Bloks 2.5.37

Saved files that stay safe when they can't be read, change cards that show only each turn's own work, and tidier webhooks

• Security: connector keys stay off the command line. Up to 2.5.34, Claude Code was started with its MCP settings in its command line, where other programs on the computer could read the Composio key and any MCP server headers. 2.5.35 moved them into a private file, and this release adds a test that keeps them there. If you used Composio or an MCP server with a token on 2.5.34 or earlier, rotate that key. Thanks to @rpavlovs for reporting it privately.
• Saved files are never written over after a failed read. If a conversation, your agents or your settings can't be read for a moment, Bloks now says which file and waits, instead of starting empty and saving over it. A damaged file is kept aside, and a file a scanner or backup is holding is tried again first (#245, thanks @rpavlovs).
• Memory Undo never deletes a file it couldn't read. An edit or Undo over a memory file that can't be read now stops and says so (#246, thanks @rpavlovs).
• Change cards show each turn's own files. When agents share a folder, a card lists only what that turn edited. A turn that ran commands beside another still tells you the folder changed (#241, thanks @rpavlovs).
• Webhooks.
  • An event in your main conversation is marked as the webhook's, not shown as something you wrote (from #242, thanks @rpavlovs).
  • Webhooks that start a workflow now survive a restart (#244, thanks @rpavlovs).
• Mail from senders you haven't listed keeps to its own conversation even after you rename it.
• Routines and watchers an agent sets up count toward the twelve-turn limit, so an agent can't keep itself going through them.
• Smaller fixes.
  • Listing agents without messages really returns none (#243, thanks @rpavlovs).
  • The phone knows how much older history is left to load through Bloks Cloud.