Weave 0.2.1 — verified GitHub release updates

Weave 0.2.1 — verified GitHub release updates

This installer release adds authenticated GitHub release discovery and explicit managed updates:

npx joinweave@0.2.1 update --check --json
npx joinweave@0.2.1 update --yes

A new workspace can use npx joinweave@0.2.1 --yes. Updates verify the signed catalog, source and per-component archive checksums before handing off to the matching installer. Existing identity, data, managed MCP and client consent are preserved. Native/CLI/MCP components remain the exact 0.2.0 release with runtime API 2 and 46 MCP tools; only joinweave changes to 0.2.1.

Node 20.17+ in 20.x or 22.9+ is required. Scheduled automatic application, automatic health rollback and native CLI/TUI/Desktop update integration are follow-on work. Desktop remains a development build; this release contains no signed/notarized Apple desktop app. Cores remains a limited storage pilot.

The assets include the seven exact npm archives, original package provenance, signed update catalog, release manifest and checksums. Catalog signatures bind the approved GitHub workflow identity. Keep the receipt/recovery directory if an interrupted update needs recovery; this release does not migrate workspace stores.

Weave 0.2.0 — the 46-tool developer workbench

Weave 0.2.0 — the 46-tool developer workbench

All seven npm packages are published at 0.2.0 with source-bound provenance. Install or explicitly upgrade your local workspace:

npx joinweave@0.2.0

The persistent MCP server exposes 46 tools: 17 core workspace, node, DHT and Strand tools, capability discovery, and 28 typed tools for Locus, Lens, Forum, Gnosis, Basis and Nexus. Runtime API 2 supplies persistent model data, safe missing-store reads and exact-byte operations. Native executable and service receipt versions intentionally remain 0.1.0; inspect the API with weave capabilities --json.

Upgrades preserve the existing identity and Strand data. Existing agent-client entries change only when you explicitly select the clients to migrate. The old MCP tree remains available for existing clients. For example, reconnect only Codex and Cursor:

npx joinweave@0.2.0 --yes --mcp-client codex,cursor

Modified files and unrelated settings are preserved. Shell and client configuration require consent. Uninstall retains identity and workspace data unless --purge is explicitly requested. This release does not automatically check for or apply GitHub updates.

Support and verified scope

Node.js 20+ with npm is required; native optional dependencies must be enabled. Prebuilt executables support macOS 11+ on arm64/x64 and Linux arm64/x64 with glibc 2.39+. Linux ARM64 also requires OpenSSL 3 runtime libraries (libssl.so.3 and libcrypto.so.3). Managed Linux installation requires a working systemd --user session. Windows, musl and older glibc are unsupported.

Each of the four native targets passed 137 tests; three existing SDK tests remain ignored per target. After npm publication, actual Linux x64 fresh-install and 0.1.3-to-0.2.0 upgrade acceptance passed on 2026-10-13, including a real user service, 46-tool persistent MCP startup and model persistence, native/MCP/manager PID parity, stop/start, authenticated crash recovery, retained identity/data and uninstall retention. This installed-flow evidence applies to Linux x64; cross-platform build/test qualification is separate.

Desktop and the Cores encrypted-persistence purchase pilot are not included in this release. No Apple Developer ID signing or notarization is claimed. OpenAgentID is not linked automatically. The public repository distributes Node tooling, licenses and approved native executables; native Rust source remains private.

Integrity and source

The seven attached npm archives are byte-identical to the published registry tarballs and the frozen public source commit. manifest.json is the exact public release manifest. The attached provenance bundles are already public through npm and bind each archive to the GitHub-hosted attestation run. Use SHA256SUMS to check the attached archives, manifest and provenance files.

Quickstart · MCP reference · Upgrade and recovery

joinweave 0.1.3 — compact ownership receipts

joinweave 0.1.3 repairs the ownership-receipt regression in 0.1.2 while preserving the native safety limit, identity and stored data.

npx joinweave@0.1.3

Detailed managed MCP file records now live in a private, SHA256-bound census, keeping the native ownership receipt below its unchanged 64 KiB limit. Recognized 0.1.2 receipts migrate before native service commands. Persisted removal intent supports recovery after interrupted uninstall; modified or unrelated files remain protected.

Native CLI, runtime MCP and all four platform packages remain at 0.1.0. This patch does not release or install Weave Desktop.

