v0.77.0

What's Changed

Other changes

• ci: harden stable release promotion by @tolgaergin in #655
• Harden patch command authoring and removal by @tolgaergin in #656
• Harden doctor and health diagnostics by @tolgaergin in #657
• Harden and accelerate lpm global operations by @tolgaergin in #658
• Harden cache lifecycle and prune behavior by @tolgaergin in #659
• fix: harden lpm upgrade planning and execution by @tolgaergin in #660
• fix: harden lpm outdated planning and reporting by @tolgaergin in #661
• Harden Swift package install and uninstall by @tolgaergin in #662
• fix(registry): accept large proxy packuments by @tolgaergin in #664
• ci: publish daily acceptance artifact by @tolgaergin in #665
• Add LPM icon to the macOS CLI bundle by @tolgaergin in #666
• Harden lpm add source delivery by @tolgaergin in #667
• Harden lpm remove source cleanup by @tolgaergin in #668
• Harden and optimize publish workflows by @tolgaergin in #670
• Keep outdated hydration timing test deterministic by @tolgaergin in #672
• Authenticate vault sync response envelopes by @tolgaergin in #671
• Fix publish lifecycle sandbox CI coverage by @tolgaergin in #673
• Make Sigstore workflow tests hermetic by @tolgaergin in #674
• Harden lpm dev lpm.json orchestration by @tolgaergin in #675
• Harden and optimize lpm test orchestration by @tolgaergin in #677
• Add lpm bench audit coverage by @tolgaergin in #678
• Harden lpm use runtime selection and pinning by @tolgaergin in #676
• Fix full-smoke regressions across dev and source workflows by @tolgaergin in #681
• Retain required ambient peers during offline omission by @tolgaergin in #682
• Persist catalog snapshots after add finalization by @tolgaergin in #683
• Fix nightly release skip propagation by @tolgaergin in #684
• Respect registry metadata cache policy by @tolgaergin in #685
• Group release-age settings in config wizard by @tolgaergin in #686
• Fix standalone macOS notarization archive layout by @tolgaergin in #687
• Fix nightly release artifact staging by @tolgaergin in #688
• Complete authenticated env revisions and cross-client integration by @tolgaergin in #689
• Fix Bun converter cleanup after process exit by @tolgaergin in #691
• Enable organization environment browser pairing by @tolgaergin in #692
• Enable organization environment CI decryption and OIDC setup by @tolgaergin in #693
• fix(env): trust the provisioned production signing key by @tolgaergin in #695
• Default typosquat, source analysis, and release age to off by @tolgaergin in #696
• Reduce install streaming and metadata overhead by @tolgaergin in #697
• Fix workspace root resolution deadlock and bound CI audit installs by @tolgaergin in #698
• Recover interrupted installs and clarify duplicate publishes by @tolgaergin in #701
• Explain recovery when LPM_TOKEN is rejected by @tolgaergin in #702
• Explain publication review failures and use the configured registry link by @tolgaergin in #703
• Fix tunnel close handshakes and remote cache access messages by @tolgaergin in #704
• fix: portable task cache inputs and visible tunnel retries by @tolgaergin in #705
• fix: recheck cached package access and keep tunnel sessions alive by @tolgaergin in #706
• Fix Pool attribution with completed dependency graphs by @tolgaergin in #707
• Keep Pool installs working after registry rollback by @tolgaergin in #708
• Preserve package skills and validate publish metadata by @tolgaergin in #709
• Recover source delivery and preserve configuration, paths, and modes by @tolgaergin in #710
• Fix Swift publishing, configuration, and native install recovery by @tolgaergin in #711
• Fix Swift Pool reporting and Xcode workspace installs by @tolgaergin in #712
• Preserve CLI installations and credentials across release upgrades by @tolgaergin in #713
• Fix stale workspace overrides and warm catalog installs by @tolgaergin in #714
• Fix Xcode install linkage, lockfiles, and deployment minima by @tolgaergin in #715
• Fix tunnel recovery after network interruptions and preserve SSE cursors by @tolgaergin in #716
• fix(tunnel): prevent slow downloads from blocking small responses by @tolgaergin in #717
• Fix nightly release staging and Bun converter exit recovery by @tolgaergin in #718
• chore: prepare release 0.77.0 by @tolgaergin in #719
• fix(dev): retain URLs advertised during endpoint discovery by @tolgaergin in #720

Full Changelog: v0.76.5...v0.77.0

macOS standalone upgrades from 0.76.5

The standalone updater in 0.76.5 rejects newer signed app bundles with an icon. If it reports an unexpected Contents/Resources/ entry, rerun the installer once:

curl -fsSL https://cli.lpm.dev/install | sh

For the latest nightly release:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_CHANNEL=nightly sh

The installer preserves saved credentials and configuration. It checks the release checksum and macOS signing and notarization. If cosign is installed, it also verifies the checksum manifest's Sigstore identity. Do not disable verification or delete your credentials. npm and Homebrew installations should continue using their package manager.