v0.1.82

Highlights

• 🔐 Your API keys and tokens are now stored encrypted. keys.json, the ChatGPT store and the X store become AES-256-GCM envelopes that reveal nothing without the key that opens them, and refuse any altered byte. The key is generated on your machine the first time and kept in your system's keyring (Windows Credential Manager, macOS Keychain, or the desktop keyring on Linux), never in a file. Nothing to do on your side: the existing plain store is encrypted in place the first time the updated app reads it, after checking it reads back. Settings → API keys says how the store is protected.
• 🖥️ Servers without a desktop have no keyring: put HYDRA_KEYSTORE_PASSPHRASE=<a long phrase> in the service's .env before updating and the key is derived from it on every start, never stored. Without it HydraOps falls back to a master.key file next to the store (readable by the service's user only) and says so in Settings. See the manual's Server mode and Security chapters.
• 🧱 The store is private at the file level too: mode 600/700 on Linux and macOS, an access list naming your user alone on Windows; writes are atomic; an existing store folder is tightened on the first start. Backups now include the X store and never the master key. Keys cannot be moved to another computer by copying the file: enter them again there.
• 🛡️ An undecryptable store is treated as an error, never as "no keys": nothing overwrites it, and the key-proxy keeps the keys it already had. The agents' guard blocks master.key and the other stores like it already blocked keys.json.