2698 lines
66 KiB
Markdown
2698 lines
66 KiB
Markdown
# Changelog - MCP Server
|
|
|
|
All notable changes to the Nextcloud MCP Server will be documented in this file.
|
|
|
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
and this project adheres to [PEP 440](https://peps.python.org/pep-0440/).
|
|
|
|
## v0.121.1 (2026-06-18)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.28,<1.29
|
|
|
|
## v0.121.0 (2026-06-18)
|
|
|
|
### Feat
|
|
|
|
- **ingest**: split OCR into tier2 in-cluster (GPU, gateway-only) + tier3 upstream
|
|
|
|
### Fix
|
|
|
|
- **ingest**: warn when provider=none disables in-cluster; precise model fallback
|
|
- **ingest**: suppress misleading batch-fallback warn for in-cluster rung
|
|
|
|
### Refactor
|
|
|
|
- **ingest**: doc legacy ocr queue; fix docstrings + getattr guard
|
|
|
|
## v0.120.5 (2026-06-17)
|
|
|
|
### Fix
|
|
|
|
- **auth**: clarify empty-allowlist startup warning when userinfo is configured
|
|
- **auth**: quiet per-validation userinfo TTL log; test introspection-timeout fall-through
|
|
- **auth**: document introspection-error fall-through, drop misleading userinfo metric
|
|
- **auth**: quiet cache-hit userinfo log, test real-exp userinfo path
|
|
- **auth**: harden userinfo fallback (anti-forgery, SSRF guard, unconfigured-introspection)
|
|
- **auth**: tighten userinfo-token cache TTL and metric labelling
|
|
- **auth**: validate opaque access tokens via userinfo fallback
|
|
|
|
## v0.120.4 (2026-06-17)
|
|
|
|
### Fix
|
|
|
|
- **vector**: guard dead-letter on etag, harden marker filter
|
|
- **vector**: clear dead-letter marker on delete, treat oversize as terminal
|
|
- **vector**: dead-letter terminally-failed documents to stop multi-user re-queue loop
|
|
|
|
## v0.120.3 (2026-06-16)
|
|
|
|
### Fix
|
|
|
|
- **document-processors**: make glyph-corruption ratio of 0 disable the signal
|
|
- **document-processors**: inline/external parity when structured tier is absent
|
|
- **document-processors**: correct cascade escalation metric + review nits
|
|
- **document-processors**: escalate glyph-corrupt PDFs to the structured tier
|
|
|
|
## v0.120.2 (2026-06-16)
|
|
|
|
### Refactor
|
|
|
|
- **auth**: drop built-in well-known MCP client list
|
|
|
|
## v0.120.1 (2026-06-16)
|
|
|
|
### Fix
|
|
|
|
- **vector**: propagate cancel in cleanup task; cover 403 + sweep-failure
|
|
- **vector**: self-heal stale app passwords on auth failure
|
|
|
|
## v0.120.0 (2026-06-16)
|
|
|
|
### Feat
|
|
|
|
- **vector-sync**: honor Astrolabe admin consent for searchable sources
|
|
|
|
### Fix
|
|
|
|
- **vector-sync**: address round-7 — only log purge endpoint when enabled
|
|
- **vector-sync**: address round-6 review — rename shadowed var, add test
|
|
- **vector-sync**: address round-5 review — partial-failure signal, markers
|
|
- **vector-sync**: address round-4 review — processor test, partial eviction
|
|
- **vector-sync**: address round-3 review — gate purge route, bound set, nits
|
|
- **vector-sync**: address round-2 review — one-shot backstop, helper, caps
|
|
- **vector-sync**: address PR review — dict guard, symmetric backstop, metrics
|
|
|
|
### Refactor
|
|
|
|
- **scanner**: _should_scan helper to cut scan_user_documents complexity
|
|
- **scanner**: cut backstop cognitive complexity (SonarQube S3776)
|
|
- **vector-sync**: dedupe "Bad request" 400s via a helper (SonarCloud S1192)
|
|
|
|
## v0.119.0 (2026-06-15)
|
|
|
|
### Feat
|
|
|
|
- **ocr**: opt-in batch OCR mode via the gateway's async batch routes
|
|
|
|
### Fix
|
|
|
|
- **ocr**: round-5 review nits — empty-pages failure, comments, test cleanup
|
|
- **ocr**: round-4 review — defensive poll + drop dead tracking columns
|
|
- **ocr**: round-3 review — guard unexpected batch status + tests/comments
|
|
- **ocr**: round-2 review — lazy store lock, mode enum normalization, type hints
|
|
- **ocr**: wire batch settings into _field_map + review nits
|
|
|
|
## v0.118.0 (2026-06-15)
|
|
|
|
### Feat
|
|
|
|
- **calendar**: list external read-only (subscribed) calendars
|
|
|
|
## v0.117.2 (2026-06-14)
|
|
|
|
### Fix
|
|
|
|
- **security**: enforce WEBHOOK_SECRET min length + address round-2 review
|
|
- **security**: require WEBHOOK_SECRET for the Nextcloud webhook receiver
|
|
|
|
## v0.117.1 (2026-06-14)
|
|
|
|
### Refactor
|
|
|
|
- **auth**: drop remaining stale token-exchange references
|
|
- **auth**: remove vestigial token-exchange code path
|
|
|
|
## v0.117.0 (2026-06-13)
|
|
|
|
### Feat
|
|
|
|
- **ingest**: record suppressed OCR escalations (what-if-OCR signal)
|
|
|
|
### Fix
|
|
|
|
- **ingest**: address review round 2 (Literal reason + exhaustive branch + test)
|
|
- **ingest**: address review round 1 (Literal kind + log tidy)
|
|
|
|
### Refactor
|
|
|
|
- **ingest**: rename ignore_enabled→ignore_ocr_enabled + empty/structured test
|
|
|
|
## v0.116.0 (2026-06-13)
|
|
|
|
### Feat
|
|
|
|
- **ingest**: per-tier escalation via procrastinate queue-hop
|
|
|
|
### Fix
|
|
|
|
- **ingest**: stagger stalled-job reclaim to avoid thundering herd (round 5)
|
|
- **ingest**: zero queue-depth gauge on all-queues-drained (review round 4)
|
|
- **ingest**: address review round 3 + SonarCloud reliability gate
|
|
- **ingest**: address review round 2 (stale gauge + hygiene)
|
|
- **ingest**: address review round 1 (reclaim queue + tests)
|
|
|
|
## v0.115.1 (2026-06-13)
|
|
|
|
### Fix
|
|
|
|
- **classifier**: make image coverage diagnostic-only, not an OCR routing trigger
|
|
|
|
### Refactor
|
|
|
|
- **classifier**: rename IMAGE_COVERAGE_SCANNED → IMAGE_HEAVY_THRESHOLD
|
|
|
|
## v0.115.0 (2026-06-12)
|
|
|
|
### Feat
|
|
|
|
- **vector-sync**: scan provisioned users immediately
|
|
|
|
### Refactor
|
|
|
|
- **vector-sync**: clear SonarCloud gate + round-2 nits
|
|
- **vector-sync**: address round-1 review nits
|
|
|
|
## v0.114.0 (2026-06-11)
|
|
|
|
### Feat
|
|
|
|
- **auth**: advertise offline_access in discovered OAuth scopes
|
|
|
|
## v0.113.1 (2026-06-11)
|
|
|
|
### Fix
|
|
|
|
- **vector**: don't inflate qdrant-error metric on embed drops (#893 r3)
|
|
- **vector**: nested-group drop classification + review/Sonar fixes (#893)
|
|
- **vector**: retry transient embed errors so a pod rollover drops 0 docs
|
|
|
|
## v0.113.0 (2026-06-11)
|
|
|
|
### Feat
|
|
|
|
- **document**: configurable OCR timeout and fail-fast PDF size guard
|
|
|
|
### Fix
|
|
|
|
- **document**: catch httpx timeout from gateway OCR backend (#892 r3)
|
|
- **document**: timeout reason bucket + Sonar https hotspot (#892 round 2)
|
|
- **document**: apply OCR timeout to Mistral backend + review/Sonar fixes (#892)
|
|
- **vector**: guard unbound doc_task + address review nits (#891)
|
|
- **vector**: URL-encode DAV paths and unwrap TaskGroup exceptions
|
|
|
|
## v0.112.0 (2026-06-11)
|
|
|
|
### Feat
|
|
|
|
- **worker**: structured logs + metrics + traces for ingest worker
|
|
|
|
### Fix
|
|
|
|
- **worker**: clear Sonar S5332 hotspot + address review nits
|
|
|
|
### Refactor
|
|
|
|
- **worker**: trim observability helper docstring; clarify test fake
|
|
|
|
## v0.111.0 (2026-06-10)
|
|
|
|
### Feat
|
|
|
|
- **deck**: surface remapped labels in move-card response
|
|
- **deck**: add deck_move_card_to_board tool for cross-board moves
|
|
|
|
### Fix
|
|
|
|
- **deck**: make done-restore best-effort on move; cover combined states
|
|
- **deck**: preserve done/archived and validate target board on move
|
|
|
|
## v0.110.2 (2026-06-10)
|
|
|
|
### Fix
|
|
|
|
- convert astrolabe int provisioned_at to ISO before ProvisioningStatus
|
|
- **ci**: gate can-i-deploy broker steps individually, not at job level
|
|
|
|
## v0.110.1 (2026-06-10)
|
|
|
|
### Fix
|
|
|
|
- **app**: port-aware MCP URL fallback + clear readiness cache per lifespan (round 4)
|
|
- **app**: cancel readiness loop on lifespan shutdown (review round 2)
|
|
- **config**: correct OIDC token-type/scopes env keys; address review round 1
|
|
- **health**: non-gating readiness probe; shared-task-group lifespan; settings migration
|
|
|
|
### Refactor
|
|
|
|
- **app**: cancel only the readiness loop at shutdown (review round 3)
|
|
|
|
## v0.110.0 (2026-06-08)
|
|
|
|
### Feat
|
|
|
|
- **metering**: pages_embedded = real parsed page count
|
|
|
|
### Refactor
|
|
|
|
- **metering**: harden page_count guard per review
|
|
|
|
## v0.109.1 (2026-06-08)
|
|
|
|
### Fix
|
|
|
|
- **documents**: guard Unix-only resource import for Windows (#877)
|
|
|
|
### Refactor
|
|
|
|
- **documents**: fully decouple document stack from server startup; Windows-safe tests
|
|
|
|
## v0.109.0 (2026-06-08)
|
|
|
|
### Feat
|
|
|
|
- **usage**: rename metrics → tokens_embedded/pages_embedded + export token cost to Prometheus
|
|
- **usage**: meter embedding tokens as embeddings_queries on both paths
|
|
|
|
### Fix
|
|
|
|
- **usage**: drop redundant GatewayProvider.embed_batch override (round 3)
|
|
- **usage**: embed query once across doc_types; address review round 1
|
|
|
|
### Refactor
|
|
|
|
- **search**: structural per-instance query side-channel; doc search billing gap
|
|
- **usage**: extract indexing metering helper; address review round 2
|
|
|
|
## v0.108.3 (2026-06-08)
|
|
|
|
### Fix
|
|
|
|
- **contacts**: address PR #876 round-2 nits
|
|
- **contacts**: address PR #876 round-1 review
|
|
- **contacts**: resolve real CardDAV object path for delete/update (fixes #874)
|
|
|
|
## v0.108.2 (2026-06-07)
|
|
|
|
### Fix
|
|
|
|
- **vector**: address PR #873 round-2 review
|
|
- **vector**: gate scanner app polls on per-user enabled apps
|
|
|
|
## v0.108.1 (2026-06-07)
|
|
|
|
### Fix
|
|
|
|
- **deck**: include archived cards in list tools for status=all/archived
|
|
|
|
### Refactor
|
|
|
|
- **deck**: address PR #872 round-1 review
|
|
|
|
## v0.108.0 (2026-06-07)
|
|
|
|
### Feat
|
|
|
|
- **usage**: record per-tenant usage events into the app DB
|
|
|
|
### Refactor
|
|
|
|
- **usage**: final round-6 nits on PR #871
|
|
- **usage**: close out round-5 nits on PR #871
|
|
- **usage**: address round-4 review on PR #871
|
|
- **usage**: address round-3 review on PR #871
|
|
- **usage**: address round-2 review on PR #871
|
|
- **usage**: address round-1 review on PR #871
|
|
|
|
## v0.107.0 (2026-06-06)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- PDFs are re-chunked page-aware by default. Existing
|
|
deployments will re-index PDF content on the next vector sync (different
|
|
chunk counts and page_number labels). Set DOCUMENT_CHUNK_PAGE_AWARE=false
|
|
to retain the previous char-based behaviour.
