@stackbone/cli 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.1] - 2026-10-08
+
+### Added
+
+- **`stackbone dev` says so when the organization's trial has ended.** The
+  control plane refuses the tunnel grant and the local registration of an
+  organization whose trial is over with `trial_expired`. The CLI prints that
+  the trial ended, that nothing was deleted and how to continue, exits `5`, and
+  does not retry. `stackbone init` reads the same refusal the same way. A
+  session that was already running keeps running (PLA-2036).
+- **`stackbone link` stops at an ended trial too.** The control plane now also
+  refuses `trial_expired` when an organization whose trial is over registers a
+  box (`link`) or creates a workspace (`init`), so both commands print the same
+  trial-ended message and exit `5` (PLA-2037).
+
+### Security
+
+- **A `stackbone dev` box no longer verifies connector calls with a key from
+  the public repo.** Every dev box signed `/api/connect/*` with the same
+  constant and encrypted connected accounts under the same key, so anyone
+  holding a tunnel URL could mint tokens for the creator's Gmail, Slack or
+  HubSpot. Each dev box now mints its own pair on its first boot and keeps it
+  in its own dev Postgres, next to the connections it protects. Connections
+  made with an older CLI are moved onto the new key at boot and keep working;
+  one that no known key can open is removed with a warning, and you reconnect
+  it in Studio (PLA-1866).
+
 ## [0.6.0] - 2026-10-06
 
 ### Added