v0.37.3

The release is four files. The .gha, the .rhp and the .vsix are installed by hand, and the
.mcpb for Claude Desktop installs the first two itself. No package is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

The .mcpb is the Claude Desktop extension: open it, or drag it onto Settings › Extensions in
Claude Desktop. It carries the .gha and the .rhp and installs them into Rhino's package folder
when it first starts, so with it the three steps above are not needed. A .gha already copied into
Grasshopper\Libraries by hand stops it: the extension then installs nothing and says so, because
Grasshopper would load both copies.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.37.2

The release is four files. The .gha, the .rhp and the .vsix are installed by hand, and the
.mcpb for Claude Desktop installs the first two itself. No package is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

The .mcpb is the Claude Desktop extension: open it, or drag it onto Settings › Extensions in
Claude Desktop. It carries the .gha and the .rhp and installs them into Rhino's package folder
when it first starts, so with it the three steps above are not needed. A .gha already copied into
Grasshopper\Libraries by hand stops it: the extension then installs nothing and says so, because
Grasshopper would load both copies.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.37.1

The release is four files. The .gha, the .rhp and the .vsix are installed by hand, and the
.mcpb for Claude Desktop installs the first two itself. No package is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

The .mcpb is the Claude Desktop extension: open it, or drag it onto Settings › Extensions in
Claude Desktop. It carries the .gha and the .rhp and installs them into Rhino's package folder
when it first starts, so with it the three steps above are not needed. A .gha already copied into
Grasshopper\Libraries by hand stops it: the extension then installs nothing and says so, because
Grasshopper would load both copies.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.37.0

The release is four files. The .gha, the .rhp and the .vsix are installed by hand, and the
.mcpb for Claude Desktop installs the first two itself. No package is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

The .mcpb is the Claude Desktop extension: open it, or drag it onto Settings › Extensions in
Claude Desktop. It carries the .gha and the .rhp and installs them into Rhino's package folder
when it first starts, so with it the three steps above are not needed. A .gha already copied into
Grasshopper\Libraries by hand stops it: the extension then installs nothing and says so, because
Grasshopper would load both copies.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.36.1

The release is four files. The .gha, the .rhp and the .vsix are installed by hand, and the
.mcpb for Claude Desktop installs the first two itself. No package is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

The .mcpb is the Claude Desktop extension: open it, or drag it onto Settings › Extensions in
Claude Desktop. It carries the .gha and the .rhp and installs them into Rhino's package folder
when it first starts, so with it the three steps above are not needed. A .gha already copied into
Grasshopper\Libraries by hand stops it: the extension then installs nothing and says so, because
Grasshopper would load both copies.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.36.0

The release is four files. The .gha, the .rhp and the .vsix are installed by hand, and the
.mcpb for Claude Desktop installs the first two itself. No package is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

The .mcpb is the Claude Desktop extension: open it, or drag it onto Settings › Extensions in
Claude Desktop. It carries the .gha and the .rhp and installs them into Rhino's package folder
when it first starts, so with it the three steps above are not needed. A .gha already copied into
Grasshopper\Libraries by hand stops it: the extension then installs nothing and says so, because
Grasshopper would load both copies.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.34.1

The release is three files, the .gha, the .rhp and the .vsix, installed by hand. No package
is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.34.0

The release is three files, the .gha, the .rhp and the .vsix, installed by hand. No package
is published on any server, and there is no plan for one. For Rhino's Package Manager,
tools/pack-yak.ps1 in the repository builds a .yak into a folder, and everyone who can read
that folder can install from it.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, open Properties and
select Unblock. Windows marks files that arrived from elsewhere, and Grasshopper refuses a
blocked assembly with no warning. A blocked file must be unblocked by hand.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions, and it updates that list only when it closes normally. A kill
skips the registrations made in that session; plug-ins recorded from an earlier normal close still
load.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol. The port in %TEMP%\phenome-rhino-<pid>.port answers when the canvas cannot: it says
whether Rhino is free, what dialog is holding it and how to answer that.

What changed since the installed version is in CHANGELOG.md.

If that file has a ### Security block for a version above the installed one, read it before
deciding to skip this release. The link binds to loopback and runs code in Rhino. A vulnerability
in it is reachable by anything that runs on the same machine, a web page included. Those entries
say what an attacker could do and what to do about it.

v0.33.0

Three parts of one mechanism, and they install by hand. These three files are the whole release:
there is no package on any server and no plan for one. If you would rather install from Rhino's
Package Manager, tools/pack-yak.ps1 in the repository builds a .yak for a folder of your own,
which is also how to hand it round a studio — whoever can read the folder can install.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, Properties,
Unblock — Windows marks files that arrived from elsewhere and Grasshopper refuses a blocked
assembly silently. This is the step everybody misses.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions — but it writes that list when it closes normally, so a Rhino
killed rather than closed forgets it was ever told.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol, and %TEMP%\phenome-rhino-<pid>.port the one that still answers when the canvas
cannot — whether Rhino is free, what dialog is holding it, and how to answer that.

What changed since the version you have is in CHANGELOG.md, which is written for that question
rather than for the commit history.

If that file has a ### Security block for a version above yours, read it before deciding to
skip this release. The link binds loopback and runs code in Rhino, so a hole in it is reachable
by anything that runs on your machine — a web page included. Those entries say what an attacker
could do and what to do about it, in plain words.

v0.32.0 — security release, do not skip

This release fixes a security problem. The ### Security block in CHANGELOG.md says what it was, what somebody could have done with it, and whether you were exposed. Read that before deciding to install this later.

Three parts of one mechanism, and they install by hand. These three files are the whole release:
there is no package on any server and no plan for one. If you would rather install from Rhino's
Package Manager, tools/pack-yak.ps1 in the repository builds a .yak for a folder of your own,
which is also how to hand it round a studio — whoever can read the folder can install.

The .gha goes in %APPDATA%\Grasshopper\Libraries\. Then right-click it, Properties,
Unblock — Windows marks files that arrived from elsewhere and Grasshopper refuses a blocked
assembly silently. This is the step everybody misses.

The .rhp: drag it onto an open Rhino, or point PlugInManager at it. Rhino remembers what
it has loaded between sessions — but it writes that list when it closes normally, so a Rhino
killed rather than closed forgets it was ever told.

The .vsix: code --install-extension phenome-link-<version>.vsix, or let the canvas's
Pair with VS Code button do it on the first pairing.

Then restart Rhino. GET / on the port in %TEMP%\phenome-link-<pid>.port describes the canvas
protocol, and %TEMP%\phenome-rhino-<pid>.port the one that still answers when the canvas
cannot — whether Rhino is free, what dialog is holding it, and how to answer that.

What changed since the version you have is in CHANGELOG.md, which is written for that question
rather than for the commit history.

If that file has a ### Security block for a version above yours, read it before deciding to
skip this release. The link binds loopback and runs code in Rhino, so a hole in it is reachable
by anything that runs on your machine — a web page included. Those entries say what an attacker
could do and what to do about it, in plain words.