v0.5.0

v0.5.0 · 2026-07-04

The largest release since v0.4.0 (238 commits): Connect Knowledge brings your cloud drives into every room, a much bigger Integrations Hub (Slack, Google, Microsoft 365, Snowflake, LinkedIn, Discord, Telegram), agents get their own Channels, a Telegram remote-control gateway, clean-path routing, a borderless "Manila Arc" redesign, and a deep editor + knowledge-import pass.

🟢 New

• 🟢 Connect Knowledge: per-room knowledge sources. Browse Google Drive, iCloud, OneDrive/SharePoint, and Dropbox read-only inside a room, or mount a synced folder inline with a read-only policy enforced on the server. Native Google Docs and Sheets shortcuts render in place, the cloud picker auto-detects your desktop-sync accounts, and there is no OAuth to set up.
• 🟢 Integrations Hub, much bigger: a 52-connector tabbed catalog with illustrated per-step setup art. Live connectors now include Slack, Google (Gmail, Calendar, Drive), Microsoft 365 (OneDrive, SharePoint, Teams, with personal-account sign-in), Snowflake, LinkedIn, Discord, and Telegram, plus a Social category and a "Soon" request flow. A launch gate keeps not-yet-ready tiles grayed out.
• 🟢 Channels: per-room team chat for your agents (the internal team-chat, renamed from "Slack"). @mention an agent and it actually replies, with a live "is typing" indicator; channels sort by most recent activity and live under .channels per room.
• 🟢 Telegram remote control: an inbound gateway to run agents and search Cabinet from Telegram, with room-scoped chats, a personalized welcome, and a per-chat /model command for provider, model, and effort overrides.
• 🟢 Knowledge import: bring Apple Notes (macOS) and a Notion export (.zip) in as local Markdown.
• 🟢 In-app browser: external links and web pages open inside Cabinet in the desktop app, using a native web view that loads sites an iframe can't, with an iframe fallback on the web build.
• 🟢 Editor: inline Mermaid diagrams with zoom and pan, LaTeX (.tex) embed rendering and a file viewer, file:// links, a wide mode for full-width reading, and a Link vs Embed chooser when you paste a URL.
• 🟢 Schedule: unified Schedule surfaces with calendar interactivity, one-off tasks, and a "this and following" recurrence split.
• 🟢 Onboarding: a new knowledge-graph step in the wizard.

🔵 Improved

• 🔵 Manila Arc: a borderless redesign where the bright content sheet floats on a manila "desk", with softened hairline borders.
• 🔵 Clean-path routing: the app moved from hash routing to clean paths end to end (web and Electron), with reopen-to-last-path persistence, section anchors in previews, and nested cabinets round-tripping correctly on reload.
• 🔵 Editor and paste: paginated PDF export that skips cross-origin fonts, tree-view sorting, relative-image resolution in standalone .md pages, and any embed can be turned back into a plain link (frame-checked so a framing-hostile site can't leave a dead box).
• 🔵 Tasks: real-time updates for non-Claude (Codex) runs, immediate Codex failure surfacing with actionable hints, one shared SSE connection for conversation events, concurrent follow-ups rejected with a clear 409, and no more phantom _pending conversations.
• 🔵 Sidebar: moving standalone .md files no longer fails with ENOENT, renaming preserves the file extension, and the Edit Symlink dialog no longer overflows its box.
• 🔵 Observability: diagnostic logging and attributed file history.

🟣 AI & providers

• 🟣 Added Claude Fable 5 and bumped Opus 4.7 to 4.8; stale task errors now clear on recovery.
• 🟣 A SEND_EMAIL agent action wired end to end (inline and JSON parsing, dispatch, transcript), calling sendEmail() directly instead of a flaky HTTP self-fetch.
• 🟣 Conversation run timeout raised from 10 minutes to 1 hour (env-tunable); finalized conversations skip transcript re-parse.
• 🟣 Scheduler trigger health is exposed on the daemon /health endpoint.

🟡 Fixed

• 🟡 Auth: PBKDF2 password hashing with a per-install salt and login rate-limiting (closes #11); the daemon authenticates scheduler triggers against the KB_PASSWORD gate and backfills all auth inputs from .env; sign-in works on mobile browsers and through reverse proxies.
• 🟡 Windows: repaired the CLI install path, the Squirrel installer and release manifest, chunked PTY prompts, and remaining POSIX-only assumptions.
• 🟡 Artifacts: external paths detected by absoluteness rather than a system-dir denylist, placeholder paths sanitized so repair is idempotent, and task artifacts resolved against the task cwd so they open and appear in the sidebar.
• 🟡 Networking and dev: npm run dev:all works behind LAN / Tailscale / VPN hostnames; background-tab polling pauses so two Cabinet URLs can coexist; the file watcher stops following symlinks to avoid EMFILE.
• 🟡 Agents / editor: unified the agent spawn working directory (fixes scheduled-run ENOENT) and kept EditorContent mounted to avoid a flushSync-in-lifecycle warning.
• 🟡 Lint and security: eliminated all 49 react-hooks compiler-rule errors repo-wide and patched the ws and next advisories.

