v2.1.0

Added

• dmage sync [app] — one command that does the right thing: pulls when the server is ahead,
  pushes local changes, or (when both moved) shows a key-level diff and asks you to choose —
  never auto-merges. Bare dmage in a project now hints "unpushed changes → dmage sync". Uses
  a small device-level marker (~/.dotmage/sync_state.json, revision + hash, no secrets), never
  written into the project.
• dmage completions <shell> — print a shell completion script (bash/zsh/fish/elvish/
  powershell) to stdout so Tab completes commands and flags. Homebrew installs them
  automatically; otherwise redirect the script where your shell looks.
• dmage open — open the web admin panel in your browser, already logged in. Resolves
  the server like push/pull, reads the panel URL from /health, mints a one-time
  5-min login token and opens it via the URL fragment (kept out of server logs). Falls
  back to printing the link on headless/SSH sessions; --print forces that.
• dmage upgrade --channel dev — opt into prerelease builds (v2.x.y-dev.N);
  the default stable channel ignores prereleases entirely. Semver comparison is
  prerelease-aware (2.2.0 > 2.2.0-dev.3 > 2.1.0), so leaving the dev channel is a
  regular upgrade once the stable release lands.
• --json on status, diff, history, apps, whoami — machine-readable output
  for scripts, CI and editor integrations. One JSON document on stdout, errors stay on
  stderr; schemas are a semver contract (spec §5). diff --json never includes secret
  values, even with --show-values.
• Prebuilt Linux aarch64 binary (dmage-linux-aarch64) — Raspberry Pi and ARM VPS
  are covered by releases and dmage upgrade; install one-liners now pick the
  binary via uname -m.

Changed

• TLS switched from OpenSSL to rustls: Linux binaries no longer require libssl
  at runtime and run on any glibc distro out of the box.
• Releases are no longer cut automatically on push to main: a release is an
  annotated tag (git tag -a vX.Y.Z && git push origin vX.Y.Z) — the pipeline starts
  only from the tag, cross-checks it against Cargo.toml, and main quietly collects
  features between releases.

Fixed

• dmage gen-ci-token failed with missing field token_expires_at while parsing the
  server response. The client now accepts both token_expires_at and the older
  expires_at field name, so it works against current and older servers.
• dmage env new --copy-from produced an environment whose every pull failed with
  "AEAD authentication failed": the server copied the encrypted blob byte-for-byte,
  but ciphertext is bound to app|env|rev. The copy now happens client-side —
  decrypt the source, re-encrypt for the new environment, push as rev 1.
• dmage rotate-key no longer aborts (and blocks rotation forever) when it hits a
  revision it cannot decrypt: the broken revision is kept byte-for-byte, marked with
  the new key generation, and reported loudly at the end.

Security