v0.1.1

Security

• Fixed a command-injection vulnerability in magpie pack add <source>: an untrusted source
  string was passed straight into git clone's argv, and git's ext::<command> transport let a
  crafted source (e.g. ext::sh -c '...') run arbitrary shell commands — full RCE for a command
  whose entire purpose is installing packs someone else wrote and shared. pack_source.rs now
  requires an exact https:///git@ URL before anything reaches git clone, with
  GIT_ALLOW_PROTOCOL as a second layer; 5 regression tests cover the exact payloads.
• Set a real Content-Security-Policy on the desktop app's webview (was csp: null). Not
  currently exploitable on its own — there's no script-injection path today — but closes the gap
  for the moment one gets introduced.
• Patched 6 Dependabot advisories in the docs site's build tooling (postcss, sharp,
  fast-uri) via pnpm-workspace.yaml overrides. Build-time-only; never reached the shipped
  desktop app.

Fixed

• A failed stream load (refreshStream()) used to fail silently to the console — the UI looked
  identical to "you have no captures." Now shows a visible error banner with a Retry button.

Known limitations

• Linux is still not hand-verified on real hardware. Carried over from v0.1.0, still true:
  the full test suite passes in CI on every push, but nobody has run the actual desktop app
  (tray icon, global hotkey, screenshot capture, in-app update) on a real Linux machine. See
  RELEASING.md's manual hardware check — outstanding, not a checklist item skipped for a good
  reason.
• macOS builds are still unsigned and unpublished — code signing isn't wired up yet (see
  ROADMAP.md). Linux-only release.
• The glib dependency (via the Linux tray/menu chain: tray-icon → libappindicator → gtk → glib) has an open, medium-severity Dependabot advisory with no compatible patched version
  available without a major gtk-rs bump — tracked in #15, not fixed here.

Full Changelog: v0.1.0...v0.1.1

macOS builds aren't attached to this release yet -- code signing isn't set up. Linux only for now.

v0.1.0

Added

• Capture core — the stream, Now, search (FTS5), merge, tags, projects.
• MCP server + CLI — queue_take/queue_peek, capture_add/done/fail/handback,
  capture_search; the magpie CLI (add|list|search|done|drain|export|serve-mcp).
• Screenshots + OCR — region capture, searchable text (macOS verified; Linux implemented,
  not yet run on real hardware — see this release's Linux hardware check in RELEASING.md,
  a later chunk).
• Prompt packs — magpie pack add github:someone/agent-prompts, fill-in-the-blank templates.
• Confidence-aware capture filing — the desktop toast proposes a destination project and
  commits it on a quick tap; never auto-files.
• Sessions, handback, and session digests — an MCP-connected agent's session is a persistent
  record; capture_handback gives it a third outcome beyond done/fail; ending a session
  writes a searchable summary into the stream.
• Capture list v2 — sections, soft-delete with real Undo and Recently Deleted, Markdown
  rendering, a context-menu interaction model, keyboard-first navigation, and remappable
  global hotkeys.
• The "3a canonical" redesign — two-theme Slate/Paper token layer, the main window rebuilt
  around a session strip and one overlay stack, hold-to-aim, and Across (⌘⌥K).
• In-app update checking and installation — background and manual checks, auto-download,
  and user-initiated install and relaunch; never installs or relaunches without you seeing
  what's in the update first.

Known limitations

• Linux builds are CI-verified but not yet hand-verified on real hardware for this specific
  release (tracked as a one-time manual check before this tag is treated as the real first
  release — see RELEASING.md, a later chunk).
• macOS builds are unsigned and unnotarized in this release — the Apple Developer ID isn't
  set up yet. Only the Linux artifact is published for v0.1.0.

macOS builds aren't attached to this release yet -- code signing isn't set up. Linux only for now.