🐸 Versioned release

[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

varlock 1.14.1 → 1.15.0 _CHANGELOG.md

• Add generateOtp() for generating TOTP 2FA codes (bump file)
• proxy: --persist-ca keeps a broker's CA across restarts so clients that already trust it keep working (bump file)
• Reach the credential proxy from another machine or a remote sandbox, with no external tunnel tool. varlock proxy start / run gain --expose (optionally --expose=<addr>) to bind off-loopback and serve a built-in CONNECT-over-WebSocket tunnel, so a client behind provider HTTP ingress (E2B, Modal, ...) can route through it. Enabling the tunnel mints a per-session data-plane token that clients must present (pin it with VARLOCK_PROXY_TOKEN), while loopback clients stay exempt and the control endpoint stays loopback-only. varlock proxy run --url <wss-url> -- <command> (with the token in VARLOCK_PROXY_TOKEN, or --token) runs the command through a broker running elsewhere: it opens the tunnel, self-wires the env and CA certs from the broker, and only ever holds placeholders. varlock proxy env also gains --full (emit the whole child-view env, not just the wiring) with --proxy-url / --cert-dir to repoint it, for wiring a client manually. New varlock proxy token prints a session's data-plane token, so a minted one can be read back rather than scraped from logs; the startup banner now withholds it unless stdout is a terminal. (bump file)
• The install script now verifies the sha256 of the downloaded archive against the release's published checksums.txt, and fails without installing on a mismatch. (bump file)

Patch releases

@varlock/1password-plugin 2.0.2 → 2.0.3 _CHANGELOG.md

• Never cache one-time password codes, and give a clear error when Connect is asked for one (bump file)

env-spec-language 0.3.1 → 0.3.2 _CHANGELOG.md

• Add generateOtp() to autocomplete (bump file)

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 131.8 KB (+2.8%)

Metric	v1.14.1 (published)	This release	Δ
Total dist	4790.4 KB	4922.2 KB	+131.8 KB (+2.8%)
JS	1656.2 KB	1692.0 KB	+35.8 KB (+2.2%)
Sourcemaps	3058.2 KB	3154.2 KB	+96.0 KB (+3.1%)
Type defs	76.0 KB	76.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.

[pullfrog]

✅ No new issues found.

Reviewed changes Verified the generated release artifacts for the three packages included in this release.

• varlock 1.15.0: Consistently updates the package manifest, lockfile workspace version, and changelog for generateOtp().
• @varlock/1password-plugin 2.0.3: Consistently records the OTP caching and Connect error fix across release artifacts.
• env-spec-language 0.3.2: Consistently records generateOtp() autocomplete across release artifacts.
• Bump consumption: Removes the three corresponding .bumpy files after incorporating their entries.

  ^{｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}