Release v0.53.0 · Morelitea/initiative

Permanent deletion (purge) is now admin-only at the database, not just in app code. Emptying an item from the trash for good was gated only by an app-layer check; a RESTRICTIVE row-level-security policy now backs it on every soft-deletable item.
Changing your password now requires your current password. This stops a leaked session token or API key from silently taking over an account by setting a new password. (Accounts that sign in only through your identity provider have no local password and are unaffected.)
A password change or reset now also revokes your API keys. Previously, resetting a compromised account's password left any outstanding API keys working; a credential reset now deactivates them too, so a leaked key can't survive the response.

Full access for the Project Manager role. Guild admins can now grant the Project Manager role Full access from an initiative's Roles settings. Members with that role can view and edit every item in the initiative — projects, documents, queues, counters, calendar events — even when an item isn't shared with them, and can manage who else has access. It applies only within that one initiative, and shows on each item's Share control as a locked editor that can't be removed. Only guild admins can turn it on, and only on the Project Manager role (so a manager can't grant it to themselves).
Scoped API keys (read-only and single-guild). When creating an API key you can now mark it read-only (it can read but never write) and/or pin it to a single guild (it can only reach that guild's data). Recommended for machine credentials such as CI or an automation/MCP tool, so a leaked key has a limited blast radius. Existing keys keep full access.
Optional MCP server for AI assistants. A new opt-in endpoint lets MCP-compatible AI tools (such as Claude Code) work with Initiative on your behalf — read your projects, tasks, and initiatives, and make a few safe edits (create a task, move a task, add a comment) — authenticated with your personal API key. It's off by default and enabled per deployment (ENABLE_MCP); every action runs as you, under the same permissions and access rules as the app, and a read-only API key can't make changes.

Adding an option to a select / multi-select custom property lost input focus after each keystroke, so only one character could be typed at a time. Option rows are no longer re-keyed by the value being edited.
Guild admins were wrongly shown "access denied" when opening (or saving edits to) a document they hadn't been explicitly shared on. The realtime collaboration connection didn't apply the guild-admin access bypass the rest of the app uses; guild admins now have full access to every document in their guild.

Sharing for projects, documents, queues, counters, and calendar events is now a single Google-Docs-style Share control — pick All initiative members (Viewer or Editor) or Restricted (specific people and roles), available from each item's settings and its create dialog. Replaces the separate role- and user-permission panels.
Creating a custom-property option now asks only for a label; the stored option value is derived from the label automatically (and de-duplicated), removing the redundant Value field from the editor.
The date picker now accepts a typed date — a text field at the top of the popover parses common formats (e.g. 2026-06-16, 06/16/2026, Jun 16, 2026) on Enter or blur — and exposes month/year dropdowns in the calendar header for quickly jumping across years instead of clicking month-by-month.

Downloads

No new app build this release — installed apps update automatically over the air on next launch.

docker pull morelitea/initiative:0.53.0

Or use latest tag. View on Docker Hub.