146 non-merge commits since v0.6.0 — 73 fix, 26 feat, 19 test, 14 docs, 5 chore, 2 refactor, 1 revert, 1 style, 1 ci. 332 files changed. No breaking changes.
Highlights
Slack setup you can actually follow
Connecting Slack no longer means guessing. The create page now generates a Slack app manifest with both request URLs filled in and links straight to Slack's app-creation flow. The credentials panel says where each credential actually lives in Slack rather than masking everything behind identical dots, and explains the empty conversation list and thread-mention behaviour instead of leaving them as surprises.
A message from an unverified sender used to be dropped silently. It now gets a reply — once per day per conversation — pointing at the Profile UI so the person can link their account.
Larger file uploads
The GFS upload ceiling moves 10MB → 16MB, matched across the desktop client, the browser client, and the gfsc write path. Getting there meant homologating timeouts at every hop (control-ui proxy, control-api→gfsc, the nginx funnel) at 300s, and raising control-api's memory ceiling: uploads arrive base64-in-JSON and are fully buffered, so a 16MB file transiently holds roughly five copies. At the old limit, two concurrent uploads OOM-killed the pod.
Plugin UI SDK
Plugins can render their own UI through a consented context bridge, and gfs:// links from a plugin now open in the Desktop viewer.
Desktop chat
Chats open at the latest message, with a scroll-to-bottom control that stays legible on hover and is scoped to the active chat.
Egress drift on GKE (#299)
External-egress FQDN resolution now accumulates over a sliding window instead of replacing the set each pass, fixing stale /32 drift. The resync interval must stay at or below half the overlap window, and HCC now fails closed at startup rather than silently drifting if that invariant is violated.
Connectors and secrets
Connector context membership and sharing are managed in place, creating a connector requires an explicit credentials choice rather than defaulting silently, and secret-provider availability is surfaced up front.
Reliability
Among the 73 fixes: control-api no longer 500s when a provider guard meets a missing channel or a non-string credential; enabling a provider without its credentials is rejected rather than half-applied; Slack targets whose Secret lacks a signing secret are hidden instead of offered; and the control-api DB migration Job now retries a transient lock timeout instead of failing the whole deploy.
Images
Release images are promoted, not rebuilt — release-images.yml copies the exact digests already proven on :latest into :v0.7.0, so they are byte-identical to what was tested.