CHANGELOG.md

Unreleased

Version 0.8.0 (2026-06-19)

Added

• Cross-platform lockfiles (schema v2). quiver.lock now pins the Nushell runtime version (when the manifest declares a nu-version) and records plugin and nu download artifacts per target triple. At lock time quiver eagerly pins the download URL and asset_sha256 for every platform listed in a release's signed checksums file, so the lockfile is identical no matter which OS runs qv install — a Linux install no longer rewrites what a macOS install produced. Each platform additionally records its own extracted-binary sha256 for local cache-tamper detection. Plugins whose releases lack a multi-platform checksums file fall back to pinning the current platform only.
• qv install --frozen can now install the pinned Nushell version and plugin binaries on a fresh platform using the per-platform artifacts recorded in the lockfile, verifying each download against its pinned, signed asset_sha256.

Changed

• The lockfile schema is now version 2. Existing v1 lockfiles are read transparently and rewritten to v2 on the next qv install; the per-platform security hash for plugins (asset_sha256) remains the verification anchor.

Fixed

• qv install --frozen no longer reuses an already-cached plugin binary without verification when the lockfile has no recorded extracted sha256 for the current platform (e.g. when the lock was generated on a different OS). In that case it now forces a fresh, signed download and verifies it against the pinned asset_sha256, so a cached binary is never trusted blindly. Frozen installs are now strictly verified on every platform.
• On Windows, qv run no longer fails with Access is denied. (os error 5) when the account lacks the symlink-creation privilege. Quiver now creates a hard link for .nu-env/bin/ entries before falling back to a file copy, so the project-local nu binary and plugins are executable without Administrator rights or Developer Mode.
• clone install mode no longer errors with Operation not supported on filesystems without copy-on-write support (ext4 without reflink, overlayfs, tmpfs — common on CI runners). Module materialization now reflinks per file via the reflink-copy crate and transparently falls back to a standard copy, instead of shelling out to cp --reflink=always.

Changed

• Default install_mode now mirrors uv's link modes: clone (copy-on-write) on macOS, and hardlink on Linux and Windows. Previously Linux defaulted to clone, which failed on filesystems without reflink support. Override with install_mode in ~/.config/quiver/config.nuon.

Version 0.7.3 (2026-05-26)

Added

• Dependency fetching and installation now runs in parallel via rayon. Module clones, plugin asset downloads, and module exports all proceed concurrently, significantly reducing install times for projects with multiple dependencies.

Fixed

• qv run now correctly invokes .nu-env/bin/nu instead of falling back to the system nu binary. Previously, the project-local Nushell binary was ignored, meaning scripts could run against the wrong Nushell version.

Version 0.7.2 (2026-05-25)

Added

• Warn users if a dependency requires a nu-version incompatible with the package's nu-version.
• Use the tui-scrollview crate for scrollviews in the TUI. This fixes a few bugs with the previous implementation.

Fixed

• A few more situations where the TUI was getting jumbled with eprintln! commands.

Misc

• Updated dependencies.

Version 0.7.1 (2026-05-12)

Fixed

• TUI was getting messed up with the log since I was using eprintln! instead of UI elements.
• Fixed an issue where it wouldn't warn the user if a nupackage.toml was present.

Version 0.7.0 (2026-05-12)

Added

• Running qv in a non-project directory will open the TUI and offer to create a new quiver project. Previously it just showed the TUI without any helpful information.
• Run qv -g to edit your global quiver dependencies in the TUI.

Changed

• BREAKING: The package manifest is now nupackage.nuon instead of nupackage.toml. The lockfile is also in nuon format. Existing projects must migrate:

  open nupackage.toml | to nuon --indent 2 | save -f nupackage.nuon
  rm nupackage.toml
  rm quiver.lock
  qv install

• BREAKING: The global Quiver config is now config.nuon. Navigate to your global quiver config dir and run the following to migrate:

    open config.toml | to nuon --indent 2 | save -f config.nuon
    rm config.toml
    rm quiver.lock
    qv install -g

• Quiver will warn users with migration instructions when a legacy nupackage.toml or config.toml is detected.
• Updated the Cargo.lock. Among other things, this includes the most recent commits to leaves so Nu syntax highlighting in the TUI is better than ever.

Version 0.6.1 (2026-05-08)

Added

• You can now run commands from within the TUI and the results will be shown in the log at the bottom (previously running a command like adding a dep would close the TUI). The command log is hidden by default, can be toggled with /, and is shown automatically while TUI-triggered commands run.
• The TUI Add flow now lets repository modules and plugins choose how to pin the dependency before adding it: auto-detect, tag, branch, or revision.
• The TUI now supports clickable header tabs for switching between Dependencies, Graph, and Add.

Changed

• TUI README rendering now uses leaves for true Markdown rendering and syntax highlighting for code blocks.
• TUI panes and dialogs now use rounded borders, and dependency detail labels are styled for easier scanning.
• The TUI Add page now gives the repository README preview the main pane instead of splitting it with the built-in plugin list.
• The TUI Add tab now opens built-in plugin selection in a focused dialog via b.
• TUI remove confirmation now accepts Enter to confirm and Esc to cancel.
• TUI mouse movement and button release no longer steal focus; focus changes on click or scroll instead.

