v0.2.0

Owlat v0.2.0

Self-hosted server

From the admin dashboard → Settings → System & Updates → "Update now", or:

owlat upgrade --version 0.2.0

Manual upgrade (fetch compose + SHA256, verify, apply):

curl -fsSL https://github.com/wolvesdotink/owlat/releases/download/v0.2.0/docker-compose-0.2.0.yml -o docker-compose.yml
curl -fsSL https://github.com/wolvesdotink/owlat/releases/download/v0.2.0/docker-compose-0.2.0.yml.sha256 -o docker-compose.yml.sha256
sha256sum -c <(sed "s|docker-compose-0.2.0.yml|docker-compose.yml|" docker-compose.yml.sha256)
docker compose pull && docker compose up -d
docker compose --profile deploy run --rm convex-deploy

Desktop app

Download the installer for your OS from the assets below (macOS .dmg,
Windows .msi/.exe, Linux .AppImage/.deb). Existing installs
auto-update to this version.

Supply-chain verification (recommended)

cosign verify ghcr.io/wolvesdotink/web:0.2.0 \
  --certificate-identity-regexp "https://github.com/wolvesdotink/owlat/.github/workflows/.*@.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify docker-compose.yml --repo wolvesdotink/owlat

Images: web, mta, updater, convex-deploy, imap, mail-sync, code-worker, setup — all ghcr.io/wolvesdotink/<name>:0.2.0

