Repository navigation
Releases: workhold/doca
Release list
v0.2.30
Doca 0.2.30 — independent MCP executions and tiered SDD
MCP tool use now creates standalone execution tasks. It shares authorization, leases, cancellation, operation receipts and actual provider usage with chat tools, while creating no conversation or memory thread. Personal settings → MCP → Execution history provides status, authorized resources, stopping and removal of closed history. Saved documents/files and host audit/usage facts remain intact.
Current DDL makes task conversation/model associations and the retained MCP conversation reference nullable, and adds the empty ai_task_resources ledger through the approved reconciler. Existing rows are preserved without conversion; historical MCP conversations disappear from chat entry points and cannot resume. The compatibility generation is unchanged.
Plugin SDK source is 0.2.0 with ai.v2 / ai.continuations.v2. Task identity is always jobId; sessionId exists only for real conversations. Rebuild plugins with sdkRange: "^0.2.0" and update host/Web/plugins together. Old ranges and services are rejected without adapters. Back up before upgrade; automatic application downgrade is not provided.
SQLite and PostgreSQL 17/18 checks include actual released 0.2.29 data, retained rows, repeated/concurrent startup and review rejection. See verification. Publication receipts are recorded separately after successful remote verification; publishing artifacts does not deploy a running installation.
The repository adopts tiered SDD, with full/standard/light records, a module index, pinned Spec Kit 1.0.4, and PR traceability checks. This process change does not alter runtime data.
GitHub Release includes the built plugin SDK 0.2.0 tarball and checksum for rebuilding plugins. This release does not publish the SDK to npm. Docker Hub targets are smartdoca/doca:0.2.30 and latest for native Linux amd64/arm64. The browser extension remains 0.2.11.
Web assets are attached as doca-web-assets-v0.2.30.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Fresh installations can use the attached doca-compose-v0.2.30.yaml: edit the origin and generated master key, then run docker compose up -d. Administrator initialization is built into the image. A SHA-256 checksum is attached. Existing installations must preserve their project, volumes and key.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.30.tar.gz with a SHA-256 checksum.
The built plugin SDK and its SHA-256 checksum are also attached for rebuilding plugins against this release's public contract; this does not publish an npm package.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.29
Doca 0.2.29 — AI conversation history and deletion fixes
New AI turns save the original question and owned attachment information before file validation, model initialization and attachment recognition. If setup fails, reopening or refreshing the conversation still shows the question, attachment and task failure. An existing saved message and its context remain intact when an attempt resumes.
The welcome screen no longer appears below queued or running task progress when messages have not arrived. Loading an existing conversation suppresses the welcome screen; starting a new conversation restores it. Render caching includes the selected conversation ID.
Conversation deletion now shows errors inside the confirmation dialog and supports retry. Conversations with active tasks offer an explicit Stop task action before a separate deletion confirmation. The server continues to reject deletion while tasks are queued, running or awaiting approval, including when their state changes after opening the dialog. Stopping tasks does not automatically delete a conversation. Chinese and English prompts are included.
No database structure, stored format or historical-message recovery is introduced. Existing missing message records are not reconstructed or rewritten. Existing historical message readers, retry defaults and session-file cleanup rules are unchanged. Preserve databases, attachments, configuration and master keys, and update server and Web together. The 0.2.28 upgrade requirements still apply. See the verification record for scope and evidence.
GitHub Release assets and native Linux amd64/arm64 Docker Hub images are the publication targets. Fresh installations can use doca-compose-v0.2.29.yaml; existing installations retain their deployment identity and volumes. Publishing does not deploy a running site. The browser extension remains version 0.2.11.
Web assets are attached as doca-web-assets-v0.2.29.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Fresh installations can use the attached doca-compose-v0.2.29.yaml: edit the origin and generated master key, then run docker compose up -d. Administrator initialization is built into the image. A SHA-256 checksum is attached. Existing installations must preserve their project, volumes and key.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.29.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.28
Doca 0.2.28 — User groups and shared permission management
Adds group creation, avatars, roles, named/link invitations with consent, leaving, ownership handover and dissolution. Group grants join personal permissions in Invite collaborators and member management for documents, libraries, knowledge books and shared folders. Shared folders use a folder-sharing icon, with groups immediately below.
Shared membership adds a related-user directory relationship. Administrators configure group search with per-user overrides: joined groups by default, explicit permission intersections, or all active groups. Foreign rosters remain private. Revocation/dissolution immediately removes the corresponding source and reauthorizes connected sessions and knowledge results.
