Dev Autographs v0.2.28

Version 0.2.28 hardens desktop update staging: each installer is written into a unique directory, verified again on disk, and held against writes/deletion through process launch on Windows. It also updates Rust TLS and JavaScript build dependencies to patched releases. Account-key recovery documentation now describes the actual encrypted registry copy and the limits of client-code protection. The CLI now serves overlay assets from each monorepo web app and keeps metadata out of visible header elements. Browser sign-in state is now serialized across tabs; older completions cannot erase a newer connection, and recovered keys and renewed sessions stay correctly bound. Storage events wake login immediately. An isolated v2 migration retains recovery bytes, prevents post-logout reimport and tells users to reload old tabs. Registry services, signed records, installed legal notices and user data are preserved.

• Update staging now rejects path escapes and altered on-disk bytes. Four new native regression tests verify independent staging, replacement denial and successful guarded process launch.
• Patched source-map-js 1.2.2 and rustls 0.23.46; a high-severity npm audit gate now runs in source CI.
• Web sign-in now requires Web Locks; unsupported browsers stop safely before state-changing requests. Legacy and recovery browser key bytes can remain after active identity logout until site storage is cleared. Reload older open tabs after upgrading.
• Reviewed source: 7e6502c68f539016629fda21416032affec945a1. Installer SHA-256: 5c599cb77efc62e22625e60782322f0a960e0d87168c4789e08ec8f1d7afce79. Exact sizes and hashes are in releases/v0.2.28/release.json.
• All four source CI jobs passed in run 39094675865. The real silent installer lifecycle passed 23 checks on each Windows Server 2022 and 2025 VM in run 39094709286; reports bind to candidate 3b576dc, this source and these exact setup bytes.

This release is unsigned. Hashes verify the published bytes, not an independently authenticated publisher. Interactive Windows 10/11, SmartScreen/UAC, missing-WebView2 bootstrap and live OAuth remain separate unverified gates. Existing releases and software licenses are preserved. Client programs can still be inspected or reverse engineered.

SHA-256 5c599cb77efc62e22625e60782322f0a960e0d87168c4789e08ec8f1d7afce79
Published 2026-10-18 UTC from the installer committed in this repo.

Web desk setup (.ps1 / .sh) installs cli.cjs from this release (same build).