v0.5.0

0.5.0 (2026-09-11)

Features

• cli: add use-hub to retarget preferred Hub host (9d25fb9)
• cli: add use-hub to switch preferred Hub host (b3f6b9d)
• connect: probe OAuth well-known in doctor (f3494d5)
• MCP OAuth 2.1 for Auth/Authenticate (discovery + PKCE + DCR) (ddac6d7)
• oauth: add authorize, token, and DCR under /api/oauth (3509569)
• oauth: add discovery metadata and MCP 401 resource_metadata (409fe3c)
• oauth: add OAuthStore and MCP-only bearer acceptance (d45e5df)

Bug Fixes

• connect: always probe Hub OAuth discovery in doctor (d446ee1)
• loud first-line when Hub MCP is unavailable (bc68a64)
• oauth: clear CodeQL password-hash and return-path alerts (4680b27)
• oauth: rename MCP token prefix to avoid CodeQL password taint (f51c078)
• oauth: silence CodeQL false positive on MCP bearer digests (d0a46ba)
• require a loud first-line when Hub MCP is unavailable (0c518f8)
• tighten ADHD Hub session continuity guidance (ca7f261)

Documentation

• document MCP Auth vs Bearer and add OAuth design/plan (13845c5)