What's Changed

Other Changes

• Green the public CI: security advisories, Docker builds, scanners, coverage by @marcelxpfeifer in #8
• feat(setup-cli): add owlat-setup env --show to list required env vars for the current flag state by @marcelxpfeifer in #9
• chore(env): delete inert NOTIFICATION_PROVIDER and VECTOR_STORE seams by @marcelxpfeifer in #15
• test(campaigns): cover the pre-send content/URL scan gate + reconcile roadmap by @marcelxpfeifer in #11
• docs(roadmap): reconcile the Knowledge Graph row — auto-link, graph retrieval, analytics already ship by @marcelxpfeifer in #14
• feat(files): link auto-captured inbound attachments to the sender contact by @marcelxpfeifer in #10
• feat(inbox): auto-archive inbound mail from blocklisted senders on receipt by @marcelxpfeifer in #12
• feat(ai): cross-source LLM-synthesized ask-anything answers with citations by @marcelxpfeifer in #13
• ci: auto-regenerate bun.lock on Dependabot npm PRs by @marcelxpfeifer in #16
• chore(email-builder): delete dead allBlockTypes union mirror by @marcelxpfeifer in #17
• refactor(shared): derive social-platform labels from one exhaustive Record by @marcelxpfeifer in #18
• refactor(web): route local date/number formatters through formatters.ts by @marcelxpfeifer in #19
• refactor(web): extract UiSpinner and dedup 75 brand-spinner copies by @marcelxpfeifer in #20
• refactor(api): add getOrThrow load-or-404 helper by @marcelxpfeifer in #21
• refactor(api): use adminQuery wrapper for inline org:manage reads by @marcelxpfeifer in #22
• fix(api): single-.paginate()-safe audience/segment counting; bump convex-test to 0.0.54 by @marcelxpfeifer in #24
• refactor(api): collapse hand-rolled permission ceremony onto requireOrgPermission by @marcelxpfeifer in #23
• refactor(api): bake feature-flag floor into chat/assistant fn wrappers by @marcelxpfeifer in #26
• refactor(api): delete duplicate MTA client, route systemMail via sendProviderDispatch by @marcelxpfeifer in #27
• refactor(api): extract shared email translation blob operations by @marcelxpfeifer in #28
• feat: suggest merged SPF record so adding DNS records doesn't break other mail providers by @marcelxpfeifer in #25
• refactor(web): extract UiAvatar and dedup chat avatar blocks by @marcelxpfeifer in #29
• feat(web): show why a DNS record failed to verify (found vs expected) by @marcelxpfeifer in #30
• feat(web): one-line domain readiness summary above the DNS records by @marcelxpfeifer in #31
• feat(web): auto-recheck domain DNS verification so users need not click Verify repeatedly by @marcelxpfeifer in #32
• feat(web): autodiscover IMAP/SMTP settings from the email address by @marcelxpfeifer in #33
• feat(web): deep-link the exact app-password page on external-mailbox auth errors by @marcelxpfeifer in #34
• feat(web): auto-detect the server public IP in the desktop setup wizard by @marcelxpfeifer in #35
• feat(api,web): real reverse-DNS (PTR) preflight for the receiving MX host by @marcelxpfeifer in #36
• feat(web): stop guessing the Convex dashboard URL in the onboarding banner by @marcelxpfeifer in #37
• feat(web): warn before adding an unusable sending domain (freemail / no NS) by @marcelxpfeifer in #38
• feat(web): actionable fix on the delivery cannot-send card by @marcelxpfeifer in #39
• feat(web): Cmd+Enter send, Cmd+Shift+Enter send-later, Esc minimizes the composer by @marcelxpfeifer in #40
• feat(web): Superhuman-parity single-key shortcuts + "?" cheat-sheet overlay by @marcelxpfeifer in #41
• feat(web): auto-advance to the next conversation after archive/trash/snooze by @marcelxpfeifer in #42
• feat(web): undoable triage — "Archived — Undo (Cmd+Z)" toast for archive/trash/move/spam by @marcelxpfeifer in #43
• feat(web): layout-matching skeletons + designed empty states for Postbox by @marcelxpfeifer in #44
• feat(web): sender/recipient avatars (initials + deterministic color) across Postbox by @marcelxpfeifer in #45
• feat(web): prefetch adjacent messages on j/k so Enter opens instantly by @marcelxpfeifer in #46
• chore: relicense from MIT to Apache 2.0 by @marcelxpfeifer in #47
• feat(web): adaptive dark-mode rendering of received HTML email by @marcelxpfeifer in #48
• feat(web): in-app Quick Look overlay for image/PDF attachments by @marcelxpfeifer in #49
• feat(web): tracking-pixel detection + privacy badge on received mail by @marcelxpfeifer in #50