Version 0.6.0 (2026-05-05)

Added

• qv now launches a TUI where you can manage dependencies for your Quiver project. It includes a dependency graph, README and info viewer for installed dependencies, and an interactive mode to view dependency README's from github before adding them.
• qv lsp now uses a Ratatui/Crossterm interactive picker, so editor selection works on Windows too.

Fixed

• Release builds now vendor libgit2 through the git2 crate, avoiding failures from missing or stale system libgit2 installations.

Version 0.5.2 (2026-05-01)

Added

• Project-local commands now discover the nearest enclosing nupackage.toml by walking up from the current working directory, so commands like qv run amazing.nu work from subdirectories of a Quiver project.

Fixed

• Improved Windows compatibility for Quiver-managed Nushell binaries by consistently using the platform-specific .nu-env/bin/nu path (nu.exe on Windows) across qvx, generated project env files, plugin registration, and editor LSP configs.
• Global Quiver config and lockfile paths now use the platform config directory on windows and ~/.config on macOS/linux.
• qv lsp now fails clearly on Windows when invoked without explicit editor names, instead of attempting to use the Unix-only interactive picker (hopefully switch to ratatui for this at some point).

Version 0.5.1 (2026-04-22)

Added

• qvx now accepts --nu-version <requirement> and writes that requirement into its ephemeral environment manifest.
• When --nu-version is not supplied, qvx now reads the remote module's nupackage.toml when present and reuses its package.nu-version requirement.

Fixed

• qvx now runs the environment-local .nu-env/bin/nu when Quiver installs or links one, instead of always requiring nu to already be on PATH.

Version 0.5.0 (2026-04-22)

Added

• New qvx command to run remote Nu modules as a tool with an ephemeral env.

Version 0.4.1 (2026-04-21)

Added

• hardlink mode now falls back to copy instead of failing.
• copy operations now fall back to manual streaming copy when std::fs::copy hits PermissionDenied
• CI-oriented overrides:
  • QUIVER_SKIP_NU_INSTALL=1 skips .nu-env/bin/nu creation entirely.
  • QUIVER_NU_BIN=/path/to/nu forces Quiver to use a specific Nushell binary.
• GitHub release lookups now:
  • send Authorization: Bearer ... when GITHUB_TOKEN or GH_TOKEN is present
  • cache release metadata within the process
  • include the response body and X-RateLimit-* headers on HTTP 403s

Version 0.4.0 (2026-03-31)

Added

• Global plugin installation. Global plugins are automatically registered to your default plugin.msgpackz upon installation. They are listed under the [plugins] table in your global config.toml for quiver.

Changed

• Global module dependencies are now listed under a [modules] table in the quiver's global config.toml.

Fixed

• Fixed args for lsp configs. Somehow the previous version worked for Nu <=0.110.

Version 0.3.4 (2026-03-09)

Changed

• Since the standard module project structure is <module-name>/<module-name>, modules are now extracted to .nu-env/modules/<module-name> with the package information going to .nu-env/modules/<module-name>-<version>.dist-info, like in Python. You now only need to type use nu-salesforce * in your script instead of use nu-salesforce/nu-salesforce *.

Version 0.3.3 (2026-03-06)

Added

• Nu plugins are now registered whenever they are installed, whether that is through qv run, qv add-plugin, or qv install. This means you can literally just clone a quiver project and run qv run your-project/amazing_things.nu and it will work, even if you are using Nu plugins.

Fixed

• qv run properly sets the --plugin-config when running nu.
• Some issues with plugins being stale in the lockfile when the nu-version changed in the nupackage.toml.

Changed

• Quiver will always download the version of nu specified for a project, even if that version matches your current global installation in PATH. Why? Because if we symlink to your version in PATH at Nu 0.110.0, and you update to Nu 0.111.0, the symlink in your project's .nu-env/bin/ will now be at 0.111.0 while your project is still at 0.110.0.
• Quiver is now licensed under MIT or Apache 2.0, at your option.

Version 0.3.2 (2026-03-05)

Improved

• The logs generated by quiver are more concise, accurate, and helpful

Version 0.3.1 (2026-03-03)

Highlights

• Added fail-closed checksum verification for downloaded Nushell/plugin release assets.
• Hardened install security by rejecting insecure http:// git sources.
• Reworked archive extraction to avoid shell-based extraction and block unsafe archive entries.
• Improved plugin install reliability (semver tag selection, .tar.xz support, stale lockfile detection fixes).

Added

• qv install --allow-unsigned (explicit insecure override).
• qv install --no-build-fallback (disable plugin source-build fallback).
• [security] require_signed_assets = true config support (default enabled).
• Lockfile metadata for plugin release assets:
  • asset_sha256
  • asset_url

Changed

• --frozen now enforces strict security behavior:
  • signed assets required
  • unsigned override disabled
  • build fallback disabled
• Git cache directory naming now uses SHA-256 of the URL (collision-resistant).
• Cached repo origin is validated to prevent mismatch/reuse of wrong repository.
• Core Nushell plugins with a Nu version are installed directly into the shared plugin installs directory.

