Skip to content

Release Notes - v0.17.0

Release Date: 2026-08-10

v0.17.0 completes the Team Agent initiative started in v0.16.0. It adds an Admin UI for member/allowlist management, Google and GitHub single sign-on, and a production hosted-deployment stack (Docker Compose, Caddy automatic HTTPS, backup/restore) — everything needed to run a self-hosted team-mode deployment end to end, from first login to daily operations.

Highlights

  • Admin UI - A superadmin-only Admin tab for allowlist and member management (disable/enable, rename), over a new /api/admin/users API.
  • Single Sign-On - Optional Google OIDC and GitHub OAuth login, additive to magic-link email. An SSO identity links by verified email to an existing account rather than creating a duplicate, and never bypasses the allowlist.
  • Hosted Deployment - A production Docker Compose stack (deploy/team/prod/) — Caddy with automatic HTTPS, PostgreSQL never exposed to the host, omniagent fully environment-variable configured — plus backup/restore scripts with an automated, CI-verified restore check.
  • Team Deployment Guide - A new guide covering Lightsail provisioning, the compose stack, a smoke checklist, and day-2 operations (upgrades, rollback, troubleshooting).

What's New

Admin UI

Superadmins get an Admin tab in the web UI, alongside the existing allowlist API:

  • Allowlist — add or remove approved emails, with an optional note.
  • Members — every user's role, status, and linked sign-in providers, with a Disable/Enable toggle. Disabling ends access immediately without deleting the account; a superadmin cannot disable their own account.

New endpoints: GET /api/admin/users, PATCH /api/admin/users/{id}.

See the Team Mode guide.

Single Sign-On (Google, GitHub)

Configure one or both providers under team.sso:

team:
  sso:
    google:
      client_id: "1234567890-abc.apps.googleusercontent.com"
      client_secret: "GOCSPX-..."
    github:
      client_id: "Iv1.abc123"
      client_secret: "..."
  • The redirect URI is fixed, not configurable: {base_url}/api/auth/{google,github}/callback.
  • A first-time sign-in checks the provider's verified email against the allowlist exactly like a magic-link request — a non-allowlisted email is rejected and no account is created.
  • If the verified email matches an existing user (e.g. someone who has only used magic-link so far), the SSO identity links to that same account. A user can hold multiple linked identities at once; the Admin tab's Members card shows each as a badge.
  • Google SSO performs a real OIDC discovery call at gateway startup; a discovery failure is fatal by design, so a misconfigured deployment fails loudly instead of silently never offering the button. GitHub's plain OAuth2 flow makes no such call.

See the Team Mode guide for exact Google Cloud Console / GitHub OAuth App registration steps.

Hosted Deployment

A complete, from-scratch deployment path for a single-VM team-mode stack:

  • deploy/team/prod/docker-compose.yaml — Caddy (automatic HTTPS) → omniagent → PostgreSQL (never published to the host), with named volumes for data and certificate persistence across restarts.
  • deploy/team/prod/backup.sh / restore.sh — pg_dump/psql-based, with a manual GitHub Actions workflow (team-backup-restore.yaml) that verifies the restore path against a disposable database.
  • A new Team Deployment guide: Lightsail provisioning, a smoke checklist, and operations (upgrades, rollback, the full environment-variable matrix, troubleshooting).

Configuration

  • team.* fields are now settable via OMNIAGENT_TEAM_* environment variables (database DSNs, base URL, superadmin email, SMTP, SSO client credentials) — the mechanism the new Compose stack relies on. See Environment Variables → Team Mode.
  • Fixed a previously-published but non-functional ${VAR}-style config example (team.smtp.password, agent.api_key) — YAML values are not shell-expanded; use the documented env vars instead.

Upgrade Notes

  • No breaking changes. SSO and the hosted-deployment assets are additive and opt-in; existing team-mode and personal-mode deployments are unaffected.
  • If you deploy via the new Compose stack, PostgreSQL migrations (including the identities table used by SSO/admin identity linking) run automatically and idempotently on omniagent startup.
  • Configuring Google SSO makes gateway run perform a real network call at boot (OIDC discovery); ensure the host has outbound internet access to accounts.google.com before enabling it in production.

Full Changelog

See CHANGELOG.md for the complete list of changes with commit references.