Skip to content

Pad v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 May 17:37
· 83 commits to main since this release
v0.6.0
08f76f3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.6.0 — Release Highlights

Wiki-link backlinks ("Mentioned in") — PLAN-1593

Pad's [[...]] syntax has always flowed one way: an item shows who it links to. v0.6.0 adds a materialized reverse index so every item can answer "what mentions me?" cheaply, surfaced as a new Mentioned in panel and a per-item count badge. The rollout shipped in four phases: a server-side reverse index for ref-form links (Phase 1, TASK-1594), title-form [[Title]] resolution with a rename cascade so backlinks survive item renames (Phase 2a, TASK-1595), cross-workspace links + a request-independent ACL helper so the panel honors membership for bearer-auth and MCP requests (Phase 2b, TASK-1597), and the UI panel + count badge + CLI + MCP plumbing (Phase 3, TASK-1596). Parent↔child mentions are suppressed from the panel to keep it useful (TASK-1607).

pad_library MCP tool + ToolSurfaceVersion 0.5 — PLAN-1560

The convention + playbook library is now reachable from pure-MCP agents. New pad_library catalog tool with list / get / categories / activate actions (TASK-1563) closes the gap that previously had the onboard playbook telling MCP-only agents to "work from your own knowledge." Backed by extended HTTP endpoints (?category, ?summary, /library/entry, TASK-1561) and a pad library get CLI command + --full flag + server-side category filter (TASK-1562). ToolSurfaceVersion bumps to 0.5 to advertise the new action surface; the bootstrap shape is unchanged.

Plan-limit UX + Stripe-ready upgrade CTAs — PLAN-825

The limit-hit experience is now polished end-to-end. A standardized plan-limit error envelope flows through HTTP / MCP / CLI / UI so every surface speaks the same shape (TASK-788). Every limit-hit point in the web UI gets an inline "Upgrade to Pro" CTA wired through to POST /billing/checkout and a Stripe Checkout session (TASK-800). The free-tier workspace cap drops from 5 to 3 (TASK-1609), with a paired migration so existing deployments converge on the new default (TASK-1610).

Security: go-jose CVE clear (BUG-1619)

github.com/go-jose/go-jose/v3 bumped from v3.0.4 to v3.0.5 to clear GO-2026-4945 (Go JOSE panics in JWE decryption), reachable indirect via ory/fosite from the OAuth authorize handler. Caught by govulncheck during release pre-flight. Drop-in dependency bump, no API changes.

Bug fixes

Share button on item pages no longer throws a TypeError on items with null grants/share-link slices (BUG-1598); admin-modal reactive loop on open is broken (no specific BUG ref — landed with the modal series). CI hardening: golang.org/x/net bumped to clear GO-2026-5025..5030 (#618), Go (PostgreSQL) job unbroken, gofmt unblock on workspace_members.go (BUG-1565).

Other notable

  • Inline-expand DOM removed from the admin users page in favor of the modal (TASK-1555, refactor)
  • README gains a cross-link nav row (site, blog, changelog, X, Bluesky) (#617)
  • Cross-workspace wiki-link resolution honors the new request-independent ACL helper (PLAN-1593 Phase 2b)

Install

# Homebrew (macOS / Linux)
brew install perpetualsoftware/tap/pad

# Docker (multi-arch)
docker pull ghcr.io/perpetualsoftware/pad:0.6.0

# Direct download
# https://github.com/PerpetualSoftware/pad/releases/tag/v0.6.0

Verifying

All artifacts are signed via Sigstore keyless OIDC. To verify the checksums:

cosign verify-blob \
  --certificate-identity-regexp "^https://github.com/PerpetualSoftware/pad/.github/workflows/release.yml@.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate checksums.txt.pem \
  --signature  checksums.txt.sig \
  checksums.txt

The container image manifests are likewise cosign-signed; SBOMs (SPDX) ship alongside each archive, and SLSA v1 build provenance is attested per-archive (verify with gh attestation verify <archive> --repo PerpetualSoftware/pad).

Changelog

Features

  • a04e521: feat(admin): GET /admin/users/{id}/activity paginated feed (TASK-1546) (#601) (@xarmian)
  • eff0824: feat(admin): GET /admin/users/{id}/detail per-workspace breakdown (TASK-1545) (#600) (@xarmian)
  • 48323e2: feat(admin): GET /admin/users/{id}/metrics windowed engagement metrics (TASK-1547) (#602) (@xarmian)
  • 0c5ec04: feat(admin): extend user list with aggregations + sort/filter (TASK-1544) (#599) (@xarmian)
  • 35ac755: feat(backlinks): UI panel + mention badge + CLI + MCP (Phase 3) (#623) (@xarmian)
  • 905876a: feat(backlinks): cross-workspace wiki-links + request-independent ACL (Phase 2b) (#622) (@xarmian)
  • 8e7d404: feat(backlinks): server-side reverse index for [[...]] (Phase 1) (#620) (@xarmian)
  • 4aff8c7: feat(backlinks): suppress parent↔child mentions from "Mentioned in" panel (TASK-1607) (#625) (@xarmian)
  • c67c167: feat(backlinks): title-form wiki-links + rename cascade (Phase 2a) (#621) (@xarmian)
  • de1beb4: feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613) (@xarmian)
  • 6433cc5: feat(mcp): pad_library catalog tool + ToolSurfaceVersion 0.5 (TASK-1563) (#615) (@xarmian)
  • 2df6ede: feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612) (@xarmian)
  • 0a09c1d: feat(store): add users.last_write_at column + write-path hook (TASK-1543) (#598) (@xarmian)
  • 88a30e5: feat(web): admin modal Activity tab (TASK-1554) (#609) (@xarmian)
  • 6765542: feat(web): admin modal Overview tab (TASK-1553) (#608) (@xarmian)
  • 4308723: feat(web): admin modal Settings & overrides tab (TASK-1551) (#606) (@xarmian)
  • 46ca27c: feat(web): admin modal Workspaces tab (TASK-1552) (#607) (@xarmian)
  • 5990008: feat(web): admin user list — pagination + sort + filter UI (TASK-1549) (#604) (@xarmian)
  • 0249147: feat(web): admin user modal shell with empty tabs (TASK-1550) (#605) (@xarmian)
  • 8a85eca: feat(web): admin user table — cheap aggregation columns (TASK-1548) (#603) (@xarmian)

Bug fixes

  • f48c99e: fix(auth): scope admin platform role to cookie session auth (BUG-1616) (#632) (@xarmian)
  • 83716a6: fix(backlinks): scope cross-workspace admin enumeration to membership for bearer auth (BUG-1617) (#633) (@xarmian)
  • 3a04c06: fix(backlinks): suppression must query item_links, not items.parent_id (TASK-1607 followup) (#626) (@xarmian)
  • 8cf460b: fix(ci): unbreak Go (PostgreSQL) test + clear x/net govulncheck findings (#618) (@xarmian)
  • 08f76f3: fix(deps): bump go-jose/v3 to v3.0.5 to clear GO-2026-4945 (BUG-1619) (#634) (@xarmian)
  • c1c9f2e: fix(share): guard nil grants/share-link slices to prevent ShareDialog TypeError (BUG-1598) (#624) (@xarmian)
  • ef7eaba: fix(web): admin modal reactive loop on open (#611) (@xarmian)

Refactors

Other changes

Contributors

xarmian
Assets 17
Loading