v0.3.0

Lockpin v0.3.0. Install: https://lockpin.dev

Built from source commit a9b6f8b2b634 with scripts/build-release.sh on our build machine, twice, with byte-identical results. GitHub Actions was unavailable for this release, so it carries SHA256SUMS (which the installers check) but no Sigstore signatures or SBOMs; those return with the next release built in GitHub Actions.

Changes since v0.2.0 that alter defaults (read before upgrading)

• A call Lockpin cannot meter in solo mode is now refused unless -allow-uncapped lists its path (reads always pass).
• New -day-limit: everything on one machine together may spend at most $20 per UTC day by default (solo mode; 0 removes the ceiling).
• A budget header can only tighten a task's cap. Raising a cap goes through the allowance, the meter's control token or an admin, and is alerted. A restart with looser settings is alerted as a config edit.

New

• Keys: expiry and rotation (lockpin keys rotate, -expires), service keys with hard per-run caps (-service), warnings when a task nears its budget, and team member defaults (lockpin keys lifetime) (#238).
• Team admins: the admin pages are locked, admins can be scoped to a team, each team has its own allowance, and there is a post-quantum remote admin channel (#195, #233).
• Charging: a call whose reply has no usage is charged for what happened, and a request that was never fully sent is not charged (#226). Near the cap, Anthropic calls stay on the 5-minute prompt cache (#227).
• Meter, overlay and dashboard: the ask banner says what is being asked and says when the call was refused (#229, #231). Every meter notice and dialog is restyled, with pill buttons, a close ×, and plain wording (#240). The meter can link to a single task (#239). The overlay gains pace and unusual-spend cards, faster motion and a presenting mode (#237). The dashboard groups token counts (#230).
• Installers: they find the latest release without GitHub's API, so there is no anonymous rate limit (#225).
• Docs: getting started, every command, and install.md matching the public releases (#234, #235).

The VS Code extension 0.1.5 (new panel, waiting-for-you view, grouped problems, status bar hover card, #236; Me and Bots sections, #239) is already out on the Marketplace and Open VSX.

Packages: per-machine MSIs (x64, arm64), .deb/.rpm (amd64, arm64) and macOS .pkg installers (Apple silicon, Intel) are attached. None of them is signed, and the .pkg files are not notarized, so macOS asks before opening them. SHA256 of each package:

41c1789d11f59dc7a19852fb81107c5120bf2c207a0ff0e03932eed3626d3111  lockpin-0.3.0-1.aarch64.rpm
bd8c53f101eb28936a3cdbdc8454c3fb47472ff37296c7222e56fa030f37fa4e  lockpin-0.3.0-1.x86_64.rpm
b48366d2cf47da094335a7c826664f748d05a4ec93f3dd4245edb9e9f144bc8d  lockpin_0.3.0-1_amd64.deb
1c3cb53847089392bcc582633e989bf6edccc76954968b48929cda96c0a4c532  lockpin_0.3.0-1_arm64.deb
6e58ab9356ab1030593fc163ee672248993c3085e8e564b6751f2b7cddf6f2f2  lockpin_0.3.0_darwin_amd64.pkg
dba799c483e786c8ca8258fd9d5bfc2b6148ec5a6457b29afd3d581e03d56629  lockpin_0.3.0_darwin_arm64.pkg
cadd02cf776e1352b38d7f6c25e6fc17ff5b46a84293cd40fad231daa82fcb5d  lockpin_0.3.0_windows_amd64.msi
d5342bcb9a079d18fd28edc440098548f910359e63d143e80478e294cd8d6b92  lockpin_0.3.0_windows_arm64.msi