v0.2.1

0.2.1 (2026-03-21)

Bug Fixes

• ci: escape awk variables in Nix postPatch string (440c5b9)
• ci: handle Cargo.lock version drift in Nix build (a65b5dd)
• ci: ignore unfixable SDK transitive advisories in cargo audit (44e5564)
• ci: remove broken postPatch and sync Cargo.lock in release PR (a8b542f)

Security

• auth: persist password backoff counter across restarts (51293ff)
• ci: add cargo-audit to CI pipeline (e593343)
• common: reject world/group-writable config file and sync docs (8c11a56)
• common: warn on world/group-writable config file (b44441a)
• ipc: add connection limits, timeouts, and reduce message size (7449a23)
• sdk: pass Zeroizing<String> through SDK boundary and bound KDF params (61037d7)
• service: make memory hardening fatal, add macOS PT_DENY_ATTACH (e704431)
• service: remove --allow-insecure-memory escape hatch (b351158)
• service: remove PATH fallback for prompt binary discovery (91582a6)
• ssh: add UID peer verification to SSH agent socket (49d2bdf)
• ssh: zeroize SSH private key material after signing (0a6b9a7)

Other Changes

• apply cargo fmt formatting (288a36d)