaste-identity@4.3.1`)
 
 Today's surface stays; three pieces are added.
 

package/vendor/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-docs",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "private": true,
   "description": "Lamaste documentation — markdown files served by the panel and published to GitHub Pages",
   "type": "module",

package/vendor/docs/todo/lib-cli-desktop-refactor.md

@@ -29,7 +29,7 @@ feria                        dev registry — OUT OF SCOPE, do not touch
 
 ### Naming Rules
 
-- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.3.0'`. No `-lib` suffix.
+- **`lamaste`** is the core lib. You `import { ... } from '@lamalibre/lamaste@4.3.1'`. No `-lib` suffix.
 - **`-d` suffix** for daemons — Unix convention (`httpd`, `sshd`, `mongod`). Instantly signals "long-running process".
 - **`-ui`** for React component libraries — universal term, avoids "serverd serves the panel" tautology.
 - **`create-*`** for all npx one-shot tools — the one npm convention everyone knows.
@@ -74,24 +74,24 @@ lamaste                              core library (types, constants, schemas, pl
 
 | #   | Package (npm name)                  | Type        | Depends on | Purpose                                                                                                             |
 | --- | ----------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------------------------------------------------- |
-| 1   | `@lamalibre/lamaste@4.3.0`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.3.0/agent` — agent domain logic                                                            |
-|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.3.0/server` — server domain logic                                                          |
-| 2   | `@lamalibre/lamaste-agent@4.3.0`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
-| 3   | `@lamalibre/lamaste-agentd@4.3.0`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
-| 4   | `@lamalibre/lamaste-agent-ui@4.3.0`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
-| 5   | `@lamalibre/lamaste-server@4.3.0`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
-| 6   | `@lamalibre/lamaste-serverd@4.3.0`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
-| 7   | `@lamalibre/lamaste-server-ui@4.3.0`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
-| 8   | `@lamalibre/lamaste@4.3.0-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
-| 9   | `@lamalibre/lamaste-cloud@4.3.0`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
-| 10  | `@lamalibre/lamaste-tickets@4.3.0`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
-| 11  | `@lamalibre/lamaste-identity@4.3.0`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
-| 12  | `@lamalibre/create-lamaste@4.3.0`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
-| 13  | `@lamalibre/create-lamaste-agent@4.3.0`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
-| 14  | `@lamalibre/create-lamaste-desktop@4.3.0` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
-| 15  | `@lamalibre/create-lamaste-admin@4.3.0`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
-| 16  | `@lamalibre/create-lamaste-e2e@4.3.0`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
+| 1   | `@lamalibre/lamaste@4.3.1`                | core lib    | nothing    | Types, constants, Zod schemas, plugin host Fastify plugin, atomic file helpers, client interfaces                   |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.3.1/agent` — agent domain logic                                                            |
+|     |                                     |             |            | Subpath: `@lamalibre/lamaste@4.3.1/server` — server domain logic                                                          |
+| 2   | `@lamalibre/lamaste-agent@4.3.1`          | CLI         | `lamaste`  | Thin agent CLI. No Fastify, no HTTP                                                                                 |
+| 3   | `@lamalibre/lamaste-agentd@4.3.1`         | daemon      | `lamaste`  | Agent REST API on :9393. No CLI argument parsing                                                                    |
+| 4   | `@lamalibre/lamaste-agent-ui@4.3.1`       | UI lib      | `lamaste`  | Agent React components + browser SPA build. Used by desktop and agentd                                              |
+| 5   | `@lamalibre/lamaste-server@4.3.1`         | CLI         | `lamaste`  | **NEW.** Thin server CLI. No Fastify, no HTTP                                                                       |
+| 6   | `@lamalibre/lamaste-serverd@4.3.1`        | daemon      | `lamaste`  | Server REST API on :3100. No CLI argument parsing. Renamed from `serverd`                                           |
+| 7   | `@lamalibre/lamaste-server-ui@4.3.1`      | UI lib      | `lamaste`  | Server/admin React components + browser SPA build. Replaces both `panel-client` and `lamaste-admin-panel`           |
+| 8   | `@lamalibre/lamaste@4.3.1-desktop`        | desktop     | `lamaste`  | Unified Tauri app. Multi-target: full, agent-only, server-only. Credentials, tray, deep links                       |
+| 9   | `@lamalibre/lamaste-cloud@4.3.1`          | lib + CLI   | —          | Cloud provider abstraction (already correct pattern)                                                                |
+| 10  | `@lamalibre/lamaste-tickets@4.3.1`        | SDK         | —          | Agent-to-agent authorization                                                                                        |
+| 11  | `@lamalibre/lamaste-identity@4.3.1`       | SDK         | —          | Authelia identity parsing and query                                                                                 |
+| 12  | `@lamalibre/create-lamaste@4.3.1`         | provisioner | `lamaste`  | Server provisioner: OS hardening, nginx, Authelia, certs. `npx create-lamaste`                                      |
+| 13  | `@lamalibre/create-lamaste-agent@4.3.1`   | provisioner | `lamaste`  | Agent provisioner: cert enrollment, service setup. `npx create-lamaste-agent`. Renamed from `install-lamaste-agent` |
+| 14  | `@lamalibre/create-lamaste-desktop@4.3.1` | installer   | —          | Desktop app installer. `npx create-lamaste-desktop`. Renamed from `install-lamaste-desktop`                         |
+| 15  | `@lamalibre/create-lamaste-admin@4.3.1`   | provisioner | `lamaste`  | Admin cert upgrade to hardware-bound. `npx create-lamaste-admin`. Renamed from `install-lamaste-admin`              |
+| 16  | `@lamalibre/create-lamaste-e2e@4.3.1`     | test infra  | —          | E2E test MCP server. `npx create-lamaste-e2e`. Renamed from `install-lamaste-e2e-mcp`                               |
 | 17  | `@lamalibre/feria`                  | dev tool    | —          | Dev registry + release runner. **Out of scope — do not touch in this refactor**                                     |
 