|
|
|
|
### Feat
|
|
|
|
- **vector**: page-aware PDF chunking for predictable per-page retrieval
|
|
|
|
### Fix
|
|
|
|
- **vector**: skip page-assignment span/warning on empty boundaries
|
|
- **vector**: route empty page_boundaries to char-based path; test ws offsets
|
|
|
|
## v0.106.0 (2026-06-06)
|
|
|
|
### Feat
|
|
|
|
- **vector**: index files in real time on vector-index tag changes
|
|
|
|
## v0.105.0 (2026-06-05)
|
|
|
|
### Feat
|
|
|
|
- quality + scan OCR escalation trigger (junk-text-layer scans)
|
|
|
|
### Fix
|
|
|
|
- **review**: unify "scanned" flag name + log image_coverage length drift
|
|
- **review**: align classify_pdf routing with the hot path + scan-tail test
|
|
- **review**: align quality threshold, cap + DRY scan coverage, warn on failure
|
|
|
|
## v0.104.1 (2026-06-05)
|
|
|
|
### Fix
|
|
|
|
- close pypdfium2 page handle on error + cover classifier/OCR edge cases
|
|
|
|
## v0.104.0 (2026-06-05)
|
|
|
|
### Feat
|
|
|
|
- tier-3 OCR processor (gateway or direct Mistral)
|
|
- tiered PDF processor with pypdfium2 fast path (deprecate pymupdf4llm)
|
|
|
|
### Fix
|
|
|
|
- **review**: _enum_fields validation, gate classify_from_text flags, OCR warnings
|
|
- **review**: lock OCR backend init, warn on rollback fallthrough, zero-page metric
|
|
- **review**: cache OCR backend, drop asserts, real pipeline_tier, guard zero-page
|
|
- OCR escalation falls back to tier-1 result when OCR can't run
|
|
|
|
## v0.103.0 (2026-06-04)
|
|
|
|
### Feat
|
|
|
|
- use Nextcloud filename for indexed file title + reconcile on rename
|
|
|
|
### Fix
|
|
|
|
- **review**: guard placeholder in scanner reconcile + test dual-write path
|
|
|
|
## v0.102.0 (2026-06-04)
|
|
|
|
### Feat
|
|
|
|
- tier-0 document classifier in shadow mode
|
|
|
|
### Fix
|
|
|
|
- **review**: warn (not debug) on shadow-classify failure; tidy pymupdf usage
|
|
- **review**: sample last page, document flags-vs-routing, add flag-path tests
|
|
|
|
## v0.101.4 (2026-06-04)
|
|
|
|
### Fix
|
|
|
|
- lower DOCUMENT_PDF_GRAPHICS_LIMIT default 5000 -> 1000
|
|
|
|
## v0.101.3 (2026-06-04)
|
|
|
|
### Fix
|
|
|
|
- **tests**: moderate re-scan interval to stop multi-user index churn
|
|
- **tests**: fast vector-sync cadence for multi-user-basic CI service
|
|
- **tests**: repair multi-user-basic Astrolabe integration suite
|
|
|
|
## v0.101.2 (2026-06-04)
|
|
|
|
### Fix
|
|
|
|
- **review**: type timeout as float; document worker reuse + identity check
|
|
- **review**: require graphics_limit>=1, type _index_document, cover rlimit branch
|
|
- **review**: close doc via try/finally; don't count parse failures as indexed
|
|
- isolate PDF parse in a subprocess so a bad file can't OOM the pod
|
|
|
|
## v0.101.1 (2026-06-04)
|
|
|
|
### Fix
|
|
|
|
- resolve startup NameError in vector-sync metrics task
|
|
|
|
## v0.101.0 (2026-06-04)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- /api/v1/vector-sync/status field `indexed_documents` now holds
|
|
the distinct-document count (was the chunk count); the chunk count moved to the
|
|
new `indexed_chunks` field. The Astrolabe UI + the nc_get_vector_sync_status MCP
|
|
tool / userinfo page are harmonized in a follow-up (Deck #195).
|
|
|
|
### Feat
|
|
|
|
- harmonize MCP tool + userinfo page to documents/chunks model
|
|
- backend-agnostic vector-sync gauges (pending/documents/chunks)
|
|
|
|
### Fix
|
|
|
|
- add metrics-interval validator + type/test gaps (review #850)
|
|
|
|
## v0.100.0 (2026-06-04)
|
|
|
|
### Feat
|
|
|
|
- add IngestTransport port for local/distributed ingest backends
|
|
|
|
### Refactor
|
|
|
|
- address PR #851 review round 5 (ingest transport)
|
|
- address PR #851 review round 4 (ingest transport)
|
|
- address PR #851 review round 3 (ingest transport)
|
|
- address PR #851 review round 2 (ingest transport)
|
|
- address PR #851 review round 1 (ingest transport)
|
|
|
|
## v0.99.0 (2026-06-04)
|
|
|
|
### Feat
|
|
|
|
- dedup shared-file parsing/embedding across users in vector sync
|
|
|
|
### Fix
|
|
|
|
- only merge prior acl_principals for files (review #848)
|
|
- **webdav**: harden offset/key truthiness and escape SEARCH mime type
|
|
- **webdav**: await fallback, guard dedup key, split paging for complexity
|
|
- paginate tagged-folder SEARCH so the scanner discovers all files
|
|
|
|
## v0.98.1 (2026-06-04)
|
|
|
|
### Fix
|
|
|
|
- make procrastinate ingest queue opt-in (default to in-process anyio)
|
|
|
|
## v0.98.0 (2026-06-03)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- the external-NATS-ingest env vars are removed
|
|
(INGEST_MODE, STATUS_BACKEND, INGEST_BUS_URL, INGEST_BUS_NUM_REPLICAS,
|
|
FACT_EVENT_EMITTER). Use INGEST_QUEUE (memory|postgres) and the `worker`
|
|
command instead. TENANT_ID is retained (no longer NATS-subject-charset-validated).
|
|
|
|
### Feat
|
|
|
|
- replace NATS ingest with procrastinate Postgres queue (#183)
|
|
|
|
### Fix
|
|
|
|
- initialize document processors in the ingest worker (PR #836 round-5)
|
|
- address PR #836 round-3 review (lock-key invariant, single open)
|
|
- address PR #836 round-2 review (connect/timeout/observability)
|
|
- address PR #836 review — forward task_producer to MCP contexts + cleanups
|
|
- **ci**: install procrastinate in the dev group so ty + unit tests resolve it
|
|
|
|
## v0.97.0 (2026-06-03)
|
|
|
|
### Feat
|
|
|
|
- **search**: support multiple folders in the semantic-search path filter
|
|
|
|
### Fix
|
|
|
|
- **search**: cap path_prefixes server-side; unify Iterable typing
|
|
- **search**: cap path_prefixes at the MCP tool; widen path filter tests
|
|
- **search**: address review feedback on multi-folder path filter
|
|
|
|
## v0.96.0 (2026-06-03)
|
|
|
|
### Feat
|
|
|
|
- **observability**: astrolabe_* metrics + traces for the document pipeline
|
|
|
|
### Fix
|
|
|
|
- **observability**: address third review round
|
|
- **observability**: address second review round
|
|
- **observability**: address PR review + SonarCloud findings
|
|
|
|
## v0.95.0 (2026-06-03)
|
|
|
|
### Feat
|
|
|
|
- add Claude Desktop extension (.mcpb) for single-user stdio mode
|
|
|
|
### Fix
|
|
|
|
- **mcpb**: add Windows support via platform_overrides and run.cmd
|
|
- **mcpb**: address review feedback on manifest and run.sh
|
|
|
|
## v0.94.1 (2026-06-03)
|
|
|
|
### Fix
|
|
|
|
- **search**: address PR #834 re-review (403/404 coverage + docs)
|
|
- **search**: address PR #834 review findings
|
|
- **search**: gate verify-on-read file results on vector-index tag membership
|
|
|
|
### Perf
|
|
|
|
- **search**: skip exclusion lookup on empty tag set; fix semaphore comment
|
|
|
|
## v0.94.0 (2026-06-02)
|
|
|
|
### Feat
|
|
|
|
- **search**: ADR-027 Phase 2 — file-path filter
|
|
- **search**: ADR-027 Phase 1 — modified-date range filter
|
|
|
|
## v0.93.0 (2026-06-01)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- deck list tools now default to detail="summary" and
|
|
status="open". The include_archived_cards parameter is replaced by status
|
|
(use status="all" to include archived cards); pass detail="full" to restore
|
|
the previous per-card shape.
