Tale v0.5.2

0.5.2 is a feature and fix release on the 0.5 line: connector OAuth apps become configurable per organization, and the assistant's access to your documents — listing, reading, and indexing — is repaired.

Highlights

Connector OAuth apps per organization (#3109)

Vendor OAuth app credentials for connectors and cloud import (Microsoft 365, Google Drive, OneDrive) were previously configurable only through deployment environment variables, so every organization on a multi-org deployment shared one vendor app. They can now be registered per organization:

• Settings → Connectors gains an admin-only OAuth apps card showing, per provider, whether the organization uses its own app, the deployment-wide app, or none — with the exact redirect URIs to register shown in the configure dialog.
• Resolution is organization app first, deployment environment second on every OAuth lane (connector consent and token exchange, cloud-import consent, exchange, and refresh). Env-only deployments keep working unchanged — no operator action on upgrade.
• Client secrets are stored encrypted, never echoed back to the browser (listings carry a masked preview), and every write lands on the audit chain.
• A Microsoft app registered as single-tenant now works: the organization app's tenant ID replaces the catalog's /common endpoints, which single-tenant registrations reject (AADSTS50194).
• Slack stays deployment-env-only by design: its inbound event signature check runs before any organization is known, so an org-level Slack app could consent but never verify.

The same change moves the app's own navigations off the retired 0.4 /http_api dialect onto their native /api routes, fixing three broken flows: Documents → From Microsoft 365 / Google Drive → Connect (404 under bun dev), Settings → Connectors → Connect (broken in dev and production), and voice playback (fetched a retired route). Externally registered wire paths — IdP redirect URIs, SAML, SCIM — are public contract and keep their /http_api aliases.

Agent document listing, read, and indexing repaired (#3112)

Three 0.5-cutover regressions sat on the vertical between the chat assistant and your documents, all fixed:

• Listing: the chat document tool and the sandbox agent's document_find failed on every call since the cutover (the ported query referenced a column that does not exist in the 0.5 schema). Listing now returns each document's folder breadcrumb exactly as 0.4 did, through one shared helper behind both doors, with the fileName/extension filters restored.
• Read: the chat door's inline document fallback for rag_fetch was never wired to a handler, and hub-authored inline documents came back content-less on both doors.
• Indexing: RAG indexing of an uploaded document stopped after the first 64-chunk slice but stamped the document Indexed — a large PDF could sit at 64 of 900+ chunks stored, invisible to search beyond its opening pages, with the corpus stuck processing. The worker now drains all slices, with per-slice progress that doubles as the liveness signal.

If you uploaded large documents on 0.5.0 or 0.5.1: a document that shows Indexed but is mostly missing from search results was truncated by this bug. After upgrading, use Retry indexing on the document — the resume path keeps the chunks already stored and completes the rest.

Migration notes

One SQL migration (0058, the connector OAuth apps table) applies automatically at backend boot during tale deploy. No operator action is needed.

Upgrading

• On the 0.5 line (0.5.0 / 0.5.1):

  tale update
  tale deploy

• New install:

  curl -fsSL https://raw.githubusercontent.com/tale-project/tale/main/scripts/install-cli.sh | bash
  mkdir tale-05 && cd tale-05
  tale init
  tale deploy

• Coming from 0.4.x: 0.5 remains a breaking minor with no in-place upgrade in either direction — read the v0.5.0 release notes and Upgrades → 0.4 → 0.5: breaking cutover before touching anything.

What's Changed

• feat(platform): configure connector OAuth apps per organization by @larryro in #3109
• fix(platform): repair the agent document listing, read, and indexing by @larryro in #3112

Full Changelog: v0.5.1...v0.5.2