[miguel-heygen]

What

Release v0.9.30: a version bump of all packages and plugin manifests, the changelog entry and releases/v0.9.30.md.

It carries five changes since v0.9.29 and nothing else:

• fix(reverse): give agents the sign-in reason to say, and catch stale CLIs that know reverse #7488: when hyperframes reverse needs a sign-in, the agent says why in one message with the link (and the device code on a remote terminal); the reverse skill spots an outdated CLI install and runs the latest release.
• fix(aws-lambda): the handler ZIP installs its runtime from a committed lockfile with scripts off #7485: the Lambda handler ZIP installs its runtime from a committed lockfile, with install scripts turned off.
• fix(studio-server): history sweeps stop holding the host's event loop on large projects #7491: on large projects, Studio's history checks no longer hold up the server.
• fix(studio-server): refuse cross-origin writes and unknown hosts on the preview server #7490: the preview server refuses writes from other sites and requests for host names it does not serve. Local use needs no change; a tunnel, Codespaces or remote dev host now has to be named in HYPERFRAMES_PREVIEW_ALLOWED_HOSTS, and the notes say so.
• fix(gcp-cloud-run): pin the base image and verify chrome-headless-shell and bun by sha256 #7487: the Cloud Run image pins its base image and checks its browser and bun downloads by checksum.

Why

Ships the Studio history fix that apps pinning Studio are waiting for, and the preview server's write check.

Related work

Follows chore: release v0.9.29 (#7483).

How

bun run release:prepare 0.9.30 on release/v0.9.30 at main; the generated TODO summary and three generated lines were rewritten by hand in both notes files, then the command was rerun to cut the version. The changed file list matches the v0.9.29 release commit. No tag is pushed; the release workflow tags the merge SHA.

No visible change

Version bump and changelog only. Each change was captured in its own PR.

Test plan

• Unit tests added/updated (release commit only, no code)
• Manual testing performed: diff checked to be only version strings plus the two notes files
• Documentation updated: docs/changelog.mdx and releases/v0.9.30.md, summary rewritten by hand
• Comments follow CONTRIBUTING.md "Comments"

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Nov 10, 2026, 11:52 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[heygengenesis]

Requesting changes at 779c7c43. The release is one commit behind main, the same problem as v0.9.29 (#7483).

What checks out: 22 files, same set as v0.9.29. The 20 manifests are bumped 0.9.29 → 0.9.30, and no 0.9.29 version string is left. v0.9.29...779c7c43 is #7490, #7487, #7491 and the release commit, which matches the notes. HYPERFRAMES_PREVIEW_ALLOWED_HOSTS matches PREVIEW_ALLOWED_HOSTS_ENV in studio-server/src/helpers/requestIdentity.ts, and the tunnel/Codespaces upgrade note is clear. Every Actions run on this head is green.

Blocker: #7485 (fix(aws-lambda): the handler ZIP installs its runtime from a committed lockfile with scripts off, f9255e39a) merged to main at 10:41Z. That is before this PR opened (10:53Z), but it is not on release/v0.9.30 (ahead 1, behind 1). The release workflow tags the merge SHA, so merging as is would:

• ship #7485's change to @hyperframes/aws-lambda (new scripts/runtimeLock.ts, runtime-lock/ lockfiles, build-zip.ts, package.json files) as v0.9.30 with no notes entry, while compare/v0.9.29...v0.9.30 still lists it;
• contradict the body's "three changes since v0.9.29 and nothing else";
• leave the Desktop walk PASS covering packed packages built without #7485. packages/aws-lambda/package.json is touched by both the bump and #7485, so the merged manifest is not the one that was walked.

Fix: rebase on current main and rerun bun run release:prepare 0.9.30. Add #7485 under Fixes (AWS Lambda) in both docs/changelog.mdx and releases/v0.9.30.md, add the tag, update the body to four changes, then rerun CI and the Desktop walk on the new head.

The "fails without the fix" rule doesn't apply here: this is a release PR, not a fix PR.

[heygengenesis]

Approving at aa58f6d3. The change request is resolved.

• The branch is re-cut on current main: 1 commit ahead, 0 behind. v0.9.29...aa58f6d3 is #7490, #7487, #7491, #7485 and the release commit.
• #7485 is under Fixes (AWS Lambda) in both docs/changelog.mdx and releases/v0.9.30.md, with the AWS Lambda tag. The body lists four changes.
• The diff is the same 22 files: 20 manifests bumped 0.9.29 → 0.9.30, plus the two notes files. The HYPERFRAMES_PREVIEW_ALLOWED_HOSTS note matches the code.
• Every Actions run on this head is green: CI, CodeQL, Docs, regression, Windows render and Lambda arm64 image.

The app walk PASS on this head is still the merge gate. Check again that the branch is 0 behind main right before merge.

[heygengenesis]

Approving at 5914a742.

• The branch is re-cut on current main: 1 commit ahead, 0 behind. v0.9.29...5914a742 is #7490, #7487, #7491, #7485, #7488 and the release commit.
• Both notes files list all five changes, with #7488 under CLI. The body says five changes. The diff is the same 22 files: 20 manifests bumped 0.9.29 → 0.9.30, plus the two notes files.
• Since aa58f6d3, the only non-release content is #7488 coming in from main.
• Every Actions run on this head is green, including both CI runs.

Nit, not blocking: the changelog tags are now Release, Reverse, AWS Lambda, Studio Server. Gcp Cloud Run dropped out even though #7487 is still listed, and Reverse sits where CLI would match the entry label.

The app walk PASS on this head and 0-behind at merge are still the gates.