v0.81.0

What's Changed

Breaking changes

• Separate browser visibility from CI env storage by @tolgaergin in #929

Features

• Evaluate env requirements and defaults in the final execution scope by @tolgaergin in #932

Other changes

• perf(firewall): stop holding downloads for monitor-mode verdicts by @tolgaergin in #912
• fix(install): request a tarball again when its body fails mid-stream by @tolgaergin in #913
• test(workflows): fail clearly when the binary cannot inject faults by @tolgaergin in #914
• perf(exec): reuse recorded Node versions for file runs by @tolgaergin in #915
• perf(run): skip the macOS sh launcher and wait for children without polling by @tolgaergin in #916
• perf(extractor): hold whole tarballs in system-allocated buffers by @tolgaergin in #917
• refactor(swift): build the Swift environment scrub on the shared baseline by @tolgaergin in #919
• claude/remote cache async http by @tolgaergin in #920
• fix(env): keep lifecycle, dlx and Windows environments as OS strings by @tolgaergin in #921
• fix(dev): clarify missing commands and skip fresh empty installs by @tolgaergin in #923
• Preserve per-project CLI env approval in Keychain by @tolgaergin in #924
• Preserve named empty environments in cloud sync by @tolgaergin in #925
• bench: interleave firewall mode and harden timeout cleanup by @tolgaergin in #926
• bench: run T3 managers in a seeded random order by @tolgaergin in #927
• Validate env declarations strictly and reject unsafe defaults by @tolgaergin in #928
• Add exact env bounds, conditional requirements and groups by @tolgaergin in #931
• Resolve reusable env schemas with retained source snapshots by @tolgaergin in #933
• Generate typed env modules with isolated client validation by @tolgaergin in #934
• Enforce warning-free native release builds by @tolgaergin in #937
• fix(semver): validate npm ranges before upstream parsing by @tolgaergin in #938
• test(workflows): make readiness checks deterministic by @tolgaergin in #939
• fix(tunnel): recover automatically from approved relay key rotations by @tolgaergin in #940
• refactor(env): share stored value rules through lpm-env by @tolgaergin in #941
• fix(env): locate root schema definition errors in the native engine by @tolgaergin in #942
• feat(env): check stored values through the native engine by @tolgaergin in #943
• fix(runner): stop concurrent discovery and lease races in port handling by @tolgaergin in #945
• fix(common): release advisory locks before closing their files by @tolgaergin in #946
• fix(deps): update quinn-proto to 0.11.19 for RUSTSEC-2026-0338 to 0342 by @tolgaergin in #956
• feat(env): report what overrides replace and where prefixes come from by @tolgaergin in #947
• ci: give the macOS workspace job room for a slow runner by @tolgaergin in #957
• Open the browser with BROWSER on every platform by @tolgaergin in #958
• Drop the free tunnel tier from the CLI by @tolgaergin in #949
• Patch rustls for RUSTSEC-2026-0346 to 0349, and keep a runner test clear of the stop's grace by @tolgaergin in #960
• fix(tunnel): keep tunnel captures out of git by @tolgaergin in #952
• fix(remote-cache): wait out the Registry's request limits and honour its 100 MiB artifact cap by @tolgaergin in #950
• fix(cli): label byte sizes in binary units by @tolgaergin in #951
• Give Fast tests and the Windows hoisted-mode audit room to finish by @tolgaergin in #962
• Outlast a brief CloudKit outage when checking the notarization ticket by @tolgaergin in #961
• fix(release): retry Apple's timestamp and ticketing services through brief outages by @tolgaergin in #963
• fix(install): outlast a brief CloudKit outage when checking the notarization ticket by @tolgaergin in #964
• fix(tunnel): read git 2.56's message for a .git file pointing nowhere by @tolgaergin in #965
• fix(setup): refuse to write .npmrc past a .git file git can't use by @tolgaergin in #966
• fix(deps): move to zip 9.0.3 and keep only execute bits from runtime zips by @tolgaergin in #969
• chore: prepare release 0.81.0 by @tolgaergin in #968

Full Changelog: v0.79.0...v0.81.0

macOS standalone upgrades from 0.76.5

The standalone updater in 0.76.5 rejects newer signed app bundles with an icon. If it reports an unexpected Contents/Resources/ entry, rerun the installer once:

curl -fsSL https://cli.lpm.dev/install | sh

For the latest nightly release:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_CHANNEL=nightly sh

The installer preserves saved credentials and configuration. It checks the release checksum and macOS signing and notarization. If cosign is installed, it also verifies the checksum manifest's Sigstore identity. Do not disable verification or delete your credentials. npm and Homebrew installations should continue using their package manager.