 ### Rename Map (1.x → 2.0.0)
@@ -116,7 +116,7 @@ The core library uses **subpath exports** to provide domain-specific entry point
 
 ```json
 {
-  "name": "@lamalibre/lamaste@4.3.0",
+  "name": "@lamalibre/lamaste@4.3.1",
   "exports": {
     ".": "./dist/index.js",
     "./agent": "./dist/agent/index.js",
@@ -126,9 +126,9 @@ The core library uses **subpath exports** to provide domain-specific entry point
 ```
 
 ```typescript
-import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.3.0';
-import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.3.0/agent';
-import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.3.0/server';
+import { RESERVED_API_PREFIXES, pluginManifestSchema } from '@lamalibre/lamaste@4.3.1';
+import { loadRegistry, loadAgent, isAgentLoaded } from '@lamalibre/lamaste@4.3.1/agent';
+import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.3.1/server';
 ```
 
 **Why subpath exports instead of three packages (`lamaste-lib`, `lamaste-lib-agent`, `lamaste-lib-server`):**
@@ -149,7 +149,7 @@ import { createTunnel, rotateCert } from '@lamalibre/lamaste@4.3.0/server';
 
 | Layer                    | Agent side                                      | Server side                                    |
 | ------------------------ | ----------------------------------------------- | ---------------------------------------------- |
-| **Domain logic**         | `@lamalibre/lamaste@4.3.0/agent`                      | `@lamalibre/lamaste@4.3.0/server`                    |
+| **Domain logic**         | `@lamalibre/lamaste@4.3.1/agent`                      | `@lamalibre/lamaste@4.3.1/server`                    |
 | **Operational CLI**      | `lamaste-agent`                                 | `lamaste-server` (new)                         |
 | **Long-running daemon**  | `lamalibre-lamaste-agentd` on :9393 (extracted) | `lamalibre-lamaste-serverd` on :3100 (renamed) |
 | **UI components**        | `lamaste-agent-ui` (renamed)                    | `lamaste-server-ui` (merged)                   |
@@ -471,7 +471,7 @@ The Rust backend has both `commands.rs` (legacy) and `agents.rs` (multi-agent).
 
 Create `packages/lamaste/` (TypeScript) with subpath exports:
 
-**Root (`@lamalibre/lamaste@4.3.0`):**
+**Root (`@lamalibre/lamaste@4.3.1`):**
 
 - Types: `AdminClient`, `AgentClient` TypeScript interfaces, plugin manifest types, capability types
 - Constants: Reserved API prefixes, curated plugin list, capability names
@@ -479,7 +479,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Plugin Host: Fastify plugin for plugin route mounting, bundle serving, disabled handler (unified from three routers)
 - File Helpers: Atomic write (temp → fsync → rename), promise-chain mutex
 
-**Agent subpath (`@lamalibre/lamaste@4.3.0/agent`):**
+**Agent subpath (`@lamalibre/lamaste@4.3.1/agent`):**
 
