dxs 0.5.9

Tokens and daemon secrets can now be stored as encrypted documents, with random keys held in macOS Keychain, Windows Credential Manager or Linux Secret Service. Existing credentials migrate atomically, and plaintext is removed only after the encrypted copy reads back.

Plaintext file storage remains the default while native-vault support finishes platform validation. To opt back out, even with a locked or unavailable vault, set credential_storage file and sign in again. A process-only memory mode is also available. Native prompts appear only during interactive login and dxs init; help, discovery and telemetry never open the vault.

On Python 3.10, dxs auth login reported success but the next command saw you as signed out. The credential reader rejected the Z suffix on UTC timestamps and silently returned an empty store. Timestamps now round-trip correctly, and CI covers authentication on Python 3.10 through 3.14.

A uv tool install keeps the Python it was installed with, so upgrading system Python never fixes it. dxs doctor checks runtime, installer, PATH, release compatibility and stored credentials, with JSON and offline modes. For uv installs it can rebuild on a newer interpreter, keeping extras, indexes and version constraints, then verifies the result in a fresh process.

dxs update and the update check now honor the release's Requires-Python, and an incompatible interpreter gets an actionable error instead of a traceback. The minimum stays Python 3.10. Other installers get manual repair guidance.

Every invocation used to import every command family, including authentication, HTML parsing and report rendering. Commands now load only when selected; help and shell completion read lightweight metadata. Median startup reductions measured in CI:

Percent reduction in median wall time versus the previous release, 30 runs per case. The local JSON case is report schema.

Both generate and generate-flow now resolve explicit dotted paths into nested filter trees, including paths through collections. Paths outside the selected shape resolve from OData metadata without changing the query; flow paths resolve from the declared type tree.

Auto-population stays scalar-only unless you add --include-collection-filters. Unresolved paths, reserved quantifier markers, incompatible filter contracts and sorts across a collection boundary are now rejected before any file is written.

Generated datasources could omit totalCount, custom columns or linked fields from outParams, which the platform then rejected. Generation and validate now share one set of output rules and finalize after enhancements and linked metadata. Missing or incompatible linked metadata stops generation before writing. Report-owned bindings carry the complete contract.

Attach detailed notes to a commit with --release-notes TEXT or --release-notes-file PATH. The text is sent exactly as written and previewed during dry runs. History readers expose it as commitReleaseNotes, and YAML output preserves Markdown whitespace and line endings. Omitting the option leaves commit and cascade behavior unchanged.

The command called an endpoint that does not exist and refused inactive versions. It now verifies the component, destination definition, organization and version, then activates through the supported route. A 403 explains the per-user HasDeployAccess grant you need.

--definition-id is now required. --force skips only the confirmation prompt, never the target checks.

The platform removed createFeatureBranch. dxs source branch create and dxs cascade run now use the shared featureBranch route with the same payloads and returned branch IDs. This requires the updated platform API; there is no legacy fallback.

Discovery walked into junctions such as Application Data and My Documents, producing access-denied errors and exit status 1 even after every skill was repaired. Junctions are now skipped during scans, but still inspected when you pass one explicitly as a scan root.

The CLI security white paper for Entra administrators reviewing dxs was updated October 12 for opt-in credential storage. It is available from Datex on request.

Quartermaster deployment and monitoring work, plus maintainer tooling. Nothing in the dxs package changes, and product telemetry collection is unchanged.