Dicklesworthstone/coding_agent_account_manager v0.1.18

on GitHub

caam v0.1.18

Security/infrastructure release: release verification moved from cosign keyless (GitHub Actions OIDC) to minisign with a maintainer-held key, and the self-updater's asset matcher is fixed.

Highlights

• Release signing switched to minisign (fixes #77). SHA256SUMS is now signed as SHA256SUMS.minisig with the caam release key (minisign key ID 1BBD79B28BF718D0). The public key is embedded in the binary; the updater verifies in pure Go, fail-closed. Releases <= 0.1.17 keep the legacy cosign verification path.
• caam update finds its platform asset again (fixes #75). The updater's version-wildcard pattern was compared with == and could never match, so every platform reported binary asset not found. Binaries <= 0.1.17 carry the broken matcher: upgrade out-of-band once (see below); from 0.1.18 on, self-update works.
• Plus fixes to caam next/caam run fallback behavior, Claude onboarding state in shallow profiles, caam doctor Codex probe reporting, and Codex login layer naming. See the CHANGELOG.

Upgrading from <= 0.1.17

caam update on old binaries cannot self-update (that is the #75 bug). Upgrade once manually, e.g. on Linux x86_64:

curl -fsSL -o caam.tar.gz https://github.com/Dicklesworthstone/coding_agent_account_manager/releases/download/v0.1.18/caam_0.1.18_linux_amd64.tar.gz
tar -xzf caam.tar.gz caam && sudo install caam /usr/local/bin/

(substitute darwin_arm64, darwin_amd64, linux_arm64, or windows_amd64.zip for your platform), or use the install script:

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_account_manager/main/install.sh" | bash

Verify this release

minisign -Vm SHA256SUMS -P RWTQGPeLsnm9G7VFdFWkkcRi3wJK/PqsYxWC+oLNN74W9IjBxRU1Xu70
shasum -a 256 -c SHA256SUMS --ignore-missing