zen 1.1.0

zen 1.1.0

First update since the initial release. zen is the Zenvara command-line interface — a single
self-contained native binary (NativeAOT, no .NET runtime required) for installing, operating, and
talking to a Zenvara instance.

This release is mostly hardening. Read the breaking changes before upgrading: four of them remove or
refuse behaviour that works in 1.0.0, and one changes what a scripted teardown does.

Breaking changes

• zen setup chromium is gone, with no alias. Use zen setup playwright. It installs the same
  Playwright-managed Chromium used for PDF generation. A script calling the old name fails with an
  unknown-command error rather than silently doing nothing.

• zen run, zen invoke-flow and zen invoke-flow-async are gone. None of them ever worked:
  run was a phantom verb the CLI had no case for, and the invoke-flow* spellings pointed at a
  server verb that does not exist. They are removed rather than repaired. zen invoke is unaffected
  — it is the connector-action verb and stays.

• zen service install --system now runs as a dedicated account. A bare --system auto-creates
  and uses _<name> instead of the interactively-logged-in operator who ran the install; pass
  --service-user to override. On Windows the default install root moved to %ProgramFiles%.
  A service installed by 1.0.0 is not migrated in place. Upgrading the binary does not change an
  existing service's account or paths — remove and reinstall the service if you want the new
  least-privilege layout.

• zen service remove and zen iis remove now refuse resources they do not recognise as their
  own. This is the one most likely to break an existing teardown script: where 1.0.0 deleted a
  unit, service, job, site or app-pool unconditionally, 1.1.0 checks ownership first and exits
  non-zero when the resource does not look like a Zenvara install this instance owns. Pass
  --force-foreign to skip the check and get the old behaviour.

New

• Trust-on-install for extension packs. zen extension install and add prompt before trusting
  an unknown provider key. --trust-provider accepts that prompt non-interactively and trusts the
  key permanently — the flag to use in CI.
• zen service install --force reconfigures an existing installation instead of failing. It
  overlays the requested settings onto appsettings.user.yaml, backs up the previous file, and
  preserves an existing Auth signing key.
• Pin a version, or override the source. zen app fetch, zen app update and zen cli update
  take --version to install a specific release rather than the latest. --url is now optional
  everywhere it appears — the download URL is derived from the GitHub release by default.
• Fail-closed signature verification. Downloads are verified against a signed release manifest.
  A Tampered verdict is never bypassable, including by --insecure-skip-verify; only the
  honest cases (an expired manifest, a missing signature) accept that flag.
• Running a flow from the CLI works. In 1.0.0 there was no functioning way to do it — every
  spelling failed. zen run-flow <name> and zen run-flow-async <name> now forward correctly to the
  server, alongside zen flows, zen logs and zen output.

Hardening and fixes

Between 1.0.0 and 1.1.0 the CLI went through a security-hardening campaign and a defect sweep
covering elevation and privilege handling, secrets-file and socket permissions, path and symlink
handling under elevation, exit-code correctness, service and IIS ownership gates, download and
signature verification, and the passthrough command surface. Individually these are small; together
they are the reason this release exists. Nothing in this section changes a documented command
signature — anything that did is in Breaking changes above.

Supported platforms

Platform	Archive
Linux x64	zen-linux-x64.tar.gz
Linux arm64	zen-linux-arm64.tar.gz
Windows x64	zen-win-x64.zip
macOS x64 (Intel)	zen-osx-x64.tar.gz
macOS arm64 (Apple silicon)	zen-osx-arm64.tar.gz

Each archive contains the single zen executable. A .sha256 checksum file accompanies every
archive, and the release carries a signed SHA256SUMS manifest (SHA256SUMS.jws).

Install

# Linux / macOS (pick your archive from the table above)
tar xzf zen-linux-x64.tar.gz
./zen path install   # puts zen on the system PATH
zen --help

# Windows
Expand-Archive zen-win-x64.zip .
.\zen.exe path install
zen --help

Verify a download:

sha256sum -c zen-linux-x64.tar.gz.sha256

Upgrading from 1.0.0

zen cli update          # updates the CLI itself

Then re-read the breaking changes above. In particular, check any script that calls
zen setup chromium, zen run, zen service remove or zen iis remove.