• chore: add .gitattributes to force LF on shell scripts by @marcelxpfeifer in #51
• docs(contributing): document Windows dev needs WSL2 or Git Bash by @marcelxpfeifer in #52
• docs(self-hosting): add supported-platforms / OS matrix section by @marcelxpfeifer in #54
• fix(install): guard install.sh to Linux with an actionable message by @marcelxpfeifer in #55
• feat(web,api): one-click Unsubscribe chip from List-Unsubscribe headers by @marcelxpfeifer in #53
• fix(web,desktop): use cross-env so the desktop build works on Windows by @marcelxpfeifer in #56
• feat(web): reader typography + header polish (measure cap, timestamps, avatars) by @marcelxpfeifer in #57
• ci(desktop): publish the release so in-app auto-update resolves by @marcelxpfeifer in #58
• fix(desktop): force exec bit on packed scripts for Windows clients by @marcelxpfeifer in #59
• feat(web): inline reply box pinned under the conversation by @marcelxpfeifer in #60
• ci(desktop): gate the Rust shell on macOS + Windows too by @marcelxpfeifer in #61
• docs: link to wolves.ink from the README header by @marcelxpfeifer in #64
• fix(setup): make owlat quickstart work under Docker Desktop by @marcelxpfeifer in #63
• feat(web): honest link destinations in received mail (tooltip + mismatch flag) by @marcelxpfeifer in #62
• feat(api): detect and track "needs a reply from me" on personal mail by @marcelxpfeifer in #65
• ci: unify release into one v* tag, with server-v*/desktop-v* single-target escapes by @marcelxpfeifer in #66
• feat(web): the Reply Queue — an AI task list of emails waiting on you by @marcelxpfeifer in #67
• feat(web,api): "remind me if no reply" follow-up tracking on sent mail by @marcelxpfeifer in #68
• feat(web,api): smart inbox sections — People, Newsletters, Notifications, Receipts by @marcelxpfeifer in #69
• feat(api): per-identity writing-voice profile learned from sent mail by @marcelxpfeifer in #70
• feat(web,api): inline ghost-text autocomplete in the composer (Tab to accept) by @marcelxpfeifer in #71
• feat(web,api): selection AI pill — shorter · friendlier · formal · fix grammar · translate by @marcelxpfeifer in #72
• feat(web,api): automatic cached summary strip on long threads by @marcelxpfeifer in #73
• feat(web,api): "Ask about this thread…" — assistant scoped to the open conversation by @marcelxpfeifer in #74
• feat(web,api): detect scheduling requests and pre-draft an availability reply by @marcelxpfeifer in #75
• feat(web): markdown-style typing shortcuts in the Postbox composer by @marcelxpfeifer in #77
• feat(web): hide the composer toolbar until text is selected by @marcelxpfeifer in #78
• feat(web,api): smarter recipient field — recency ranking, external-domain cue, reply-all gap hint by @marcelxpfeifer in #79
• feat(web,api): paste/drop images inline into the Simple composer (cid embedding) by @marcelxpfeifer in #80
• feat(web): attachment chips — upload progress, thumbnails, size meter by @marcelxpfeifer in #81
• feat(web): default reply-all vs reply preference + visible compose toggle by @marcelxpfeifer in #82
• feat(web): :shortcode: emoji picker in the composer by @marcelxpfeifer in #83
• feat(web): progressive disclosure — reader actions behind hover/⋯, leaner compose footer by @marcelxpfeifer in #84
• feat(web): one consistent motion system for Postbox transitions by @marcelxpfeifer in #85
• feat(web): comfortable/compact density + icon-collapsible folder rail by @marcelxpfeifer in #86
• feat(web): optional Postbox send sound (off by default) by @marcelxpfeifer in #87
• feat(web): windowed thread list + cursor pagination for large folders by @marcelxpfeifer in #88
• feat(web): Postbox render cache, iframe pre-sizing, composer chunk warmup by @marcelxpfeifer in #89
• feat(desktop,web): pure mailto parser + default-mail-app setup for the desktop shell by @marcelxpfeifer in #90
• feat(desktop,web): richer notifications — smart-category rules, grouping, tray peek by @marcelxpfeifer in #91
• refactor(ui): migrate useRichText off execCommand to Selection/Range (native-undo bridge + full test matrix) by @marcelxpfeifer in #92
• feat(web): offline read cache — instant cold start + readable mail without a connection by @marcelxpfeifer in #93
• feat(api): apply the learned writing-voice profile to the autonomous agent draft by @marcelxpfeifer in #94
