mcp-nextcloud/CHANGELOG.md

Changelog - MCP Server

All notable changes to the Nextcloud MCP Server will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to PEP 440.

v0.110.1 (2026-06-10)

Fix

• app: port-aware MCP URL fallback + clear readiness cache per lifespan (round 4)
• app: cancel readiness loop on lifespan shutdown (review round 2)
• config: correct OIDC token-type/scopes env keys; address review round 1
• health: non-gating readiness probe; shared-task-group lifespan; settings migration

Refactor

• app: cancel only the readiness loop at shutdown (review round 3)

v0.110.0 (2026-06-08)

Feat

• metering: pages_embedded = real parsed page count

Refactor

• metering: harden page_count guard per review

v0.109.1 (2026-06-08)

Fix

• documents: guard Unix-only resource import for Windows (#877)

Refactor

• documents: fully decouple document stack from server startup; Windows-safe tests

v0.109.0 (2026-06-08)

Feat

• usage: rename metrics → tokens_embedded/pages_embedded + export token cost to Prometheus
• usage: meter embedding tokens as embeddings_queries on both paths

Fix

• usage: drop redundant GatewayProvider.embed_batch override (round 3)
• usage: embed query once across doc_types; address review round 1

Refactor

• search: structural per-instance query side-channel; doc search billing gap
• usage: extract indexing metering helper; address review round 2

v0.108.3 (2026-06-08)

Fix

• contacts: address PR #876 round-2 nits
• contacts: address PR #876 round-1 review
• contacts: resolve real CardDAV object path for delete/update (fixes #874)

v0.108.2 (2026-06-07)

Fix

• vector: address PR #873 round-2 review
• vector: gate scanner app polls on per-user enabled apps

v0.108.1 (2026-06-07)

Fix

• deck: include archived cards in list tools for status=all/archived

Refactor

• deck: address PR #872 round-1 review

v0.108.0 (2026-06-07)

Feat

• usage: record per-tenant usage events into the app DB

Refactor

• usage: final round-6 nits on PR #871
• usage: close out round-5 nits on PR #871
• usage: address round-4 review on PR #871
• usage: address round-3 review on PR #871
• usage: address round-2 review on PR #871
• usage: address round-1 review on PR #871

v0.107.0 (2026-06-06)

BREAKING CHANGE

• PDFs are re-chunked page-aware by default. Existing deployments will re-index PDF content on the next vector sync (different chunk counts and page_number labels). Set DOCUMENT_CHUNK_PAGE_AWARE=false to retain the previous char-based behaviour.

Feat

• vector: page-aware PDF chunking for predictable per-page retrieval

Fix

• vector: skip page-assignment span/warning on empty boundaries
• vector: route empty page_boundaries to char-based path; test ws offsets

v0.106.0 (2026-06-06)

Feat

• vector: index files in real time on vector-index tag changes

v0.105.0 (2026-06-05)

Feat

• quality + scan OCR escalation trigger (junk-text-layer scans)

Fix

• review: unify "scanned" flag name + log image_coverage length drift
• review: align classify_pdf routing with the hot path + scan-tail test
• review: align quality threshold, cap + DRY scan coverage, warn on failure

v0.104.1 (2026-06-05)

Fix

• close pypdfium2 page handle on error + cover classifier/OCR edge cases

v0.104.0 (2026-06-05)

Feat

• tier-3 OCR processor (gateway or direct Mistral)
• tiered PDF processor with pypdfium2 fast path (deprecate pymupdf4llm)

Fix

• review: _enum_fields validation, gate classify_from_text flags, OCR warnings
• review: lock OCR backend init, warn on rollback fallthrough, zero-page metric
• review: cache OCR backend, drop asserts, real pipeline_tier, guard zero-page
• OCR escalation falls back to tier-1 result when OCR can't run

v0.103.0 (2026-06-04)

Feat

• use Nextcloud filename for indexed file title + reconcile on rename

Fix

• review: guard placeholder in scanner reconcile + test dual-write path

v0.102.0 (2026-06-04)

Feat

• tier-0 document classifier in shadow mode

Fix

• review: warn (not debug) on shadow-classify failure; tidy pymupdf usage
• review: sample last page, document flags-vs-routing, add flag-path tests

v0.101.4 (2026-06-04)

Fix

• lower DOCUMENT_PDF_GRAPHICS_LIMIT default 5000 -> 1000

v0.101.3 (2026-06-04)

Fix

• tests: moderate re-scan interval to stop multi-user index churn
• tests: fast vector-sync cadence for multi-user-basic CI service
• tests: repair multi-user-basic Astrolabe integration suite

v0.101.2 (2026-06-04)

Fix

• review: type timeout as float; document worker reuse + identity check
• review: require graphics_limit>=1, type _index_document, cover rlimit branch
• review: close doc via try/finally; don't count parse failures as indexed
• isolate PDF parse in a subprocess so a bad file can't OOM the pod

v0.101.1 (2026-06-04)

Fix

• resolve startup NameError in vector-sync metrics task

v0.101.0 (2026-06-04)

BREAKING CHANGE

• /api/v1/vector-sync/status field indexed_documents now holds the distinct-document count (was the chunk count); the chunk count moved to the new indexed_chunks field. The Astrolabe UI + the nc_get_vector_sync_status MCP tool / userinfo page are harmonized in a follow-up (Deck #195).

Feat

• harmonize MCP tool + userinfo page to documents/chunks model
• backend-agnostic vector-sync gauges (pending/documents/chunks)

Fix

• add metrics-interval validator + type/test gaps (review #850)

v0.100.0 (2026-06-04)

Feat

• add IngestTransport port for local/distributed ingest backends

Refactor

• address PR #851 review round 5 (ingest transport)
• address PR #851 review round 4 (ingest transport)
• address PR #851 review round 3 (ingest transport)
• address PR #851 review round 2 (ingest transport)
• address PR #851 review round 1 (ingest transport)

v0.99.0 (2026-06-04)

Feat

• dedup shared-file parsing/embedding across users in vector sync

Fix

• only merge prior acl_principals for files (review #848)
• webdav: harden offset/key truthiness and escape SEARCH mime type
• webdav: await fallback, guard dedup key, split paging for complexity
• paginate tagged-folder SEARCH so the scanner discovers all files

v0.98.1 (2026-06-04)

Fix

• make procrastinate ingest queue opt-in (default to in-process anyio)

v0.98.0 (2026-06-03)

BREAKING CHANGE

• the external-NATS-ingest env vars are removed (INGEST_MODE, STATUS_BACKEND, INGEST_BUS_URL, INGEST_BUS_NUM_REPLICAS, FACT_EVENT_EMITTER). Use INGEST_QUEUE (memory|postgres) and the worker command instead. TENANT_ID is retained (no longer NATS-subject-charset-validated).

