v1.8.5 (2026-09-08)

Not published to npm. v1.8.5 was tagged and built but never released. Its changes are in v1.8.6-rc.5 on npm’s next channel; the stable latest release is v1.8.4.

v1.8.5 is the first-install fix release for v1.8.4. It carries every v1.8.4 change and fixes the setup path a new operator follows on a personal Mac: the install planner’s own next step, the recovery key’s default location, the principal policy a fresh fortress needs, the handling of a pin left behind by an earlier install, and the messages a failed init prints. No new capability; the capability bounds in the v1.8.4 notes stand.

What changed

Fixed

• The install planner’s next step works on a fresh fortress. protect, export-passphrase, the planner and the launched server resolve the fortress credential through one shared path: explicit passphrase, environment passphrase, environment recovery key, the custody factor init enrolled in the OS keyring, then the machine-local stored passphrase. A custody error names exactly the sources that are accepted; a new passphrase is minted only for a fortress with no custody state at all.
• The recovery key is staged beside the fortress, never inside it. init uses the documented staging directory by default, refuses any destination that resolves inside the fortress, and writes an operator-named destination only into a directory the operator owns that is not a symlink and not group- or world-writable. Only Sanctuary’s own staging directory has its permissions tightened.
• A fresh fortress passes doctor. init writes the default principal policy; doctor, init, the agents CLI and the runtime read it through the same no-follow, regular-file-only read, and a non-regular entry at that path is refused.
• A leftover global pin is adopted, bypassed or refused explicitly. Adoption requires byte agreement with the installed app; bypass requires both the app and the system extension observed absent; anything else stops with the exact remedy. “Recovery key verified” and “complete” print only after the step they describe.
• A failed init cleans up honestly. It keeps the recovery file it announced, removes only what the run wrote, and prints one consistent next step including a retry that works. A fortress directory named like the staging directory is refused up front with the remedy.
• Install plan JSON carries the staged-recovery-file observation, and rotate-master --help describes the recovery destination the command actually uses.

Carried from v1.8.4

See docs/releases/v1.8.4.md. The capability bounds there are unchanged.