openarch 0.5.1

Changes

• openarch documents upload --replace keeps the title and the description of the document unless --title or --description is given. In 0.5.0, a replace without these flags set the title to the file name and cleared the description, so a description set with documents update was lost.
• The text view of a document (documents get, update, upload) shows its description.

No change to the workspace files. The schema upgrade note of 0.4.0 still applies: run openarch migrate for a workspace made by 0.3.1 or older.

Changelog

• 9fecf40 Point the README at release 0.5.1
• 274f153 Keep the title and description on upload --replace

openarch 0.5.0

Changes

• Plugins. openarch <name> ... runs the executable openarch-<name> from PATH, as git and kubectl do. Built-in commands always win. Global flags before the name reach the plugin as environment variables, and OPENARCH_BIN holds the path of openarch. openarch plugin list shows the plugins on PATH.
• A plugin never gets a password. OPENARCH_PASSWORD is removed from its environment: a plugin runs openarch to reach OpenArch, and openarch finds the password in the workspace or the context. A setup with only environment variables needs a workspace (--dir) or a context (openarch config set) for plugins.
• openarch documents update <id-or-path> changes the title and the description of a document, or any property from a JSON --file. Other properties keep their value. The MCP server has a documents_update tool.
• openarch documents upload and documents create take --description. documents upload --replace puts the new content into the file document with the same name under the parent, so the document keeps its id. Tools that sync a folder can run the same upload again.
• An HTTP 403 has its own message: the user is known but has no permission. The exit code is still 6.
• grpc 1.83.2 and x/net 0.62.0. Both fix vulnerabilities that openarch does not call.

No change to the workspace files: a workspace made by 0.4.x needs no step. The schema upgrade note of 0.4.0 still applies: run openarch migrate for a workspace made by 0.3.1 or older.

Changelog

• 0871106 Point the README at release 0.5.0
• c8ff994 Update grpc to 1.83.2 and x/net to 0.62.0
• adea473 Give HTTP 403 its own message and hint
• eac464e Do not pass OPENARCH_PASSWORD to plugins
• f3b9d2e Update the design after the review
• 1d2c2f1 Add documents upload --replace
• 7ffb3e2 Add documents update and --description
• de9fde4 Run openarch- plugins from PATH

openarch 0.4.2

Changes

• openarch mcp has a new flag, --allow-insecure. Without it, the init tool always keeps the secure defaults: it has no default-users, insecure-backends, bind-ip, expose, tls, cert, key or from parameter. Local models turned these options on when nobody asked for it.

The schema upgrade note of 0.4.0 still applies: run openarch migrate for a workspace made by 0.3.1 or older.

Changelog

• 843f62e Point the README at release 0.4.2
• 309e430 Let the MCP init tool turn security off only with --allow-insecure

openarch 0.4.1

Changes

• The Agent Skill and the MCP init tool tell agents more clearly to keep the secure defaults. Words such as "local" or "development" in a task are not a reason to turn security off.
• Both agent examples in examples/docker-agent now fail when the agent turned off a secure default, and use GLM 4.7 Flash by default. OLMo 3 and OLMo 3.1 write the tool calls as text.

The schema upgrade note of 0.4.0 still applies: run openarch migrate for a workspace made by 0.3.1 or older.

Changelog

• dd09f8d Point the README at release 0.4.1
• c3234d1 Keep agents from turning security off on their own
• 3cf2dfe Make GLM 4.7 Flash the default model of the install example

openarch 0.4.0

Upgrade note

openarch.yaml now has schemaVersion: 2. The options insecureBackends and defaultUsers moved into a security: block, as backendAuth and defaultUsers.

• A workspace made by an older release still works. Commands print a warning. Run openarch migrate to update the file (--dry-run shows the diff).
• Releases up to 0.3.1 cannot read a version 2 file. They report field security not found. Do not run init --force because of this error: update openarch instead.

New

• openarch skill install and openarch skill show: an Agent Skill that teaches AI coding agents to use the CLI.
• openarch migrate: updates openarch.yaml to the current schema.
• examples/docker-agent/skill: a local agent installs OpenArch with only a shell and the skill.

Changelog

• d156566 Point the README at release 0.4.0
• a95df27 Add openarch.yaml schema version 2 and openarch migrate
• 117b36e Add an example: install OpenArch with a local agent and the skill
• b9a2c58 Add an Agent Skill and openarch skill install|show

openarch 0.3.1

Changelog

• ffd3bdb Wait for progress notifications in the MCP call test
• 3135830 Point the README at release 0.3.1
• 4c55d3d Build with Go 1.27.3 and update grpc and go-jose for security fixes
• c43c865 Point the README at release 0.3.0
• d36d75e Add an example: install OpenArch with a local agent
• 2b98b26 Add documents upload, content and list
• 1c6952b Cut long MCP tool results
• b7fa6d5 Ask MCP clients to get every fact from a tool call
• 46393e4 Ask MCP clients to keep the secure defaults of init
• ae1d442 Add an MCP server with the commands as tools
• 0b89c43 Add JSON help, examples for every command and docs/llms.txt
• 3d39ff6 Pick the README logo by the GitHub theme, not the OS theme
• d8f429c Add a logo, badges and the demo to the README
• 6318ac4 Add a demo GIF of doctor, init, up and smoke-test
• 801d0e0 Add the social preview picture
• 6af74d3 Add the OpenArch CLI logo

openarch 0.2.1

Fixed

• openarch self-update now answers "up to date" on a Homebrew or Scoop install that already has the latest release. Before, it showed the hint to run brew upgrade or scoop update.

openarch 0.1.0

First release of openarch, a command line tool to install and run OpenArch with Docker Compose.

Highlights

• doctor checks Docker, Docker Compose, memory, ports and access to the image registry.
• init creates a workspace with every deployment option: storage (volume, bind, none), HTTPS (self-signed or your own certificate), listen address, port, extra ports, OpenSearch Dashboards and memory sizing. It has an interactive wizard, and every question is also a flag.
• Security is on by default: a generated OpenArch admin password, MongoDB authentication, and the OpenSearch security plugin. Passwords are in .env.local and reach the containers as Docker Compose secrets. Every part can be turned off.
• up, status, logs and down run the stack. render applies changes made to openarch.yaml.
• api ping, query, documents get and documents create call the OpenArch API. config saves connections, with passwords in the OS credential store.
• users manages the OpenArch users of a workspace.
• smoke-test checks OpenArch end to end.
• backup, restore, clean, upgrade and secrets rotate cover day-2 operations.
• Every command supports --output json and has stable exit codes.

Install

Download the archive for your system below, check it with checksums.txt, and put openarch in your PATH. See the README to verify the cosign signature, and docs/walkthrough.md for a tour of every feature.

The binaries are not signed with an Apple or Microsoft certificate, so macOS and Windows may show a warning the first time.

The default OpenArch version is 1.0.90. openarch init --version <tag> selects another one.