Pad v0.9.2

Highlights

v0.9.2 is the "honest deletion + real recovery" release. Both major themes make Pad's destructive actions trustworthy: they do exactly what the UI says, and — where the data model allows — they're recoverable.

Delete your account, export your data (PLAN-1956)

The account settings page gains a Danger Zone. You can now export all your data with one button, and delete your account through an explicit confirm flow (password + typed confirmation, plus optional TOTP re-verification for accounts with 2FA). Under the hood, the account-deletion FK cascade was hardened (TASK-1959) so a delete actually purges the trailing activity/audit rows instead of orphaning them — deletion now means deletion.

Workspace deletion is honest — and undoable for 30 days (PLAN-1969)

Deleting a workspace used to claim it "archived." It didn't. Now the Danger Zone copy is honest — it deletes — but deletion is a soft-delete with a 30-day recovery window before a scheduled job hard-purges it (honoring the 30-day GDPR erasure SLA). Within that window you can restore from anywhere:

• Web: an Undo toast right after deleting, a "Recently deleted (N days left)" section in the workspace switcher, and a dedicated /console/deleted-workspaces page.
• CLI: pad workspace deleted to list what's still restorable, pad workspace restore <slug> to bring it back.
• MCP: pad_workspace gains deleted and restore actions (ToolSurfaceVersion → 0.8) so agents can list and recover deleted workspaces too.

Also in this release

• BUG-1965 — corrected two inaccurate claims on the live /privacy page (workspace transfer + 1-year audit retention).
• /auth/me now exposes password_set, so the UI can tell password vs. passwordless accounts apart.

Install

brew install perpetualsoftware/tap/pad
# or pull the container image
docker pull ghcr.io/perpetualsoftware/pad:0.9.2

Verifying

cosign verify-blob \
  --certificate-identity-regexp "^https://github.com/PerpetualSoftware/pad/.github/workflows/release.yml@.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate checksums.txt.pem --signature checksums.txt.sig \
  checksums.txt

---

Changelog

Features

• 1b99c41: feat(cli): add 'pad workspace restore' + 'pad workspace deleted' (TASK-1972) (#833) (@xarmian)
• 7687521: feat(mcp): add pad_workspace restore + deleted actions (TASK-1973) (#834) (@xarmian)
• 1d8b04e: feat(server): expose password_set on /auth/me + TS User type (#819) (@xarmian)
• 022280a: feat(server): require TOTP re-verification to delete account (#822) (@xarmian)
• f5b437a: feat(server): workspace restore + deleted-list endpoints (TASK-1970) (#827) (@xarmian)
• b73ba63: feat(store): hard-purge soft-deleted workspaces after 30 days (TASK-1966) (#825) (@xarmian)
• fa34ac3: feat(web): "Recently deleted" section in workspace switcher (#829) (@xarmian)
• 87f8192: feat(web): add Danger Zone section with Export my data button (TASK-1961) (#820) (@xarmian)
• d53262c: feat(web): add delete-account confirm flow to settings Danger Zone (#823) (@xarmian)
• 0faa481: feat(web): add deleteAccount + exportAccountData API client methods (#818) (@xarmian)
• 7b6739e: feat(web): add workspaces.restore + listDeleted API client methods (#828) (@xarmian)
• 727deb2: feat(web): dedicated /console/deleted-workspaces page (#830) (@xarmian)
• ef5e5d7: feat(web): post-delete Undo + honest 30-day recovery copy on settings (#831) (@xarmian)

Bug fixes

• 366d4fb: fix(store): harden account-deletion FK cascade (TASK-1959) (#821) (@xarmian)
• 9efc1d3: fix(web): make workspace Danger Zone honest — it deletes, not archives (#826) (@xarmian)

Other changes

• 47dc06c: docs(web): point workspace-delete copy at real recovery surfaces (#832) (@xarmian)