|
|
|
|
### Feat
|
|
|
|
- **deck**: compact card/comment retrieval (summaries, filters, board overview)
|
|
|
|
### Refactor
|
|
|
|
- **deck**: address PR #826 review feedback
|
|
|
|
## v0.92.1 (2026-06-01)
|
|
|
|
### Fix
|
|
|
|
- **embedding**: normalize gateway base_url to the /v1 base path
|
|
|
|
## v0.92.0 (2026-06-01)
|
|
|
|
### Feat
|
|
|
|
- **embedding**: gateway provider discovers dimension via GET /v1/models
|
|
|
|
## v0.91.3 (2026-06-01)
|
|
|
|
### Fix
|
|
|
|
- **api**: distinguish Nextcloud 5xx from auth failure; tighten body parse (#824)
|
|
- **api**: block cross-user delete and address review feedback (#824)
|
|
- **api**: return 401 not 500 on failed app-password OCS validation (#824)
|
|
|
|
## v0.91.2 (2026-05-31)
|
|
|
|
### Fix
|
|
|
|
- **auth**: authenticate stored app passwords with loginName, not UID
|
|
|
|
## v0.91.1 (2026-05-31)
|
|
|
|
### Fix
|
|
|
|
- **vector**: make NATS status subscriber resilient at startup
|
|
|
|
## v0.91.0 (2026-05-31)
|
|
|
|
### Feat
|
|
|
|
- add opt-in MCP decomposition hook points (design §10)
|
|
|
|
### Fix
|
|
|
|
- stop S7632 flagging NOSONAR mentioned in prose comments
|
|
- well-form NOSONAR suppressions (SonarCloud S7632/S7503)
|
|
- address PR #814 reviewer follow-ups
|
|
- address PR #814 review + SonarCloud gate
|
|
|
|
## v0.90.2 (2026-05-30)
|
|
|
|
### Fix
|
|
|
|
- **vector-sync**: isolate per-app scans so a disabled Notes app can't abort sync
|
|
|
|
## v0.90.1 (2026-05-30)
|
|
|
|
### Fix
|
|
|
|
- **api**: validate app password against Nextcloud using loginName, not UID
|
|
|
|
## v0.90.0 (2026-05-29)
|
|
|
|
### Feat
|
|
|
|
- **search**: ACL-aware vector filter via Nextcloud Shares lookup
|
|
|
|
### Fix
|
|
|
|
- PR #813 review — cap unified_search multi-type pool; document deck self-only
|
|
- cache app-password storage to avoid per-request Alembic upgrade race
|
|
- PR #813 review — shared-file context in MCP tool path + viz over-fetch cap
|
|
- address PR #813 review round 4 (log leak, cross-user chunk ctx, algo, overlap)
|
|
- address PR #813 latest review (ACL-aware doc-type discovery, robustness)
|
|
- address PR #813 review (owner_id index, cache bound, explicit param)
|
|
- **search**: address PR #813 review (viz verify-on-read, owners cache, docs)
|
|
- **auth**: make provision/revoke consistent with the app-password store
|
|
- **auth**: login-flow provisioning — public login_url + session app passwords
|
|
- **search**: verify shared files by global file id (ACL-aware)
|
|
|
|
## v0.89.0 (2026-05-24)
|
|
|
|
### Feat
|
|
|
|
- **api**: log inbound User-Agent on management API and webhook receiver
|
|
- **webhooks**: add Deck card sync preset with vector indexing
|
|
|
|
## v0.88.3 (2026-05-22)
|
|
|
|
### Fix
|
|
|
|
- **vector-sync**: use resolved collection name in orphan sweep
|
|
- **vector-sync**: sweep placeholder orphans at Pod startup (#101)
|
|
|
|
## v0.88.2 (2026-05-21)
|
|
|
|
### Fix
|
|
|
|
- **contacts**: surface ORG/TITLE/NOTE/URL/CATEGORIES/PHOTO on read (refs #716)
|
|
|
|
## v0.88.1 (2026-05-20)
|
|
|
|
### Fix
|
|
|
|
- **contacts**: warn on unsupported dict/list email/tel update inputs
|
|
- **contacts**: two PR #719 review bugs
|
|
- **contacts**: close PR #719 second-pass review gaps
|
|
- **contacts**: persist all documented fields on create (fixes #716)
|
|
|
|
### Refactor
|
|
|
|
- **contacts**: address PR #719 follow-up review
|
|
|
|
## v0.88.0 (2026-05-20)
|
|
|
|
### Feat
|
|
|
|
- **ci**: build arm64 Docker images natively on ubuntu-24.04-arm
|
|
|
|
## v0.87.2 (2026-05-17)
|
|
|
|
### Fix
|
|
|
|
- **embedding**: instantiate BM25 singleton off the event loop
|
|
|
|
## v0.87.1 (2026-05-17)
|
|
|
|
### Fix
|
|
|
|
- **storage**: address review on PR #799 (stale comments, docs deprecation, unit test)
|
|
- **storage**: use NullPool for Postgres engine (cross-loop crashes under anyio TaskGroup)
|
|
|
|
## v0.87.0 (2026-05-17)
|
|
|
|
### Feat
|
|
|
|
- **storage**: pluggable database backend via DATABASE_URL (ADR-026)
|
|
|
|
### Fix
|
|
|
|
- **storage**: address PR #798 round-4 review (NOSONAR syntax + pg_advisory_lock + engine dispose + nits)
|
|
- **storage**: address PR #798 round-3 review (SonarQube + pool sizing + RETURNING test)
|
|
- **storage**: address PR #798 review feedback (credentials, asyncpg extra, TLS, pool)
|
|
|
|
## v0.86.4 (2026-05-16)
|
|
|
|
### Fix
|
|
|
|
- **config**: emit background-ops advisory logs once per process
|
|
|
|
## v0.86.3 (2026-05-12)
|
|
|
|
### Refactor
|
|
|
|
- convert f-string logging to lazy %-style format (G004)
|
|
|
|
## v0.86.2 (2026-05-12)
|
|
|
|
### Refactor
|
|
|
|
- drop OAuth-refresh background-sync path from oauth_sync.py
|
|
|
|
## v0.86.1 (2026-05-12)
|
|
|
|
### Refactor
|
|
|
|
- prune dead pre-LOGIN_FLOW config/runtime branches
|
|
|
|
## v0.86.0 (2026-05-12)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- ENABLE_MULTI_USER_BASIC_AUTH is no longer read from
|
|
the environment, and setting it now raises a startup ValueError with
|
|
a migration message. Replace `ENABLE_MULTI_USER_BASIC_AUTH=true` with
|
|
`MCP_DEPLOYMENT_MODE=multi_user_basic`. The same loud-deprecation
|
|
check is also applied to the recently-removed ENABLE_LOGIN_FLOW —
|
|
replace with `MCP_DEPLOYMENT_MODE=login_flow` (or drop both;
|
|
`login_flow` is the auto-detect default when no other auth env vars
|
|
are set).
|
|
- `ENABLE_LOGIN_FLOW` is no longer read from the
|
|
environment. Anyone who relied on `ENABLE_LOGIN_FLOW=true` to activate
|
|
Login Flow v2 should set `MCP_DEPLOYMENT_MODE=login_flow` instead (or
|
|
rely on it being the default when no other auth env vars are set).
|
|
- MCP_DEPLOYMENT_MODE=oauth_single_audience is no longer
|
|
accepted. Set MCP_DEPLOYMENT_MODE=login_flow (and keep
|
|
ENABLE_LOGIN_FLOW=true) for the same deployment. The un-augmented
|
|
OAuth path is no longer supported; if you previously ran the broken
|
|
path, you can either configure Login Flow v2 (recommended) or switch
|
|
to multi_user_basic / single_user_basic.
|
|
|
|
### Fix
|
|
|
|
- **config**: derive mode flags in Settings.__post_init__; address review round 2
|
|
|
|
### Refactor
|
|
|
|
- **config**: drop ENABLE_MULTI_USER_BASIC_AUTH env var, fail loud on legacy aliases
|
|
- **config**: derive enable_login_flow from mode, remove ENABLE_LOGIN_FLOW env var
|
|
- **config**: rename OAUTH_SINGLE_AUDIENCE to LOGIN_FLOW, gate on ENABLE_LOGIN_FLOW
|
|
|
|
## v0.85.1 (2026-05-11)
|
|
|
|
### Fix
|
|
|
|
- **calendar**: preserve floating/TZID semantics across CalDAV roundtrip (#782)
|
|
|
|
## v0.85.0 (2026-05-10)
|
|
|
|
### Feat
|
|
|
|
- **deck**: add file/note attachment MCP tools
|
|
|
|
### Fix
|
|
|
|
- **deck**: address review — notesPath key, scopes, modernize types
|
|
|
|
## v0.84.2 (2026-05-10)
|
|
|
|
### Fix
|
|
|
|
- **health**: forward api-key to Qdrant /readyz so Cloud probes work
|
|
|
|
## v0.84.1 (2026-05-10)
|
|
|
|
### Fix
|
|
|
|
- **vector**: address PR review round 17 + local-mode collection-creation regression
|
|
- **vector**: address PR review round 16 — type-aware index check, comments
|
|
- **vector**: address PR review round 15 — concurrency, pagination, stale coercion
|
|
- **vector**: address PR review round 14 — accurate offset-skip comment + news_item doc_id guard
|
|
- **vector**: address PR review round 13 — index offset fields + tighten test
|
|
- **vector**: address PR review round 12 — bool guard + strict doc_id validation
|
|
- **vector**: address PR review round 11 — broaden offset-skip gate, clarify ordering
|
|
- **vector**: address PR review round 10 — index chunk_index, harden index loop, lazy-init lock
|
|
- **api**: validate doc_id at chunk-context handler boundary
|
|
- **vector**: address PR review round 9 — drop redundant guard, add init lock, test float doc_id path
|
|
- **vector**: guard _group_int_doc_ids against non-int doc_id values
|
|
- **vector**: tighten get_chunk_bbox_and_page_from_qdrant doc_id to str
|
|
- **login-flow**: allow Astrolabe's OAuth client on the management API
|
|
- **vector**: address PR review round 8 — anyio convention + cosine-safe sentinel + dedup get_collection
|
|
- **vector**: add BOOL index for is_placeholder + correct wait=True docstring
|
|
- **vector**: address PR review round 6 + SonarCloud findings
|
|
- **vector**: address PR review round 5 — progress logging, summary visibility, sentinel split
|
|
- **vector**: address PR review round 4 — backfill resilience + degraded-mode docs
|
|
- **vector**: address PR review round 3 — sentinel guard, skip indexed fields, narrow types
|
|
- **vector**: address PR review round 2 — status branching, doc_id guard, doc restore
|
|
- **vector**: address PR review — wait=True backfill, batched writes, search helper
|
|
- **vector**: normalize doc_id to str + add Qdrant keyword payload indexes
|
|
|
|
## v0.84.0 (2026-05-10)
|
|
|
|
### Feat
|
|
|
|
- **contacts**: add nc_contacts_search_contacts free-text search tool
|
|
|
|
## v0.83.4 (2026-05-10)
|
|
|
|
### Fix
|
|
|
|
- **qdrant**: use get_collection for startup probe (multi-tenant safe, take 2)
|
|
|
|
## v0.83.3 (2026-05-10)
|
|
|
|
### Fix
|
|
|
|
- **qdrant**: use collection_exists for startup probe (multi-tenant safe)
|
|
|
|
## v0.83.2 (2026-05-09)
|
|
|
|
### Fix
|
|
|
|
- **chunk-context**: address PR #767 review — extract bbox helper, fix page_number overwrite
|
|
- **chunk-context**: address PR #767 review — drop dead PDF branch, redundant alias, add boundary tests
|
|
- **chunk-context**: address PR #767 round-3 review — gate readability + legacy-fallback comment
|
|
- **chunk-context**: propagate chunk_index=None through ChunkContext
|
|
- **chunk-context**: address PR #767 round-2 review — gate, parity, doc
|
|
- **chunk-context**: address PR #767 review — doc_type filter parity + tests
|
|
- **viz_routes**: address PR #767 review — param parity + always-on page_number
|
|
- **viz_routes**: validate chunk_index/total_chunks bounds in OAuth route
|
|
- **chunk-context**: use indexed chunk_index lookup, fix close-after-use bug
|
|
|
|
## v0.83.1 (2026-05-09)
|
|
|
|
### Fix
|
|
|
|
- **webdav**: decode percent-encoded names in PROPFIND/SEARCH responses
|
|
|
|
## v0.83.0 (2026-05-08)
|
|
|
|
### Feat
|
|
|
|
- **vector**: replace inline page-image payloads with chunk_bbox (Deck #76)
|
|
|
|
### Refactor
|
|
|
|
- **vector**: address PR #775 review round 3 — fix unused var, harden boundary lookup, rename trace span
|
|
- **vector**: address PR #775 review round 2 — drop dead page field, add omission tests
|
|
- **vector**: address PR #775 review — drop unused payload key, fix resource leaks
|
|
|
|
## v0.82.0 (2026-05-08)
|
|
|
|
### Feat
|
|
|
|
- **providers**: add Mistral embedding provider, route registry through dynaconf
|
|
|
|
### Refactor
|
|
|
|
