release-peekaboo

name	release-peekaboo
description	Release Peekaboo CLI/Mac app: service-account 1Password notarization, npm/GitHub release, appcast, verification, closeout.
metadata	{"clawdbot":{"emoji":"👁️","requires":{"bins":"[Truncated]"}}}

Peekaboo Release

Release ~/Projects/Peekaboo as the npm package @steipete/peekaboo plus signed/notarized macOS app assets.

Use $one-password, $browser-use, $npm, $codex-review, and repo AGENTS.md rules. Keep all op secret work inside one persistent tmux session. Never print .p8, npm tokens, passwords, or OTPs.

Current Secrets

Canonical automation item:

• vault: Molty
• title: API Key - App Store Connect - Personal - Release
• fields: key_id, issuer_id, private_key_p8
• service token: MOLTY_OP_SERVICE_ACCOUNT_TOKEN
• status: if the service account returns Service Account Deleted, use desktop op --account my.1password.com and restore the Molty service account before the next release.
• current key id: AKVLXW849T
• issuer id: 69a6de84-c8a9-47e3-e053-5b8c7c11a4d1
• App Store Connect key name: Peekaboo Release 3.2.1
• access: Admin

Legacy mirror:

• vault: Private
• title: API Key - App Store Connect - Personal
• Keep synced to the same current key so older refs do not use stale material.

Revoked old key:

• Peekaboo Release 3.2.0 / 7HRXH68LLU, revoked 2026-05-18.

Sparkle key:

• SPARKLE_PRIVATE_KEY_FILE=/Users/steipete/Library/CloudStorage/Dropbox/Backup/Sparkle/sparkle-private-key-KEEP-SECURE.txt

Developer ID release keychain:

• vault: Molty
• title: Peekaboo Release Keychain
• fields: keychain_path, keychain_password, certificate_source
• current path: /Users/steipete/Library/Keychains/peekaboo-release-321-20260518132141.keychain-db

npm publish token:

• vault: Private
• title: API Token - npm - Personal
• field: token
• Use only through a temp npmrc; delete temp files immediately. If this token requires npm web auth, use the npmjs TOTP item and delete any short-lived bypass tokens created during retries.

Notary Credential Check

Use the service account first. Put the token in the tmux environment without printing it:

tmux -S "$SOCKET" set-environment -t "$SESSION" OP_SERVICE_ACCOUNT_TOKEN "$MOLTY_OP_SERVICE_ACCOUNT_TOKEN"

Create a temp env file with service-account refs:

APP_STORE_CONNECT_API_KEY_P8=op://Molty/API Key - App Store Connect - Personal - Release/private_key_p8
APP_STORE_CONNECT_KEY_ID=op://Molty/API Key - App Store Connect - Personal - Release/key_id
APP_STORE_CONNECT_ISSUER_ID=op://Molty/API Key - App Store Connect - Personal - Release/issuer_id
SPARKLE_PRIVATE_KEY_FILE=/Users/steipete/Library/CloudStorage/Dropbox/Backup/Sparkle/sparkle-private-key-KEEP-SECURE.txt

Before a release, verify shape and Apple auth without printing values:

op run --env-file "$ENVFILE" -- bash -c '
  set -euo pipefail
  KEY_FILE="/tmp/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8"
  printf "%s\n" "$APP_STORE_CONNECT_API_KEY_P8" > "$KEY_FILE"
  chmod 600 "$KEY_FILE"
  test "$APP_STORE_CONNECT_KEY_ID" = "AKVLXW849T"
  xcrun notarytool history \
    --key "$KEY_FILE" \
    --key-id "$APP_STORE_CONNECT_KEY_ID" \
    --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
    --output-format json >/dev/null
  rm -f "$KEY_FILE"
'

Peekaboo forces notarytool submit --no-s3-acceleration; the default S3 accelerated upload path can return a misleading 401 even when history auth succeeds.

If both history and non-S3 submit fail, suspect wrong access level or stale key. Browser route:

1. Use $browser-use real Chrome profile.
2. Open https://appstoreconnect.apple.com/access/integrations/api.
3. Generate Team Key named Peekaboo Release <version> with Admin access.
4. Download .p8 once from the key row.
5. Store immediately into both 1Password items above; verify notarytool history; delete ~/Downloads/AuthKey_<key_id>.p8.
6. Revoke the older Peekaboo release key after the new key validates.

Release Flow

1. Start on clean main; pull ff-only if needed.
2. Set version in:
   • package.json
   • version.json
   • Apps/CLI/Sources/Resources/version.json
   • README npm badge
   • Core/PeekabooCore/Sources/PeekabooAgentRuntime/MCP/PeekabooMCPVersion.swift
   • Xcode marketing versions under Apps/*
3. Date CHANGELOG.md and Apps/CLI/CHANGELOG.md for the release.
4. Run focused proof or release script preflight. Release gates must be warning-free.
5. Use $codex-review before commit unless the change is trivial/docs-only.
6. Commit release prep with committer.
7. Push main.
8. Run:

op run --env-file "$ENVFILE" -- \
  bash -lc 'printf "y\n" | ./scripts/release-binaries.sh --create-github-release --publish-npm'

The script builds universal CLI, npm package, signed/notarized app zip, appcast, checksums, draft GitHub release, and npm publish.

Notarized releases must sign with Developer ID Application: Peter Steinberger (Y5PE65HELJ), not Apple Development. If your shell has SIGN_IDENTITY exported for CLI builds, override it for the release command.

If npm upload is slow and TOTP expires, use the stored npm token through a temp npmrc and complete npm web auth immediately when prompted. Do not create granular bypass tokens unless necessary; if created, delete them from https://www.npmjs.com/settings/steipete/tokens before closeout.

Verify

Required before closeout:

npm view @steipete/peekaboo@<version> version dist-tags dist.tarball dist.integrity time --json
gh release view v<version> --repo openclaw/Peekaboo --json tagName,isDraft,isPrerelease,url,assets,body
xmllint --noout appcast.xml
git status --short --branch

Confirm:

• npm version exists and latest points to it.
• GitHub release/tag/assets exist; release body is from changelog.
• app zip asset exists and appcast points at v<version>.
• appcast.xml changes are committed and pushed.
• Publish draft release if the script leaves it draft.

Closeout

1. Add next patch Unreleased section to root and CLI changelogs.
2. Commit with committer "docs(changelog): open <next-version>" CHANGELOG.md Apps/CLI/CHANGELOG.md.
3. Push.
4. Watch release/homebrew/CI workflows if triggered.
5. git checkout main && git pull --ff-only && git status --short --branch.
6. Clear tmux OP_SERVICE_ACCOUNT_TOKEN, remove temp env/key files, and final with what landed.