Unpin v1.4.1

Unpin v1.4.1

v1.4.1 reduces repeated discovery work, keeps desktop discovery caching
explicit and recoverable, and completes internal module splits without changing
Unpin's public configuration or MCP contracts.

Highlights

• Project skill discovery now walks one repository frontier for Claude Code,
  Codex, Cursor, Pi, and OpenCode, then reuses only the derived scope caches
  that are sound for each provider-specific traversal.
• The desktop bridge reuses a discovery projection for up to 60 seconds in one
  process. Choosing Reload starts a replacement bridge and reads external
  provider changes immediately.
• Group, restore, and Agent Plugin mutation attempts invalidate that desktop
  cache even when an apply fails, preventing later refreshes from publishing a
  projection captured before the attempted change.
• Mutation, MCP, terminal UI, and desktop bridge code is split into focused
  modules. Shared discovery-item ID prefixes and extracted toggle dispatch keep
  inventory and mutation routing aligned without changing public output.
• GitHub Actions and compatible Rust dependencies are updated to their current
  pinned versions.

Upgrading from v1.4.0

This is an ordinary compatible patch update. The CLI, terminal UI, desktop
workbench, MCP protocol editions, provider paths, configuration formats, and
mutation safety model remain supported.

On macOS, install the CLI and unpin-credential-broker from the same verified
archive. A compatible update preserves the already installed stable broker
byte-for-byte, so this release does not require another Keychain authorization
unless the broker is deliberately replaced or the signing certificate changes.

Artifacts

The release provides three CLI archives and two native desktop archives:

• unpin-v1.4.1-aarch64-apple-darwin.tar.gz
• unpin-v1.4.1-x86_64-apple-darwin.tar.gz
• unpin-v1.4.1-x86_64-unknown-linux-gnu.tar.gz
• unpin-desktop-v1.4.1-aarch64-apple-darwin.tar.gz
• unpin-desktop-v1.4.1-x86_64-apple-darwin.tar.gz

Every archive has a CycloneDX SBOM, GitHub build-provenance and SBOM
attestations, and an entry in SHA256SUMS.

Trust boundary

The Unpin-specific personal certificate gives the stable credential broker a
consistent designated requirement. It is not an Apple Developer ID certificate,
and the artifacts are not notarized, so it does not establish Gatekeeper trust.
Verify checksums and GitHub attestations before using Finder's Control-click
Open flow. Do not disable Gatekeeper or strip quarantine metadata. The
release uses timestamp mode none and does not claim secure timestamping. Full
instructions are in the desktop guide, and certificate expiry
and rotation are covered in the release
guide.

Verification

Publication remains blocked until the exact merged release commit passes the
locked Rust workspace checks, macOS XCTest suite, live Pi and OpenCode
validation, and finalized provider matrix. Published archives must then pass
checksum, attestation, archive-layout, version, architecture, signature, exact
identifier, designated-requirement, broker, bridge, Debian 12, and fixture-only
MCP smoke verification. Modern MCP proof includes stateless 2026-07-28
server/discover and tools/list; legacy initialize compatibility alone is
not sufficient.

Known limitations

• External provider changes can remain cached in a running desktop bridge for
  up to 60 seconds. Choose Reload to start a replacement bridge and refresh
  immediately.
• Broker upgrades and certificate rotation are intentionally not automatic and
  require a separately verified manual migration.
• No Developer ID signing or notarization.
• Desktop support remains macOS-only and architecture-specific.
• crates.io, Homebrew, Linux ARM64, and Windows distribution remain deferred.