v0.2.0

shellenv v0.2.0 — verified installs, a cross-project env registry, and man pages. Every feature in this release was dogfooded end-to-end against a real 2,000-line bootstrap script before shipping.

New features

• install --require-checksum — refuse to install versions without a pinned SHA-256 instead of warning, and refuse before anything is downloaded. The strict opt-in counterpart to the default warn-and-proceed, mirroring --strict-shell.
• Advisory env registry ($SHELLENV_HOME/registry.json) — create/destroy record env locations, so:
  • uninstall now warns about envs in other projects that still declare the removed runtime (previously only the current directory was visible), and silently prunes entries whose projects have vanished.
  • list --all shows every known env as NAME SHELL ROOT across all registered projects.
  • The registry is best-effort by design: corrupt, missing, or unwritable registry state never fails a command.
• Man pages — release tarballs now bundle man/ with one page per command, generated from the live command tree so they always match --help. Read in place with man -l man/shellenv.1, or install: cp man/*.1 ~/.local/share/man/man1/.

Fixes

• which now resolves with the same priority exec uses — env bin/, then the declared runtime's bin/, then PATH — so its answer is the binary exec would actually run (previously it could name the system shell while exec ran the pinned one).
• Re-running install for an already-installed runtime no longer also prints a misleading "Installed … into …" line.
• create now fails loudly when the env's activate.sh cannot be written, instead of silently producing a broken env.

Documentation

• docs/ARCHITECTURE.md gained eight diagrams (system overview, component fan-out, on-disk state relationships, sequence diagrams for activate/exec/install/uninstall, session lifecycle).
• README no longer over-promises fish: fish is supported for activation and .fish profiles, but shellenv does not build fish runtimes (supported installers: bash, zsh).

Build & CI

• Releases are now gated: a version tag runs the full CI matrix (ubuntu + macOS, lint, govulncheck) before any artifact is built.
• Release binaries are built with the newest stable Go, so they carry current stdlib security fixes; building from source still needs only Go 1.22+.
• CI now tests macOS (darwin binaries previously shipped untested) and enforces that the docker/podman container test actually runs on Linux instead of silently skipping.

Checksums

All tarballs are listed in SHA256SUMS. Each bundle is self-contained: binary + profiles/ + man/ + README + LICENSE.

Full Changelog: v0.1.0...v0.2.0