numan 0.2.2

[0.2.1] - 2026-08-07
Added
- numan update --self: upgrade the numan CLI itself. Standalone installs download the matching GitHub Release asset, verify the Ed25519 signature over SHA256SUMS (SHA256SUMS.sig + baked-in release public key), then check the archive digest and replace the binary. Homebrew / winget / cargo installs print the exact upgrade command instead of self-replacing; --check still queries GitHub Releases to report whether a newer version exists before printing that hint. The Release workflow now hard-fails if NUMAN_RELEASE_SIGNING_KEY is unset so every published release ships SHA256SUMS.sig.
- SECURITY.md: vulnerability reporting, scope, and cross-repo trust summary (linked from the README)
Changed
- numan search / numan info: scripts and completions are labeled install-only (activation deferred) instead of module-style "not ABI-locked" wording; install-only labels still appear when Nu is unknown
- numan try: prefers activatable curated starters (plugin/module), then falls back to Nu-agnostic install-only scripts (SuaveIV/nu_script_wttr, Sanceilaks/nufetch) without calling activate; prints a quoted overlay use path from the installed lockfile entry

[0.2.0] - 2026-08-05
Added
- Homebrew tap packaging restored: brew tap tonythethompson/numan && brew install numan, with Publish to Homebrew tap updating homebrew-numan from release SHA256SUMS (requires HOMEBREW_TAP_TOKEN)
- Side-by-side Nu version management via numan use <version>|latest|list:
- Switches the active managed Nushell install without re-downloading (errors with numan setup nu <version> hint when the requested version isn't installed yet)
- Writes <root>/nu_state/active-version.json so numan use list and downstream activation can resolve the selected Nu
- Acquires the root mutation lock and creates a PreMutation snapshot before any state change, matching install/update/activate/deactivate
- numan setup nu versioned layout: binaries now install under <root>/tools/nushell/<version>/nu instead of the previous single-binary <root>/tools/nushell/nu. Re-installing one version no longer clobbers another. numan doctor reports markers whose on-tree binary is missing.
- Journaled legacy managed-Nu migration from the single-binary layout into the versioned tree, with numan doctor auto-tier reconciliation
- Strict version-path validation (<root>/tools/nushell/<version>/...): rejects components containing /, \\, .., or anything semver won't parse, so numan setup nu ../../path cannot escape $NUMAN_ROOT.
- Shared confirmation utility (src/util/confirm.rs): consistent prompt/auto-confirm behavior across all commands …

[0.1.5] - 2026-07-29
Added
- numan setup nu installs an official managed Nushell release, optionally pinned with --version; --use-existing repairs an off-PATH installation without downloading another copy
- numan setup loader installs the bundled nushell-loader integration
- Compatibility-aware discovery: search hides incompatible packages by default (--all reveals them), info explains version compatibility, and install errors report the actual Nu/platform mismatch
- numan try installs and activates a curated starter compatible with the current Nu and platform, with managed-Nu pin offers when no starter matches
- Doctor findings distinguish PATH and managed Nu versions and report the built-in official trust-root identity
- Install support for .tar.xz / .txz package archives (alongside .zip, .tar.gz/.tgz, and .tar)
- numan completions nushell (alias nu) via clap_complete_nushell, with a vendor-autoload install hint
- Active-plugin mutation gate (Issue #22 PR1): refuse remove/update while a plugin activation record exists; doctor info activation.plugin_mutation_gated (docs/active-plugin-gate.md)
- Journaled plugin deactivate (Issue #22 PR2): numan deactivate unregisters via injectable plugin rm seam, clears PluginActivation without deleting payload; pending journal state/pending-plugin-deactivate.json …