v0.5.2

Upgrade notes

• npm: the packages are @dshakesnotbot/halo and @dshakesnotbot/halo-<os>-<arch> (npx @dshakesnotbot/halo quickstart). This is the first version on npm.
• halo-server now rate-limits each signed-in user and service token on console/API routes (20/s, burst 100, 429 with Retry-After). Automation that bursts harder should back off on 429 or raise -api-rate-limit / -api-rate-burst (0 disables).
• halo doctor --output json (and the MCP doctor tool) can now report "status": "skip" for optional CLIs that are not installed; consumers that switch on ok|warn|fail must accept it.
• Binaries are built with go1.26.10 (12 reachable standard-library vulnerabilities fixed).

Added

• halo-server sends Strict-Transport-Security (browsers honour it only over HTTPS); every Prometheus/Grafana alert carries a runbook_url to the operations guide.
• halo-server rate-limits each signed-in user and service token on console/API routes (-api-rate-limit 20/s, -api-rate-burst 100; 429 with Retry-After; 0 disables). Fleet, gateway and SCIM traffic is not charged.
• halo --version (same output as halo version).

Changed

• halo doctor (and the MCP doctor tool and --output json) report an optional CLI that is not installed with the new check status skip instead of ok; it is informational, never a warning or failure, and does not affect ok. JSON consumers that switch on status (ok, warn, fail) must accept skip. halo onboard local|install collapse a harness's adapter warnings (more than two) into one count line, --verbose lists them all and --output json is unchanged; halo plan prints a per-file summary first and (none) for a first release's empty side.
• The npm packages publish as @dshakesnotbot/halo (and @dshakesnotbot/halo-<os>-<arch>): the @dshakes npm scope does not exist, so v0.5.1 never reached npm. Use npx @dshakesnotbot/halo quickstart.
• Every command that writes only with --apply also accepts --dry-run (its default), matching quickstart, enable, eject and model switch; the two flags are mutually exclusive.

Fixed

• halo onboard company names every missing required flag in one error (--gateway, --issuer, --registry, --policy-repo, --portal-url) instead of failing one unnamed field per run; README points at --help.
• halo quickstart clones the release tag that matches the binary (cached per version), not main, and says when the Docker daemon is not running.
• A kind: Halos document outside halos.yaml and an unknown halo model switch alias now say how to fix them.

Security

• Build toolchain go1.26.6 -> go1.26.10: fixes 12 standard-library vulnerabilities govulncheck reports as reachable (net/http, crypto/tls, crypto/x509, net/textproto, os). Every binary and image is rebuilt with it.