v0.4.1

Summary

• Hardened cara plugins install|update --file so local managed plugin staging rolls back cleanly on failure and surfaces clearer recovery guidance.
• Improved plugins.status reporting when plugin loader initialization fails early so managed plugins still appear with per-plugin failure rows.
• Tightened release and CI ergonomics with a fixed guarded nextest watchdog parser and explicit fast/golden/integration/full test lanes.

Breaking Changes

• None.

Migration Steps

• No manual migration is required for the stable path from v0.4.0 to v0.4.1.
• Before upgrading, create a backup:
  • cara backup --output ./carapace-backup.tar.gz
• After upgrade, verify the install:
  • cara verify --outcome auto
  • cara verify --outcome autonomy

Rollback Steps

• Reinstall the previous known-good binary, for example v0.4.0.
• Restore the backup created before upgrade:
  • cara restore --path ./carapace-backup.tar.gz
• Re-run:
  • cara status --port 18789
  • cara verify --outcome auto --port 18789
  • cara verify --outcome autonomy --port 18789

Security

• Local plugin --file install and update flows now fail closed with deterministic cleanup of staged artifacts, backups, and lock files instead of leaving ambiguous partial local state behind after a failure.
• Plugin status now preserves per-plugin failure visibility when loader initialization fails before discovery, which improves operator diagnosis without weakening fail-closed behavior.
• No new public advisories are introduced by this release.

Verification

• Verify published artifacts and Sigstore bundles:
  • RELEASE_TAG=v0.4.1 ./scripts/smoke/verify-release-artifacts.sh
• After upgrading, verify runtime behavior:
  • cara verify --outcome auto
  • cara verify --outcome autonomy
• If you use plugins, confirm activation state after restart:
  • cara plugins status --port 18789

Known Caveats

• Plugin activation changes remain restart-based; hot reload is not part of the current public workflow.
• Broader server-side managed plugin install/update transactionality remains a separate follow-up; this release hardens the local CLI --file path only.
• Local plugin staging still assumes a trusted local state directory; additional hardening against local symlink-swap races remains tracked separately.