Feat

• replace NATS ingest with procrastinate Postgres queue (#183)

Fix

• initialize document processors in the ingest worker (PR #836 round-5)
• address PR #836 round-3 review (lock-key invariant, single open)
• address PR #836 round-2 review (connect/timeout/observability)
• address PR #836 review — forward task_producer to MCP contexts + cleanups
• ci: install procrastinate in the dev group so ty + unit tests resolve it

v0.97.0 (2026-06-03)

Feat

• search: support multiple folders in the semantic-search path filter

Fix

• search: cap path_prefixes server-side; unify Iterable typing
• search: cap path_prefixes at the MCP tool; widen path filter tests
• search: address review feedback on multi-folder path filter

v0.96.0 (2026-06-03)

Feat

• observability: astrolabe_* metrics + traces for the document pipeline

Fix

• observability: address third review round
• observability: address second review round
• observability: address PR review + SonarCloud findings

v0.95.0 (2026-06-03)

Feat

• add Claude Desktop extension (.mcpb) for single-user stdio mode

Fix

• mcpb: add Windows support via platform_overrides and run.cmd
• mcpb: address review feedback on manifest and run.sh

v0.94.1 (2026-06-03)

Fix

• search: address PR #834 re-review (403/404 coverage + docs)
• search: address PR #834 review findings
• search: gate verify-on-read file results on vector-index tag membership

Perf

• search: skip exclusion lookup on empty tag set; fix semaphore comment

v0.94.0 (2026-06-02)

Feat

• search: ADR-027 Phase 2 — file-path filter
• search: ADR-027 Phase 1 — modified-date range filter

v0.93.0 (2026-06-01)

BREAKING CHANGE

• deck list tools now default to detail="summary" and status="open". The include_archived_cards parameter is replaced by status (use status="all" to include archived cards); pass detail="full" to restore the previous per-card shape.

Feat

• deck: compact card/comment retrieval (summaries, filters, board overview)

Refactor

• deck: address PR #826 review feedback

v0.92.1 (2026-06-01)

Fix

• embedding: normalize gateway base_url to the /v1 base path

v0.92.0 (2026-06-01)

Feat

• embedding: gateway provider discovers dimension via GET /v1/models

v0.91.3 (2026-06-01)

Fix

• api: distinguish Nextcloud 5xx from auth failure; tighten body parse (#824)
• api: block cross-user delete and address review feedback (#824)
• api: return 401 not 500 on failed app-password OCS validation (#824)

v0.91.2 (2026-05-31)

Fix

• auth: authenticate stored app passwords with loginName, not UID

v0.91.1 (2026-05-31)

Fix

• vector: make NATS status subscriber resilient at startup

v0.91.0 (2026-05-31)

Feat

• add opt-in MCP decomposition hook points (design §10)

Fix

• stop S7632 flagging NOSONAR mentioned in prose comments
• well-form NOSONAR suppressions (SonarCloud S7632/S7503)
• address PR #814 reviewer follow-ups
• address PR #814 review + SonarCloud gate

v0.90.2 (2026-05-30)

Fix

• vector-sync: isolate per-app scans so a disabled Notes app can't abort sync

v0.90.1 (2026-05-30)

Fix

• api: validate app password against Nextcloud using loginName, not UID

v0.90.0 (2026-05-29)

Feat

• search: ACL-aware vector filter via Nextcloud Shares lookup

Fix

• PR #813 review — cap unified_search multi-type pool; document deck self-only
• cache app-password storage to avoid per-request Alembic upgrade race
• PR #813 review — shared-file context in MCP tool path + viz over-fetch cap
• address PR #813 review round 4 (log leak, cross-user chunk ctx, algo, overlap)
• address PR #813 latest review (ACL-aware doc-type discovery, robustness)
• address PR #813 review (owner_id index, cache bound, explicit param)
• search: address PR #813 review (viz verify-on-read, owners cache, docs)
• auth: make provision/revoke consistent with the app-password store
• auth: login-flow provisioning — public login_url + session app passwords
• search: verify shared files by global file id (ACL-aware)

v0.89.0 (2026-05-24)

Feat

• api: log inbound User-Agent on management API and webhook receiver
• webhooks: add Deck card sync preset with vector indexing

v0.88.3 (2026-05-22)

Fix

• vector-sync: use resolved collection name in orphan sweep
• vector-sync: sweep placeholder orphans at Pod startup (#101)

v0.88.2 (2026-05-21)

Fix

• contacts: surface ORG/TITLE/NOTE/URL/CATEGORIES/PHOTO on read (refs #716)

v0.88.1 (2026-05-20)

Fix

• contacts: warn on unsupported dict/list email/tel update inputs
• contacts: two PR #719 review bugs
• contacts: close PR #719 second-pass review gaps
• contacts: persist all documented fields on create (fixes #716)

Refactor

• contacts: address PR #719 follow-up review

v0.88.0 (2026-05-20)

Feat

• ci: build arm64 Docker images natively on ubuntu-24.04-arm

v0.87.2 (2026-05-17)

Fix

• embedding: instantiate BM25 singleton off the event loop

v0.87.1 (2026-05-17)

Fix

• storage: address review on PR #799 (stale comments, docs deprecation, unit test)
• storage: use NullPool for Postgres engine (cross-loop crashes under anyio TaskGroup)

v0.87.0 (2026-05-17)

Feat

• storage: pluggable database backend via DATABASE_URL (ADR-026)

Fix

• storage: address PR #798 round-4 review (NOSONAR syntax + pg_advisory_lock + engine dispose + nits)
• storage: address PR #798 round-3 review (SonarQube + pool sizing + RETURNING test)
• storage: address PR #798 review feedback (credentials, asyncpg extra, TLS, pool)

v0.86.4 (2026-05-16)

Fix

• config: emit background-ops advisory logs once per process

v0.86.3 (2026-05-12)

Refactor

• convert f-string logging to lazy %-style format (G004)

v0.86.2 (2026-05-12)

Refactor

• drop OAuth-refresh background-sync path from oauth_sync.py

v0.86.1 (2026-05-12)

Refactor

• prune dead pre-LOGIN_FLOW config/runtime branches

v0.86.0 (2026-05-12)

BREAKING CHANGE

• ENABLE_MULTI_USER_BASIC_AUTH is no longer read from the environment, and setting it now raises a startup ValueError with a migration message. Replace ENABLE_MULTI_USER_BASIC_AUTH=true with MCP_DEPLOYMENT_MODE=multi_user_basic. The same loud-deprecation check is also applied to the recently-removed ENABLE_LOGIN_FLOW — replace with MCP_DEPLOYMENT_MODE=login_flow (or drop both; login_flow is the auto-detect default when no other auth env vars are set).
• ENABLE_LOGIN_FLOW is no longer read from the environment. Anyone who relied on ENABLE_LOGIN_FLOW=true to activate Login Flow v2 should set MCP_DEPLOYMENT_MODE=login_flow instead (or rely on it being the default when no other auth env vars are set).
• MCP_DEPLOYMENT_MODE=oauth_single_audience is no longer accepted. Set MCP_DEPLOYMENT_MODE=login_flow (and keep ENABLE_LOGIN_FLOW=true) for the same deployment. The un-augmented OAuth path is no longer supported; if you previously ran the broken path, you can either configure Login Flow v2 (recommended) or switch to multi_user_basic / single_user_basic.

