openarch 0.5.0

Changes

• Plugins. openarch <name> ... runs the executable openarch-<name> from PATH, as git and kubectl do. Built-in commands always win. Global flags before the name reach the plugin as environment variables, and OPENARCH_BIN holds the path of openarch. openarch plugin list shows the plugins on PATH.
• A plugin never gets a password. OPENARCH_PASSWORD is removed from its environment: a plugin runs openarch to reach OpenArch, and openarch finds the password in the workspace or the context. A setup with only environment variables needs a workspace (--dir) or a context (openarch config set) for plugins.
• openarch documents update <id-or-path> changes the title and the description of a document, or any property from a JSON --file. Other properties keep their value. The MCP server has a documents_update tool.
• openarch documents upload and documents create take --description. documents upload --replace puts the new content into the file document with the same name under the parent, so the document keeps its id. Tools that sync a folder can run the same upload again.
• An HTTP 403 has its own message: the user is known but has no permission. The exit code is still 6.
• grpc 1.83.2 and x/net 0.62.0. Both fix vulnerabilities that openarch does not call.

No change to the workspace files: a workspace made by 0.4.x needs no step. The schema upgrade note of 0.4.0 still applies: run openarch migrate for a workspace made by 0.3.1 or older.

Changelog

• 0871106 Point the README at release 0.5.0
• c8ff994 Update grpc to 1.83.2 and x/net to 0.62.0
• adea473 Give HTTP 403 its own message and hint
• eac464e Do not pass OPENARCH_PASSWORD to plugins
• f3b9d2e Update the design after the review
• 1d2c2f1 Add documents upload --replace
• 7ffb3e2 Add documents update and --description
• de9fde4 Run openarch- plugins from PATH