 - Platform: Path helpers, platform detection (from `platform.js`)
 - Registry: Agent registry CRUD, label validation, legacy migration (from `registry.js`)
@@ -491,7 +491,7 @@ Create `packages/lamaste/` (TypeScript) with subpath exports:
 - Server Registry: servers.json and storage-servers.json CRUD (new — from Rust `cloud.rs`)
 - Mode: Server mode and admin cert file operations (new — from Rust `mode.rs`)
 
-**Server subpath (`@lamalibre/lamaste@4.3.0/server`):**
+**Server subpath (`@lamalibre/lamaste@4.3.1/server`):**
 
 - Plugins: Server-side plugin lifecycle (uses shared schema from root)
 - Tunnels: Tunnel creation workflow with rollback (from `routes/tunnels.js`)

package/vendor/gatekeeper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-gatekeeper",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "description": "Authorization layer for Lamaste — groups, grants, and tunnel access control",
   "type": "module",
   "exports": {
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@fastify/rate-limit": "^10.3.0",
-    "@lamalibre/lamaste": "^4.3.0",
+    "@lamalibre/lamaste": "^4.3.1",
     "fastify": "^5.3.3",
     "undici": "^7.8.0",
     "zod": "^3.24.4"

package/vendor/server/bin/lamaste-server.js

@@ -19,6 +19,7 @@
  *   sites         Manage static sites
  *   certs         Certificate status and renewal
  *   reset-admin   Emergency admin authentication reset
+ *   panel-pin     The public-key pin of the panel's IP listener
  *   uninstall     Full server teardown
  */
 
@@ -66,6 +67,7 @@ ${b('COMMANDS')}
   ${c('sites')}           Manage static sites (list, create, delete)
   ${c('certs')}           Certificate status, renewal, and agent cert listing
   ${c('reset-admin')}     Emergency admin reset (reverts to P12, clears 2FA)
+  ${c('panel-pin')}       The panel's TLS key pin, to compare with what agents and the desktop pinned
   ${c('chisel')}          Manage chisel tunnel-server credentials (rotate-credential)
   ${c('registry-credential')} Registry (Feria) service credential used to broker agent install tokens
   ${c('uninstall')}       Full server teardown (requires confirmation)
@@ -195,6 +197,11 @@ async function main() {
       await runResetAdmin({ json, passwordFile });
       break;
     }
+    case 'panel-pin': {
+      const { runPanelPin } = await import('../src/commands/panel-pin.js');
+      await runPanelPin({ json });
+      break;
+    }
     case 'registry-credential': {
       const { runRegistryCredential } = await import('../src/commands/registry-credential.js');
       await runRegistryCredential(args.slice(1), { json });

package/vendor/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-server",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "description": "Server operations CLI for Lamaste",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -17,7 +17,7 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@lamalibre/lamaste": "^4.3.0",
+    "@lamalibre/lamaste": "^4.3.1",
     "chalk": "^5.3.0",
     "execa": "^9.0.0"
   },

package/vendor/server/src/commands/panel-pin.js

@@ -0,0 +1,40 @@
+/**
+ * lamaste-server panel-pin — the public-key pin of the panel's IP listener.
+ *
+ * The panel's IP address (`https://<ip>:9292`) is served with a self-signed
+ * certificate, so the clients that reach it there pin its public key the
+ * first time they connect: `lamaste-agent setup` (and `panel reset-pin`),
+ * and the desktop app, which shows the pin with the server. This prints the
+ * pin from the certificate itself, read on the relay — compare the two to
+ * know a client pinned the panel and not something in between.
+ */
+
+import chalk from 'chalk';
+import { emit } from '../ndjson.js';
+import { readPanelIdentity } from '../panel-identity.js';
+
+/**
+ * @param {{ json: boolean }} options
+ */
+export async function runPanelPin({ json }) {
+  const identity = await readPanelIdentity();
+  const pin = `sha256//${identity.pin}`;
+  if (json) {
+    emit({
+      pin,
+      address: identity.address,
+      port: identity.port,
+      certificate: identity.certPath,
+    });
+    return;
+  }
+  console.log(
+    `${chalk.bold('Panel:')}       https://${identity.address}:${identity.port} ${chalk.dim(`(${identity.certPath})`)}`,
+  );
+  console.log(`${chalk.bold('Key pin:')}     ${chalk.cyan(pin)}`);
+  console.log(
+    chalk.dim(
+      'Agents and the desktop app pin this key the first time they connect; the pin they show must be this one.',
+    ),
+  );
+}