Validation: all 60 checks passed with no skips on Depot run 38281000021, including the full registry MCP tree. The exact candidate completed a fresh supervised Linux install, live doctor with three peers, actual persistent MCP initialization/tool listing, stop/start, crash recovery, safe rerun and identity/data-preserving uninstall. Its native ownership receipt was 854 bytes. This candidate flow used the exact local installer archive; separate postpublication registry acceptance is tracked independently.

Archive SHA256: 35628d03da4dd0e49e8b40b4adab5d0706f62631eab558d5faccbb1cf71dffd2.

Qualified application source: cf3181e7f79c609e9a023e20ca69ebf86d15cd10. Signed release operations: cb162109762ce230a144d9678dda7c8cb579b0f9. GitHub-hosted provenance run: 38281608819. The attached qualification, manifest and provenance receipts bind the exact archive bytes; no native binaries were rebuilt for this patch.

For an affected 0.1.2 workspace, retain the same WEAVE_HOME and run npx joinweave@0.1.3 --yes --json. Do not purge identity/data or hand-edit receipts to work around the earlier error. Review any changed-file conflicts; PATH and agent-client changes still require explicit consent.

joinweave 0.1.2 — receipt regression; use 0.1.1

Release withdrawn from recommendation — 2026-10-12. A fresh native-service installation with the full MCP dependency inventory exposed an ownership receipt larger than the native 64 KiB safety limit. The node can start, but installer service verification fails. Use the previously verified npx joinweave@0.1.1 while the corrective patch is qualified. Preserve your existing identity and data; do not delete ~/.weave to recover. The attached 0.1.2 artifacts and original validation statement are retained below for traceability.

joinweave 0.1.2 installs a complete developer workspace with a moving ASCII weave, a native Weave node and agent tooling that stays installed locally.

npx joinweave

• Installs the native CLI, preserves or creates a local identity, starts a background node and prepares ~/Weave.
• Keeps MCP 0.1.0 and its dependencies under ~/.weave/tools/mcp-0.1.0; selected clients use the recorded absolute Node path instead of downloading the server at startup.
• Shell PATH and agent-client edits are explicit choices. --yes --json stays machine-readable; --no-animation selects plain progress; --no-mcp skips agent-tool installation and configuration.
• Cancellation waits for child termination before cleanup. Retained-data uninstall preserves identity, data and modified or unrelated files.

The native CLI and six scoped packages remain at 0.1.0. Node.js 20+ is required. macOS and supported Linux arm64/x64 are supported; see the installation guide for Linux prerequisites. This npm package does not install Weave Desktop, dBrowser or Loom. The visible workspace folder is not automatically shared.

The exact attached installer archive passed 55 Depot checks, including a real managed MCP install and stdio tool discovery, and is bound to verified Sigstore provenance. Prior live network evidence and the new installer’s validation scope are distinguished in the documentation.

Quickstart · Installation and support · Release details

Weave is public — joinweave 0.1.1

The web for agents is public.

Start with one signed record. Connect a second machine. Verify what arrives.

Weave gives developers and agents a local workspace for signed, append-only data, peer discovery and verified sharing. Install the prebuilt runtime on supported macOS or Linux with:

npx joinweave

Keep writer keys local, announce a strand, and let a receiver pin its writer key and fetch selected blocks. Sparse replicas retain verified data and retrieve missing blocks on demand. The CLI and runtime MCP tools operate the same persistent node, so your agent can create, append, discover, replicate and read through one workspace.

Explore Weave · First-strand quickstart · CLI · Runtime MCP · Sparse replication

---

Install a complete Weave workspace with npx joinweave. The installer detects macOS or Linux, installs the matching prebuilt CLI, creates an identity and user service, and offers agent MCP setup with explicit consent.

Version 0.1.1 waits for asynchronous launchd deregistration within a single ten-second deadline. It preserves managed files when shutdown cannot be verified, keeps the native 0.1.0 service-ownership receipt protocol, and packages both existing licenses. Native platform, CLI and MCP packages remain at 0.1.0.

The installer archive is built and checked on Depot, compared byte for byte with reviewed public source, and carries cryptographically verified npm provenance.

Supported platforms: macOS ARM64/x64 (macOS 11+), Linux x64/ARM64 (glibc 2.39+, Ubuntu 24.04 tested; ARM64 requires OpenSSL 3). Node 20+ is required.

Fresh registry acceptance passed on Mac and Ubuntu 24.04: doctor found three live peers, user-service restart and crash recovery passed, and canonical npx joinweave --yes --json reruns preserved identity and data. Both temporary publishing tokens were revoked.