oneloop 0.1.0-rc.5

The fifth release candidate. It fixes many bugs in the web app, in MCP and in
the commands, limits the size of Knowledge folders, and updates rustls for a
security fix. Read the upgrade notes before you upgrade.

Upgrade notes

• A Knowledge folder now stops syncing, and shows that it is too large, when
  it has more than 5,000 subfolders, or more than 5,000 files counting links
  and other files that the sync leaves out. A knowledge base that synced in
  0.1.0-rc.4 can reach these limits: choose a smaller folder, or remove files
  or subfolders from it. Before, such a folder could fill the disk with
  folders or left-out files, and many deep subfolders could make search use
  gigabytes of memory.
• In MCP, the command tools now answer every edit and deletion without
  expectedRevision with precondition_failed, as the documentation says.
  Before, discussion.comment.edit failed with validation_failed, and
  execute_destructive_command refused the call as invalid arguments.
  discussion.comment.create and the inbox.* operations now refuse an
  expectedRevision with validation_failed, as creating a task does.
  Before, they ignored it.
• In MCP, a read_pool nextCursor from an earlier version now fails with
  validation_failed, because Pool cursors have a new form. Start again from
  the first page.

Changed

• ONELOOP_TRUSTED_PROXIES now ignores empty items, such as a trailing
  comma, like the other lists. Before, oneloop refused to start.
• An MCP download now names the file in its Content-Disposition header, as
  a browser download does.
• In MCP, list_attachments and reorder_attachment now accept a task key,
  such as WEB-042, in taskId, as create_attachment_upload does.

Fixed

• oneloop serve, oneloop backup and the other commands no longer fail
  when nothing reads their standard error and they have a warning or notice
  to print, such as a copy left by an interrupted backup. The serve warning
  about an empty ONELOOP_TRUSTED_PROXIES is now a log line like the others.
• Times such as "5m ago" on comments, activity and the Inbox now count from
  the server's clock. Before, a computer clock that ran fast or slow made a
  new comment read "5m ago", or stay "just now" too long.
• The Inbox's counts, activity feeds, a block's history and, in MCP,
  search_tasks without a status now show the data of one moment. Before, a
  change that landed while they were read could show twice, not at all, or
  with counts that didn't match the items.
• When a person opens more than 16 tabs, the oldest one now always says that
  its live updates are paused, with Resume. Before, it could look
  connected and show no new changes until you used it, or reconnect at once
  and close another tab.
• One person's slow avatar uploads can no longer hold up avatar changes for
  everyone. Each person now has one avatar upload at a time; another one
  gets "try again" at once. When the server is busy, a refused avatar upload
  now gets that answer instead of a network error.
• After you change a task's status on its page, the status in the page header,
  the Status icon and Block task now change at once. Before, they changed
  only after you left the task's fields. Overdue also follows a changed
  deadline at once.
• Choosing Done in the Status of a blocked task now asks you to unblock and
  complete it, as the Board does. Before, the change failed with an error.
• Saving a changed block reason now says "Block reason updated", and unblocking
  and completing a task says "Task unblocked and completed". Before, they said
  "Task blocked" and "Task unblocked".
• A block reason with several spaces in a row before a mention keeps the
  mention. Before, the mention was dropped and the person was not notified.
• oneloop asks before you leave a task whose new deadline could not be saved
  because the connection was lost, also after you left the deadline field. A
  link to the page you are on no longer asks to discard your changes.
• When you press Back or Forward with text you haven't sent and then
  Cancel, the browser history stays as it was. Before, the next Back
  skipped a page.
• When someone else renamed a milestone while you edited its name, the
  question about the change now shows their name. Before, it showed no saved
  value.
• The Temporary switch in a file preview works. Before, it did nothing.
• After you add a Pool item with a description, the description field closes,
  so the next item starts with its title. Before, it stayed open and empty.
• Dropping a track back in its own place on the Roadmap no longer shows an
  error.
• On a 320-pixel-wide screen, the Roadmap header shows the whole Epic
  button. Before, part of it was cut off. Screen readers still read the
  Roadmap heading there.
• An epic's activity now comes in pages of up to 100 items, like all other
  activity, as the limits in the documentation say. It stopped at 50.
• With a very large ONELOOP_STORAGE_LIMIT, above about 200 PiB, the storage
  page for administrators shows the right cleanup points of 80% and 70%.
  Before, it showed wrong values.
• When a Knowledge folder is too large to sync, oneloop now says to remove
  files or subfolders. Before, it said to remove large files, which doesn't
  help a folder with too many files or subfolders.
• Knowledge search now says when some files are searched by name only,
  because their text doesn't fit in the search index. Before, a word in such
  a file gave "No results" without a reason. In MCP, search_knowledge and
  read_knowledge_overview replies then include "partial": true.
• Markdown in Knowledge shows at the reader's own width and spacing.
  Before, it used the wider layout of file previews.
• A Knowledge file download now always sends the file, as an attachment
  download does. Before, a download request with If-None-Match could get an
  empty "not modified" answer.
• The page where you connect an AI app lists projects in the same order as
  the app, without regard to upper and lower case.

Security

• Updated rustls to 0.23.46 (RUSTSEC-2026-0349). oneloop uses it when it
  fetches the metadata document of an AI assistant that connects.

Distribution

• Docker: ghcr.io/code19m/oneloop:0.1.0-rc.5, for linux/amd64 and
  linux/arm64
• From source:
  cargo install --git https://github.com/code19m/oneloop --tag v0.1.0-rc.5 --locked