overlane 0.1.162 → 0.1.163

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. package/README.md +11 -1
  2. package/dist/overlane-full.mjs +216 -216
  3. package/dist/overlane.mjs +44 -44
  4. package/package.json +1 -1
  5. package/plugins/claude/plugins/overlane/.claude-plugin/plugin.json +1 -1
  6. package/plugins/claude/plugins/overlane/scripts/overlane-activity-send.mjs +13 -13
  7. package/plugins/claude/plugins/overlane/scripts/overlane-codemap.mjs +17 -17
  8. package/plugins/claude/plugins/overlane/scripts/overlane-context.mjs +18 -18
  9. package/plugins/claude/plugins/overlane/scripts/overlane-guard.mjs +11 -11
  10. package/plugins/claude/plugins/overlane/scripts/overlane-intake.mjs +18 -18
  11. package/plugins/claude/plugins/overlane/scripts/overlane-overlay.mjs +15 -15
  12. package/plugins/claude/plugins/overlane/scripts/overlane-quota.mjs +15 -15
  13. package/plugins/claude/plugins/overlane/scripts/overlane-statusline.mjs +11 -11
  14. package/plugins/claude/plugins/overlane/scripts/overlane-stop.mjs +16 -16
  15. package/plugins/codex/plugins/overlane/.codex-plugin/plugin.json +1 -1
  16. package/plugins/codex/plugins/overlane/scripts/overlane-activity-send.mjs +13 -13
  17. package/plugins/codex/plugins/overlane/scripts/overlane-codemap.mjs +17 -17
  18. package/plugins/codex/plugins/overlane/scripts/overlane-context.mjs +18 -18
  19. package/plugins/codex/plugins/overlane/scripts/overlane-guard.mjs +11 -11
  20. package/plugins/codex/plugins/overlane/scripts/overlane-intake.mjs +18 -18
  21. package/plugins/codex/plugins/overlane/scripts/overlane-overlay.mjs +15 -15
  22. package/plugins/codex/plugins/overlane/scripts/overlane-quota.mjs +15 -15
  23. package/plugins/codex/plugins/overlane/scripts/overlane-statusline.mjs +11 -11
  24. package/plugins/codex/plugins/overlane/scripts/overlane-stop.mjs +16 -16
  25. package/plugins/release-manifest.json +24 -24
package/README.md CHANGED
@@ -113,4 +113,14 @@ Bots that you message (chat or scheduled agents) do not need the CLI. They conne
113
113
 
114
114
  ## Releases
115
115
 
116
- Releases are built by the repository's release workflow: it packs `overlane-<version>.tgz`, installs it into a clean prefix, runs a smoke test, attaches it to the GitHub release `v<version>`, and publishes to npm with provenance when the repository has an npm token.
116
+ Releases are built and published by Overlane's own release pipeline: it packs `overlane-<version>.tgz`, installs it into a clean prefix, runs a smoke test and publishes it to npm. The registry's own provenance badge needs a CI provider this pipeline is not, so each release instead carries signed build provenance (an in-toto statement with a SLSA v1 predicate, signed with Ed25519) and the software bill of materials, both attached to the GitHub release.
117
+
118
+ ### Verify a download
119
+
120
+ ```
121
+ npm pack overlane@<version>
122
+ # download overlane-<version>.intoto.json from the GitHub release of that version, and scripts/verify-release-attestation.mjs plus scripts/release-signing-key.pub from the same tag
123
+ node verify-release-attestation.mjs verify --package overlane-<version>.tgz --attestation overlane-<version>.intoto.json --public-key release-signing-key.pub
124
+ ```
125
+
126
+ It prints the commit and release run the package was built from, and exits 1 if the tarball, the statement or the signature do not match.