- **providers**: address PR #772 review round 3 — hermetic test, lazy logging, defensive-guard tests
|
|
- **providers**: address PR #772 review round 2 — guard, naming, docs, tests
|
|
- **providers**: address PR #772 review — shared retry, cleaner imports, no-op close
|
|
|
|
## v0.81.0 (2026-05-07)
|
|
|
|
### Feat
|
|
|
|
- **vector**: expand tagged directories for include + apply EXCLUDED_TAGS in scanner
|
|
|
|
### Fix
|
|
|
|
- **webdav**: include fileid in find_by_type SEARCH + address PR #765 review
|
|
|
|
## v0.80.0 (2026-05-06)
|
|
|
|
### Feat
|
|
|
|
- **webdav**: add tag-based file exclusion (#710)
|
|
|
|
### Fix
|
|
|
|
- **webdav**: finish lazy-logging conversion in get_tag_by_name
|
|
- **webdav**: address PR #764 review round 4
|
|
- **webdav**: address PR #764 review round 3
|
|
- **webdav**: drop anyio.Lock and add integration tests for tag exclusion
|
|
- **webdav**: address PR #764 review round 2
|
|
- **webdav**: address PR #764 review
|
|
|
|
## v0.79.3 (2026-05-03)
|
|
|
|
### Fix
|
|
|
|
- **webhooks**: use HTTP 428 instead of 412 for unprovisioned users
|
|
- **webhooks**: use app-password basic auth for NC API calls
|
|
|
|
## v0.79.2 (2026-05-03)
|
|
|
|
### Fix
|
|
|
|
- **test**: retry consent handling in login_flow_static_client_token
|
|
- **webhooks**: use OCS v2 capabilities for /api/v1/apps
|
|
|
|
## v0.79.1 (2026-05-03)
|
|
|
|
### Fix
|
|
|
|
- **auth**: address PR #758 round-7 medium/minor review
|
|
- **auth**: address PR #758 round-7 important review
|
|
- **auth**: address PR #758 round-6 medium/low review
|
|
- **auth**: address PR #758 round-5 medium/low review
|
|
- **auth**: address PR #758 round-4 review
|
|
- **auth**: address PR #758 round-3 final review
|
|
- **auth**: address PR #758 round-3 review
|
|
- **auth**: address PR #758 round-2 review
|
|
- **auth**: address PR #758 auto-review (id-token verify, nonce, CI key)
|
|
- **auth**: fail closed on missing sub claim, delete Flow 2 callback session
|
|
- **auth**: address PR #758 follow-up review
|
|
- **auth**: use Settings for OIDC env vars in token revocation helper
|
|
- **auth**: address PR #758 review — XSS, CSRF, open redirect, JWKS cache
|
|
- **auth**: harden OAuth/session for hosted multi-tenant deployment (#626)
|
|
|
|
## v0.79.0 (2026-05-02)
|
|
|
|
### Feat
|
|
|
|
- **deck**: add response filters and archived stacks tool
|
|
|
|
### Fix
|
|
|
|
- **deck**: address PR #759 round-3 review feedback
|
|
- **deck**: address PR #759 round-2 review feedback
|
|
- **deck**: address PR #759 review feedback
|
|
|
|
## v0.78.0 (2026-05-02)
|
|
|
|
### Feat
|
|
|
|
- **auth**: elicit Astrolabe URL on missing app password
|
|
|
|
### Fix
|
|
|
|
- **auth**: address PR #757 round-3 review feedback
|
|
- **auth**: invalidate scope cache on web/REST provisioning paths
|
|
- **auth**: address PR #757 round-2 review feedback
|
|
- **auth**: address PR #757 review feedback
|
|
|
|
### Refactor
|
|
|
|
- **config**: consolidate NEXTCLOUD_PUBLIC_ISSUER_URL through Settings
|
|
|
|
## v0.77.1 (2026-05-01)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency icalendar to >=7.1.0,<7.2.0
|
|
|
|
## v0.77.0 (2026-05-01)
|
|
|
|
### Feat
|
|
|
|
- **search**: verify-on-read for semantic search results (ADR-019)
|
|
|
|
### Refactor
|
|
|
|
- **search**: address PR #750 round 12 review feedback
|
|
- **search**: address PR #750 round 11 review feedback
|
|
- **search**: address PR #750 round 10 review feedback
|
|
- **search**: address PR #750 round 9 review feedback
|
|
- **search**: pre-push review fixes for PR #750
|
|
- **search**: address PR #750 round 8 review feedback
|
|
- **search**: address PR #750 round 7 review feedback
|
|
- **search**: address PR #750 round 6 review feedback
|
|
- **search**: address PR #750 round 5 review feedback
|
|
- **search**: address PR #750 round 4 review feedback
|
|
- **search**: address PR #750 round 3 review feedback
|
|
- **search**: address PR #750 round 2 review feedback
|
|
- **search**: address PR #750 review feedback
|
|
|
|
## v0.76.0 (2026-05-01)
|
|
|
|
### Feat
|
|
|
|
- **infra**: distribute terraform modules under infra/terraform
|
|
|
|
### Fix
|
|
|
|
- **infra**: address PR review feedback on tf modules
|
|
|
|
## v0.75.2 (2026-04-30)
|
|
|
|
### Fix
|
|
|
|
- **webhooks**: escape webhook_uri, lazy logging, document 401 header omission
|
|
- **webhooks**: escape HTML in error responses, compare bearer as bytes
|
|
- **webhooks**: authenticate deliveries via WEBHOOK_SECRET; review nits
|
|
- **webhooks**: wire receiver to vector sync queue and fix registered URI
|
|
|
|
### Refactor
|
|
|
|
- **webhooks**: bound queue waits, route URLs through dynaconf
|
|
- **webhooks**: address PR review on auth-pass
|
|
|
|
## v0.75.1 (2026-04-30)
|
|
|
|
### Fix
|
|
|
|
- **vector-sync**: wire document streams into OAuthAppContext
|
|
|
|
## v0.75.0 (2026-04-29)
|
|
|
|
### Feat
|
|
|
|
- **talk**: add MCP integration for Nextcloud Talk (spreed)
|
|
|
|
### Fix
|
|
|
|
- **talk**: address remaining PR #741 reviewer feedback
|
|
- **talk**: address PR #741 reviewer feedback
|
|
|
|
## v0.74.0 (2026-04-29)
|
|
|
|
### Feat
|
|
|
|
- **auth**: drop test-client defaults, add ALLOWED_MGMT_CLIENT allowlist
|
|
|
|
## v0.73.2 (2026-04-29)
|
|
|
|
### Fix
|
|
|
|
- **oauth**: follow redirects when fetching OIDC discovery
|
|
|
|
## v0.73.1 (2026-04-29)
|
|
|
|
### Fix
|
|
|
|
- **calendar**: thread raw credentials to caldav AsyncDAVClient
|
|
|
|
## v0.73.0 (2026-04-29)
|
|
|
|
### Feat
|
|
|
|
- **deck**: add card comment tools
|
|
|
|
### Fix
|
|
|
|
- **deck**: address review feedback on card comment tools
|
|
|
|
## v0.72.7 (2026-04-27)
|
|
|
|
### Fix
|
|
|
|
- **client**: route /apps/* through /index.php for non-pretty-URL installs
|
|
- **notes**: defensively unwrap list-shaped Notes responses (refs #730)
|
|
|
|
## v0.72.6 (2026-04-26)
|
|
|
|
### Fix
|
|
|
|
- **models**: coerce Contact.birthday + relax Table.owner_display_name
|
|
|
|
## v0.72.5 (2026-04-23)
|
|
|
|
### Fix
|
|
|
|
- **api**: use stored app password for chunk-context and pdf-preview
|
|
|
|
## v0.72.4 (2026-04-16)
|
|
|
|
### Fix
|
|
|
|
- **tests**: convert create_mcp_client_session to asynccontextmanager
|
|
|
|
## v0.72.3 (2026-04-15)
|
|
|
|
### Fix
|
|
|
|
- coerce numeric nutrition values to strings in Cookbook model (fixes #708)
|
|
|
|
## v0.72.2 (2026-04-14)
|
|
|
|
### Fix
|
|
|
|
- enable uvx/PyPI deployments without Docker assumptions
|
|
|
|
## v0.72.1 (2026-04-07)
|
|
|
|
### Fix
|
|
|
|
- strip resource server prefix from JWT scopes for tool filtering
|
|
|
|
## v0.72.0 (2026-04-07)
|
|
|
|
### Feat
|
|
|
|
- add --version option to CLI
|
|
|
|
## v0.71.0 (2026-04-07)
|
|
|
|
### Feat
|
|
|
|
- add stdio transport support for local MCP usage
|
|
|
|
### Fix
|
|
|
|
- address third round of review feedback
|
|
- address second round of review feedback
|
|
- address PR review feedback and fix CI test failures
|
|
|
|
## v0.70.4 (2026-04-07)
|
|
|
|
### Fix
|
|
|
|
- conditionally include offline_access based on IdP discovery
|
|
|
|
## v0.70.3 (2026-04-07)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.27,<1.28
|
|
|
|
## v0.70.2 (2026-04-07)
|
|
|
|
### Fix
|
|
|
|
- conditionally include offline_access in Flow 2 scope request
|
|
|
|
## v0.70.1 (2026-04-07)
|
|
|
|
### Fix
|
|
|
|
- fall back to client_id when aud claim is absent (Cognito compat)
|
|
|
|
## v0.70.0 (2026-04-07)
|
|
|
|
### Feat
|
|
|
|
- add OIDC resource server scope prefix for Cognito compatibility
|
|
|
|
### Fix
|
|
|
|
- address second round of PR review for scope prefix
|
|
- address PR review for OIDC scope prefix feature
|
|
|
|
## v0.69.0 (2026-04-07)
|
|
|
|
### Feat
|
|
|
|
- implement dynaconf configuration management (ADR-024 phases 1-3)
|
|
|
|
### Fix
|
|
|
|
- resolve dynaconf settings.toml not found in non-editable installs
|
|
|
|
## v0.68.4 (2026-04-07)
|
|
|
|
### Refactor
|
|
|
|
- change OAuth scope separator from colon to dot for IDP compatibility
|
|
|
|
## v0.68.3 (2026-04-05)
|
|
|
|
### Fix
|
|
|
|
- address PR review feedback for client registry and DCR proxy
|
|
- support cloud OAuth clients and graceful DCR fallback
|
|
|
|
### Refactor
|
|
|
|
- remove ALLOWED_MCP_CLOUD_CLIENTS and add keycloak CI profile
|
|
- consolidate ALLOWED_MCP_CLIENTS and add redirect URI validation
|
|
|
|
## v0.68.2 (2026-04-04)
|
|
|
|
### Fix
|
|
|
|
- address PR review — remove token exchange tests, improve logging
|
|
- address PR review — stale mcp-oauth refs, Playwright TimeoutError catch
|
|
- update expected auth tools list for login-flow scope test
|
|
|
|
### Refactor
|
|
|
|
- remove RFC 8693 token exchange and Keycloak OAuth implementation
|
|
- remove oauth profile, migrate MCP/OAuth tests to login-flow
|
|
|
|
## v0.68.1 (2026-04-01)
|
|
|
|
### Fix
|
|
|
|
- convert BDAY datetime.date to string before Pydantic validation
|
|
|
|
## v0.68.0 (2026-03-31)
|
|
|
|
### Feat
|
|
|
|
- add web-based Login Flow v2 provisioning endpoint
|
|
|
|
### Fix
|
|
|
|
- require bearer token on provision endpoints (open redirect mitigation)
|
|
- address PR review round 3 — info disclosure, conditional routes, cleanup
|
|
- address PR review round 2 — expiry checks, race guards, poll tests
|
|
- address PR review — XSS escape, asyncio→anyio, URL rewrite dedup
|
|
- use app password auth for background sync in Login Flow mode
|
|
- discover Login Flow v2 users in OAuth mode user manager
|
|
- rewrite Login Flow v2 poll endpoint URL to use configured host
|
|
- handle internal hostname without port in Login Flow v2 URL rewriting
|
|
|
|
### Refactor
|
|
|
|
- use redirect-based Login Flow v2 provision instead of popup
|
|
|
|
## v0.67.0 (2026-03-29)
|
|
|
|
### Feat
|
|
|
|
- add Tailscale Funnel config for Claude AI connector testing
|
|
|
|
## v0.66.2 (2026-03-29)
|
|
|
|
### Fix
|
|
|
|
- allow HTTPS redirect URIs for non-localhost OAuth clients
|
|
- move Astrolabe OAuth hook to before-starting for reliable OIDC client creation
|
|
- resolve OAuth compatibility issues for login-flow deployment
|
|
|
|
## v0.66.1 (2026-03-28)
|
|
|
|
### Fix
|
|
|
|
- pin Renovate Nextcloud updates to matching major version
|
|
|
|
## v0.66.0 (2026-03-28)
|
|
|
|
### Feat
|
|
|
|
- add Nextcloud Collectives app support (#621)
|
|
|
|
### Fix
|
|
|
|
- address PR review feedback (round 9)
|
|
- address PR review feedback (round 8)
|
|
- address PR review feedback (round 7) and fix CI
|
|
- address PR review feedback (round 6)
|
|
- address PR review feedback (round 5)
|
|
- add trash/delete collective tools and address review feedback (round 4)
|
|
- address PR review feedback (round 3)
|
|
- address PR review feedback (round 2)
|
|
- correct tool annotations to match ADR-017 conventions
|
|
- address PR review feedback for Collectives support