• feat(api): emit a retrieval coverage/confidence signal from context_retrieval by @marcelxpfeifer in #95
• fix(email-renderer): escape color/font/width fields in style & VML (stored XSS) by @marcelxpfeifer in #96
• feat(web,api): text snippets with slash-trigger in the composer by @marcelxpfeifer in #76
• fix(email-renderer): safe JSON-in-HTML embedding (</script> breakout + control chars) by @marcelxpfeifer in #98
• feat(api): draft-quality self-check that gates autonomy on the draft, not the classifier by @marcelxpfeifer in #97
• fix(email-scanner): match unquoted hrefs + trim before scheme check by @marcelxpfeifer in #99
• fix(email-builder): string[] array editors no longer push objects (render crash) by @marcelxpfeifer in #101
• feat(api): server-derived recipient + deterministic pre-send reference monitor on auto-send by @marcelxpfeifer in #100
• fix(email-builder): social block no longer silently dropped inside Container/Hero by @marcelxpfeifer in #102
• feat(api): never widen autonomy without the user — graduation-suggestion gate by @marcelxpfeifer in #103
• fix(web): email body iframe resizes to content (was clipped to 200px) by @marcelxpfeifer in #104
• fix(web): reopening a saved draft no longer overwrites its body with the signature by @marcelxpfeifer in #105
• fix(web): block Postbox send while attachments are still uploading by @marcelxpfeifer in #107
• fix(api): campaign send walker survives a thrown hop (retry/watchdog) by @marcelxpfeifer in #108
• fix(api): enforce form-forced double opt-in at campaign send by @marcelxpfeifer in #109
• fix(imap): correct FETCH BODY literal octet count for non-ASCII/8-bit bodies by @marcelxpfeifer in #111
• fix(web): contact CSV export no longer throws past ~2,000 contacts by @marcelxpfeifer in #112
• feat(web,api): persist and surface the autonomy decision reason + draft grounding by @marcelxpfeifer in #110
• fix(compose): isolate the untrusted code-worker executor network by @marcelxpfeifer in #113
• feat(web): keyboard-first agent review queue (j/k/Enter + approve/edit/reject) by @marcelxpfeifer in #114
• fix(sdk): handle empty-body 4xx/5xx as errors (was swallowed as success) by @marcelxpfeifer in #115
• feat(web): before/after diff when reviewing or editing an agent draft by @marcelxpfeifer in #116
• feat(api): configurable send-delay / undo window on autonomous sends by @marcelxpfeifer in #106
• fix(setup): pin OWLAT_VERSION on the install pull path (deploy signed images, not :dev) by @marcelxpfeifer in #117
• fix(release): single-target releases stop clobbering the shared "latest" (updater/install) by @marcelxpfeifer in #118
• fix(desktop): stamp the release tag into the desktop version (auto-update resolves) by @marcelxpfeifer in #119
• fix(web): enforce composer attachment count/total-size limits by @marcelxpfeifer in #120
• fix(api): re-check suppression list in the campaign worker before dispatch by @marcelxpfeifer in #122
• feat(api): awaiting_clarification lifecycle state + pendingClarification + resume-into-draft by @marcelxpfeifer in #121
• fix(mta): return the real message id on idempotency dedup (VERP attribution) by @marcelxpfeifer in #123
• fix(api): SES send is idempotent under dispatch retry (no double-delivery) by @marcelxpfeifer in #125
• feat(api): clarify step — slot-based missing-info detection with divergence gating by @marcelxpfeifer in #126
• docs: bring Postbox docs current with shipped email-experience features by @marcelxpfeifer in #124
• fix(mail-sync): deterministic synthetic Message-ID (stop backfill duplication) by @marcelxpfeifer in #127
• fix(api): terminal status for retry-exhausted agentActions (retry cron no longer starves) by @marcelxpfeifer in #128
• fix(api): audience dashboard uses denormalized counts (stop unbounded reactive collects) by @marcelxpfeifer in #130
• fix(api): rate-limit the @assistant-in-chat path (LLM-cost DoS) by @marcelxpfeifer in #131
• fix(api): stop returning the webhook HMAC secret to the client by @marcelxpfeifer in #132
• fix(code-worker): resource limits, process-group kill, cap-drop, workspace cleanup by @marcelxpfeifer in #133
• fix(sdk-js): cap the 429 Retry-After sleep (mirror the Java 30s cap) by @marcelxpfeifer in #134
• ci(release): gate the release ref on ci:verify before publishing artifacts by @marcelxpfeifer in #136