Personal and group grants use the same compact two-line controls, including role changes, descendant scope and confirmed removal. Personal source details reuse those controls; independently granted group access remains effective. Group previews show three avatars, with profile cards and a More popover. Effective group roles appear in bold blue.
Document-tree drag operations now show a loading status through saving and tree refresh, block further dragging while pending and clear the status after success or failure.
The approved schema addition retains the compatibility generation and historical data: seven empty group/ACL tables plus an explicitly initialized joined-groups policy. Startup/hourly cleanup removes associations after 24 hours while retaining content, tombstones and audit. Back up databases, attachments, configuration and master keys, and update every server and Web together. Downgrade needs separate preservation and recovery review; do not drop the added tables or overwrite later writes to bypass older-version review. See behavior, upgrade rules and verification.
GitHub Release assets and native Linux amd64/arm64 Docker Hub images are the publication targets. Publication does not update a running site. Fresh installations can use doca-compose-v0.2.28.yaml; existing sites must preserve their deployment identity and volumes. The 0.2.27 renderer/configuration requirements still apply when upgrading from earlier versions.
Web assets are attached as doca-web-assets-v0.2.28.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Fresh installations can use the attached doca-compose-v0.2.28.yaml: edit the origin and generated master key, then run docker compose up -d. Administrator initialization is built into the image. A SHA-256 checksum is attached. Existing installations must preserve their project, volumes and key.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.28.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.27
Doca 0.2.27 — Browser-free rendering and single-file installation
Rich-text and Markdown PDF exports now use pinned WeasyPrint 70.0. Canvas PNG exports use the official Canvas SDK's SVG output, isolated Node rendering and resvg. The runtime image no longer contains Chromium or Playwright and no longer requires a host seccomp JSON file or browser shared-memory configuration. LibreOffice remains for Office conversion; PDF.js remains for PDF reading and editable import.
Fresh SQLite/local-storage installations can download doca-compose-v0.2.27.yaml from this Release, save it as compose.yaml, set DOCA_ORIGIN and a newly generated DOCA_CREDENTIAL_MASTER_KEY, protect the file, and run docker compose up -d. Initialize the administrator with docker compose exec doca bash docker/admin.sh bootstrap. See deployment instructions for proxy, health, password reset and offline image delivery. The image includes the administrator scripts; no source checkout or companion seccomp file is needed.
Upgrade requirement: remove DOCA_PDF_CHROMIUM from the container environment, even if it is empty. This obsolete setting is explicitly rejected at startup and PDF export; there is no fallback to Chromium. Remove the old security_opt seccomp-file entry from your deployment configuration when using the new image. Existing sites must retain their Compose project name, persistent volumes, databases, attachments, configuration and credential master key. The standalone YAML is for fresh installations, not a replacement for an existing site's configuration.
Existing PDF endpoints, document formats, public editor APIs and historical SDK readers retain their established paths. No database structure or persisted-data conversion is introduced. To roll back, restore the previous code, dependency lock, image and matching deployment configuration while preserving all subsequent data. Upgrades from versions before 0.2.24 must also follow the 0.2.24 requirements.
Export fixes cover table column widths, Chinese font loading and HTML labels in diagrams. Diagrams containing SVG foreignObject are rasterized in the exporting client to preserve their labels; ordinary document text remains selectable. PDF import still approximates complex editable layouts. See the renderer verification for tested examples and limits.
GitHub Release assets and native Linux amd64/arm64 Docker Hub images are the publication targets. Publishing them does not update a running Doca site.
Web assets are attached as doca-web-assets-v0.2.27.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Fresh installations can use the attached doca-compose-v0.2.27.yaml: edit the origin and generated master key, then run docker compose up -d. Administrator initialization is built into the image. A SHA-256 checksum is attached. Existing installations must preserve their project, volumes and key.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.27.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.26
Doca 0.2.26 — Search relevance and spreadsheet editing fixes
Platform and assistant search now filter candidates against the current authorized title and full source text before counting or pagination. A shared brand such as DOCA alone does not satisfy a multiword topic. Queries with no relevant content return an empty list. Successful empty file searches stay empty rather than falling back to candidate listings. The filter favors precision: semantic paraphrases without shared concrete terms can be omitted. Existing AI score settings and access checks remain in force.
The official npm dependency @smartdoca/sheet 0.2.15 fixes clicking the Wrap and Merge labels and prevents frozen panes with unequal row heights or column widths from covering the cell being edited. Host callbacks and public signatures remain unchanged; declaration differences are generated import hashes and union-member order. Model, Yjs, preferences and XLSX runtime bytes match 0.2.14. No host scroll patch, new props, schema change or data conversion is added.