Security Hardening

• Reject insecure dependency sources using http:// (manifest and CLI normalization paths).
• Added dependency/plugin/binary name validation to reduce path traversal and unsafe names.
• Checksum source detection supports:
  • SHA256SUMS, SHA256SUMS.txt, checksums.txt
  • <asset>.sha256
• Checksum parsing supports common formats (POSIX, BSD, single-hash lines).
• Archive extraction protections added (including path traversal/symlink safety checks).

Fixed

• Plugin installer now handles .tar.xz release assets.
• “Latest tag” lookup is now semver-aware (fixes lexicographic tag ordering bugs).
• Stale lockfile detection improved for dependency/plugin changes (including plugin bin changes).
• Plugin linking behavior improved for idempotence and target consistency.

Documentation

• README now documents supply-chain security model and CI recommendation:
  • qv install --frozen --no-build-fallback

Version 0.3.0 (2026-03-02)

Added

• Added plugin dependencies via [dependencies.plugins] and qv add-plugin.
• Added support for Nushell core plugins as first-class dependencies (for example qv add-plugin polars).
• Added plugin-aware qv list and qv remove behavior for project dependencies.
• Added qv init --nu-version <requirement> to pin Nushell version requirements at project creation time.
• Added semver enforcement for package.nu-version, including automatic Nushell install from GitHub releases when no matching local binary is available.
• Added plugin post-install guidance (plugin add / plugin use) after dependency installation.
• Added progress bars and colored terminal output for network/download operations.
• Added configurable install_mode in global config (clone, hardlink, copy) for module installation strategy.
• qv init now ensures .nu-env/ is ignored by Git by creating or updating .gitignore.

Changed

• Quiver install artifacts now live under ~/.local/share/quiver/installs/ instead of cache paths.
• Default install mode is now clone on macOS/Linux (with fallback to copy) and hardlink on Windows.
• Environment generation now uses .nu-env/config.nu (plus .nu-env/plugins.msgpackz) and aliases nu with both --config and --plugin-config.
• Core plugin resolution now prefers binaries that match the selected project Nushell install.

Fixed

• Fixed handling for specific Nushell version downloads and project activation wiring.
• Fixed scaffolding output in generated mod.nu comments for current environment behavior.

Internal

• Removed an unused function from config handling.
• Added repository-local agent guidance in AGENTS.md.

Version 0.2.3 (2026-02-25)

Added

• Added qv run to run your nu scripts with the package environment and nu version in .nu-env/bin/.
• Added a virtual nu symlink in the environment bin. This is a step towards managing your version of nu with quiver.
• Added qv lsp to generate project specific profiles for helix and/or zed since we need to pass in env.nu so modules can be discovered by the lsp.

Changed

• Moved Nushell environment artifacts to nu-env/, including the modules/ subdirectory.
• Improved activate.nu to export a definition of nu that loads the env.nu with the $NU_LIB_DIRS properly filled.

Fixed

• Improved activate.nu reliability.

Version 0.2.2 (2026-02-24)

Nuance is now Quiver, with the executable being qv.

Removed

• Removed script dependency installation from quiver.
• Removed add-script / remove-script commands and .nu_scripts activation flow.

Changed

• Simplified install, list, hook, and global config flows to module-only behavior.
• Kept lockfile artifact kind support forward-compatible for future dependency kinds (for example plugins).

Version 0.2.1 (2026-02-23)

Added

• Improved project scaffolding by placing mod.nu in a subdirectory.
• Updated hook and instructions for using modules in the scaffolded mod.nu.

Fixed

• Script removal functionality.
• Capitalization in README.

Version 0.2.0 (2026-02-23)

Added

• Added first-class script dependencies via [dependencies.scripts] with nuance add-script and nuance remove-script.
• Added script installation into .nu_scripts/ from a specific path in a git repo or gist clone URL.
• Added lockfile artifact kinds (module / script) and script path tracking for reproducible frozen installs.

Changed

• Switched module declarations from [dependencies] to [dependencies.modules].
• Updated activate.nu generation and nuance hook output to support both module and script dependency paths.
• Updated module install/activation to detect real module entry paths (including nupm-style nested layouts) by reading nupm.nuon metadata hints and scanning for mod.nu, then generating export use statements with the discovered path (for example nu-salesforce/nu-salesforce).

Version 0.1.1 (2026-02-21)

Added

• Added global module management via --global/-g for nuance install, nuance add, and nuance remove.
• Added generated .nu_modules/activate.nu output from nuance init and nuance install to make project module activation easier.
• Added nuance hook to print a Nushell env-change hook for automatic project activation.
• Added configurable default git provider support for owner/repo shorthand in nuance add via default_git_provider.

Changed

• Updated README install docs to include Homebrew, shell script, and mise installation methods.
• Updated README with badges and general formatting improvements.

Version 0.1.0 (2026-02-20)

Added

• Initial public release.