|
|
|
|
## v0.65.4 (2026-03-27)
|
|
|
|
### Fix
|
|
|
|
- pin starlette<1.0 to prevent startup crash (#648)
|
|
|
|
## v0.65.3 (2026-03-22)
|
|
|
|
### Refactor
|
|
|
|
- remove Smithery deployment mode
|
|
|
|
## v0.65.2 (2026-03-22)
|
|
|
|
### Fix
|
|
|
|
- increase vector sync wait timeout to prevent sampling test timeouts in CI
|
|
- reduce vector sync scan interval to 5s for single-user service
|
|
- expose public status endpoints in all modes and enable vector sync (#637)
|
|
|
|
## v0.65.1 (2026-03-21)
|
|
|
|
### Fix
|
|
|
|
- resolve OIDC consent flow 500 errors on NC 32
|
|
- address PR #632 review comments
|
|
- **ci**: build OIDC app for all test modes including single-user
|
|
- patch OIDC consent flow regression and add CI build step
|
|
- **caldav**: address PR #632 review feedback
|
|
- **caldav**: migrate to upstream caldav v3.0.1 to fix href handling (#629)
|
|
|
|
## v0.65.0 (2026-03-03)
|
|
|
|
### Feat
|
|
|
|
- **auth**: implement OAuth AS proxy to fix audience mismatch (ADR-023)
|
|
- **ci**: add Nextcloud version matrix (NC 31, 32, 33)
|
|
- **helm**: add login-flow auth mode to Helm chart (ADR-022)
|
|
- add Docker Compose profiles and Login Flow v2 service
|
|
|
|
### Fix
|
|
|
|
- replace assert with proper guard and invalidate scope cache after provisioning
|
|
- disable NC rate limiting in dev/CI and add token endpoint diagnostics
|
|
- address review feedback — security, caching, CI 429 retry
|
|
- skip keycloak hook when profile inactive and update stale PRM test
|
|
- address remaining PR #589 review findings
|
|
- address PR #589 review findings
|
|
- address PR review issues for Login Flow v2
|
|
- address PR #589 review feedback (round 2)
|
|
- **ci**: remove dev OIDC mount to fix HTTP 500 in single-user/multi-user-basic
|
|
- **ci**: fix health check timeout and per-profile MCP server URL routing
|
|
- **ci**: fix PHP gating, add multi-user-basic matrix entry, upload debug artifacts
|
|
- address PR #589 review feedback for Login Flow v2
|
|
- **ci**: fix integration test collection and skip Playwright in CI
|
|
- **test**: fix 17 pre-existing unit test failures and add astrolabe CI build
|
|
- **ci**: keep third_party mount, always build submodules in CI
|
|
- **ci**: revert accidental third_party mount, use compose override for OIDC
|
|
- **ci**: don't block integration matrix on unit-test failures
|
|
|
|
## v0.64.5 (2026-03-03)
|
|
|
|
### Fix
|
|
|
|
- handle pythonvCard4 dict-format fields and missing phone numbers (#601)
|
|
|
|
## v0.64.4 (2026-02-26)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency icalendar to v7
|
|
|
|
## v0.64.3 (2026-02-21)
|
|
|
|
### Fix
|
|
|
|
- address PR #574 fourth review round
|
|
- address PR #574 third review round
|
|
- address PR #574 second review round
|
|
- address PR #574 review comments
|
|
- wrap raw list returns in response models to produce single TextContent block
|
|
|
|
## v0.64.2 (2026-02-20)
|
|
|
|
### Fix
|
|
|
|
- address PR #571 review comments
|
|
- resolve stale credentials causing astrolabe background sync test failures
|
|
|
|
### Refactor
|
|
|
|
- enforce PLC0415 (import-outside-top-level) for source code
|
|
|
|
## v0.64.1 (2026-02-18)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.26,<1.27
|
|
|
|
## v0.64.0 (2026-02-16)
|
|
|
|
### Feat
|
|
|
|
- add self-signed SSL certificate support for Nextcloud connections
|
|
|
|
### Fix
|
|
|
|
- add type: ignore for caldav ssl_verify_cert parameter
|
|
- convert CA bundle path to ssl.SSLContext to avoid httpx deprecation warning
|
|
|
|
## v0.63.5 (2026-02-16)
|
|
|
|
### Refactor
|
|
|
|
- remove stale astrolabe references from commitizen config
|
|
- extract Astrolabe to separate repository
|
|
|
|
## v0.63.4 (2026-02-08)
|
|
|
|
### Fix
|
|
|
|
- strip whitespace from category names when splitting
|
|
- handle categories, recurrence_rule, attendees, and reminder_minutes in update_event
|
|
|
|
## v0.63.3 (2026-02-08)
|
|
|
|
### Fix
|
|
|
|
- expand recurring events in date-range queries
|
|
|
|
## v0.63.2 (2026-02-07)
|
|
|
|
### Fix
|
|
|
|
- use CalDAV time-range filter for calendar date range queries
|
|
|
|
## v0.63.1 (2026-02-03)
|
|
|
|
### Fix
|
|
|
|
- **helm**: add backward compatibility for legacy persistence configs
|
|
|
|
## v0.63.0 (2026-01-28)
|
|
|
|
### Feat
|
|
|
|
- **astrolabe**: add background token refresh job
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: add pagination and psalm fixes for token refresh
|
|
- **astrolabe**: add locking to prevent token refresh race condition
|
|
- **astrolabe**: add issued_at to on-demand token refresh
|
|
|
|
## v0.62.0 (2026-01-26)
|
|
|
|
### Feat
|
|
|
|
- **scripts**: add database query helpers for development
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: resolve Psalm type errors in PDF preview code
|
|
- **astrolabe**: fix Psalm baseline and ESLint import order
|
|
- **astrolabe**: load pdfjs-dist externally to fix PDF viewer
|
|
- **astrolabe**: improve error messages for authorization issues
|
|
- **astrolabe**: rename OAuthController and fix app password check
|
|
- **tests**: improve Astrolabe integration test reliability
|
|
- **astrolabe**: update Plotly title attributes for v3 compatibility
|
|
- **deps**: update dependency plotly.js-dist-min to v3
|
|
|
|
### Refactor
|
|
|
|
- **api**: split management.py into domain-focused modules
|
|
- **astrolabe**: replace client-side PDF.js with server-side PyMuPDF rendering
|
|
|
|
## v0.61.5 (2026-01-17)
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: improve token refresh error handling and validation
|
|
- **astrolabe**: delete stale tokens when refresh fails
|
|
- **astrolabe**: resolve CI failures for code quality checks
|
|
- **astrolabe**: use internal URL for OAuth token refresh
|
|
|
|
### Refactor
|
|
|
|
- **astrolabe**: add PHP property types to fix Psalm errors
|
|
- **astrolabe**: upgrade to @nextcloud/vue 9.3.3 API
|
|
|
|
## v0.61.4 (2026-01-16)
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: Address reviewer feedback for hybrid mode
|
|
- **astrolabe**: Fix NcSelect options and CSS loading
|
|
- **astrolabe**: fix OAuth flow and settings UI for hybrid mode
|
|
- **api**: return OIDC config in hybrid mode for Astrolabe OAuth flow
|
|
|
|
## v0.61.3 (2026-01-15)
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: address review feedback for Vue 3 bindings
|
|
- **astrolabe**: update Vue component bindings for Vue 3 compatibility
|
|
|
|
## v0.61.2 (2026-01-15)
|
|
|
|
### Fix
|
|
|
|
- **ci**: bump helm chart version when MCP appVersion changes
|
|
|
|
## v0.61.1 (2026-01-15)
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: define appName and appVersion for @nextcloud/vue
|
|
|
|
## v0.61.0 (2026-01-14)
|
|
|
|
### Feat
|
|
|
|
- Add rate limiting and extract helpers for app password endpoints
|
|
|
|
### Fix
|
|
|
|
- Add missing annotations for deck remove/unassign operations
|
|
- **auth**: Store app passwords locally for multi-user BasicAuth background sync
|
|
|
|
### Refactor
|
|
|
|
- Use get_settings() for vector sync enabled check
|
|
- Extract storage helper and improve PHP error handling
|
|
|
|
## v0.60.4 (2026-01-12)
|
|
|
|
### Fix
|
|
|
|
- **deck**: use correct endpoint for reorder_card to fix cross-stack moves
|
|
|
|
## v0.60.3 (2025-12-31)
|
|
|
|
### Fix
|
|
|
|
- **deck**: Always preserve fields in update_card for partial updates
|
|
- **astrolabe**: Fix CSS loading for Nextcloud apps
|
|
- **astrolabe**: Fix revoke access button HTTP method mismatch
|
|
|
|
## v0.60.2 (2025-12-29)
|
|
|
|
### Fix
|
|
|
|
- **oauth**: Enable browser OAuth routes for Management API in hybrid mode
|
|
|
|
## v0.60.1 (2025-12-26)
|
|
|
|
### Fix
|
|
|
|
- **mcp**: Move all imports to the top of modules
|
|
|
|
## v0.60.0 (2025-12-26)
|
|
|
|
### Feat
|
|
|
|
- Remove URL rewriting in favor of proper nextcloud config
|
|
- **helm**: migrate to new environment variable naming convention
|
|
- Migrate to vue 3
|
|
- **astrolabe**: upgrade to Vue 3 and @nextcloud/vue 9
|
|
|
|
### Fix
|
|
|
|
- **tests**: Add singleton reset fixture to prevent anyio.WouldBlock errors
|
|
- **tests**: Fix integration test failures in qdrant, sampling, and rag tests
|
|
- **auth**: Skip issuer validation for management API tokens
|
|
- Use settings.enable_offline_access for env var consolidation
|
|
- Add required config.py attributes
|
|
- **docker**: remove overwritehost to fix container-to-container DCR
|
|
- **deps**: update dependency @nextcloud/vue to v9
|
|
- **deps**: update dependency vue to v3
|
|
|
|
### Refactor
|
|
|
|
- **auth**: Decouple BasicAuth and OAuth authentication strategies
|
|
|
|
## v0.59.1 (2025-12-22)
|
|
|
|
### Fix
|
|
|
|
- **helm**: set OIDC client env vars when using existingSecret
|
|
- **helm**: trigger chart release workflow on helm chart tags
|
|
|
|
## v0.59.0 (2025-12-22)
|
|
|
|
### Feat
|
|
|
|
- **helm**: add support for multi-user BasicAuth mode
|
|
|
|
### Fix
|
|
|
|
- **helm**: address PR #447 reviewer feedback
|
|
- **helm**: include MCP server version bumps in changelog pattern
|
|
|
|
## v0.58.0 (2025-12-22)
|
|
|
|
### Feat
|
|
|
|
- **config**: enable DCR for multi-user BasicAuth with offline access
|
|
- **astrolabe**: implement app password provisioning for multi-user background sync
|
|
- **config**: consolidate configuration with smart dependency resolution (ADR-021)
|
|
|
|
## v0.57.0 (2025-12-20)
|
|
|
|
### Feat
|
|
|
|
- **auth**: add multi-user BasicAuth pass-through mode
|
|
- **astrolabe**: add dynamic MCP server configuration for testing
|
|
|
|
### Fix
|
|
|
|
- **config**: address reviewer feedback
|
|
|
|
### Refactor
|
|
|
|
- **config**: centralize configuration validation and simplify startup
|
|
|
|
## v0.56.2 (2025-12-20)
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: screenshots in info.xml
|
|
- **astrolabe**: screenshots in info.xml
|
|
|
|
## v0.56.1 (2025-12-19)
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: Update screenshots
|
|
- **ci**: skip existing Helm chart releases to prevent duplicate release errors
|
|
|
|
## v0.56.0 (2025-12-19)
|
|
|
|
### Feat
|
|
|
|
- **ci**: add --increment flag to bump scripts for manual version control
|
|
|
|
### Fix
|
|
|
|
- **astrolabe**: add contents:write permission to appstore workflow
|
|
- **astrolabe**: update commitizen pattern to properly update info.xml version
|
|
- **astrolabe**: prevent workflow failure when only helm/astrolabe commits exist
|
|
- **astrolabe**: info.xml
|
|
|
|
## v0.55.1 (2025-12-19)
|
|
|
|
### Fix
|
|
|
|
- **ci**: push all tags explicitly in bump workflow
|
|
|
|
## v0.55.0 (2025-12-19)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- MCP server now bumps for ANY conventional commit except
|
|
those explicitly scoped to helm or astrolabe.
