EnvLatch v0.2.2

EnvLatch v0.2.2

EnvLatch v0.2.2 fixes a misleading agent-host result: a restricted process
could report saved_key_count=0 even though the user's keys remained available
through the normal macOS Keychain context.

Fixed

• envlatch doctor now labels saved_key_count as current-process visibility.
• A zero count in a known host sandbox emits
  keychain_visibility_warning=sandboxed_zero_is_inconclusive and exits
  nonzero instead of presenting the vault as conclusively empty.
• The bundled agent skill requires the complete envlatch run ... command to
  use the host's normal macOS Keychain approval path and forbids recreating
  keys based on a sandboxed zero.
• A genuinely empty vault outside a known sandbox remains a valid zero-key
  result.

No secret values are read by doctor, and this patch does not change the
Keychain service, saved values, endpoint metadata, key groups, or command
environment contract.

Signed macOS release

The arm64 DMG and ZIP are Developer ID signed, notarized by Apple, stapled, and
Gatekeeper-approved. Each artifact has an adjacent SHA-256 checksum.

• ZIP SHA-256:
  45568ece9cc45af67d94527485b258bc980d3d57251dcd9d25bb81c907853c87
• DMG SHA-256:
  49f0561e6f58aed1957aa7d096176e3f4a51503c302abec74797d811b63a6415

EnvLatch v0.2.1

EnvLatch v0.2.1

EnvLatch v0.2.1 brings the provider-aware key dashboard to the signed macOS
download while preserving the provider-agnostic CLI and Keychain security
contract from v0.2.0.

New

• Searchable, provider-aware saved-key cards with locally bundled real provider
  marks.
• Editable presets for OpenAI, Anthropic, Gemini, OpenRouter, and MiniMax, plus
  a Custom path for any provider or host.
• Key groups and agent setup remain in the same dashboard, with secondary
  sections collapsed until needed.
• English and Chinese READMEs now show the real SwiftUI dashboard using
  synthetic key names.

Unchanged security contract

• Secret values remain in the macOS default Keychain and are never loaded to
  render the dashboard.
• Agents, SDKs, scripts, tests, and backends still receive ordinary environment
  variables through one envlatch run command; no SDK or provider-specific
  integration is required.
• Direct saved-key selection, repeated --using, and reusable key groups all
  validate the complete selection before reading a value.
• Provider, API contract, base URL, and credential-variable bindings are
  non-secret metadata.

Signed macOS release

The arm64 DMG and ZIP are Developer ID signed, notarized by Apple, stapled, and
Gatekeeper assessed. Each artifact has an adjacent SHA-256 checksum.

EnvLatch v0.2.0 — signed & notarized for macOS

EnvLatch v0.2.0

EnvLatch v0.2.0 adds two multi-key workflows while keeping the same
provider-agnostic launch contract.

New

• Repeat --using with exact saved key names for a one-off multi-key command.
• Run envlatch groups create to save a reusable group from non-secret key
  names.
• Installed agent guidance and the GUI setup prompt teach both paths.

Safety behavior

• The complete repeated selection and every endpoint binding are validated
  before any Keychain value is read.
• Repeated selectors reject duplicates and accept saved keys only; an existing
  group must be used by itself.
• Group creation never reads values, refuses missing keys and endpoint
  conflicts, and never replaces an existing group.
• Pairing remains setup status, not authorization.

Signed macOS release

The recommended arm64 DMG and ZIP are Developer ID signed, notarized by Apple,
stapled, and accepted by Gatekeeper. Each has an adjacent SHA-256 checksum.
The explicitly named unsigned DMG remains a legacy preview.

Users upgrading from an ad-hoc-signed build may receive one Keychain
authorization prompt per existing item. Enter the login password and choose
Always Allow once; choosing Allow authorizes only the current read.
Touch ID-per-read is intentionally not the default because it would block
unattended agent launches.

EnvLatch v0.1.0 — unsigned preview

EnvLatch v0.1.0 — unsigned preview

EnvLatch stores API keys once in macOS Keychain and launches local agents,
SDKs, scripts, tests, or backends with a least-privilege environment:

envlatch run --using OPENAI_API_KEY -- npm test

Download

This prerelease provides an unsigned arm64 preview:

• EnvLatch-0.1.0-macos-arm64-unsigned.dmg
• EnvLatch-0.1.0-macos-arm64-unsigned.dmg.sha256

The app is ad-hoc signed, not Developer ID signed or notarized. Verify the
checksum before mounting. macOS will require Privacy & Security → Open
Anyway for the installer and may require it again for the app.

shasum -a 256 -c EnvLatch-0.1.0-macos-arm64-unsigned.dmg.sha256

The DMG's Install EnvLatch.command installs the app, CLI, and reusable agent
skill. It also includes the MIT license and unsigned-preview notice. Add
credentials only through the installed app after verifying the download.

Included

• one provider-agnostic envlatch run --using command;
• direct use of every saved key plus optional multi-key groups;
• per-key Anthropic, OpenAI Chat Completions, OpenAI Responses, and Gemini
  client bindings;
• direct execve without shell interpolation;
• optional any-name agent/host pairing and a reusable installed skill;
• transactional source and preview installers.

No secret values are exported, copied into the repository, or included in the
release artifacts. A notarized, friction-free binary remains a later release
boundary.