• fix(build): add dist/** to turbo build outputs (unpoison the sdk-js publish) by @marcelxpfeifer in #137
• feat(api): shadow "would-have-sent" mode + per-category/sender scorecard by @marcelxpfeifer in #135
• ci: enforce the oxfmt format check (configured but never run) by @marcelxpfeifer in #138
• chore(web): drop dead deps (@tiptap/*, ai, @ai-sdk/openai) + lazy-load posthog-js by @marcelxpfeifer in #140
• docs(self-hosting): MTA & ClamAV are profile-gated (stock install ships no AV) by @marcelxpfeifer in #141
• feat(web,api): offer 2-3 draft options at the review gate by @marcelxpfeifer in #139
• fix(web,a11y): correct mislabeled Close/Confirm icon buttons app-wide by @marcelxpfeifer in #142
• fix(web,a11y): set (WCAG 3.1.1) by @marcelxpfeifer in #143
• feat(api): per-org dollar spend budget that fails closed by @marcelxpfeifer in #144
• feat(web,api): Postbox-native clarify — "Needs your input" Reply Queue card by @marcelxpfeifer in #129
• fix(code-worker): run untrusted agent+tests under a separate unprivileged UID (close /proc secret leak) by @marcelxpfeifer in #145
• feat(api): capture post-send outcomes (replies/bounces/complaints) as autonomy feedback by @marcelxpfeifer in #146
• feat(web,api): VIP/important-sender signal + unified cross-thread priority score by @marcelxpfeifer in #147
• feat(web,api): smart snooze — AI-suggested wake time + snooze-until-they-reply by @marcelxpfeifer in #148
• feat(web,api): strip tracking pixels / remote images on inbound mail by @marcelxpfeifer in #149
• feat(api): prompt caching + complexity routing in the drafting path by @marcelxpfeifer in #150
• feat(web): "Coach my draft" rung for high-stakes mail by @marcelxpfeifer in #151
• feat(web,api): ask-eagerness dial + per-email cap + ask→answer→draft-delta instrumentation by @marcelxpfeifer in #152
• feat(api): answer-memory — persist clarification answers so it never asks twice by @marcelxpfeifer in #153
• feat(api): durable grounding — open-commitments recall + curated policy/FAQ with precedence by @marcelxpfeifer in #154
• feat(api): preserve grounding under compaction + agentic fetch-more in the draft path by @marcelxpfeifer in #155
• feat(web,api): freeform revise-by-instruction on the whole draft + streaming by @marcelxpfeifer in #156
• feat(web,api): AI draft proposes/attaches the right file by @marcelxpfeifer in #157
• feat(api): inbound injection hardening -- quarantined extraction + hidden-text strip + guard beyond 8k by @marcelxpfeifer in #158
• feat(api): per-sender/per-contact autonomy with a first-N-observed warm-up by @marcelxpfeifer in #160
• feat(ui): adopt Fluid Functionalism design system by @marcelxpfeifer in #162
• feat(api): quality/eval harness — golden set, edit-distance metric, ask-rate dashboards by @marcelxpfeifer in #164
• feat(web,api): Daily Brief digest + bidirectional commitment/deadline tracking by @marcelxpfeifer in #165
• feat(web,api): bring on-arrival draft + confidence + review gate into personal Postbox by @marcelxpfeifer in #167
• feat(web,api): autonomy trust controls — graduation nudge, kill switch, working hours by @marcelxpfeifer in #161
• feat(api): edit-learning flywheel — diff draft→sent into the voice profile + per-contact overrides by @marcelxpfeifer in #163
• feat(api): real free/busy availability grounding for scheduling replies by @marcelxpfeifer in #166
• feat(web,api): natural-language handling rules by @marcelxpfeifer in #168
• style(marketing): minimal Linear-style header + footer (drop beta bar) by @marcelxpfeifer in #169
• style(marketing): minimal hero — typography-led, calm product frame by @marcelxpfeifer in #170
• style(marketing): feature overview without numbers/badges — quiet bento by @marcelxpfeifer in #171
• style(marketing): TrustBar, OpenSource, Developer sections — one quiet rhythm by @marcelxpfeifer in #172
• style(marketing): flat minimal pricing + statement CTA (no orbits, no tilt) by @marcelxpfeifer in #173
• style(docs): quiet chrome — header, sidebar, ToC, footer match the landing by @marcelxpfeifer in #174
• style(docs): sans display prose + minimal content components by @marcelxpfeifer in #175

New Contributors

• @marcelxpfeifer made their first contribution in #8
• @dependabot[bot] made their first contribution in #6

Full Changelog: https://github.com/wolvesdotink/owlat/commits/v0.2.0