v0.2.79

v0.2.79 — WebDAV document mounts, unified search, and org-isolation hardening

This release adds WebDAV support to mount an organization's documents as a network drive, a unified search palette shared across the platform and docs, and a fully recursive Google Drive sync with delete/rename reconciliation. It also hardens multi-org isolation in the RAG service with shared-secret authentication and per-org data scoping, and refactors the on-disk config into a uniform org-first layout that is auto-migrated during tale upgrade.

🔒 Security

• Hardened the RAG service for multi-org deployments (#1752):
  • Shared-secret authentication — the RAG service now accepts an Authorization: Bearer token (RAG_AUTH_TOKEN) with a constant-time compare, defending against lateral access on the internal Docker network. Auth is presence-based: when the token is unset the service stays open and logs a loud [SECURITY] warning on every boot.
  • Per-org data isolation — every protected endpoint now requires an X-Tale-Org header, and the data layer enforces org_slug on documents, chunks, and the semantic cache (with a cross-table foreign key). Two orgs with semantically identical queries can no longer pull each other's cached responses via embedding similarity. The schema migration runs automatically and idempotently at RAG startup.

💥 Breaking Changes

• Uniform org-first config layout (#1752): the config tree is now <root>/<org>/<domain>/... for every org, including default. tale upgrade and tale start auto-detect the legacy flat layout (agents/, workflows/, … at the project root) and migrate it in place after an interactive confirm. See the Migration Guide below.
• Per-domain config env overrides removed (#1752): AGENTS_DIR, WORKFLOWS_DIR, PROVIDERS_DIR, INTEGRATIONS_DIR, and SKILLS_DIR are no longer honored — the platform strips them from the Convex deployment env on every boot. Operators with custom paths must set a single TALE_CONFIG_DIR root and place files under <org>/<domain>/.

🚀 Features

• WebDAV server (#1757): mount an organization's documents as a network drive from Finder, Windows File Explorer, iOS Files, or rclone via a read-write WebDAV Class 2 endpoint at /dav/<orgSlug>/. Per-user app-passwords are managed under Settings → WebDAV; uploads land in the Document Hub and flow through the existing RAG indexing pipeline, with .trash soft-delete and lock support. The HMAC key auto-derives from the deployment's instance secret, so no extra configuration is required.
• Unified search palette (#1758): one shared command palette across the platform and the docs site, backed by a new backend entity-search seam with org-scoped relevance ranking (exact → prefix → substring, then newest). Ships alongside an optimistic-update data layer that makes list edits and deletes feel instant.
• Recursive Google Drive sync (#1756): the Google Drive integration now mirrors nested folder hierarchies, reconciles deletes (removing synced docs + their RAG entries when they vanish from Drive), and detects renames and cross-folder moves without re-downloading. Includes data-loss safety hardening (truncation guard skips reconcile, atomic upserts, cross-sync isolation).
• Recover failed audio transcriptions (#1753): failed dictation and audio-upload transcriptions can now be retried from the UI without re-recording or re-uploading — the recording is retained and re-sent on retry.
• Install the PWA from iOS (#1744): the "Get app" menu entry now appears on iOS Safari and opens an illustrated "Add to Home Screen" sheet, instead of being hidden on browsers that don't fire the native install prompt.

🛠 Improvements

• Mobile navigation overhaul (#1759): a five-slot bottom nav with a featured Chat tab and a "More" overflow sheet, a back button on dashboard sub-pages, and safe-area polish so installed PWAs draw correctly down to the home indicator.
• Settings & notifications polish (#1754): Cancel/Discard buttons on settings pages, the notification bell moved to a standalone sidebar popover, entity-named row counts across data tables ("Showing all 7 agents"), and assorted dropdown/menu refinements.
• Icon-only toolbar buttons on mobile (#1747): a shared opt-in collapses button labels to icons below the sm breakpoint (keeping accessible names), applied across Save/Discard clusters and editor toolbars to stop button bars from crowding.
• Redesigned maintenance screen (#1743): the proxy maintenance/update page now matches the offline screen's design system (design tokens, light/dark, reduced-motion support).
• Calmer overlays (#1750): removed the zoom-scale entrance from popovers, dropdowns, menus, selects, and dialogs — they now animate with fade + slide only.

🐛 Fixes

• Document search covers all pages (#1745): searching or filtering the documents table now eagerly loads the remaining pages, so matches outside the first 20 rows are found instead of reading as "no results."
• New orgs seed from the builtin catalog (#1751): scaffolding a new org no longer copies the default org's writable workspace, so scratch agents and test workflows stop leaking into new orgs as templates.
• Mobile settings Save/Discard (#1749): the Save/Discard cluster is now visible on small screens via a mobile-only action bar, and the duplicate "unsaved changes" prompt on discard-and-leave is fixed.
• Mobile top-bar and bottom spacing (#1746): top-bar controls no longer collide with the iOS status bar / Dynamic Island, and the empty band below the bottom nav (a double-counted safe-area inset) is gone.

📝 Other

• Added WebDAV usage and API documentation in en/de/fr (#1757).
• Pointed the subprocessors DPA links to the canonical web URL, fixing the docs link-check CI (#1748).

Upgrade

Run tale upgrade to update the CLI, then tale deploy to apply the new version.

Migration Guide

This release requires attention for two changes. The RAG schema migration and the container-side config migration are handled automatically; the host-side config-layout move is prompted during tale upgrade.

1. Config layout is migrated automatically (one-time).
The config tree is now uniformly org-first (<root>/<org>/<domain>/...). When you run tale upgrade (or tale start), it detects the legacy flat layout and prompts you to migrate it in place (default No — answer Yes). The move is rollback-insured: container-side providers/secrets are copied, not moved, and cleaned up later.

• CI / non-TTY: tale upgrade has no --yes flag and will abort on a legacy layout rather than migrate silently. Migrate explicitly with tale start --yes (dev) or tale deploy --override-all -y (prod).
• After the new deployment is healthy, you can optionally reclaim the rollback copies (sha-verified before removal):

  tale migrate config-layout --cleanup-old

2. Replace per-domain config env overrides (only if you use them).
AGENTS_DIR, WORKFLOWS_DIR, PROVIDERS_DIR, INTEGRATIONS_DIR, and SKILLS_DIR are no longer honored. If you relied on them, set a single root instead and lay files out per org:

# Before: AGENTS_DIR=/custom/agents WORKFLOWS_DIR=/custom/workflows ...
# After:
TALE_CONFIG_DIR=/custom/config   # then place files under <org>/<domain>/, e.g. default/agents/, default/workflows/

3. (Recommended) Enable RAG service authentication.
The RAG service now supports shared-secret Bearer auth, but stays open (with a loud [SECURITY] log warning each boot) until you set it. To enable it, set the same token on both the platform and RAG containers:

# Generate once, then set the SAME value on both containers' env:
RAG_AUTH_TOKEN=$(openssl rand -hex 32)

Per-org RAG data isolation (the org_slug schema migration and semantic-cache scoping) applies automatically — no manual database step is required.

Contributors

@yannickmonney, @larryro, @Israeltheminer, @AdeolaAdekoya

---

Full Changelog: v0.2.78...v0.2.79