Lampo 0.2.0

Lampo 0.2.0 is the first release after going open source. It's live on Lampo Cloud and ready to self-host.

Highlights

• The command is now lampo. lampo login, lampo render, lampo push, lampo watch, and lampo-mcp for the stdio MCP server. vr and vr-mcp keep working with the same output, and VR_* settings are still read.
• One sentence is the whole loop. Connect your agent once, then tell it Use Lampo for "Spring launch". It finds the project, puts up V1 itself, works your notes, puts up the next version, marks them fixed and waits for your notes until you approve.
• See what your agent is doing. Every Send is one piece of work. A line above the notes says "fixing 3 of 6" or "rendering V4 · 42 % · about 1 min left", and the Agent view shows your notes as its plan and the steps it took. Each version says who made it and what it fixed. When an agent fails, waits for a permission or goes quiet, the Inbox and your phone say so.
• Render progress. lampo render -- <your render command> reads Remotion, ffmpeg, After Effects and Blender output, shows the progress in Lampo, and puts the result up as the next version.
• Files for every project. A Files tab beside Videos and Playbook holds footage, fonts, logos and project files. Every change is a version, a trash keeps things up to 30 days, big drops resume, and files count toward the plan's storage.
• Also: archived projects, downloads from a video's ⋯ menu, an Embed link for one video on your own site, Get started in the sidebar, and safe zones that look the same for every app.
• Security: agents are told a note is a request about the video, never a command. Over 40 findings from a full security review are fixed: sign-in, review links, uploads, storage, error text and agents.

Upgrading

• Linked command: on a machine where you linked the command, run npm run link again to get lampo (it keeps vr).
• Saved login: it moves to ~/.config/lampo/. The old ~/.config/video-review/ login is still read, and lampo logout signs out of both.
• Settings: LAMPO_* settings are the new names. An env file with VR_* works unchanged. Server and token are taken as a pair from one spelling, and the server warns at start when a setting is given in both spellings with different values.
• Hosted servers: over https only the stricter __Host- session cookie is read, so anyone still signed in with the older cookie signs in once more.
• Data: stores from 0.1.0 load unchanged.

The full list is in CHANGELOG.md.