|
|
|
|
### Feat
|
|
|
|
- **ci**: implement monorepo-aware version bumping workflow
|
|
|
|
### Fix
|
|
|
|
- **ci**: make MCP server default bump target for all non-scoped commits
|
|
- **ci**: restrict docker build to MCP server tags only
|
|
- **ci**: correct appstore-push-action version to v1.0.4
|
|
|
|
## v0.54.0 (2025-12-19)
|
|
|
|
### Feat
|
|
|
|
- **astrolabe**: add Nextcloud App Store deployment automation
|
|
- configure commitizen monorepo with independent versioning
|
|
|
|
### Fix
|
|
|
|
- **ci**: improve versioning and error handling
|
|
- **ci**: address critical workflow and validation issues
|
|
- **astrolabe**: address code review feedback
|
|
|
|
## v0.53.0 (2025-12-19)
|
|
|
|
### Feat
|
|
|
|
- add Alembic database migration system
|
|
- make chunk modal title clickable link to documents
|
|
- add native Plotly hover styling for clickable points
|
|
- add click interactivity to Plotly 3D scatter chart
|
|
- improve chunk viewer with fixed navigation and markdown rendering
|
|
- **astrolabe**: enable multi-select for document types and refactor PDF viewer
|
|
- **auth**: implement refresh token rotation for Nextcloud OIDC
|
|
- **astrolabe**: enhance unified search and add webhook management
|
|
- **astrolabe**: add webhook management UI to admin settings
|
|
- **astrolabe**: add OAuth token refresh and webhook presets
|
|
- **search**: add file_path metadata and chunk offsets to search results
|
|
- **astrolabe**: use proper icons and thumbnails in unified search
|
|
- **astrolabe**: add admin search settings and enhanced UI
|
|
- **astrolabe**: add unified search provider with clickable file links
|
|
- **astrolabe**: add 3D PCA visualization for semantic search
|
|
- **astrolabe**: add Nextcloud PHP app for MCP server management
|
|
- **vector-sync**: enable background sync in OAuth mode
|
|
|
|
### Fix
|
|
|
|
- **security**: address critical security issues from PR #401 code review
|
|
- **oauth**: enable PKCE for all clients and add token_broker to oauth_context
|
|
- **astrolabe**: revert invalid files_pdfviewer URL for file links
|
|
- resolve type checking warnings for CI
|
|
- move Alembic to package submodule for Docker compatibility
|
|
- update unified search results to match chunk viz display
|
|
- **astrolabe**: handle OAuth refresh token rotation
|
|
- address critical code review issues (4 fixes)
|
|
- resolve CI linting issues for Astroglobe
|
|
|
|
### Refactor
|
|
|
|
- **astrolabe**: extract PDF viewer to dedicated component
|
|
- **astrolabe**: reframe UI as semantic search service
|
|
|
|
## v0.52.1 (2025-12-13)
|
|
|
|
### Perf
|
|
|
|
- **deck**: optimize card lookup by storing board_id/stack_id in metadata
|
|
|
|
## v0.52.0 (2025-12-13)
|
|
|
|
### Feat
|
|
|
|
- **vector**: add Deck card vector search with visualization support
|
|
|
|
## v0.51.0 (2025-12-13)
|
|
|
|
### Feat
|
|
|
|
- **vector-viz**: add news_item support for links and chunk expansion
|
|
|
|
## v0.50.2 (2025-12-13)
|
|
|
|
### Fix
|
|
|
|
- **news**: revert get_item() to use get_items() + filter
|
|
|
|
## v0.50.1 (2025-12-12)
|
|
|
|
### Fix
|
|
|
|
- Disable DNS rebinding protection for containerized deployments
|
|
- **deps**: update dependency mcp to >=1.23,<1.24
|
|
|
|
## v0.50.0 (2025-12-11)
|
|
|
|
### Feat
|
|
|
|
- add MCP tool annotations for enhanced UX
|
|
|
|
### Fix
|
|
|
|
- address PR review feedback
|
|
|
|
## v0.49.2 (2025-12-09)
|
|
|
|
### Fix
|
|
|
|
- Update lockfile
|
|
|
|
## v0.49.1 (2025-12-09)
|
|
|
|
### Fix
|
|
|
|
- Revert mcp version <1.23
|
|
|
|
## v0.49.0 (2025-12-08)
|
|
|
|
### Feat
|
|
|
|
- **news**: add Nextcloud News app integration
|
|
|
|
### Fix
|
|
|
|
- resolve all type checking errors (8 errors fixed)
|
|
|
|
### Refactor
|
|
|
|
- **news**: simplify vector sync to fetch all items
|
|
|
|
### Perf
|
|
|
|
- **news**: use direct API endpoint for get_item()
|
|
|
|
## v0.48.6 (2025-12-03)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.23,<1.24
|
|
|
|
## v0.48.5 (2025-11-28)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency pillow to v12
|
|
|
|
## v0.48.4 (2025-11-23)
|
|
|
|
### Fix
|
|
|
|
- Add rate limit retry logic to OpenAI provider
|
|
|
|
## v0.48.3 (2025-11-23)
|
|
|
|
### Fix
|
|
|
|
- Increase MCP sampling timeout to 5 minutes for slower LLMs
|
|
|
|
## v0.48.2 (2025-11-23)
|
|
|
|
### Fix
|
|
|
|
- Share vector sync state with FastMCP session lifespan via module singleton
|
|
- Share vector sync state with FastMCP session lifespan via module singleton
|
|
|
|
## v0.48.1 (2025-11-23)
|
|
|
|
### Fix
|
|
|
|
- Use WebDAV for tag creation and add LLM-as-a-judge for RAG tests
|
|
|
|
### Refactor
|
|
|
|
- Move background tasks to server lifespan and deprecate SSE transport
|
|
|
|
## v0.48.0 (2025-11-23)
|
|
|
|
### Feat
|
|
|
|
- Add tag management methods to WebDAV client
|
|
|
|
## v0.47.0 (2025-11-23)
|
|
|
|
### Feat
|
|
|
|
- Add OpenAI provider support for embeddings and generation
|
|
|
|
## v0.46.2 (2025-11-22)
|
|
|
|
### Fix
|
|
|
|
- **smithery**: Enable JSON response format for scanner compatibility
|
|
|
|
## v0.46.1 (2025-11-22)
|
|
|
|
### Perf
|
|
|
|
- Optimize vector viz search performance
|
|
|
|
## v0.46.0 (2025-11-22)
|
|
|
|
### Feat
|
|
|
|
- Add Smithery CLI deployment support
|
|
- Implement ADR-016 Smithery stateless deployment mode
|
|
|
|
### Fix
|
|
|
|
- **smithery**: Add JSON Schema metadata to mcp-config endpoint
|
|
- **smithery**: Use container runtime pattern for config discovery
|
|
- Add Smithery lifespan and auth mode detection
|
|
|
|
## v0.45.0 (2025-11-22)
|
|
|
|
### Feat
|
|
|
|
- Add context expansion to semantic search with chunk overlap removal
|
|
- Use Ollama native batch API in embed_batch()
|
|
- Implement Qdrant placeholder state management
|
|
- Switch files to use numeric IDs with file_path resolution
|
|
- Implement per-chunk vector visualization with context expansion
|
|
|
|
### Fix
|
|
|
|
- Use alpha_composite for proper RGBA highlight blending
|
|
- Remove pymupdf.layout.activate() to fix page_chunks behavior
|
|
- Centralize PDF processing and generate separate images per chunk
|
|
- Set is_placeholder=False in processor to fix search filtering
|
|
- Increase placeholder staleness threshold to 5x scan interval
|
|
- Add placeholder staleness check to prevent duplicate processing
|
|
- Use empty SparseVector instead of None for placeholders
|
|
- Return empty array instead of null for query_coords when no results
|
|
- Align PDF text extraction between indexing and context expansion
|
|
- Update models and viz to use int-only doc_id
|
|
- Reconstruct full content for notes to match indexed offsets
|
|
- Add async/await, PDF metadata, and type safety fixes
|
|
|
|
### Refactor
|
|
|
|
- Simplify PDF text extraction with single to_markdown call
|
|
|
|
### Perf
|
|
|
|
- Optimize PDF processing with parallel extraction and single-render highlights
|
|
|
|
## v0.44.1 (2025-11-21)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.22,<1.23
|
|
|
|
## v0.44.0 (2025-11-19)
|
|
|
|
### Feat
|
|
|
|
- Improve vector visualization with static assets and fixes
|
|
- Redesign UI to match Nextcloud ecosystem aesthetic
|
|
|
|
### Fix
|
|
|
|
- Improve 3D plot rendering with explicit dimensions and window resize support
|
|
- Preserve 3D plot camera and improve documentation
|
|
- Preserve 3D plot camera position and fix CSS loading
|
|
|
|
## v0.43.0 (2025-11-18)
|
|
|
|
### Feat
|
|
|
|
- Replace custom document chunker with LangChain MarkdownTextSplitter
|
|
|
|
## v0.42.0 (2025-11-17)
|
|
|
|
### Feat
|
|
|
|
- **viz**: Add dual-score display and improve UI controls
|
|
|
|
## v0.41.0 (2025-11-17)
|
|
|
|
### Feat
|
|
|
|
- add configurable fusion algorithms for BM25 hybrid search
|
|
- add chunk position tracking to vector indexing and search
|
|
- add vector viz template and chunk context endpoint
|
|
|
|
### Fix
|
|
|
|
- prevent infinite loop in DocumentChunker with position tracking
|
|
- Relax SearchResult validation to support DBSF fusion scores > 1.0
|
|
|
|
## v0.40.0 (2025-11-16)
|
|
|
|
### Feat
|
|
|
|
- add unified provider architecture with Amazon Bedrock support
|
|
|
|
### Fix
|
|
|
|
- suppress Starlette middleware type warnings in ty checker
|
|
|
|
## v0.39.0 (2025-11-16)
|
|
|
|
### Feat
|
|
|
|
- Implement BM25 hybrid search with native Qdrant RRF fusion
|
|
|
|
### Fix
|
|
|
|
- Handle named vectors in visualization and semantic search
|
|
- Update vizApp to use bm25_hybrid algorithm and remove deprecated weights
|
|
- Update viz routes to use BM25 hybrid search after refactor
|
|
|
|
## v0.38.0 (2025-11-16)
|
|
|
|
### Feat
|
|
|
|
- add concurrent uploads and --force flag to upload command
|
|
- implement RAG evaluation framework with CLI tooling
|
|
|
|
### Fix
|
|
|
|
- download qrels from BEIR ZIP instead of HuggingFace
|
|
|
|
### Refactor
|
|
|
|
- migrate asyncio to anyio for consistent structured concurrency
|
|
- replace httpx client with NextcloudClient in upload command
|
|
|
|
### Perf
|
|
|
|
- Eliminate double-fetching in semantic search sampling
|
|
- fix vector viz search performance and visual encoding
|
|
- make note deletion concurrent in upload --force
|
|
|
|
## v0.37.0 (2025-11-16)
|
|
|
|
### Feat
|
|
|
|
- Add OpenTelemetry tracing to @instrument_tool decorator
|
|
|
|
## v0.36.0 (2025-11-15)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- Search algorithms now require Qdrant to be populated.
