Peekaboo Release

Release ~/Projects/Peekaboo as the npm package @steipete/peekaboo plus signed/notarized macOS app assets.

Use $one-password, $browser-use, $npm, $autoreview, and repo AGENTS.md rules. Load $release-private if it exists before resolving Peter-owned credential locators. Read $npm before any npm auth, token, or publish recovery work. Keep all op secret work inside one persistent tmux session. Never print .p8, npm tokens, passwords, or OTPs.

Current Secrets

• Peter-owned credential item names, key ids, issuer ids, keychain paths, and npm token locators live in $release-private.
• Required ASC fields: key_id, issuer_id, private_key_p8.
• Stale/revoked key symptom: xcrun notarytool submit fails with HTTP status code: 401. Unauthenticated.
• All ASC fields must come from the same current item; do not mix profile values with 1Password refs.

Sparkle key:

• Repo .mac-release.env has the current fallback.
• Do not set SPARKLE_PRIVATE_KEY_FILE for normal releases.

Developer ID release keychain: