v0.5.0

0.5.0 (2026-07-08)

Features

• actions: make resolved display params a first-class map for disclosure (#426) (cf4db8a)
• auth: decouple managed-IdP sign-in from invite-only admission (#434) (d557486)
• connections: admin "show all users' connections" view + full management (#407) (e52590f)
• executor: expand array-valued query params to repeated key=value pairs (#420) (462ceed)
• gmail: threads, label modify/CRUD, and untrash operations (#415) (98ebf4c)
• mcp: OAuth-authenticated MCP servers + HubSpot via remote MCP (#418) (788df5e)
• members: promote/demote org admins + fix invite-as-admin grant (#433) (fcf8d24)
• oauth: bind connections to the owner identity on import/connect (D23) (#410) (5244ca0)
• oauth: expose provider OAuth metadata + template scopes for white-label partners (#401) (b50e4f9)
• oauth: per-org oauth_redirect_url + opt-in white-label switch (#398) (210a2fc)
• oauth: resolve connections at the owner identity (D22) (#406) (7a5bd8b)
• oauth: surface partial OAuth grants at discovery + self-heal NULL scopes (#411) (937130b)
• oauth: white-label connections as a token vault (POST /v1/connections/import) (#400) (c93289a)
• oauth: white-label headless OAuth — URL-less auth-recovery (#402) (301b02d)
• orgs: trial mode — instance-admin managed trials + self-serve Stripe trial (#436) (630be78)
• save feedback (03da0ff)
• services: add built-in Google Keep (Notes) service (#409) (69fb7b4)
• services: add built-in Google Tasks service definition (#408) (220a1f9)
• services: add LinkedIn service + OAuth provider (#414) (7d3f8b5)
• services: add Notion service template + OAuth provider (#417) (26aba42)
• services: explicit disclose declarations for all shipped write actions (#425) (a18bbd6)
• services: org-admin curated service catalogs + hard instantiation gate (#435) (95bcc3e)
• services: resolve IDs to names on destructive actions and chain them into disclose (#427) (2b5f97e)
• services: use_default_connection opt-out + atomic pin_service_ids (#431) (493cbb8)
• slack: wrap Slack's MCP server with OAuth-connection auth (#416) (30a830b)

Bug Fixes

• connections: scope credentials page listing to the service owner (#430) (0a09e88)
• dashboard: move use_default_connection toggle to service Connection tab (#432) (814198f)
• db: size the connection pool and isolate background jobs to stop pool exhaustion (#424) (a3df33d)
• deps: patch Dependabot security advisories (#412) (107d689)
• hubspot: re-sync to HubSpot's replaced MCP tool catalog + record requested scopes when /token omits scope (#428) (6660857)
• oauth: never narrow recorded scopes on refresh; break the metadata-scope reconnect loop (#423) (1b70d5a)
• services: allow Write members to manage their own services (#437) (3943c99)

