pi-setup-share v0.2.0

This release makes profiles easier to share as standard ZIP files and makes portable MCP choices complete and visible without copying machine-specific or secret-bearing configuration.

Added

• New exports are ZIP archives containing exactly one profile.json.
• Legacy plain JSON profiles remain importable.
• The export assistant shows portable MCP servers, explains safe reasons for omissions, and can select all portable servers at once.

Security

Archive parsing is bounded and in memory. It rejects extra entries or bytes, renamed entries, directories, links, encryption, comments, ZIP64, invalid CRC, inconsistent local/central metadata, oversized archives, and oversized decompressed profiles. Validation does not authenticate the sender or make profile contents trustworthy.

Upgrade

Update both the sender and receiver before sharing a new ZIP:

pi install npm:pi-setup-share@0.2.0

Restart Pi after updating. Existing 0.1.x JSON profiles continue to import, but a 0.1.x receiver cannot open the new ZIP container.

Verification

• 186 tests on Windows, macOS, and Linux with Node.js 22.19.0 and 24
• TypeScript checking and CodeQL
• Isolated npm audit with no known vulnerabilities
• Native extension registration through Pi 0.85.0 without personal settings or model calls
• Independent archive/security and release-candidate reviews

Artifact

pi-setup-share-0.2.0.tgz

• 28 files
• 175,936 bytes unpacked
• 46,618 bytes compressed
• SHA-256: 88af2711c24a113c5a18bec63af5d8ab9f835b5b1276f9f766035042fc66a97b

Full changes: v0.1.1...v0.2.0