|
|
Vector sync must be enabled and documents indexed for search to work.
|
|
|
|
### Feat
|
|
|
|
- Normalize hybrid search RRF scores to 0-1 range
|
|
- Enhance vector visualization UI and parallelize search verification
|
|
- Add Vector Viz tab to app home page
|
|
- Add vector visualization pane with multi-select document types
|
|
- Implement custom PCA to remove sklearn dependency
|
|
- Add multi-document Protocol with cross-app search support
|
|
- Update nc_semantic_search tool with algorithm selection
|
|
- Implement unified search algorithm module
|
|
|
|
### Fix
|
|
|
|
- Reorder tabs and fix viz pane session access
|
|
|
|
### Refactor
|
|
|
|
- Optimize Nextcloud access verification with centralized filtering
|
|
- Make all search algorithms query Qdrant payload, not Nextcloud
|
|
|
|
### Perf
|
|
|
|
- Exclude vector-sync status polling from distributed tracing
|
|
|
|
## v0.35.0 (2025-11-15)
|
|
|
|
### Feat
|
|
|
|
- Enable SSE transport for mcp service and update test fixtures
|
|
|
|
## v0.34.2 (2025-11-13)
|
|
|
|
### Fix
|
|
|
|
- Use NEXTCLOUD_OIDC_CLIENT_ID/SECRET env vars consistently
|
|
|
|
## v0.34.1 (2025-11-13)
|
|
|
|
### Fix
|
|
|
|
- return all notes when search query is empty
|
|
|
|
## v0.34.0 (2025-11-13)
|
|
|
|
### Feat
|
|
|
|
- Complete Phase 5 - Instrument all 93 MCP tools
|
|
- Add instrumentation decorator and apply to notes tools (Phase 5)
|
|
- Add OAuth token and database metrics (Phases 3-4)
|
|
- Add metrics instrumentation for queue, health, and database operations
|
|
|
|
## v0.33.1 (2025-11-13)
|
|
|
|
### Fix
|
|
|
|
- Move grafana_folder from labels to annotations
|
|
|
|
## v0.33.0 (2025-11-13)
|
|
|
|
### Feat
|
|
|
|
- Add Grafana dashboard and vector sync metric instrumentation
|
|
|
|
## v0.32.1 (2025-11-12)
|
|
|
|
### Fix
|
|
|
|
- add dynamic dimension detection for Ollama embedding models
|
|
|
|
## v0.32.0 (2025-11-11)
|
|
|
|
### Feat
|
|
|
|
- **ollama**: Pull model on startup if not available in ollama
|
|
- add dynamic vector sync status updates with htmx polling
|
|
- add webhook management UI and BeforeNodeDeletedEvent support
|
|
- validate Nextcloud webhook schemas and document findings
|
|
|
|
### Fix
|
|
|
|
- improve webapp tab UI with CSS Grid and viewport-filling container
|
|
|
|
### Refactor
|
|
|
|
- move webapp from /user/page to /app
|
|
- consolidate database storage for webhooks and OAuth tokens
|
|
|
|
## v0.31.1 (2025-11-10)
|
|
|
|
### Refactor
|
|
|
|
- simplify OpenTelemetry tracing configuration
|
|
|
|
## v0.31.0 (2025-11-10)
|
|
|
|
### Feat
|
|
|
|
- skip tracing for health and metrics endpoints
|
|
|
|
### Fix
|
|
|
|
- add retry logic for ETag conflicts in category change test
|
|
- optimize Notes API pagination with pruneBefore parameter
|
|
|
|
## v0.30.0 (2025-11-10)
|
|
|
|
### Feat
|
|
|
|
- **helm**: Add document chunking configuration
|
|
- **vector**: Add configurable chunk size and overlap for document embedding
|
|
- **vector**: Support multiple embedding models with auto-generated collection names
|
|
|
|
### Fix
|
|
|
|
- Support in-memory Qdrant for CI testing
|
|
|
|
## v0.29.2 (2025-11-09)
|
|
|
|
### Fix
|
|
|
|
- **helm**: Set default strategy to Recreate
|
|
|
|
## v0.29.1 (2025-11-09)
|
|
|
|
### Fix
|
|
|
|
- **observability**: isolate metrics endpoint to dedicated port
|
|
|
|
## v0.29.0 (2025-11-09)
|
|
|
|
### Feat
|
|
|
|
- **helm**: Add observability support with ServiceMonitor and Grafana dashboard
|
|
|
|
### Fix
|
|
|
|
- **readiness**: Only check external Qdrant in network mode
|
|
|
|
## v0.28.0 (2025-11-09)
|
|
|
|
### Feat
|
|
|
|
- **observability**: Add comprehensive monitoring with Prometheus and OpenTelemetry
|
|
|
|
### Fix
|
|
|
|
- **vector**: Handle missing 'modified' field in notes gracefully
|
|
|
|
## v0.27.3 (2025-11-09)
|
|
|
|
### Fix
|
|
|
|
- **ci**: Use helm dependency build instead of update to use Chart.lock
|
|
|
|
## v0.27.2 (2025-11-09)
|
|
|
|
### Fix
|
|
|
|
- **helm**: update Qdrant dependency condition to match new mode structure
|
|
|
|
## v0.27.1 (2025-11-09)
|
|
|
|
### Fix
|
|
|
|
- **ci**: add Helm repository setup to chart release workflow
|
|
|
|
## v0.27.0 (2025-11-09)
|
|
|
|
### Feat
|
|
|
|
- **helm**: add Qdrant local mode support with three deployment options [skip ci]
|
|
- add Qdrant local mode support with in-memory and persistent storage
|
|
- implement ADR-009 - refactor semantic search to use generic semantic:read scope
|
|
- implement MCP sampling for semantic search RAG (ADR-008)
|
|
- add optional vector database and semantic search to helm chart
|
|
- add vector sync processing status to /app endpoint
|
|
- implement semantic search tool and fix vector sync issues (ADR-007 Phase 3)
|
|
- implement vector sync scanner and processor (ADR-007 Phase 2)
|
|
|
|
### Fix
|
|
|
|
- implement deletion grace period and vector sync status tool
|
|
- remove unnecessary urllib3<2.0 constraint
|
|
- integrate vector sync tasks with Starlette lifespan for streamable-http
|
|
|
|
### Refactor
|
|
|
|
- migrate vector sync from asyncio.Queue to anyio memory object streams
|
|
- update to Qdrant query_points API and fix Playwright Keycloak login
|
|
|
|
## v0.26.1 (2025-11-08)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.21,<1.22
|
|
|
|
## v0.26.0 (2025-11-08)
|
|
|
|
### Feat
|
|
|
|
- add real elicitation integration test with python-sdk MCP client
|
|
- unify session architecture and enhance login status visibility
|
|
|
|
### Fix
|
|
|
|
- Consolidate OAuth callbacks and implement PKCE for all flows
|
|
|
|
## v0.25.0 (2025-11-05)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- All OAuth deployments must be reconfigured to specify
|
|
resource URIs (NEXTCLOUD_MCP_SERVER_URL and NEXTCLOUD_RESOURCE_URI) and
|
|
choose between multi-audience or token exchange mode.
