0.7.2: optional BYO-TLS on the TCP bind (cert pinning); stop editing settings.json

[johnfink8]

Adds optional TLS to the cross-machine path, and stops brackish install from touching your settings.json.

• TLS, bring-your-own cert. serve/up --tls-cert/--tls-key serve HTTPS on the TCP bind; the client pins the self-signed cert by SHA-256 fingerprint, which rides in the connect … --tls-pin line the invite prints. No CA, no public signing; tls gen wraps openssl. Pinning checks every connection — resumption is off, since an earlier draft trusted resumed sessions and a probe showed that left most connections unverified.
• install no longer edits settings.json. Dropped the long-stubbed inbox hook (a per-prompt subprocess in every session) and the --permission allow-rule insertion; it just copies the skill now (+67/−1179 across the install code). Add Bash(brackish *) yourself if you want fewer approval prompts.
• Verified with the suite plus a real two-Claude cross-machine trial: the server Claude set up TLS and invited unaided, the client connected over HTTPS with the pin.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds optional TLS + cert pinning for cross-machine TCP transport and removes all settings.json mutation from brackish install/uninstall.

Changes:

• Introduces BYO-TLS on the TCP bind (HTTPS) plus SHA-256 fingerprint pinning in the client.
• Adds brackish tls gen (openssl wrapper) and extends config to persist TLS cert/key + pin fields.
• Simplifies install/uninstall to only copy/remove the skill directory; removes hook/permission wiring and related tests/docs updates.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/tls.test.ts	Adds unit + e2e coverage for pin normalization, root-cause messaging, TLS serve + pinning.
tests/install.test.ts	Updates expectations now that install/uninstall no longer edits settings.json or manages hooks.
tests/config.test.ts	Ensures TLS config fields round-trip in TOML.
src/lib/tls.ts	Adds cert fingerprint + pin normalization helpers.
src/client/client.ts	Implements pinned TLS via undici connector/Agent and extends bootstrap redeem to support pinning.
src/daemon/server.ts	Adds optional HTTPS serving on TCP bind and surfaces tcpScheme + tlsFingerprint.
src/io/config.ts	Persists tls_pin, tls_cert, tls_key in config.
src/cli/tls.ts	Adds brackish tls gen command (openssl wrapper) + outputs pin and serve instructions.
src/cli/common.ts	Adds rootCauseMessage and uses it to surface nested undici/connect errors.
src/cli/bootstrap.ts	Adds --tls-pin support to connect; invite output includes pin when applicable.
src/cli/daemon.ts	Adds TLS flags to serve/up; includes pin + scheme in printed URLs and invite lines.
src/io/install.ts	Removes settings.json/hook/permission mutation machinery; install now only copies skill dir.
src/cli/install.ts	Simplifies CLI to install/uninstall skill directory only; removes hook/permission commands.
skill/*.md, README.md, CHANGELOG.md	Documents new TLS flow and the revised install behavior.
harness/*.ts	Updates harness behavior to match new install and supports TLS trial mode.
package.json	Bumps version to 0.7.2.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.