Fix

• config: derive mode flags in Settings.post_init; address review round 2

Refactor

• config: drop ENABLE_MULTI_USER_BASIC_AUTH env var, fail loud on legacy aliases
• config: derive enable_login_flow from mode, remove ENABLE_LOGIN_FLOW env var
• config: rename OAUTH_SINGLE_AUDIENCE to LOGIN_FLOW, gate on ENABLE_LOGIN_FLOW

v0.85.1 (2026-05-11)

Fix

• calendar: preserve floating/TZID semantics across CalDAV roundtrip (#782)

v0.85.0 (2026-05-10)

Feat

• deck: add file/note attachment MCP tools

Fix

• deck: address review — notesPath key, scopes, modernize types

v0.84.2 (2026-05-10)

Fix

• health: forward api-key to Qdrant /readyz so Cloud probes work

v0.84.1 (2026-05-10)

Fix

• vector: address PR review round 17 + local-mode collection-creation regression
• vector: address PR review round 16 — type-aware index check, comments
• vector: address PR review round 15 — concurrency, pagination, stale coercion
• vector: address PR review round 14 — accurate offset-skip comment + news_item doc_id guard
• vector: address PR review round 13 — index offset fields + tighten test
• vector: address PR review round 12 — bool guard + strict doc_id validation
• vector: address PR review round 11 — broaden offset-skip gate, clarify ordering
• vector: address PR review round 10 — index chunk_index, harden index loop, lazy-init lock
• api: validate doc_id at chunk-context handler boundary
• vector: address PR review round 9 — drop redundant guard, add init lock, test float doc_id path
• vector: guard _group_int_doc_ids against non-int doc_id values
• vector: tighten get_chunk_bbox_and_page_from_qdrant doc_id to str
• login-flow: allow Astrolabe's OAuth client on the management API
• vector: address PR review round 8 — anyio convention + cosine-safe sentinel + dedup get_collection
• vector: add BOOL index for is_placeholder + correct wait=True docstring
• vector: address PR review round 6 + SonarCloud findings
• vector: address PR review round 5 — progress logging, summary visibility, sentinel split
• vector: address PR review round 4 — backfill resilience + degraded-mode docs
• vector: address PR review round 3 — sentinel guard, skip indexed fields, narrow types
• vector: address PR review round 2 — status branching, doc_id guard, doc restore
• vector: address PR review — wait=True backfill, batched writes, search helper
• vector: normalize doc_id to str + add Qdrant keyword payload indexes

v0.84.0 (2026-05-10)

Feat

• contacts: add nc_contacts_search_contacts free-text search tool

v0.83.4 (2026-05-10)

Fix

• qdrant: use get_collection for startup probe (multi-tenant safe, take 2)

v0.83.3 (2026-05-10)

Fix

• qdrant: use collection_exists for startup probe (multi-tenant safe)

v0.83.2 (2026-05-09)

Fix

• chunk-context: address PR #767 review — extract bbox helper, fix page_number overwrite
• chunk-context: address PR #767 review — drop dead PDF branch, redundant alias, add boundary tests
• chunk-context: address PR #767 round-3 review — gate readability + legacy-fallback comment
• chunk-context: propagate chunk_index=None through ChunkContext
• chunk-context: address PR #767 round-2 review — gate, parity, doc
• chunk-context: address PR #767 review — doc_type filter parity + tests
• viz_routes: address PR #767 review — param parity + always-on page_number
• viz_routes: validate chunk_index/total_chunks bounds in OAuth route
• chunk-context: use indexed chunk_index lookup, fix close-after-use bug

v0.83.1 (2026-05-09)

Fix

• webdav: decode percent-encoded names in PROPFIND/SEARCH responses

v0.83.0 (2026-05-08)

Feat

• vector: replace inline page-image payloads with chunk_bbox (Deck #76)

Refactor

• vector: address PR #775 review round 3 — fix unused var, harden boundary lookup, rename trace span
• vector: address PR #775 review round 2 — drop dead page field, add omission tests
• vector: address PR #775 review — drop unused payload key, fix resource leaks

v0.82.0 (2026-05-08)

Feat

• providers: add Mistral embedding provider, route registry through dynaconf

Refactor

• providers: address PR #772 review round 3 — hermetic test, lazy logging, defensive-guard tests
• providers: address PR #772 review round 2 — guard, naming, docs, tests
• providers: address PR #772 review — shared retry, cleaner imports, no-op close

v0.81.0 (2026-05-07)

Feat

• vector: expand tagged directories for include + apply EXCLUDED_TAGS in scanner

Fix

• webdav: include fileid in find_by_type SEARCH + address PR #765 review

v0.80.0 (2026-05-06)

Feat

• webdav: add tag-based file exclusion (#710)

Fix

• webdav: finish lazy-logging conversion in get_tag_by_name
• webdav: address PR #764 review round 4
• webdav: address PR #764 review round 3
• webdav: drop anyio.Lock and add integration tests for tag exclusion
• webdav: address PR #764 review round 2
• webdav: address PR #764 review

v0.79.3 (2026-05-03)

Fix

• webhooks: use HTTP 428 instead of 412 for unprovisioned users
• webhooks: use app-password basic auth for NC API calls

v0.79.2 (2026-05-03)

Fix

• test: retry consent handling in login_flow_static_client_token
• webhooks: use OCS v2 capabilities for /api/v1/apps

v0.79.1 (2026-05-03)

Fix

• auth: address PR #758 round-7 medium/minor review
• auth: address PR #758 round-7 important review
• auth: address PR #758 round-6 medium/low review
• auth: address PR #758 round-5 medium/low review
• auth: address PR #758 round-4 review
• auth: address PR #758 round-3 final review
• auth: address PR #758 round-3 review
• auth: address PR #758 round-2 review
• auth: address PR #758 auto-review (id-token verify, nonce, CI key)
• auth: fail closed on missing sub claim, delete Flow 2 callback session
• auth: address PR #758 follow-up review
• auth: use Settings for OIDC env vars in token revocation helper
• auth: address PR #758 review — XSS, CSRF, open redirect, JWKS cache
• auth: harden OAuth/session for hosted multi-tenant deployment (#626)

v0.79.0 (2026-05-02)

Feat

• deck: add response filters and archived stacks tool

Fix

• deck: address PR #759 round-3 review feedback
• deck: address PR #759 round-2 review feedback
• deck: address PR #759 review feedback

v0.78.0 (2026-05-02)

Feat

• auth: elicit Astrolabe URL on missing app password

Fix

• auth: address PR #757 round-3 review feedback
• auth: invalidate scope cache on web/REST provisioning paths
• auth: address PR #757 round-2 review feedback
• auth: address PR #757 review feedback

Refactor

• config: consolidate NEXTCLOUD_PUBLIC_ISSUER_URL through Settings

v0.77.1 (2026-05-01)

Fix

• deps: update dependency icalendar to >=7.1.0,<7.2.0

v0.77.0 (2026-05-01)

Feat

• search: verify-on-read for semantic search results (ADR-019)

Refactor

• search: address PR #750 round 12 review feedback
• search: address PR #750 round 11 review feedback
• search: address PR #750 round 10 review feedback
• search: address PR #750 round 9 review feedback
• search: pre-push review fixes for PR #750
• search: address PR #750 round 8 review feedback
• search: address PR #750 round 7 review feedback
• search: address PR #750 round 6 review feedback
• search: address PR #750 round 5 review feedback
• search: address PR #750 round 4 review feedback
• search: address PR #750 round 3 review feedback
• search: address PR #750 round 2 review feedback
• search: address PR #750 review feedback

v0.76.0 (2026-05-01)

Feat

• infra: distribute terraform modules under infra/terraform

Fix

• infra: address PR review feedback on tf modules

v0.75.2 (2026-04-30)

Fix

• webhooks: escape webhook_uri, lazy logging, document 401 header omission
• webhooks: escape HTML in error responses, compare bearer as bytes
• webhooks: authenticate deliveries via WEBHOOK_SECRET; review nits
• webhooks: wire receiver to vector sync queue and fix registered URI

Refactor

• webhooks: bound queue waits, route URLs through dynaconf
• webhooks: address PR review on auth-pass

v0.75.1 (2026-04-30)

