4.84.6.md

status	ACTIVE
version	4.84
owner_skill	ls-github-release-publishing

LocalSetup 4.84.6

LocalSetup 4.84.6 adds a dynamic terminal workspace, private input dialogs, encrypted artifact workflows, and an installed agent runtime with bounded controls and recovery.

Highlights

• Check before scheduling: the cron readiness command reports observable prerequisites, blockers, unchecked requirements, and next actions without running or enabling a task.
• Review guidance before retirement: assess accuracy, review age, historical value, dependent instructions, and the limits of a usage search before changing or retiring a reference.
• Understand recovery confidence: report backup attempts, integrity checks, and successful recovery exercises separately, then prepare an isolated exercise that protects originals.
• Resume a contribution: follow receiving-project rules and keep work, review readiness, submission readiness, and confirmed submission visible in one private progress record.
• Continue settled LSCli history in another workspace: select the source with --source-workspace and the destination with --workspace; the new session retains exact history while requiring fresh authority.
• Explain an unfamiliar tool from source: write an operational reference tied to a reviewed revision, with source citations, coverage, failure and recovery behavior, and visible unresolved questions.
• Manage local previews safely: guide existing project commands through verified loopback startup, reuse, inspection, conflict handling, and stopping only the owned preview.
• Prepare media metadata copies: choose hidden fields to retain, remove, or update, preserve original files and legitimate attribution, and verify each output against the chosen policy.
• Prepare private transcripts and captions: check local processing capability, mark drafts, review words and timing, export sidecar captions, and optionally render a separate captioned video.
• Follow active work in the terminal: dormant sections collapse to one row, active work expands below them, and paging preserves configurable minimum heights. Readable controls and selection redraws support keyboard and mouse use.
• Enter private input through reusable dialogs: text, multiline, password, checkbox, radio and confirmation fields use bounded, operation-bound delivery. Sudo and OpenPGP consumers retain their own authority checks.
• Share encrypted files across carriers: protected metadata, per-file messages, recipient addressing, volume reconstruction and persistent receipts preserve verification independently of storage or transport accounts.
• Read protected files through ordinary tools: configured catalogs resolve encrypted volumes and delta dependencies beneath explicit file and disclosure grants. Models do not select keys or bypass verification.
• Preserve independent origins and concurrent edits: bounded admissions retain each origin’s trust and receipts. Common-base forks remain separate until an explicitly authored merge creates a new immutable version.
• Resume authorized snapshot publication: exact coverage, current assignments and durable job identity govern client, worker and on-demand consolidation. Lost acknowledgements require reconciliation rather than duplicate publication.
• Apply signed configuration at defined boundaries: terminal tuning, container settings and ordered output filters consume validated revisions while preserving running operation identity.
• Run coding tools behind explicit grants: installed workers use the shared file, process and provider brokers. Private credentials stay outside worker environments, and cancellation remains available during stalled output.
• Control and reconcile admitted runs: one authenticated encrypted protocol carries bounded requests over owned streams, SSH relay processes and HTTP adapters. A fresh read-only recovery session can inspect an original run without replaying it.
• Prepare installed heartbeat reviews: explicit profiles, secret references, readiness checks and granted tool-free review support scheduled observation without treating configuration as activation authority.
• Install verified runtime assets: authenticated release sets and hash-locked dependency preparation support offline installation, protected launchers and retained predecessors.
• Bound retained observations and provider context: ordered filter policies, retained event limits and explicit context selection govern what resumed runs see, while preserving signed protocol fields and raw files.
• Qualify terminal startup before dispatch: status-pane startup tolerates a short process-label transition while retaining exact pane, process-birth and command checks. Native CI uses the qualified tmux runner and rejects an unexpected tmux version before the suite.

After publication, see the release and downloads for release assets.