🔴 Changed

• 🔴 Clean-path routing: the app serves clean URLs instead of hash routes across web and Electron. Old hash links resolve via a marker-scan parser, but the canonical form is now path-based.
• 🔴 Channels on-disk rename: the internal team-chat directory moved from .slack to .channels, scoped per room.

🙏 Thanks

Contributions this release from Alexandra Goldemberg, @alexsh1410 (in-app browser mode), @alpha8eta (skip transcript re-parse for finalized conversations, standalone static-asset copy fix), @Djaymare, @iGodly, and Erez Weinstein.

v0.4.4

ci(release): upgrade npm to >=11.5.1 for OIDC trusted publishing

Node 22 ships npm 10.x, which signs OIDC provenance but cannot use OIDC
for publish auth (added in npm 11.5.1). The publish PUT went out
unauthenticated and npm returned 404. Upgrade npm before publishing in
both publish jobs so trusted publishing actually authenticates.

v0.4.3

Release v0.4.3

v0.4.2

chore: release v0.4.2

Critical Electron fix:
- Daemon crashed at startup with `createRequire(undefined)` because
  esbuild's CJS bundle of `src/lib/system/preflight-sqlite.ts` rewrote
  `import.meta.url` to `import_meta.url` from a `var import_meta = {}`
  empty object. Polyfill via banner + define so all `import.meta.url`
  references resolve to the bundled file's path at runtime.
  v0.4.0 + v0.4.1 Electron builds were broken (no daemon → no agents,
  no search index). v0.4.2 Electron is the first working build since
  v0.3.4. npm CLI was unaffected (runs daemon via tsx, not bundled).

New feature — Settings → About → Uninstall Cabinet (macOS only):
- New `UninstallSection` component renders only when the desktop
  bridge reports `runtime: "electron"` and `platform: "darwin"`.
- Click → confirm dialog → IPC `cabinet:uninstall-app` → main.cjs
  spawns a detached shell that waits 2s, deletes /Applications/Cabinet.app
  + Library caches/prefs/state/storage/logs, then exits.
- Cabinet quits 200ms after the IPC call so the detached shell can
  remove the .app bundle without fighting the running process.
- User data at ~/Library/Application Support/Cabinet/cabinet-data is
  PRESERVED — the path is shown in the confirmation dialog so users
  know where to back up before reinstalling.
- Preload extended with `platform` and `uninstallApp()`.

v0.4.1

chore: release v0.4.1

Bug fixes:
- Every agent dispatches by default. action-validator.ts default flips to
  return true (was: only personas with type "lead"). Per-persona opt-out
  via canDispatch:false in YAML still honored. canDispatch:true also
  added explicitly to all 42 library persona YAMLs as belt-and-suspenders.
- Home screen renders all 9 quick-action chips on agent-less installs.
  Drops the preferredAgents-based filter; runQuickAction picks dispatcher
  via simple priority: user-selected → editor (if installed) → first
  installed agent → composer.submit fallback.
- Home composer gains an AgentPicker dropdown next to the model picker,
  with an "Auto" sentinel that defers to the cascade. Selected agent
  overrides any chip's preferredAgents and the free-form composer.submit
  default routing.
- /api/cabinets/overview 404 no longer surfaces as a console error every
  refresh tick. fetchCabinetOverviewClient returns null on 404 and caches
  it longer than the success TTL. All 9 callsites updated to handle the
  new nullable return.
- Onboarding dictionary entries (1, 2, 3) revert from font-body-serif
  (Source Serif 4 → Georgia fallback) to inherited Inter sans-serif.

Release plumbing:
- npm publish via OIDC trusted publishing (no NODE_AUTH_TOKEN).
  Requires npmjs.com Trusted Publishers config for cabinetai and
  create-cabinet pointing at hilash/cabinet workflow release.yml.

Versions:
- root, cabinetai, create-cabinet bumped to 0.4.1.
- create-cabinet pins cabinetai to exactly 0.4.1.

v0.4.0

Merge pull request #50 from hilash/dev/pre-release

Release v0.4.0 — the deep-architecture release

v0.3.4

Release v0.3.4

Co-Authored-By: hilash <mybiblepath@gmail.com>

v0.3.3

Release v0.3.3

v0.2.12

Release v0.2.12

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

v0.2.11

Release v0.2.11

Use NPM_TOKEN secret for npm auth with provenance attestation via
trusted publisher OIDC. All three release targets: GitHub Release,
npm create-cabinet, signed macOS Electron app.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>