Fix

• vector-sync: wire document streams into OAuthAppContext

v0.75.0 (2026-04-29)

Feat

• talk: add MCP integration for Nextcloud Talk (spreed)

Fix

• talk: address remaining PR #741 reviewer feedback
• talk: address PR #741 reviewer feedback

v0.74.0 (2026-04-29)

Feat

• auth: drop test-client defaults, add ALLOWED_MGMT_CLIENT allowlist

v0.73.2 (2026-04-29)

Fix

• oauth: follow redirects when fetching OIDC discovery

v0.73.1 (2026-04-29)

Fix

• calendar: thread raw credentials to caldav AsyncDAVClient

v0.73.0 (2026-04-29)

Feat

• deck: add card comment tools

Fix

• deck: address review feedback on card comment tools

v0.72.7 (2026-04-27)

Fix

• client: route /apps/* through /index.php for non-pretty-URL installs
• notes: defensively unwrap list-shaped Notes responses (refs #730)

v0.72.6 (2026-04-26)

Fix

• models: coerce Contact.birthday + relax Table.owner_display_name

v0.72.5 (2026-04-23)

Fix

• api: use stored app password for chunk-context and pdf-preview

v0.72.4 (2026-04-16)

Fix

• tests: convert create_mcp_client_session to asynccontextmanager

v0.72.3 (2026-04-15)

Fix

• coerce numeric nutrition values to strings in Cookbook model (fixes #708)

v0.72.2 (2026-04-14)

Fix

• enable uvx/PyPI deployments without Docker assumptions

v0.72.1 (2026-04-07)

Fix

• strip resource server prefix from JWT scopes for tool filtering

v0.72.0 (2026-04-07)

Feat

• add --version option to CLI

v0.71.0 (2026-04-07)

Feat

• add stdio transport support for local MCP usage

Fix

• address third round of review feedback
• address second round of review feedback
• address PR review feedback and fix CI test failures

v0.70.4 (2026-04-07)

Fix

• conditionally include offline_access based on IdP discovery

v0.70.3 (2026-04-07)

Fix

• deps: update dependency mcp to >=1.27,<1.28

v0.70.2 (2026-04-07)

Fix

• conditionally include offline_access in Flow 2 scope request

v0.70.1 (2026-04-07)

Fix

• fall back to client_id when aud claim is absent (Cognito compat)

v0.70.0 (2026-04-07)

Feat

• add OIDC resource server scope prefix for Cognito compatibility

Fix

• address second round of PR review for scope prefix
• address PR review for OIDC scope prefix feature

v0.69.0 (2026-04-07)

Feat

• implement dynaconf configuration management (ADR-024 phases 1-3)

Fix

• resolve dynaconf settings.toml not found in non-editable installs

v0.68.4 (2026-04-07)

Refactor

• change OAuth scope separator from colon to dot for IDP compatibility

v0.68.3 (2026-04-05)

Fix

• address PR review feedback for client registry and DCR proxy
• support cloud OAuth clients and graceful DCR fallback

Refactor

• remove ALLOWED_MCP_CLOUD_CLIENTS and add keycloak CI profile
• consolidate ALLOWED_MCP_CLIENTS and add redirect URI validation

v0.68.2 (2026-04-04)

Fix

• address PR review — remove token exchange tests, improve logging
• address PR review — stale mcp-oauth refs, Playwright TimeoutError catch
• update expected auth tools list for login-flow scope test

Refactor

• remove RFC 8693 token exchange and Keycloak OAuth implementation
• remove oauth profile, migrate MCP/OAuth tests to login-flow

v0.68.1 (2026-04-01)

Fix

• convert BDAY datetime.date to string before Pydantic validation

v0.68.0 (2026-03-31)

Feat

• add web-based Login Flow v2 provisioning endpoint

Fix

• require bearer token on provision endpoints (open redirect mitigation)
• address PR review round 3 — info disclosure, conditional routes, cleanup
• address PR review round 2 — expiry checks, race guards, poll tests
• address PR review — XSS escape, asyncio→anyio, URL rewrite dedup
• use app password auth for background sync in Login Flow mode
• discover Login Flow v2 users in OAuth mode user manager
• rewrite Login Flow v2 poll endpoint URL to use configured host
• handle internal hostname without port in Login Flow v2 URL rewriting

Refactor

• use redirect-based Login Flow v2 provision instead of popup

v0.67.0 (2026-03-29)

Feat

• add Tailscale Funnel config for Claude AI connector testing

v0.66.2 (2026-03-29)

Fix

• allow HTTPS redirect URIs for non-localhost OAuth clients
• move Astrolabe OAuth hook to before-starting for reliable OIDC client creation
• resolve OAuth compatibility issues for login-flow deployment

v0.66.1 (2026-03-28)

Fix

• pin Renovate Nextcloud updates to matching major version

v0.66.0 (2026-03-28)

Feat

• add Nextcloud Collectives app support (#621)

Fix

• address PR review feedback (round 9)
• address PR review feedback (round 8)
• address PR review feedback (round 7) and fix CI
• address PR review feedback (round 6)
• address PR review feedback (round 5)
• add trash/delete collective tools and address review feedback (round 4)
• address PR review feedback (round 3)
• address PR review feedback (round 2)
• correct tool annotations to match ADR-017 conventions
• address PR review feedback for Collectives support

v0.65.4 (2026-03-27)

Fix

• pin starlette<1.0 to prevent startup crash (#648)

v0.65.3 (2026-03-22)

Refactor

• remove Smithery deployment mode

v0.65.2 (2026-03-22)

Fix

• increase vector sync wait timeout to prevent sampling test timeouts in CI
• reduce vector sync scan interval to 5s for single-user service
• expose public status endpoints in all modes and enable vector sync (#637)

v0.65.1 (2026-03-21)

Fix

• resolve OIDC consent flow 500 errors on NC 32
• address PR #632 review comments
• ci: build OIDC app for all test modes including single-user
• patch OIDC consent flow regression and add CI build step
• caldav: address PR #632 review feedback
• caldav: migrate to upstream caldav v3.0.1 to fix href handling (#629)

v0.65.0 (2026-03-03)

Feat

• auth: implement OAuth AS proxy to fix audience mismatch (ADR-023)
• ci: add Nextcloud version matrix (NC 31, 32, 33)
• helm: add login-flow auth mode to Helm chart (ADR-022)
• add Docker Compose profiles and Login Flow v2 service

Fix

• replace assert with proper guard and invalidate scope cache after provisioning
• disable NC rate limiting in dev/CI and add token endpoint diagnostics
• address review feedback — security, caching, CI 429 retry
• skip keycloak hook when profile inactive and update stale PRM test
• address remaining PR #589 review findings
• address PR #589 review findings
• address PR review issues for Login Flow v2
• address PR #589 review feedback (round 2)
• ci: remove dev OIDC mount to fix HTTP 500 in single-user/multi-user-basic
• ci: fix health check timeout and per-profile MCP server URL routing
• ci: fix PHP gating, add multi-user-basic matrix entry, upload debug artifacts
• address PR #589 review feedback for Login Flow v2
• ci: fix integration test collection and skip Playwright in CI
• test: fix 17 pre-existing unit test failures and add astrolabe CI build
• ci: keep third_party mount, always build submodules in CI
• ci: revert accidental third_party mount, use compose override for OIDC
• ci: don't block integration matrix on unit-test failures

v0.64.5 (2026-03-03)

