agent-paste CLI cli-v0.1.3

Standalone CLI binaries cross-compiled with bun build --compile. macOS binary is codesigned + notarized. Each binary carries a GitHub build-provenance attestation (verify: gh attestation verify <binary> --repo zaks-io/agent-paste) and an attached SLSA provenance sidecar (*.intoto.jsonl). A CycloneDX SBOM of exactly what is compiled into the binary (agent-paste-cli.sbom.cdx.json), a blocking grype scan report (agent-paste-cli.grype.json), scanner/DB versions (scan-metadata.json), and repo security attestation bundle (repo-security-attestation.tgz) are attached. Draft - review and publish manually. Verify downloads against SHA256SUMS.

What's Changed

• chore(ci): gate code formatting in verify (local + CI) by @isuttell in #451
• Redact internal system/platform actors from tenant audit log by @isuttell in #453
• Unify apex + web on one shared @agent-paste/ui design system by @isuttell in #454
• CLI: skip upgrade download when already on the latest version by @isuttell in #455
• fix(mcp): accept reserved _meta on tools/call envelope by @isuttell in #456
• Rewrite + de-dupe the apex landing page; truthful CLI-output demo by @isuttell in #458
• Turbo-native deploy: one command to deploy any Worker to preview by @isuttell in #457
• Add hot reload workflow for local apex preview by @isuttell in #459
• Make Artifact URL the default live publish handoff by @isuttell in #460
• fix(mcp): align OAuth resource discovery for Codex by @isuttell in #461
• Clarify agent-facing ephemeral publish guidance by @isuttell in #462
• fix(cli): align publish contract and auth retryability by @isuttell in #463
• fix(mcp): return artifact url from publish tools by @isuttell in #464
• fix(web): encode live-proxy path params, reject control chars in auth return path by @isuttell in #465
• Define Artifact State glossary by @isuttell in #473
• fix(viewer): restore live updates and sibling assets by @isuttell in #474
• fix(scripts): smoke-secret provisioning scope, fileURLToPath, spawn error handling, local harness client IP by @isuttell in #468
• fix(mcp,auth): session-scoped idempotency keys, auth challenges, notification handling, working edge cache, retryable WorkOS errors by @isuttell in #470
• fix(cli,contracts,db): make --render-mode real — shared inference map, stored render_mode honored at finalize by @isuttell in #472
• fix(billing): authoritative webhook supersession, orphan adoption, drift normalization, override re-apply by @isuttell in #466
• fix(jobs): decrypt bytes before safety scan, purge bundle objects, retry on kill switch by @isuttell in #467
• fix(db,api): exempt pinned artifacts from expiry/purge, align dashboard token TTL with artifact expiry by @isuttell in #471
• fix(publish): nested-path routing, guard order, idempotency peek contract, allowance key hashing, upload TOCTOU + real put-url expiry by @isuttell in #469
• feat(upload): dedupe publish blobs by workspace by @isuttell in #476
• Make Access Link Signed URL the default live handoff by @isuttell in #475
• fix(content): force PDFs to download, reconcile media disposition with spec by @isuttell in #477
• CLI: rich/plain/json output modes with schema_version + exit codes by @isuttell in #478
• CI-local Postgres smoke for PR preview burn-in by @isuttell in #481
• docs: reconcile launch status by @isuttell in #482
• Make artifact sharing explicit by default by @isuttell in #483
• chore(skills): refresh workflow skills from zaks-io/skills (AP-298) by @isuttell in #480
• Fix Access Link viewer CSP nonce for hydration by @isuttell in #484
• Fix deploy Turbo cache reuse across hosted deploy workflows by @isuttell in #485
• Reframe apex demo around agent-paste.sh prompt by @isuttell in #486
• feat(web): add floating Access Link brand bar by @isuttell in #487
• fix(ci): cache security scanner CLIs and vulnerability DBs by @isuttell in #488
• fix(web): cache the wrangler deploy-config redirect with the build by @isuttell in #489
• fix(cli): stop buffering files in walkLocalPath for unused sha256 (AP-292) by @isuttell in #479
• fix(api): make ephemeral PoW difficulty env-tunable; lower it in the local harness by @isuttell in #490
• docs(cli): align README with shipped CLI surface before 0.1.3 release by @isuttell in #492
• docs(apex): teach agents to check whoami JSON, not its exit code by @isuttell in #493

Full Changelog: cli-v0.1.2...cli-v0.1.3