Compatibility

Existing same-workspace LSCli branches remain compatible: omitting --source-workspace uses --workspace for both sessions. Both workspace directories must already exist. Branching copies settled LSCli checkpoint history, not working-tree files or another client's live conversation; the guided procedure checks client capability before a move.

The new preview, metadata, and transcription packages are instruction-only procedures. They use available project commands and installed tools; they do not bundle a server supervisor, media editor, speech engine, or model. Unsupported tools, formats, clients, or local processing remain explicit limitations rather than automatic remote fallbacks.

Cron readiness is a read-only report with ready, blocked, and unchecked findings. It does not activate cron, execute task commands, verify task-specific credentials or recovery, or infer success from enabled state. A zero command exit status means the report was produced; inspect the reported readiness before activation.

Windows support remains WSL2-only. Native terminal behavior is qualified for supported tmux paths; transport and terminal compatibility do not imply that every remote host is configured.

Existing supported OpenPGP generations and their signed ciphertext remain readable under their historical receipt policy. New container/configuration capabilities use explicit versions; an unknown required capability fails before acceptance. Installing LocalSetup does not generate keys, enroll machines or authorize disclosure.

Encrypted control requires explicit current peer admission, a live owner and a fresh readiness challenge. SSH or HTTP connectivity alone grants no execution authority. The HTTP relay command is not an HTTPS listener; TLS configuration belongs to the caller of the server API.

Recovery grants admit reconciliation only. Saved bindings and journals identify evidence; they cannot restore expired execution authority or justify replaying an uncertain operation.

The earlier SDK paging and Agent Q v2/envelope compatibility changes remain. Corrected 4.x numbering does not restore older source or protocol APIs.

Update

Refresh the selected LocalSetup packages through the supported install or recorded package-refresh workflow. The new contribution workflow is in dev and GitHub-maintenance selections; previews are in dev, and media procedures are in dev and frontend. The normal profile includes dev.

Use the existing documentation-alignment, backup, Git, Node, and Remotion owners to reach the extended procedures. Keep task records and private evidence under the receiving repository's private state owner; review and sharing do not imply publication authority.

Use the documented setup and dependency-preparation entrypoints with independently verified artifact digests. Retain the previous installed runtime and inspect incomplete candidates before recovery.

Select provider URLs and existing credential references explicitly, run readiness checks, and enable schedules only within the granted scope. External provider authentication and actual remote SSH-host setup require environment-specific qualification.

For installation and source refresh, read the quickstart update instructions. Adapter changes follow the adapter ownership guide.

Verify the download

Focused source checks cover native input delivery, deterministic layout/redraw, independent encrypted origins, delta reconstruction, immutable forks/merges, authenticated control and cancellation under output backpressure.

Focused checks cover status-pane startup transitions, changed process identities, native rollover, controlled pager exit, and managed Bash handshake. These checks do not substitute for the final hosted candidate suite.

Synthetic observer checks cover terminal attachment, family rollover, paging and resizing with the parent terminal type unset or limited. Closed-terminal diagnostics retain bounded child output without requiring a second terminal read.

An isolated installed-runtime fixture verified ordinary CLI and sandboxed SDK reads across encrypted volumes, disclosure denial, hidden workspaces, absent worker credentials and plaintext-cache cleanup. A separate-key installed CLI fixture verified owner-exit reconciliation, rejected execution and unchanged original evidence.

These fixture results do not establish a live external scheduled review, fleet-wide deployment or actual remote SSH-host qualification. Before publication, require final exact-candidate full-suite and documentation evidence, verified source/tag signatures, and complete archive/checksum/SBOM/native-runtime asset checks. Verify localsetup-v4.84.6.tar.gz with its .sha256 checksum and .cdx.json SBOM sidecars.

Download the framework archive with both its .sha256 checksum and .cdx.json SBOM sidecars. Keep all three files in the same directory before running verify-release.

uv run --locked python ls/tools/localsetup.py --source-root . verify-release /path/to/localsetup-v4.84.6.tar.gz