HyperFrames v0.9.30

HyperFrames v0.9.30 changed how the preview server handles requests. It now refuses writes from other sites and requests for host names it doesn't serve. Local use needs no change.

If you open hyperframes preview or the Studio dev server through a tunnel, Codespaces, or a remote dev host, that setup can now get a 403. Name the host in HYPERFRAMES_PREVIEW_ALLOWED_HOSTS (comma separated), for example HYPERFRAMES_PREVIEW_ALLOWED_HOSTS=demo.tunnels.example hyperframes preview.

The release also fixes Studio's history checks holding up the server on large projects. When hyperframes reverse needs you to sign in, the agent now explains why in one message with the link, plus the device code on a remote terminal. The reverse skill also spots an outdated CLI install and runs the latest release instead. The Lambda handler ZIP now installs from a committed lockfile with install scripts off, and the Cloud Run image pins its base image and checks its browser and bun downloads by checksum.