Fix

• handle pythonvCard4 dict-format fields and missing phone numbers (#601)

v0.64.4 (2026-02-26)

Fix

• deps: update dependency icalendar to v7

v0.64.3 (2026-02-21)

Fix

• address PR #574 fourth review round
• address PR #574 third review round
• address PR #574 second review round
• address PR #574 review comments
• wrap raw list returns in response models to produce single TextContent block

v0.64.2 (2026-02-20)

Fix

• address PR #571 review comments
• resolve stale credentials causing astrolabe background sync test failures

Refactor

• enforce PLC0415 (import-outside-top-level) for source code

v0.64.1 (2026-02-18)

Fix

• deps: update dependency mcp to >=1.26,<1.27

v0.64.0 (2026-02-16)

Feat

• add self-signed SSL certificate support for Nextcloud connections

Fix

• add type: ignore for caldav ssl_verify_cert parameter
• convert CA bundle path to ssl.SSLContext to avoid httpx deprecation warning

v0.63.5 (2026-02-16)

Refactor

• remove stale astrolabe references from commitizen config
• extract Astrolabe to separate repository

v0.63.4 (2026-02-08)

Fix

• strip whitespace from category names when splitting
• handle categories, recurrence_rule, attendees, and reminder_minutes in update_event

v0.63.3 (2026-02-08)

Fix

• expand recurring events in date-range queries

v0.63.2 (2026-02-07)

Fix

• use CalDAV time-range filter for calendar date range queries

v0.63.1 (2026-02-03)

Fix

• helm: add backward compatibility for legacy persistence configs

v0.63.0 (2026-01-28)

Feat

• astrolabe: add background token refresh job

Fix

• astrolabe: add pagination and psalm fixes for token refresh
• astrolabe: add locking to prevent token refresh race condition
• astrolabe: add issued_at to on-demand token refresh

v0.62.0 (2026-01-26)

Feat

• scripts: add database query helpers for development

Fix

• astrolabe: resolve Psalm type errors in PDF preview code
• astrolabe: fix Psalm baseline and ESLint import order
• astrolabe: load pdfjs-dist externally to fix PDF viewer
• astrolabe: improve error messages for authorization issues
• astrolabe: rename OAuthController and fix app password check
• tests: improve Astrolabe integration test reliability
• astrolabe: update Plotly title attributes for v3 compatibility
• deps: update dependency plotly.js-dist-min to v3

Refactor

• api: split management.py into domain-focused modules
• astrolabe: replace client-side PDF.js with server-side PyMuPDF rendering

v0.61.5 (2026-01-17)

Fix

• astrolabe: improve token refresh error handling and validation
• astrolabe: delete stale tokens when refresh fails
• astrolabe: resolve CI failures for code quality checks
• astrolabe: use internal URL for OAuth token refresh

Refactor

• astrolabe: add PHP property types to fix Psalm errors
• astrolabe: upgrade to @nextcloud/vue 9.3.3 API

v0.61.4 (2026-01-16)

Fix

• astrolabe: Address reviewer feedback for hybrid mode
• astrolabe: Fix NcSelect options and CSS loading
• astrolabe: fix OAuth flow and settings UI for hybrid mode
• api: return OIDC config in hybrid mode for Astrolabe OAuth flow

v0.61.3 (2026-01-15)

Fix

• astrolabe: address review feedback for Vue 3 bindings
• astrolabe: update Vue component bindings for Vue 3 compatibility

v0.61.2 (2026-01-15)

Fix

• ci: bump helm chart version when MCP appVersion changes

v0.61.1 (2026-01-15)

Fix

• astrolabe: define appName and appVersion for @nextcloud/vue

v0.61.0 (2026-01-14)

Feat

• Add rate limiting and extract helpers for app password endpoints

Fix

• Add missing annotations for deck remove/unassign operations
• auth: Store app passwords locally for multi-user BasicAuth background sync

Refactor

• Use get_settings() for vector sync enabled check
• Extract storage helper and improve PHP error handling

v0.60.4 (2026-01-12)

Fix

• deck: use correct endpoint for reorder_card to fix cross-stack moves

v0.60.3 (2025-12-31)

Fix

• deck: Always preserve fields in update_card for partial updates
• astrolabe: Fix CSS loading for Nextcloud apps
• astrolabe: Fix revoke access button HTTP method mismatch

v0.60.2 (2025-12-29)

Fix

• oauth: Enable browser OAuth routes for Management API in hybrid mode

v0.60.1 (2025-12-26)

Fix

• mcp: Move all imports to the top of modules

v0.60.0 (2025-12-26)

Feat

• Remove URL rewriting in favor of proper nextcloud config
• helm: migrate to new environment variable naming convention
• Migrate to vue 3
• astrolabe: upgrade to Vue 3 and @nextcloud/vue 9

Fix

• tests: Add singleton reset fixture to prevent anyio.WouldBlock errors
• tests: Fix integration test failures in qdrant, sampling, and rag tests
• auth: Skip issuer validation for management API tokens
• Use settings.enable_offline_access for env var consolidation
• Add required config.py attributes
• docker: remove overwritehost to fix container-to-container DCR
• deps: update dependency @nextcloud/vue to v9
• deps: update dependency vue to v3

Refactor

• auth: Decouple BasicAuth and OAuth authentication strategies

v0.59.1 (2025-12-22)

Fix

• helm: set OIDC client env vars when using existingSecret
• helm: trigger chart release workflow on helm chart tags

v0.59.0 (2025-12-22)

Feat

• helm: add support for multi-user BasicAuth mode

Fix

• helm: address PR #447 reviewer feedback
• helm: include MCP server version bumps in changelog pattern

v0.58.0 (2025-12-22)

Feat

• config: enable DCR for multi-user BasicAuth with offline access
• astrolabe: implement app password provisioning for multi-user background sync
• config: consolidate configuration with smart dependency resolution (ADR-021)

v0.57.0 (2025-12-20)

Feat

• auth: add multi-user BasicAuth pass-through mode
• astrolabe: add dynamic MCP server configuration for testing

Fix

• config: address reviewer feedback

Refactor

• config: centralize configuration validation and simplify startup

v0.56.2 (2025-12-20)

Fix

• astrolabe: screenshots in info.xml
• astrolabe: screenshots in info.xml

v0.56.1 (2025-12-19)

Fix

• astrolabe: Update screenshots
• ci: skip existing Helm chart releases to prevent duplicate release errors

v0.56.0 (2025-12-19)

Feat

• ci: add --increment flag to bump scripts for manual version control

Fix

• astrolabe: add contents:write permission to appstore workflow
• astrolabe: update commitizen pattern to properly update info.xml version
• astrolabe: prevent workflow failure when only helm/astrolabe commits exist
• astrolabe: info.xml

v0.55.1 (2025-12-19)

Fix

• ci: push all tags explicitly in bump workflow

v0.55.0 (2025-12-19)

BREAKING CHANGE

• MCP server now bumps for ANY conventional commit except those explicitly scoped to helm or astrolabe.

