cli-v0.11.1

Runx CLI 0.11.1

Local registry refreshes now respect the existing record's write permissions
while retaining atomic publication. This patch also updates transport
dependencies and prepares distribution through the established trusted npm
publisher.

Highlights

• A refused registry update leaves the existing record intact.
• Updated MCP and HTTP dependencies retain the native execution boundary.

Added

• Windows coverage for atomic registry publication, retained readers,
  no-clobber creation and file access.

Changed

• Updated locked Rust dependencies, including MCP transport and Windows
  process supervision.
• Release publishing uses the validated repository-bound npm identity.
• Distribution publisher metadata identifies auscaster and oss@0state.com.
• The certificate-data license permission stays scoped to its package without
  duplicating a dependency patch version in license policy.
• CLI quality gates use the bundled core-skill inventory. Registry
  publication retains full package validation.

Fixed

• Atomic registry refreshes check the destination's write access before
  replacement. Staging no longer permits an ordinary user to overwrite a
  read-only record merely because its directory is writable.
• Windows registry refreshes can replace a record while a reader finishes
  reading its original bytes.

Removed

• The release path's dependency on a personal npm publishing token.

Security

• Updated the x402 conformance tooling to 2.29.0, replacing its vulnerable
  Zod 3 dependency with the patched Zod 4 line. Its source revision and seven
  source digests are verified against the published package's provenance;
  the protocol test vectors remain unchanged.

Breaking changes

None. Skill, connector and receipt wire contracts remain unchanged.

Upgrade guidance

Install the patch through your existing CLI distribution channel. For npm:

npm install --global @runxhq/cli@0.11.1
runx --version

No local state migration is required. The native launcher and its matching
JavaScript worker continue to ship together.

Contributors

Thanks to DivyamTalwar for the local registry
report and proposed atomic-publication boundary, and to dependency maintainers
for the upstream updates.

Full changelog: cli-v0.11.0...cli-v0.11.1