Patch Changes

• 0d14cec: Isolate dev and production data paths: when DEV=true, all config/session/password/cache files use ~/.config/relic-dev/ and keychain service uses com.relic.tui.dev
• 0d14cec: Fix editor not deleting secrets that were removed before saving

Patch Changes

• ace257c: Isolate dev and production data paths: when DEV=true, all config/session/password/cache files use ~/.config/relic-dev/ and keychain service uses com.relic.tui.dev

Minor Changes

• 1ff1b4c: Add relic version and relic upgrade commands, redesign CLI help output, and show version/plan in TUI status bar

Minor Changes

• Add machine identity with service accounts and OIDC trust policies.

  • Service accounts for passwordless CI/CD — single RELIC_SERVICE_TOKEN replaces RELIC_API_KEY + RELIC_PASSWORD
  • OIDC trust policies for GitHub Actions and GitLab CI — verify CI platform identity with --github org/repo or --gitlab group/project
  • Dashboard management — list, revoke service accounts, and configure OIDC policies from the web
  • CLI commands — relic service-account create, list, revoke
  • MCP server — service token support and tool annotations (readOnlyHint, destructiveHint)
  • HKDF-SHA256 key derivation for service account tokens (no master password needed)
  • API key + master password in CI is now deprecated — use service accounts instead

Minor Changes

• 08bf115: Add built-in MCP server for AI assistants. Run relic mcp to start a stdio-based Model Context Protocol server that integrates with Cursor, Claude Code, Codex, Zed, OpenCode, and Claude Desktop.

  Available tools:

  • whoami — show the authenticated user
  • list-projects — list all projects with environments and folders
  • list-secrets — list secret key names, scopes, and types (never values)
  • get-current-project — read project config from relic.toml
  • run-with-secrets — run a command with secrets injected as environment variables

  Secret values are never exposed to the AI. The server inherits Relic's client-side encryption model — list-secrets returns names only, and run-with-secrets returns command output only.

Patch Changes

• Skip redundant keychain write to eliminate second macOS password prompt

Deprecated

This release is deprecated and no longer supported.

Versions before v0.6.7 had packaging/release issues and may not work correctly.
Please use v0.6.7 or newer instead.

Patch Changes

• Fix TUI stdin Buffer crash, cache keychain password to avoid repeated macOS prompts, and resolve web migration issues

Deprecated

This release is deprecated and no longer supported.

Versions before v0.6.7 had packaging/release issues and may not work correctly.
Please use v0.6.7 or newer instead.

Patch Changes

• Fix TUI crash in compiled binary caused by Buffer stdin data and Windows release packaging

Deprecated

This release is deprecated and no longer supported.

Versions before v0.6.7 had packaging/release issues and may not work correctly.
Please use v0.6.7 or newer instead.

Patch Changes

• Enable TUI in compiled binary by patching OpenTUI native lib resolution and bundling libopentui alongside the binary

Deprecated

This release is deprecated and no longer supported.

Versions before v0.6.7 had packaging/release issues and may not work correctly.
Please use v0.6.7 or newer instead.

Patch Changes

• Fix CLI binary compilation to bundle TUI and resolve argon2 native module error