Feat

• ci: implement monorepo-aware version bumping workflow

Fix

• ci: make MCP server default bump target for all non-scoped commits
• ci: restrict docker build to MCP server tags only
• ci: correct appstore-push-action version to v1.0.4

v0.54.0 (2025-12-19)

Feat

• astrolabe: add Nextcloud App Store deployment automation
• configure commitizen monorepo with independent versioning

Fix

• ci: improve versioning and error handling
• ci: address critical workflow and validation issues
• astrolabe: address code review feedback

v0.53.0 (2025-12-19)

Feat

• add Alembic database migration system
• make chunk modal title clickable link to documents
• add native Plotly hover styling for clickable points
• add click interactivity to Plotly 3D scatter chart
• improve chunk viewer with fixed navigation and markdown rendering
• astrolabe: enable multi-select for document types and refactor PDF viewer
• auth: implement refresh token rotation for Nextcloud OIDC
• astrolabe: enhance unified search and add webhook management
• astrolabe: add webhook management UI to admin settings
• astrolabe: add OAuth token refresh and webhook presets
• search: add file_path metadata and chunk offsets to search results
• astrolabe: use proper icons and thumbnails in unified search
• astrolabe: add admin search settings and enhanced UI
• astrolabe: add unified search provider with clickable file links
• astrolabe: add 3D PCA visualization for semantic search
• astrolabe: add Nextcloud PHP app for MCP server management
• vector-sync: enable background sync in OAuth mode

Fix

• security: address critical security issues from PR #401 code review
• oauth: enable PKCE for all clients and add token_broker to oauth_context
• astrolabe: revert invalid files_pdfviewer URL for file links
• resolve type checking warnings for CI
• move Alembic to package submodule for Docker compatibility
• update unified search results to match chunk viz display
• astrolabe: handle OAuth refresh token rotation
• address critical code review issues (4 fixes)
• resolve CI linting issues for Astroglobe

Refactor

• astrolabe: extract PDF viewer to dedicated component
• astrolabe: reframe UI as semantic search service

v0.52.1 (2025-12-13)

Perf

• deck: optimize card lookup by storing board_id/stack_id in metadata

v0.52.0 (2025-12-13)

Feat

• vector: add Deck card vector search with visualization support

v0.51.0 (2025-12-13)

Feat

• vector-viz: add news_item support for links and chunk expansion

v0.50.2 (2025-12-13)

Fix

• news: revert get_item() to use get_items() + filter

v0.50.1 (2025-12-12)

Fix

• Disable DNS rebinding protection for containerized deployments
• deps: update dependency mcp to >=1.23,<1.24

v0.50.0 (2025-12-11)

Feat

• add MCP tool annotations for enhanced UX

Fix

• address PR review feedback

v0.49.2 (2025-12-09)

Fix

• Update lockfile

v0.49.1 (2025-12-09)

Fix

• Revert mcp version <1.23

v0.49.0 (2025-12-08)

Feat

• news: add Nextcloud News app integration

Fix

• resolve all type checking errors (8 errors fixed)

Refactor

• news: simplify vector sync to fetch all items

Perf

• news: use direct API endpoint for get_item()

v0.48.6 (2025-12-03)

Fix

• deps: update dependency mcp to >=1.23,<1.24

v0.48.5 (2025-11-28)

Fix

• deps: update dependency pillow to v12

v0.48.4 (2025-11-23)

Fix

• Add rate limit retry logic to OpenAI provider

v0.48.3 (2025-11-23)

Fix

• Increase MCP sampling timeout to 5 minutes for slower LLMs

v0.48.2 (2025-11-23)

Fix

• Share vector sync state with FastMCP session lifespan via module singleton
• Share vector sync state with FastMCP session lifespan via module singleton

v0.48.1 (2025-11-23)

Fix

• Use WebDAV for tag creation and add LLM-as-a-judge for RAG tests

Refactor

• Move background tasks to server lifespan and deprecate SSE transport

v0.48.0 (2025-11-23)

Feat

• Add tag management methods to WebDAV client

v0.47.0 (2025-11-23)

Feat

• Add OpenAI provider support for embeddings and generation

v0.46.2 (2025-11-22)

Fix

• smithery: Enable JSON response format for scanner compatibility

v0.46.1 (2025-11-22)

Perf

• Optimize vector viz search performance

v0.46.0 (2025-11-22)

Feat

• Add Smithery CLI deployment support
• Implement ADR-016 Smithery stateless deployment mode

Fix

• smithery: Add JSON Schema metadata to mcp-config endpoint
• smithery: Use container runtime pattern for config discovery
• Add Smithery lifespan and auth mode detection

v0.45.0 (2025-11-22)

Feat

• Add context expansion to semantic search with chunk overlap removal
• Use Ollama native batch API in embed_batch()
• Implement Qdrant placeholder state management
• Switch files to use numeric IDs with file_path resolution
• Implement per-chunk vector visualization with context expansion

Fix

• Use alpha_composite for proper RGBA highlight blending
• Remove pymupdf.layout.activate() to fix page_chunks behavior
• Centralize PDF processing and generate separate images per chunk
• Set is_placeholder=False in processor to fix search filtering
• Increase placeholder staleness threshold to 5x scan interval
• Add placeholder staleness check to prevent duplicate processing
• Use empty SparseVector instead of None for placeholders
• Return empty array instead of null for query_coords when no results
• Align PDF text extraction between indexing and context expansion
• Update models and viz to use int-only doc_id
• Reconstruct full content for notes to match indexed offsets
• Add async/await, PDF metadata, and type safety fixes

Refactor

• Simplify PDF text extraction with single to_markdown call

Perf

• Optimize PDF processing with parallel extraction and single-render highlights

v0.44.1 (2025-11-21)

Fix

• deps: update dependency mcp to >=1.22,<1.23

v0.44.0 (2025-11-19)

Feat

• Improve vector visualization with static assets and fixes
• Redesign UI to match Nextcloud ecosystem aesthetic

Fix

• Improve 3D plot rendering with explicit dimensions and window resize support
• Preserve 3D plot camera and improve documentation
• Preserve 3D plot camera position and fix CSS loading

v0.43.0 (2025-11-18)

Feat

• Replace custom document chunker with LangChain MarkdownTextSplitter

v0.42.0 (2025-11-17)

Feat

• viz: Add dual-score display and improve UI controls

v0.41.0 (2025-11-17)

Feat

• add configurable fusion algorithms for BM25 hybrid search
• add chunk position tracking to vector indexing and search
• add vector viz template and chunk context endpoint

Fix

• prevent infinite loop in DocumentChunker with position tracking
• Relax SearchResult validation to support DBSF fusion scores > 1.0

v0.40.0 (2025-11-16)

Feat

• add unified provider architecture with Amazon Bedrock support

Fix

• suppress Starlette middleware type warnings in ty checker

v0.39.0 (2025-11-16)

Feat

• Implement BM25 hybrid search with native Qdrant RRF fusion

Fix

• Handle named vectors in visualization and semantic search
• Update vizApp to use bm25_hybrid algorithm and remove deprecated weights
• Update viz routes to use BM25 hybrid search after refactor

v0.38.0 (2025-11-16)

Feat

• add concurrent uploads and --force flag to upload command
• implement RAG evaluation framework with CLI tooling

Fix

• download qrels from BEIR ZIP instead of HuggingFace

Refactor

• migrate asyncio to anyio for consistent structured concurrency
• replace httpx client with NextcloudClient in upload command

Perf

• Eliminate double-fetching in semantic search sampling
• fix vector viz search performance and visual encoding
• make note deletion concurrent in upload --force

v0.37.0 (2025-11-16)

Feat

• Add OpenTelemetry tracing to @instrument_tool decorator

v0.36.0 (2025-11-15)

BREAKING CHANGE

• Search algorithms now require Qdrant to be populated. Vector sync must be enabled and documents indexed for search to work.