What's Changed

• fix(services): reflect provider auto-resolve in credentials_status by @angel-manuel in #378
• fix(dashboard): don't logout on a service-auth 401 in "try it" by @angel-manuel in #379
• test(actions): cover ?wrap=true 200 auth envelopes by @angel-manuel in #380
• fix(connections): "Wrong account" on /connect-authorize for multi-org + admin/actor override by @angel-manuel in #381
• feat(oauth): allow dashboard override of env-configured OAuth providers by @angel-manuel in #382
• feat(identities): add on-demand cascade-archive endpoint by @angel-manuel in #383
• feat(services): hidden api-key test_email fake for eval fixtures by @angel-manuel in #384
• feat(auth): passwordless email magic-link login by @angel-manuel in #385
• fix(agents): only badge the logged-in identity as "(you)" by @angel-manuel in #386
• feat(oauth): white-label custom redirect URIs for connect flows by @angel-manuel in #388
• docs(env): document GitHub sign-in OAuth App + callback URLs by @angel-manuel in #387
• feat(oauth): expose raw authorize URL on upgrade_scopes reauth by @angel-manuel in #392
• feat(identities): admin can remove user members from an org by @angel-manuel in #393
• chore(deps-dev): Bump the dashboard-deps group in /dashboard with 8 updates by @dependabot[bot] in #390
• chore(deps): Bump the github-actions-deps group with 2 updates by @dependabot[bot] in #389
• chore(deps): Bump the cargo-deps group with 6 updates by @dependabot[bot] in #391
• feat(login): use landing wordmark's skewed slash on login page by @angel-manuel in #395
• feat(infra): provision GitHub login OAuth secrets, gate login providers by @angel-manuel in #396
• release: v0.4.0 (dev → master) by @angel-manuel in #394
• chore(release): v0.4.0 by @angel-manuel in #397
• feat(oauth): per-org oauth_redirect_url + opt-in white-label switch by @angel-manuel in #398
• ci(infra): Kaniko layer caching + age-based registry cleanup by @angel-manuel in #399
• feat(oauth): white-label connections as a token vault (POST /v1/connections/import) by @angel-manuel in #400
• feat(oauth): expose provider OAuth metadata + template scopes for white-label partners by @angel-manuel in #401
• feat(oauth): white-label headless OAuth — URL-less auth-recovery by @angel-manuel in #402
• feat(oauth): resolve connections at the owner identity (D22) by @angel-manuel in #406
• feat(services): add built-in Google Tasks service definition by @angel-manuel in #408
• feat(services): add built-in Google Keep (Notes) service by @angel-manuel in #409
• feat(connections): admin "show all users' connections" view + full management by @angel-manuel in #407
• chore(deps-dev): Bump the dashboard-deps group in /dashboard with 7 updates by @dependabot[bot] in #404
• chore(deps): Bump the cargo-deps group with 6 updates by @dependabot[bot] in #405
• chore(deps): Bump actions/checkout from 6 to 7 in the github-actions-deps group by @dependabot[bot] in #403
• feat(oauth): bind connections to the owner identity on import/connect (D23) by @angel-manuel in #410
• feat(oauth): surface partial OAuth grants at discovery + self-heal NULL scopes by @angel-manuel in #411
• feat(services): add Notion service template + OAuth provider by @angel-manuel in #417
• feat(executor): expand array-valued query params to repeated key=value pairs by @angel-manuel in #420
• fix(deps): patch Dependabot security advisories by @angel-manuel in #412
• chore(deps): Bump the cargo-deps group with 3 updates by @dependabot[bot] in #413
• feat(services): add LinkedIn service + OAuth provider by @angel-manuel in #414
• feat(gmail): threads, label modify/CRUD, and untrash operations by @angel-manuel in #415
• feat(mcp): OAuth-authenticated MCP servers + HubSpot via remote MCP by @angel-manuel in #418
• fix(oauth): never narrow recorded scopes on refresh; break the metadata-scope reconnect loop by @angel-manuel in #423
• fix(db): size the connection pool and isolate background jobs to stop pool exhaustion by @angel-manuel in #424
• chore(deps-dev): Bump the dashboard-deps group in /dashboard with 10 updates by @dependabot[bot] in #421
• feat(slack): wrap Slack's MCP server with OAuth-connection auth by @angel-manuel in #416
• chore(deps): Bump the cargo-deps group with 4 updates by @dependabot[bot] in #422
• feat(services): explicit disclose declarations for all shipped write actions by @angel-manuel in #425
• feat(actions): make resolved display params a first-class map for disclosure by @angel-manuel in #426
• feat(services): resolve IDs to names on destructive actions and chain them into disclose by @angel-manuel in #427
• fix(hubspot): re-sync to HubSpot's replaced MCP tool catalog + RFC 6749 scope fallback on OAuth callback by @angel-manuel in #428
• docs(readme): remove pre-release warning by @angel-manuel in #429
• fix(connections): scope credentials page listing to the service owner by @angel-manuel in #430
• feat(services): use_default_connection opt-out + atomic pin_service_ids by @angel-manuel in #431
• fix(dashboard): move use_default_connection toggle to service Connection tab by @angel-manuel in #432
• feat(members): promote/demote org admins + fix invite-as-admin grant by @angel-manuel in #433
• feat(auth): decouple managed-IdP sign-in from invite-only admission by @angel-manuel in #434
• feat(orgs): trial mode — instance-admin managed trials + self-serve Stripe trial by @angel-manuel in #436
• feat(services): org-admin curated service catalogs + hard instantiation gate by @angel-manuel in #435
• fix(services): allow Write members to manage their own services by @angel-manuel in #437
• release: promote dev → master (post-v0.4.0) by @angel-manuel in #438
• chore(release): v0.5.0 by @angel-manuel in #440

Full Changelog: v0.3.0...v0.5.0