v2.2.0

ZManager CLI 2.2.0 Release Notes

ZManager CLI 2.2.0 adds restart-safe hosted TZAP authentication and certificate recovery, strengthens archive extraction limits, and expands cross-platform release validation.

Highlights

Hosted TZAP identity lifecycle

• Added browser-based hosted login with PKCE, loopback callbacks, and durable handoff recovery.
• Bound sessions and hosted device identities to their authenticated user, environment, and service origins.
• Added restart-safe certificate enrollment and renewal reconciliation, plus journaled recovery for local identity catalog writes.
• Kept signing keys in native secret stores while exposing local certificate and contact workflows through the CLI.

Archive safety and recovery

• Reject extraction paths that would traverse selected or existing symbolic-link ancestors.
• Bound decoded archive intermediates before trusting metadata, with cancellation support.
• Improved nested Debian package payload handling and added coverage for hostile archive and filesystem edge cases.
• Preserve existing outputs and identity catalogs after disk-full or interrupted writes; retry safely after recovery.

Cross-platform builds and supply-chain checks

• Pin and validate the forensic reader forks used by builds instead of updating unrelated sibling checkouts.
• Add scheduled RustSec and offline identity/package audit workflows.
• Validate macOS archive behavior against native Apple tools and build/test Windows ARM64 with the same Rust toolchain as macOS.
• Keep offline and hosted CLI profiles available as separate release packages.

Upgrading

This release adds hosted identity and recovery flows without changing the existing archive command interface. Existing offline workflows remain available in the offline package.