Feat

• Normalize hybrid search RRF scores to 0-1 range
• Enhance vector visualization UI and parallelize search verification
• Add Vector Viz tab to app home page
• Add vector visualization pane with multi-select document types
• Implement custom PCA to remove sklearn dependency
• Add multi-document Protocol with cross-app search support
• Update nc_semantic_search tool with algorithm selection
• Implement unified search algorithm module

Fix

• Reorder tabs and fix viz pane session access

Refactor

• Optimize Nextcloud access verification with centralized filtering
• Make all search algorithms query Qdrant payload, not Nextcloud

Perf

• Exclude vector-sync status polling from distributed tracing

v0.35.0 (2025-11-15)

Feat

• Enable SSE transport for mcp service and update test fixtures

v0.34.2 (2025-11-13)

Fix

• Use NEXTCLOUD_OIDC_CLIENT_ID/SECRET env vars consistently

v0.34.1 (2025-11-13)

Fix

• return all notes when search query is empty

v0.34.0 (2025-11-13)

Feat

• Complete Phase 5 - Instrument all 93 MCP tools
• Add instrumentation decorator and apply to notes tools (Phase 5)
• Add OAuth token and database metrics (Phases 3-4)
• Add metrics instrumentation for queue, health, and database operations

v0.33.1 (2025-11-13)

Fix

• Move grafana_folder from labels to annotations

v0.33.0 (2025-11-13)

Feat

• Add Grafana dashboard and vector sync metric instrumentation

v0.32.1 (2025-11-12)

Fix

• add dynamic dimension detection for Ollama embedding models

v0.32.0 (2025-11-11)

Feat

• ollama: Pull model on startup if not available in ollama
• add dynamic vector sync status updates with htmx polling
• add webhook management UI and BeforeNodeDeletedEvent support
• validate Nextcloud webhook schemas and document findings

Fix

• improve webapp tab UI with CSS Grid and viewport-filling container

Refactor

• move webapp from /user/page to /app
• consolidate database storage for webhooks and OAuth tokens

v0.31.1 (2025-11-10)

Refactor

• simplify OpenTelemetry tracing configuration

v0.31.0 (2025-11-10)

Feat

• skip tracing for health and metrics endpoints

Fix

• add retry logic for ETag conflicts in category change test
• optimize Notes API pagination with pruneBefore parameter

v0.30.0 (2025-11-10)

Feat

• helm: Add document chunking configuration
• vector: Add configurable chunk size and overlap for document embedding
• vector: Support multiple embedding models with auto-generated collection names

Fix

• Support in-memory Qdrant for CI testing

v0.29.2 (2025-11-09)

Fix

• helm: Set default strategy to Recreate

v0.29.1 (2025-11-09)

Fix

• observability: isolate metrics endpoint to dedicated port

v0.29.0 (2025-11-09)

Feat

• helm: Add observability support with ServiceMonitor and Grafana dashboard

Fix

• readiness: Only check external Qdrant in network mode

v0.28.0 (2025-11-09)

Feat

• observability: Add comprehensive monitoring with Prometheus and OpenTelemetry

Fix

• vector: Handle missing 'modified' field in notes gracefully

v0.27.3 (2025-11-09)

Fix

• ci: Use helm dependency build instead of update to use Chart.lock

v0.27.2 (2025-11-09)

Fix

• helm: update Qdrant dependency condition to match new mode structure

v0.27.1 (2025-11-09)

Fix

• ci: add Helm repository setup to chart release workflow

v0.27.0 (2025-11-09)

Feat

• helm: add Qdrant local mode support with three deployment options [skip ci]
• add Qdrant local mode support with in-memory and persistent storage
• implement ADR-009 - refactor semantic search to use generic semantic:read scope
• implement MCP sampling for semantic search RAG (ADR-008)
• add optional vector database and semantic search to helm chart
• add vector sync processing status to /app endpoint
• implement semantic search tool and fix vector sync issues (ADR-007 Phase 3)
• implement vector sync scanner and processor (ADR-007 Phase 2)

Fix

• implement deletion grace period and vector sync status tool
• remove unnecessary urllib3<2.0 constraint
• integrate vector sync tasks with Starlette lifespan for streamable-http

Refactor

• migrate vector sync from asyncio.Queue to anyio memory object streams
• update to Qdrant query_points API and fix Playwright Keycloak login

v0.26.1 (2025-11-08)

Fix

• deps: update dependency mcp to >=1.21,<1.22

v0.26.0 (2025-11-08)

Feat

• add real elicitation integration test with python-sdk MCP client
• unify session architecture and enhance login status visibility

Fix

• Consolidate OAuth callbacks and implement PKCE for all flows

v0.25.0 (2025-11-05)

BREAKING CHANGE

• All OAuth deployments must be reconfigured to specify resource URIs (NEXTCLOUD_MCP_SERVER_URL and NEXTCLOUD_RESOURCE_URI) and choose between multi-audience or token exchange mode.

Feat

• Implement ADR-005 unified token verifier to eliminate token passthrough vulnerability

Fix

• Implement proper OAuth resource parameters and PRM-based discovery
• Simplify token verifier to be RFC 7519 compliant
• Use Keycloak client ID for NEXTCLOUD_RESOURCE_URI in token exchange
• Correct OAuth token audience validation for multi-audience mode

Refactor

• Eliminate duplicate validation logic in UnifiedTokenVerifier

v0.24.1 (2025-11-04)

Fix

• deps: update dependency mcp to >=1.20,<1.21

v0.24.0 (2025-11-04)

Feat

• add scope protection to OAuth provisioning tools
• enable authorization services for token exchange in Keycloak
• implement scope-based audience mapping and RFC 9728 support
• integrate token exchange into MCP server application
• implement RFC 8693 Standard Token Exchange for Keycloak
• Add userinfo route/page
• add browser-based user info page with separate OAuth flow
• Implement ADR-004 Progressive Consent foundation (partial)
• Complete ADR-004 Progressive Consent OAuth flows implementation
• Implement ADR-004 Progressive Consent foundation components
• Implement ADR-004 Hybrid Flow with comprehensive integration tests

Fix

• add missing await for get_nextcloud_client in capabilities resource
• use valid Fernet encryption keys in token exchange tests
• accept resource URL in token audience for Nextcloud JWT tokens
• remove token-exchange-nextcloud scope and accept tokens without audience
• move audience mapper from scope to nextcloud-mcp-server client
• move token-exchange-nextcloud from default to optional scopes
• restructure routes to prevent SessionAuthBackend from interfering with FastMCP OAuth
• allow OAuth Bearer tokens on /mcp endpoint by excluding from session auth
• correct OAuth token audience validation using RFC 8707 resource parameter
• remove remaining references to deleted oauth_callback and oauth_token
• remove Hybrid Flow, make Progressive Consent default (ADR-004)
• browser OAuth userinfo endpoint and refresh token rotation
• make ENABLE_PROGRESSIVE_CONSENT consistently opt-in (default false)
• make provisioning checks opt-in (default false)
• Disable Progressive Consent for mcp-oauth to enable Hybrid Flow tests

Refactor

• integrate token exchange into unified get_client() pattern

v0.23.0 (2025-11-03)

Feat

• Auto-configure impersonation role in Keycloak realm import
• Implement dual-tier token exchange (Standard V2 + Legacy V1 impersonation)
• Add Keycloak external IdP integration with custom scopes
• Implement RFC 8693 token exchange for Keycloak (ADR-002 Tier 2)
• Add Keycloak OAuth provider support with refresh token storage

