Skip to main content
For the complete documentation index, see llms.txt. Markdown versions are available by appending .md to page URLs.
The public entry point should serve the generated lookout-install.sh byte-for-byte:
The authenticated Setup page embeds a short-lived single-use token in one command intended for the current blank agent terminal. The bootstrap accepts no arguments and requires only LOOKOUT_SETUP_TOKEN_FILE. Before downloading the release it posts the token through a bounded JSON request body to the setup connection endpoint, allowing the browser to display Connected immediately without consuming the claim token. install/onboard.sh then reads and removes the owner-only token file, performs parallel authoritative provider inventory from the orchestration host, deterministically selects a central Linux VM, consumes the token once, and binds the deployment identity and exact discovered scope to the authenticated account. The orchestration host is not added to the target scope. The returned scope is staged in an owner-only file and install/fleet.js loads only those VMs. It never expands the scope through Tailscale, neighbor discovery, or network scanning. The installer proves possession of the local Ed25519 deployment identity and stages the deployment-only console credential. Access probes run in isolated workers with bounded parallelism. Provider-native access is attempted before OpenSSH, and failed account-level native methods are not retried for every SSH username or command. Every target downloads the pinned release directly, so the orchestration host does not recompress or relay the artifact. The installer validates signed heartbeats, removes temporary authorization and staging files, reports completion, and preserves automatic browser redirect. The setup token must never appear in a URL, process argument, cloud-init data, or logs. Central heartbeat recovery uses LOOKOUT_CENTRAL_HEARTBEAT_TIMEOUT_MS, defaulting to five minutes. Configure LOOKOUT_RESEND_API_KEY and LOOKOUT_RECOVERY_EMAIL_FROM on the hosted service to deliver recovery email. Dashboard notification and recovery-token generation remain active even when email delivery is not configured.

​
Publishing

A vMAJOR.MINOR.PATCH tag runs .github/workflows/release.yml. Configure the repository variable LOOKOUT_PUBLIC_RELEASE_BASE_URL to the HTTPS public distribution prefix (for example https://releases.lookout.security). The workflow requires an annotated tag whose signature GitHub reports as verified, tests the exact commit, creates a reproducible archive, records its SHA-256 digest, renders a bootstrap that pins that version and public URL, creates a GitHub release, and emits GitHub build-provenance attestations. Release creation is intentionally non-overwriting: re-running an already-published tag fails rather than replacing assets. Enable GitHub’s immutable-releases setting and a protected tag rule for v* on the production repository; the workflow alone cannot prevent an administrator from manually replacing an asset or tag. The hosting/CDN deployment must copy lookout-install.sh and its referenced archive to public distribution storage without modifying them, serve them only over HTTPS, use an atomic object replacement, and retain the previous objects for rollback. The application repository may remain private; a private GitHub release URL itself cannot be the anonymous target. Promotion to the short URL is a separate, auditable deployment step so creating a release cannot silently change the public installer. Configure the CDN to prevent content transformation and return Content-Type: text/x-shellscript; charset=utf-8 plus X-Content-Type-Options: nosniff. The checksum embedded in the bootstrap prevents a changed or partial archive from executing. TLS authenticates the small bootstrap itself, while GitHub’s signed artifact attestation provides independently verifiable provenance at promotion and audit time. The release includes production dependencies and a Node.js runtime. Every target verifies the same pinned checksum, extracts to a staging directory, atomically swaps the active release, and restarts the service. Target VMs do not download Node.js or run npm. Release construction rejects symlinks and submodules, and the target rejects absolute or parent-traversing archive members before extraction. For a release, first update package.json and its lockfile to the same semantic version, commit, and create a signed tag:
Before promoting the generated script, verify its attestation and test it against a disposable Linux VM. The CDN/service configuration and DNS for the real get.lookout… domain live outside this repository and must be provisioned before the short command can work.