🐸 Versioned release

packages/plugins/1password/CHANGELOG.md

@@ -8,6 +8,12 @@
 
 
 
+
+## 2.0.3
+<sub>2026-07-31</sub>
+
+- [#960](https://github.com/dmno-dev/varlock/pull/960)  *(patch)* - Never cache one-time password codes, and give a clear error when Connect is asked for one
+
 ## 2.0.2
 <sub>2026-07-29</sub>
 

packages/plugins/1password/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@varlock/1password-plugin",
   "description": "Varlock plugin to load data from 1Password vaults",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "type": "module",
   "homepage": "https://varlock.dev/plugins/1password/",
   "bugs": "https://github.com/dmno-dev/varlock/issues",

packages/varlock/CHANGELOG.md

@@ -21,6 +21,17 @@
 
 
 
+
+
+## 1.15.0
+<sub>2026-07-31</sub>
+
+- [#960](https://github.com/dmno-dev/varlock/pull/960)  *(minor)* - Add generateOtp() for generating TOTP 2FA codes
+- [#931](https://github.com/dmno-dev/varlock/pull/931)  *(minor)* - proxy: `--persist-ca` keeps a broker's CA across restarts so clients that already trust it keep working
+- [#931](https://github.com/dmno-dev/varlock/pull/931)  *(minor)*
+  Reach the credential proxy from another machine or a remote sandbox, with no external tunnel tool. `varlock proxy start` / `run` gain `--expose` (optionally `--expose=<addr>`) to bind off-loopback and serve a built-in CONNECT-over-WebSocket tunnel, so a client behind provider HTTP ingress (E2B, Modal, ...) can route through it. Enabling the tunnel mints a per-session data-plane token that clients must present (pin it with `VARLOCK_PROXY_TOKEN`), while loopback clients stay exempt and the control endpoint stays loopback-only. `varlock proxy run --url <wss-url> -- <command>` (with the token in `VARLOCK_PROXY_TOKEN`, or `--token`) runs the command through a broker running elsewhere: it opens the tunnel, self-wires the env and CA certs from the broker, and only ever holds placeholders. `varlock proxy env` also gains `--full` (emit the whole child-view env, not just the wiring) with `--proxy-url` / `--cert-dir` to repoint it, for wiring a client manually. New `varlock proxy token` prints a session's data-plane token, so a minted one can be read back rather than scraped from logs; the startup banner now withholds it unless stdout is a terminal.
+- [#955](https://github.com/dmno-dev/varlock/pull/955)  *(patch)*
+  The install script now verifies the sha256 of the downloaded archive against the release's published checksums.txt, and fails without installing on a mismatch.
 
 ## 1.14.1
 <sub>2026-07-29</sub>

packages/varlock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "varlock",
-  "version": "1.14.1",
+  "version": "1.15.0",
   "description": "AI-safe .env files: Schemas for agents, Secrets for humans.",
   "main": "index.js",
   "type": "module",

packages/vscode-plugin/CHANGELOG.md

@@ -10,6 +10,12 @@
 
 
 
+
+## 0.3.2
+<sub>2026-07-31</sub>
+
+- [#960](https://github.com/dmno-dev/varlock/pull/960)  *(patch)* - Add generateOtp() to autocomplete
+
 ## 0.3.1
 <sub>2026-07-28</sub>
 

packages/vscode-plugin/package.json

@@ -7,7 +7,7 @@
     "color": "#4F0049",
     "theme": "dark"
   },
-  "version": "0.3.1",
+  "version": "0.3.2",
   "publisher": "varlock",
   "author": "dmno-dev",
   "license": "MIT",