Directory drag operations within one knowledge base now retain trashed descendants while requiring management permission for the entire subtree, as explicitly approved. Descendant contents, deletion states, parent identities and grants are preserved. Failed drag messages remain visible after the list refresh.
This release introduces no database structure or persisted-format changes. Existing historical readers and approved defaults remain in their established paths. Retain the previous deployment and dependency lockfile for package rollback, and preserve all later content. Upgrades from versions before 0.2.24 must also follow the 0.2.24 requirements. See the issue verification.
GitHub release assets and native Linux amd64/arm64 Docker Hub images are the publication targets. Publishing them does not update a running Doca site.
Web assets are attached as doca-web-assets-v0.2.26.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.26.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.25
Doca 0.2.25 — Open Doca from the browser toolbar
Browser extension 0.2.11 adds Open Doca website above Settings in the floating toolbar. Clicking it opens the currently configured Doca site in a new tab, including when signed out. A missing or invalid site configuration opens the extension settings. The action reads the validated site address in the extension worker, with Chinese/English labels and keyboard activation.
Update Doca, download doca-browser-assistant-0.2.11.zip from Browser assistant, reload the extension in Chrome / Edge and refresh open webpages. Updating the server alone does not update an installed extension. No permissions, server APIs, database structures or persisted formats change in this release. Pending captures, conversations and connection settings retain their existing behavior. See toolbar acceptance.
This patch includes the 0.2.24 system Logo and frozen-pane comment navigation changes. Upgrades from earlier releases must also follow that release's approved database requirements. GitHub assets and native Linux amd64/arm64 Docker Hub images are the published artifacts; publication does not deploy a running site.
Web assets are attached as doca-web-assets-v0.2.25.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.25.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.24
Doca 0.2.24 — System Logo and spreadsheet comment navigation
Administrators can upload PNG, JPEG or WebP images under Site & services → Site information → System logo, preview the choice, save it or restore the default icon. The server validates non-animated images up to 5 MB / 16 megapixels, removes source metadata and produces a PNG no larger than 256 pixels per side. The saved icon appears in workspace navigation, sign-in and non-document browser tabs; document tabs retain their existing format/title icons. Failed saves retain the chosen image for retry, and saving branding does not discard unsaved site-name fields.
The approved nullable settings.site_logo addition uses the existing current-DDL reconciler without a compatibility-generation bump. Historical NULL retains default branding. Existing settings, content, permissions and document-startup cache format are preserved; there is no account_settings branding record or historical conversion. Administrator permission, same-origin checks, site-settings revision checks and transactional security audit protect writes. Unknown or damaged Logo records are preserved and rejected.
Update server and Web together after backing up databases, file volumes and deployment configuration. Previous binaries' existing structure review rejects the new field; preserve all later data for a separately reviewed recovery rather than dropping the column or restoring an old backup over later writes. GitHub assets and native Linux amd64/arm64 Docker Hub images are the release artifacts; publishing them does not deploy a running site. The browser extension remains 0.2.10.
Spreadsheet comment navigation now accounts for frozen pane pixel dimensions, including hidden rows/columns and unequal dimensions. It preserves the selection, document bytes and collaboration state. See Logo acceptance and spreadsheet comment acceptance.
Web assets are attached as doca-web-assets-v0.2.24.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.24.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.23
Doca 0.2.23 — Editor comments and resource handover
Doca now uses the official npm releases of all five editors. This release integrates native spreadsheet and slide comment backgrounds and the Canvas table connection-point interaction. Opening the sidebar or following a comment link does not paint a background. Clicking a comment highlights only its associated content; clicking another comment replaces it, and clicking elsewhere, resolving the thread or closing the sidebar clears it. Reopening does not restore a previous highlight. Highlighting is view state and never writes cell styles, shape fills, Yjs transactions or permanent anchors. Table cell editing keeps connection points hidden; non-editing hover or whole-table selection exposes them.
Comment images open in the current-page image viewer, with zoom, copy and download. The comment composer retains its thread while interacting with file-source dialogs. Signed-out private-document links open sign-in directly, and successful sign-in restores the original document and comment target. The document tree uses a smaller indent. Deployment instructions consistently clone main and use its Compose image. AI bubbles retain full layout while a task is running; the specific unreported AI tool failure still needs its conversation/error details and is not claimed resolved.
Administrators can hand over selected resources and retained grants from a disabled account to an active recipient through a preview and confirmation flow. Existing conflicts and recipient restrictions block confirmation. Ownership/grant changes and security audit commit atomically; original content, history authors, uploaders and stored objects remain. See administrator resource handover.
