youmd 0.8.5 → 0.8.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "youmd",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Identity context protocol for the agent internet — an MCP where the context is you. CLI for the You.md platform.",
   "bin": {
     "you": "dist/you.js",

package/skills/machine-bootstrap.md

@@ -138,15 +138,27 @@ You.md is the brain. The new machine should become a runnable local agent workst
   `youmd machine prompt`, `youmd machine setup`,
   `youmd skill install all`, `youmd skill sync`,
   `youmd env vault list`, `youmd env vault pull`,
-  `youmd project portfolio-hydrate`, and `youmd machine verify`.
+  `youmd project portfolio-hydrate`, `youmd machine verify`,
+  `youmd agent status`, and `youmd agent inbox`.
+- Report setup milestones to Houston's other trusted Macs with the realtime
+  agent bus instead of relying on clipboard/manual status relays:
+
+  ```bash
+  youmd agent send --channel machine-sync --kind status "Mac mini completed identity + skill sync"
+  ```
+
+  This writes through Convex realtime and the receiving daemon materializes it
+  into `~/.youmd/agent-bus/inbox.json` without reading or exposing `.env.local`
+  values.
 - Use `you` / `youmd chat` when you need the You Agent to synthesize context,
   route a natural-language request, or produce the setup artifact, then turn the
   result into concrete shell actions.
 - Do not stop to ask "what next?" after each setup phase. Continue through the
   command, verify the result, and report concise proof.
 - Interrupt Houston only for true human-gated steps: GitHub browser auth,
-  macOS Keychain/passphrase entry, npm OTP, OS permissions, or the explicit
-  90-day project expansion choice.
+  source-Mac Secret Vault share/passphrase entry if no trusted-device envelope
+  exists yet, npm OTP, OS permissions, or the explicit 90-day project expansion
+  choice.
 - If the installed CLI is stale, run the curl installer/update path first, then
   retry the You.md command. Tell Houston when npm publish is needed for
   `npx youmd@latest` or npm fallback installs.
@@ -190,24 +202,32 @@ youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault
 youmd env vault list
 ```
 
-The passphrase is still local/trusted-device material. If the new machine needs
-headless restore, store the passphrase in macOS Keychain once from a normal
-trusted Terminal. Input is silent and the value is not printed:
+On the new machine, register its local Secret Vault device key. The private key
+stays under `~/.youmd/secret-vault/devices/`; only the public key is synced:
 
 ```bash
-read -rs "PW?You.md vault passphrase: " && \
-security add-generic-password -a "$USER" -s youmd-env-vault -w "$PW" -U && \
-unset PW && echo "stored in Keychain"
+youmd env vault device-register
+```
+
+Back on the old/source machine, share local decrypt access to trusted devices.
+This stores per-device encrypted passphrase envelopes; it does not upload raw env
+values:
+
+```bash
+youmd env vault share
 ```
 
 On the new machine, pull the latest encrypted account snapshot and restore into
 already-cloned project directories without clobbering local agent auth:
 
 ```bash
-youmd env vault pull --out ~/.youmd/secret-vault
 youmd env vault pull --restore --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
 ```
 
+If `pull --restore` says no trusted-device envelope exists for this Mac, do not
+ask Houston for raw secrets. Confirm `device-register` ran on the new Mac, run
+`youmd env vault share` on the source Mac, then rerun `pull --restore`.
+
 Fallback path: create an encrypted archive from the old machine in an
 interactive macOS terminal and transfer the encrypted file by iCloud, AirDrop,
 USB, or private password-manager attachment:
@@ -225,9 +245,15 @@ youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YO
 youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
 ```
 
-If a headless agent reports that Keychain service `youmd-env-vault` is missing,
-do not make it guess. Print the Keychain command above, have Houston run it once
-on the trusted device, then rerun only the restore/setup command.
+If a headless agent still cannot decrypt after device sharing, then and only then
+use the macOS Keychain fallback for the env-vault passphrase. Input is silent and
+the value is not printed:
+
+```bash
+read -rs "PW?You.md vault passphrase: " && \
+security add-generic-password -a "$USER" -s youmd-env-vault -w "$PW" -U && \
+unset PW && echo "stored in Keychain"
+```
 
 ## Useful Variants