|
|
|
|
### Feat
|
|
|
|
- Implement ADR-005 unified token verifier to eliminate token passthrough vulnerability
|
|
|
|
### Fix
|
|
|
|
- Implement proper OAuth resource parameters and PRM-based discovery
|
|
- Simplify token verifier to be RFC 7519 compliant
|
|
- Use Keycloak client ID for NEXTCLOUD_RESOURCE_URI in token exchange
|
|
- Correct OAuth token audience validation for multi-audience mode
|
|
|
|
### Refactor
|
|
|
|
- Eliminate duplicate validation logic in UnifiedTokenVerifier
|
|
|
|
## v0.24.1 (2025-11-04)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.20,<1.21
|
|
|
|
## v0.24.0 (2025-11-04)
|
|
|
|
### Feat
|
|
|
|
- add scope protection to OAuth provisioning tools
|
|
- enable authorization services for token exchange in Keycloak
|
|
- implement scope-based audience mapping and RFC 9728 support
|
|
- integrate token exchange into MCP server application
|
|
- implement RFC 8693 Standard Token Exchange for Keycloak
|
|
- Add userinfo route/page
|
|
- add browser-based user info page with separate OAuth flow
|
|
- Implement ADR-004 Progressive Consent foundation (partial)
|
|
- Complete ADR-004 Progressive Consent OAuth flows implementation
|
|
- Implement ADR-004 Progressive Consent foundation components
|
|
- Implement ADR-004 Hybrid Flow with comprehensive integration tests
|
|
|
|
### Fix
|
|
|
|
- add missing await for get_nextcloud_client in capabilities resource
|
|
- use valid Fernet encryption keys in token exchange tests
|
|
- accept resource URL in token audience for Nextcloud JWT tokens
|
|
- remove token-exchange-nextcloud scope and accept tokens without audience
|
|
- move audience mapper from scope to nextcloud-mcp-server client
|
|
- move token-exchange-nextcloud from default to optional scopes
|
|
- restructure routes to prevent SessionAuthBackend from interfering with FastMCP OAuth
|
|
- allow OAuth Bearer tokens on /mcp endpoint by excluding from session auth
|
|
- correct OAuth token audience validation using RFC 8707 resource parameter
|
|
- remove remaining references to deleted oauth_callback and oauth_token
|
|
- remove Hybrid Flow, make Progressive Consent default (ADR-004)
|
|
- browser OAuth userinfo endpoint and refresh token rotation
|
|
- make ENABLE_PROGRESSIVE_CONSENT consistently opt-in (default false)
|
|
- make provisioning checks opt-in (default false)
|
|
- Disable Progressive Consent for mcp-oauth to enable Hybrid Flow tests
|
|
|
|
### Refactor
|
|
|
|
- integrate token exchange into unified get_client() pattern
|
|
|
|
## v0.23.0 (2025-11-03)
|
|
|
|
### Feat
|
|
|
|
- Auto-configure impersonation role in Keycloak realm import
|
|
- Implement dual-tier token exchange (Standard V2 + Legacy V1 impersonation)
|
|
- Add Keycloak external IdP integration with custom scopes
|
|
- Implement RFC 8693 token exchange for Keycloak (ADR-002 Tier 2)
|
|
- Add Keycloak OAuth provider support with refresh token storage
|
|
|
|
### Fix
|
|
|
|
- Complete Keycloak external IdP integration with all tests passing
|
|
- Complete Keycloak external IdP integration with all tests passing
|
|
- Update DCR token_type tests for OIDC app changes
|
|
|
|
### Refactor
|
|
|
|
- Remove NEXTCLOUD_OIDC_CLIENT_STORAGE environment variable
|
|
- Remove unnecessary user_oidc patch - CORSMiddleware patch is sufficient
|
|
- Unify OAuth configuration to be provider-agnostic
|
|
|
|
## v0.22.7 (2025-10-29)
|
|
|
|
### Fix
|
|
|
|
- **helm**: Remove image tag overide
|
|
|
|
## v0.22.6 (2025-10-29)
|
|
|
|
### Fix
|
|
|
|
- **helm**: Update helm chart with extraArgs
|
|
|
|
## v0.22.5 (2025-10-29)
|
|
|
|
### Fix
|
|
|
|
- Update helm chart variables
|
|
|
|
## v0.22.4 (2025-10-29)
|
|
|
|
### Fix
|
|
|
|
- **helm**: Update helm version with release
|
|
- **helm**: Update helm version with release
|
|
|
|
## v0.22.3 (2025-10-29)
|
|
|
|
### Fix
|
|
|
|
- **helm**: Update helm version with release
|
|
|
|
## v0.22.2 (2025-10-29)
|
|
|
|
### Fix
|
|
|
|
- **helm**: Update helm version with release
|
|
|
|
## v0.22.1 (2025-10-29)
|
|
|
|
### Fix
|
|
|
|
- Trigger release
|
|
|
|
## v0.22.0 (2025-10-29)
|
|
|
|
### Feat
|
|
|
|
- **server**: Add /live & /health endpoints
|
|
- Initialize helm chart
|
|
|
|
## v0.21.0 (2025-10-25)
|
|
|
|
### Feat
|
|
|
|
- Add text processing background worker for telling client about progress
|
|
|
|
### Refactor
|
|
|
|
- Transform document parsing into pluggable processor architecture
|
|
|
|
## v0.20.0 (2025-10-24)
|
|
|
|
### Feat
|
|
|
|
- **auth**: Add support for client registration deletion
|
|
- Split read/write scopes into app:read/write scopes
|
|
|
|
### Fix
|
|
|
|
- Add support for RFC 7592 client registration and deletion
|
|
- Update webdav models for proper serialization
|
|
|
|
## v0.19.1 (2025-10-24)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.19,<1.20
|
|
|
|
## v0.19.0 (2025-10-23)
|
|
|
|
### Feat
|
|
|
|
- Enable token introspection for opaque tokens
|
|
|
|
### Fix
|
|
|
|
- Add CORS middleware to allow browser-based clients like MCP Inspector
|
|
|
|
## v0.18.0 (2025-10-23)
|
|
|
|
### Feat
|
|
|
|
- **server**: Add support for custom OIDC scopes and permissions via JWTs
|
|
- Initialize JWT-scoped tools
|
|
|
|
### Fix
|
|
|
|
- Use occ-created OAuth clients with allowed_scopes for all tests
|
|
- Separate OAuth fixtures for opaque vs JWT tokens
|
|
|
|
### Refactor
|
|
|
|
- Update JWT client to use DCR, re-enable tool filtering
|
|
|
|
## v0.17.1 (2025-10-20)
|
|
|
|
### Fix
|
|
|
|
- **caldav**: Fix caldav search() due to missing todos
|
|
|
|
## v0.17.0 (2025-10-19)
|
|
|
|
### Feat
|
|
|
|
- **caldav**: Add support for tasks
|
|
|
|
### Fix
|
|
|
|
- **caldav**: Check that calendar exists after creation to avoid race condition
|
|
- **caldav**: Properly parse datetimes as vDDDTypes
|
|
|
|
### Refactor
|
|
|
|
- Migrate from internal CalendarClient to caldav library
|
|
|
|
## v0.16.0 (2025-10-19)
|
|
|
|
### Feat
|
|
|
|
- **webdav**: Add search and list favorite response tools
|
|
|
|
### Perf
|
|
|
|
- **notes**: Improve notes search performance using async iterators
|
|
|
|
## v0.15.2 (2025-10-17)
|
|
|
|
### Refactor
|
|
|
|
- Unify logging & remove factory deployment
|
|
|
|
## v0.15.1 (2025-10-17)
|
|
|
|
### Fix
|
|
|
|
- Increase HTTP client timeout to 30s
|
|
- Handle RequestError in mcp tools
|
|
|
|
## v0.15.0 (2025-10-17)
|
|
|
|
### Feat
|
|
|
|
- **cookbook**: Add full Cookbook app support with 13 tools and 2 resources
|
|
|
|
## v0.14.3 (2025-10-17)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.18,<1.19
|
|
|
|
## v0.14.2 (2025-10-16)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency pillow to v12
|
|
|
|
## v0.14.1 (2025-10-15)
|
|
|
|
### Fix
|
|
|
|
- **oauth**: Remove the option to force_register new clients
|
|
|
|
## v0.14.0 (2025-10-15)
|
|
|
|
### Feat
|
|
|
|
- Add Groups API client
|
|
- add sharing API client and server tools
|
|
- **users**: Initialize user API client
|
|
|
|
### Fix
|
|
|
|
- Update user/groups API to OCS v2
|
|
|
|
## v0.13.0 (2025-10-13)
|
|
|
|
### Feat
|
|
|
|
- **server**: Experimental support for OAuth2/OIDC authentication
|
|
|
|
## v0.12.6 (2025-10-11)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.17,<1.18
|
|
|
|
## v0.12.5 (2025-10-03)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.16,<1.17
|
|
|
|
## v0.12.4 (2025-09-25)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.15,<1.16
|
|
|
|
## v0.12.3 (2025-09-23)
|
|
|
|
### Refactor
|
|
|
|
- Add tools for all resources to enable tool-only workflows
|
|
|
|
## v0.12.2 (2025-09-20)
|
|
|
|
### Refactor
|
|
|
|
- Add `http` to --transport option
|
|
|
|
## v0.12.1 (2025-09-11)
|
|
|
|
### Fix
|
|
|
|
- **docker**: Provide --host 0.0.0.0 in default docker image
|
|
|
|
## v0.12.0 (2025-09-11)
|
|
|
|
### Feat
|
|
|
|
- **server**: Add support for `streamable-http` transport type
|
|
|
|
## v0.11.1 (2025-09-11)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.13,<1.14
|
|
|
|
## v0.11.0 (2025-09-11)
|
|
|
|
### Feat
|
|
|
|
- **deck**: Add support for stack, cards, labels
|
|
- **deck**: Initialize Deck app client/server
|
|
|
|
## v0.10.0 (2025-09-10)
|
|
|
|
### Feat
|
|
|
|
- Add WebDAV resource copy functionality
|
|
- Add WebDAV resource move/rename functionality
|
|
|
|
## v0.9.0 (2025-09-10)
|
|
|
|
### BREAKING CHANGE
|
|
|
|
- FASTMCP_-prefixed env vars have been replaced by CLI
|
|
arguments. Refer to the README for updated usage.
|
|
|
|
### Feat
|
|
|
|
- **cli**: Replace `mcp run` with click CLI and runtime options
|
|
|
|
## v0.8.3 (2025-08-31)
|
|
|
|
### Fix
|
|
|
|
- **server**: Replace ErrorResponses with standard McpErrors
|
|
- **notes**: Include ETags in responses to avoid accidently updates
|
|
|
|
## v0.8.2 (2025-08-31)
|
|
|
|
### Fix
|
|
|
|
- **notes**: Remove note contents from responses to reduce token usage
|
|
|
|
## v0.8.1 (2025-08-30)
|
|
|
|
### Fix
|
|
|
|
- **model**: Serialize timestamps in RFC3339 format
|
|
|
|
## v0.8.0 (2025-08-30)
|
|
|
|
### Feat
|
|
|
|
- **client**: Preserve fields when modifying contacts/calendar resources
|
|
- **server**: Add structured output to all tool/resource output
|
|
|
|
### Refactor
|
|
|
|
- Use _make_request where available
|
|
|
|
## v0.7.2 (2025-08-30)
|
|
|
|
### Fix
|
|
|
|
- **client**: Use paging to fetch all notes
|
|
|
|
## v0.7.1 (2025-08-08)
|
|
|
|
### Fix
|
|
|
|
- **client**: Strip cookies from responses to avoid falsely raising CSRF errors
|
|
|
|
## v0.7.0 (2025-08-03)
|
|
|
|
### Feat
|
|
|
|
- **contacts**: Initialize Contacts App
|
|
|
|
## v0.6.1 (2025-08-01)
|
|
|
|
### Fix
|
|
|
|
- **calendar**: Fix iCalendar date vs datetime format
|
|
- **calendar**: Remove try/except in calendar API
|
|
|
|
## v0.6.0 (2025-07-29)
|
|
|
|
### Feat
|
|
|
|
- **calendar**: add comprehensive Calendar app support via CalDAV protocol
|
|
|
|
### Fix
|
|
|
|
- apply ruff formatting to pass CI checks
|
|
- **calendar**: address PR feedback from maintainer
|
|
|
|
### Refactor
|
|
|
|
- **calendar**: optimize logging for production readiness
|
|
|
|
## v0.5.0 (2025-07-26)
|
|
|
|
### Feat
|
|
|
|
- Update webdav client create_directory method to handle recursive directories
|
|
- **webdav**: add complete file system support
|
|
|
|
### Fix
|
|
|
|
- apply ruff formatting to test_webdav_operations.py
|
|
|
|
## v0.4.1 (2025-07-10)
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.10,<1.11
|
|
|
|
## v0.4.0 (2025-07-06)
|
|
|
|
### Feat
|
|
|
|
- Add TablesClient and associated tools
|
|
|
|
### Fix
|
|
|
|
- update tests
|
|
|
|
### Refactor
|
|
|
|
- Modularize NC and Notes app client
|
|
|
|
## v0.3.0 (2025-06-06)
|
|
|
|
### Feat
|
|
|
|
- Switch to using async client
|
|
|
|
## v0.2.5 (2025-05-25)
|
|
|
|
### Fix
|
|
|
|
- Commitizen release process
|
|
|
|
## v0.2.4 (2025-05-25)
|
|
|
|
### Fix
|
|
|
|
- Do not update dependencies when running in Dockerfile
|
|
- Configure logging
|
|
|
|
## v0.2.3 (2025-05-25)
|
|
|
|
### Fix
|
|
|
|
- Limit search results to notes with score > 0.5
|
|
|
|
## v0.2.2 (2025-05-24)
|
|
|
|
### Fix
|
|
|
|
- Install deps before checking service
|
|
|
|
## v0.2.1 (2025-05-24)
|
|
|
|
### Fix
|
|
|
|
- Install deps before checking service
|
|
|
|
## v0.2.1 (2025-05-24)
|
|
|
|
## v0.2.0 (2025-05-24)
|
|
|
|
### Feat
|
|
|
|
- **notes**: Add append to note functionality
|
|
|
|
### Fix
|
|
|
|
- **deps**: update dependency mcp to >=1.9,<1.10
|
|
|
|
## v0.1.3 (2025-05-16)
|
|
|
|
## v0.1.2 (2025-05-05)
|
|
|
|
## v0.1.1 (2025-05-05)
|
|
|
|
## v0.1.0 (2025-05-05)
|