No database structure, document schema/codec, permanent anchor format, epoch, checkpoint or historical-data conversion changes. Existing compatibility readers and upgrade gates retain their established behavior. Update server and Web together. Preserve databases, objects, configuration and later edits when reverting binaries; a confirmed resource handover is a business change and is not automatically undone by a binary rollback.
The browser extension remains 0.2.10.
Verification: five-format comment backgrounds.
Web assets are attached as doca-web-assets-v0.2.23.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.23.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
v0.2.22
Doca 0.2.22 — Automatically reclaim idle capture slots
Every new capture checks the existing ten-task limit. If full, the server retires the oldest pending captures with no upload or retry activity for at least 30 minutes, only until the new request fits. Connections with queued, running or approval-waiting browser AI jobs are protected. Retry and upload activity refreshes the task; long object uploads send a server heartbeat. Ten active tasks remain the limit.
Reclaimed tasks use the existing expired status. Their frozen input, uploaded objects and original 24-hour deadline remain unchanged until normal cleanup. Completed documents and images are retained. Cleanup also removes the retained source of expired tasks with no images when their deadline arrives. Reclamation and insertion share the account lock and transaction; invalid requests do not retire tasks.
Extension 0.2.10 automatically rebuilds an expired capture once from its frozen material, keeping its account, destination, selection and images. It does not reread another page or loop on quota/authorization errors. Unknown current error codes remain visible. No manual task-management workflow is required.
The user explicitly approved this automatic policy on 2026-10-26. Capture protocol v1, authorization v2, database tables/columns and stored JSON shapes are unchanged. Existing pending rows use their recorded activity/deadline; no historical defaults or data conversion are introduced. Older extensions keep their current interfaces and can recapture when an old task reports expiration. During rollback, preserve all records/objects and retain the expired-source cleanup fix, or wait for reclaimed tasks to reach their original deadlines and finish cleanup before reverting that fix.
Update the server to 0.2.22, then download/reload extension 0.2.10. The production failure after 0.2.21 was the full pending-task limit; its generic notice had hidden that cause. Existing content-conversion degradation and image placeholders remain in effect.
See the verification record for the production diagnosis, approved retention policy and regression scope.
Web assets are attached as doca-web-assets-v0.2.22.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.22.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.
GitHub attachments and Docker Hub amd64/arm64 publication have been independently verified. See the release verification receipt. Production Annual Reviews acceptance has also passed after the site upgrade and extension reload: the real Chrome capture, document open and reload preserve the article ending, references and all nine stored images; the unsupported site SVG remains a placeholder with a current warning.
v0.2.21
Doca 0.2.21 — Save long webpage conversions
Browser extension 0.2.8 excludes CSS-hidden article copies, reference panels and menus from full-page capture. Below-the-fold content remains included, and visible SVG images retain their styles and definitions.
When formatting expands an accepted capture beyond the existing 768 KiB new-document import limit, the server saves the complete original Markdown as bounded plain-text blocks, preserves the page title and uploaded images, and returns a visible format-degradation notice. It does not truncate the article or repeatedly retry an oversized formatted model. The existing import limit, capture source limits, asset authorization, quota checks and storage failures remain enforced. Appending to existing documents keeps its existing size policy.
No database structure, document schema, protocol version, frozen task format or report storage changes. Existing documents and tasks are not rewritten. Start a new capture to apply the new extraction rules; completed requests continue returning the same saved document. Update the server to 0.2.21 and download/reload extension 0.2.8. Preserve existing data and later writes during rollback; no data conversion is required.
Regression coverage verifies complete source and image preservation, Unicode text blocks, the original title, CSS-hidden duplicates, and visible SVG styles using isolated documents.
The reported Annual Reviews page was captured through Chrome with extension 0.2.8, opened and reloaded successfully against an isolated 0.2.21 server. Both article figures loaded; one unsupported site-logo SVG remained a visible placeholder and current warning. See the browser acceptance record.
Web assets are attached as doca-web-assets-v0.2.21.tar.gz.
Extract it and publish the assets directory unchanged.
Set DOCA_ASSET_BASE to the HTTPS prefix that contains that assets directory, with no trailing slash.
Image-only deployment files and initialization instructions are attached as doca-deploy-v0.2.21.tar.gz with a SHA-256 checksum.
Transfer this bundle to servers without GitHub access; no source checkout is needed.
The container image is separate. Pull the matching smartdoca/doca image or transfer it with docker save/load.