open-tag 0.1.0 → 0.1.2

package/README.md

@@ -10,6 +10,29 @@ binary and `~/.opentag`; preview builds use the separate `open-tag-staging` pack
 Login installs and starts the daemon service by default. Use `--no-start` for credential-only login. The public daemon
 commands are `install`, `start`, `stop`, `restart`, `status`, and `uninstall`; v0.1 does not provide a Windows service.
 
+## Persistent runtime credentials
+
+Put daemon-only runtime environment values in `<OPENTAG_HOME>/config/daemon.env` (production default:
+`~/.opentag/config/daemon.env`). Keep the Home and config directories private and the file mode at `0600`.
+The daemon loads this file at startup; non-empty values already supplied by its supervisor take precedence.
+Restart the daemon after changing the file, once its current work can safely stop. Never share credential values.
+For unattended Claude subscription access, use the token created by `claude setup-token` as
+`CLAUDE_CODE_OAUTH_TOKEN`, rather than copying a short-lived access token from native login storage.
+
+Service installation and upgrade refresh preserve existing custom environment values in launchd plists and
+environment directives in the systemd unit. Installation and refresh enforce mode `0600` even when the definition content is unchanged, because it may contain secrets. OpenTag still regenerates its executable and managed `PATH`,
+`OPENTAG_HOME`, and `OPENTAG_SERVICE_MODE`. On Linux, the service entrypoint sets these three values after systemd
+applies environment files and removals, so custom directives cannot change the daemon's Home or service mode.
+Systemd drop-ins are separate files and remain untouched.
+An unsupported or ambiguous launchd environment is rejected before any definition is overwritten. Only supported UTF-8 XML environments are preserved; binary plists and other encodings must be converted first or use `config/daemon.env`.
+
+Claude readiness always consults the CLI's authentication status using the same setting sources as execution.
+Explicit credentials targeting the default Anthropic endpoint are additionally checked with one bounded, read-only
+Models API request per readiness check. Equivalent official URLs (including the default port and host case) receive the same check. When both `ANTHROPIC_AUTH_TOKEN` and `ANTHROPIC_API_KEY` are set, the check sends both authentication headers. A rejected credential requires sign-in or replacement; connectivity, permission, rate-limit,
+and service failures remain retryable unavailability. This check makes no model generation request and does not
+prove access to a particular model or available quota. Native login storage, custom gateways, Bedrock, Vertex,
+and Foundry remain under the Claude CLI's credential handling; OpenTag does not read or renew their tokens.
+
 ## Targeted Computer preparation
 
 `opentag connect <code>` (also `opentag computer connect <code>`) binds the Computer named by the one-time setup flow.

package/THIRD_PARTY_NOTICES

@@ -359,6 +359,35 @@ IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ---
 
+## fflate@0.8.3
+
+Source: https://github.com/101arrowz/fflate
+License: MIT
+
+MIT License
+
+Copyright (c) 2026 Arjun Barrett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
 ## tar-stream@3.2.0
 
 Source: https://github.com/mafintosh/tar-stream

package/dist/cli/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { B as presentCommand, F as CommandError, H as configureClientLoggerForService, I as EXIT_CODES, L as commandExitCode, U as resolveOpenTagHome, V as toCommandError, W as resolveOpenTagHomeLayout, a as installCliProcessErrorReporting, j as CommanderError, k as resolveChannelEnvironment, o as reportCommandFailure, s as resolveCommandPath, t as createProgram, z as observeCommandFailures } from "../program-CXagchrn.mjs";
+import { B as presentCommand, F as CommandError, H as configureClientLoggerForService, I as EXIT_CODES, L as commandExitCode, U as resolveOpenTagHome, V as toCommandError, W as resolveOpenTagHomeLayout, a as installCliProcessErrorReporting, j as CommanderError, k as resolveChannelEnvironment, o as reportCommandFailure, s as resolveCommandPath, t as createProgram, z as observeCommandFailures } from "../program-BpXcUOCH.mjs";
 //#region src/cli/run.ts
 /**
 * The CLI entry point's whole behaviour, so it can run under test with a real program.