v0.82.0

What's Changed

Other changes

• Seal GitHub Actions secret values in the env engine for LPM Vault by @tolgaergin in #985
• Retry the disk images macOS tests attach and report why hdiutil fails by @tolgaergin in #986
• Keep the project's .lpm directory out of git by itself by @tolgaergin in #971
• Author package skills in lpm-skills/ and never pack .lpm by @tolgaergin in #972
• One file-selection rule for publish and deploy by @tolgaergin in #973
• Read release changes from lpm-changes/ by @tolgaergin in #974
• Commit lpm add and managed-skill records and restore them on install by @tolgaergin in #975
• Keep env sync state in .lpm/env-sync.json by @tolgaergin in #976
• Keep lifecycle scripts out of LPM's project state by @tolgaergin in #977
• Keep login and env secrets in the LPM home LPM_HOME names by @tolgaergin in #978
• Write project secret files through one helper that keeps them out of git by @tolgaergin in #979
• Keep migrate backups in .lpm and roll back only what migrate wrote by @tolgaergin in #980
• Act on the project from its subdirectories by @tolgaergin in #981
• Install fresh clones from the lockfile and never fail on package skills by @tolgaergin in #982
• Remove dead project-file writers and move the rest into .lpm by @tolgaergin in #983
• Remove the unwired workspace constraints module by @tolgaergin in #991
• Create lpm add's directories as mkdir does, refuse any git directory, and read package.json past a BOM by @tolgaergin in #989
• Fix task cache restores on case-folding, exFAT/FAT and Windows volumes, and keep them out of git directories by @tolgaergin in #990
• Keep other users from redirecting what lpm deploy writes by @tolgaergin in #992
• Run Windows lifecycle scripts in one AppContainer per project and keep .lpm to its owner by @tolgaergin in #993
• Keep tests from racing on the process environment and on programs they just wrote by @tolgaergin in #987
• Fix main's hoisted audit: patch headers with diff -u timestamps, and node_modules temporaries during reconcile by @tolgaergin in #994
• Tell a same-size Windows rewrite from the file's change-journal number in the task cache by @tolgaergin in #995
• Reject distrusted emSign intermediates in TLS verification by @tolgaergin in #996
• Extract runtime ZIP symlinks as symlinks and verify every npm package after publishing by @tolgaergin in #997
• Refresh dependencies and bundle Oxlint 1.89.0, Biome 2.6.2, Rolldown 1.2.14 by @tolgaergin in #998
• Fix two tests that fail intermittently on loaded CI runners by @tolgaergin in #999
• Keep the privileged proxy service running when another program takes its backend ports by @tolgaergin in #1000
• Move tokio from the yanked 1.54.0 to 1.54.1 by @tolgaergin in #1003
• Stop the auto-ack persistence deadline test from hanging on a paused clock by @tolgaergin in #1002
• Run the privileged proxy forwarder from a root-owned copy of the lpm that is running by @tolgaergin in #1001
• Give the vault app the CLI's LPM home and project file rules through the env engine by @tolgaergin in #1004
• Give npm thirty minutes to list a published release before failing the publish job by @tolgaergin in #1010
• Give the vault app passphrase-protected backup files through the env engine by @tolgaergin in #1005
• Run lpm.config.json schema patterns on the linear-time regex crate by @tolgaergin in #1006
• Name fallback vault files by a digest of the vault ID, so Windows can't merge or refuse them by @tolgaergin in #1008
• Ship third-party license notices with the exported env engine by @tolgaergin in #1009
• Reproduce the env engine export on a clean machine by @tolgaergin in #1015
• Move P-256 and P-384 to RustCrypto 0.14, off the crypto-bigint advisory by @tolgaergin in #1016
• Carry sync keys in backups, taken out before a reader parses the payload by @tolgaergin in #1012
• Settle an interrupted sharing-key rotation against lpm.dev's key read under its lock by @tolgaergin in #1011
• Mint sharing-key step-up proofs bound to the key change they authorize by @tolgaergin in #1013
• Move off the yanked crypto-bigint 0.7.6 by @tolgaergin in #1019
• Never pass project values that make a process run other code by @tolgaergin in #1018
• Add companion storage, its gate, and personal overrides as a run layer by @tolgaergin in #1017
• Move zstd to 0.14.3, off this week's RustSec advisories by @tolgaergin in #1025
• Expect the override count in each platform's own words by @tolgaergin in #1024
• Bring the fuzz lockfile up to date with lpm-common's lpm-env dependency by @tolgaergin in #1026
• Warn about characters in env values that are hard to see by @tolgaergin in #1027
• Report a held version while publish --wait waits, and stop at a final hold by @tolgaergin in #1029
• Register the PowerShell Gallery before signing Windows binaries by @tolgaergin in #1031
• Upload an lpm.dev publish's tarball to storage before the publish by @tolgaergin in #1032
• Take lpm.dev's 250 MiB tarball and 20,000-file limits by @tolgaergin in #1035
• chore: prepare release 0.82.0 by @tolgaergin in #1033

Full Changelog: v0.81.0...v0.82.0

macOS standalone upgrades from 0.76.5

The standalone updater in 0.76.5 rejects newer signed app bundles with an icon. If it reports an unexpected Contents/Resources/ entry, rerun the installer once:

curl -fsSL https://cli.lpm.dev/install | sh

For the latest nightly release:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_CHANNEL=nightly sh

The installer preserves saved credentials and configuration. It checks the release checksum and macOS signing and notarization. If cosign is installed, it also verifies the checksum manifest's Sigstore identity. Do not disable verification or delete your credentials. npm and Homebrew installations should continue using their package manager.