Fix

• Complete Keycloak external IdP integration with all tests passing
• Complete Keycloak external IdP integration with all tests passing
• Update DCR token_type tests for OIDC app changes

Refactor

• Remove NEXTCLOUD_OIDC_CLIENT_STORAGE environment variable
• Remove unnecessary user_oidc patch - CORSMiddleware patch is sufficient
• Unify OAuth configuration to be provider-agnostic

v0.22.7 (2025-10-29)

Fix

• helm: Remove image tag overide

v0.22.6 (2025-10-29)

Fix

• helm: Update helm chart with extraArgs

v0.22.5 (2025-10-29)

Fix

• Update helm chart variables

v0.22.4 (2025-10-29)

Fix

• helm: Update helm version with release
• helm: Update helm version with release

v0.22.3 (2025-10-29)

Fix

• helm: Update helm version with release

v0.22.2 (2025-10-29)

Fix

• helm: Update helm version with release

v0.22.1 (2025-10-29)

Fix

• Trigger release

v0.22.0 (2025-10-29)

Feat

• server: Add /live & /health endpoints
• Initialize helm chart

v0.21.0 (2025-10-25)

Feat

• Add text processing background worker for telling client about progress

Refactor

• Transform document parsing into pluggable processor architecture

v0.20.0 (2025-10-24)

Feat

• auth: Add support for client registration deletion
• Split read/write scopes into app:read/write scopes

Fix

• Add support for RFC 7592 client registration and deletion
• Update webdav models for proper serialization

v0.19.1 (2025-10-24)

Fix

• deps: update dependency mcp to >=1.19,<1.20

v0.19.0 (2025-10-23)

Feat

• Enable token introspection for opaque tokens

Fix

• Add CORS middleware to allow browser-based clients like MCP Inspector

v0.18.0 (2025-10-23)

Feat

• server: Add support for custom OIDC scopes and permissions via JWTs
• Initialize JWT-scoped tools

Fix

• Use occ-created OAuth clients with allowed_scopes for all tests
• Separate OAuth fixtures for opaque vs JWT tokens

Refactor

• Update JWT client to use DCR, re-enable tool filtering

v0.17.1 (2025-10-20)

Fix

• caldav: Fix caldav search() due to missing todos

v0.17.0 (2025-10-19)

Feat

• caldav: Add support for tasks

Fix

• caldav: Check that calendar exists after creation to avoid race condition
• caldav: Properly parse datetimes as vDDDTypes

Refactor

• Migrate from internal CalendarClient to caldav library

v0.16.0 (2025-10-19)

Feat

• webdav: Add search and list favorite response tools

Perf

• notes: Improve notes search performance using async iterators

v0.15.2 (2025-10-17)

Refactor

• Unify logging & remove factory deployment

v0.15.1 (2025-10-17)

Fix

• Increase HTTP client timeout to 30s
• Handle RequestError in mcp tools

v0.15.0 (2025-10-17)

Feat

• cookbook: Add full Cookbook app support with 13 tools and 2 resources

v0.14.3 (2025-10-17)

Fix

• deps: update dependency mcp to >=1.18,<1.19

v0.14.2 (2025-10-16)

Fix

• deps: update dependency pillow to v12

v0.14.1 (2025-10-15)

Fix

• oauth: Remove the option to force_register new clients

v0.14.0 (2025-10-15)

Feat

• Add Groups API client
• add sharing API client and server tools
• users: Initialize user API client

Fix

• Update user/groups API to OCS v2

v0.13.0 (2025-10-13)

Feat

• server: Experimental support for OAuth2/OIDC authentication

v0.12.6 (2025-10-11)

Fix

• deps: update dependency mcp to >=1.17,<1.18

v0.12.5 (2025-10-03)

Fix

• deps: update dependency mcp to >=1.16,<1.17

v0.12.4 (2025-09-25)

Fix

• deps: update dependency mcp to >=1.15,<1.16

v0.12.3 (2025-09-23)

Refactor

• Add tools for all resources to enable tool-only workflows

v0.12.2 (2025-09-20)

Refactor

• Add http to --transport option

v0.12.1 (2025-09-11)

Fix

• docker: Provide --host 0.0.0.0 in default docker image

v0.12.0 (2025-09-11)

Feat

• server: Add support for streamable-http transport type

v0.11.1 (2025-09-11)

Fix

• deps: update dependency mcp to >=1.13,<1.14

v0.11.0 (2025-09-11)

Feat

• deck: Add support for stack, cards, labels
• deck: Initialize Deck app client/server

v0.10.0 (2025-09-10)

Feat

• Add WebDAV resource copy functionality
• Add WebDAV resource move/rename functionality

v0.9.0 (2025-09-10)

BREAKING CHANGE

• FASTMCP_-prefixed env vars have been replaced by CLI arguments. Refer to the README for updated usage.

Feat

• cli: Replace mcp run with click CLI and runtime options

v0.8.3 (2025-08-31)

Fix

• server: Replace ErrorResponses with standard McpErrors
• notes: Include ETags in responses to avoid accidently updates

v0.8.2 (2025-08-31)

Fix

• notes: Remove note contents from responses to reduce token usage

v0.8.1 (2025-08-30)

Fix

• model: Serialize timestamps in RFC3339 format

v0.8.0 (2025-08-30)

Feat

• client: Preserve fields when modifying contacts/calendar resources
• server: Add structured output to all tool/resource output

Refactor

• Use _make_request where available

v0.7.2 (2025-08-30)

Fix

• client: Use paging to fetch all notes

v0.7.1 (2025-08-08)

Fix

• client: Strip cookies from responses to avoid falsely raising CSRF errors

v0.7.0 (2025-08-03)

Feat

• contacts: Initialize Contacts App

v0.6.1 (2025-08-01)

Fix

• calendar: Fix iCalendar date vs datetime format
• calendar: Remove try/except in calendar API

v0.6.0 (2025-07-29)

Feat

• calendar: add comprehensive Calendar app support via CalDAV protocol

Fix

• apply ruff formatting to pass CI checks
• calendar: address PR feedback from maintainer

Refactor

• calendar: optimize logging for production readiness

v0.5.0 (2025-07-26)

Feat

• Update webdav client create_directory method to handle recursive directories
• webdav: add complete file system support

Fix

• apply ruff formatting to test_webdav_operations.py

v0.4.1 (2025-07-10)

Fix

• deps: update dependency mcp to >=1.10,<1.11

v0.4.0 (2025-07-06)

Feat

• Add TablesClient and associated tools

Fix

• update tests

Refactor

• Modularize NC and Notes app client

v0.3.0 (2025-06-06)

Feat

• Switch to using async client

v0.2.5 (2025-05-25)

Fix

• Commitizen release process

v0.2.4 (2025-05-25)

Fix

• Do not update dependencies when running in Dockerfile
• Configure logging

v0.2.3 (2025-05-25)

Fix

• Limit search results to notes with score > 0.5

v0.2.2 (2025-05-24)

Fix

• Install deps before checking service

v0.2.1 (2025-05-24)

Fix

• Install deps before checking service

v0.2.1 (2025-05-24)

v0.2.0 (2025-05-24)

Feat

• notes: Add append to note functionality

Fix

• deps: update dependency mcp to >=1.9,<1.10

v0.1.3 (2025-05-16)

v0.1.2 (2025-05-05)

v0.1.1 (2025-05-05)

v0.1.0 (2025-05-05)