ConnectOnion 1.8.4 — stable release

Stable release, 8 September 2026. This promotes the 1.8.4 preview and the reviewed fixes in #1467, #1468, #1469 and #1470. Publication is verified by the immutable-tag workflow before the stable docs site is deployed.

python -m pip install --upgrade connectonion==1.8.4
co --version
co env

Changes

• Global settings and provider credential records follow the explicitly selected source across authentication, refresh and diagnostics. Working directory no longer silently selects a project .env or changes accounts.
• co env shows, sets and removes settings in the selected env file, redacts all values by default, says which values the shell overrides, and refuses to edit provider account records field by field. A broken line in keys.env now stops other commands with Next: co env and a line number instead of co --help; co doctor and the provider commands name co env set … / co env as the fix instead of describing the file.
• Gmail lists have frozen account-bound row contexts. Mailbox actions and incoming attachments use bounded JSON, truthful failures and private, collision-safe downloads. unanswered means the latest non-draft message is incoming.
• Gmail draft review binds confirmation to the exact account, thread and MIME content. Managed local/Drive source records survive edits and reloads; uncertain sends have durable recovery instead of a blind retry.
• Synology has the approved twenty-command core: explicit verified profiles, bounded inspections, safe transfers, durable copy/move task IDs and sharing. Optional SNMP/SSH monitoring is configured explicitly; unavailable data stays unavailable instead of appearing healthy.
• Synology sharing reads back password protection and expiry before reporting success. A mismatch revokes only the newly identified link; uncertain cleanup remains explicit. QuickConnect discovery supports regional relay addresses.
• Outlook credential failures name the correct login. Replies support CC/BCC; calendar writes preview by default. Teams creation without a confirmed join URL exits nonzero and names the existing event to inspect, avoiding duplicate creation.
• Background task shutdown terminates owned process trees and retires their output readers before cleanup completes.
• Full Control Center apps share the current conversation through a scoped browser connection. Immutable builds pass runtime-owned review before activation; blocked updates preserve the approved app. Code/diff, history, rollback and manual, periodic or internal-event updates use the same review path.
• Agent identity diagnostics use the selected configuration and backend. The optional subagent registry cleanup preserves project overrides.

Migration

Settings default to $AGENT_CONFIG_PATH/keys.env, normally ~/.co/keys.env. Applications that relied on automatic project .env loading must select it explicitly. CLI selection is a root option:

co --env-file ./project.env gmail inbox

Plain co init initializes global configuration. Use explicit project creation when you want project files. Inherited process variables remain an explicit configuration boundary; partial provider records are not mixed across accounts.

Gmail and Drive numeric rows now require the listing token printed by their listing command. Full provider IDs remain available. Re-list after expiry or an account change. Use co gmail draft review DRAFT_ID before sending; noninteractive sending requires the returned exact confirmation token. Re-review after an edit.

Synology download/upload are canonical. The get/put/shares compatibility aliases retain their documented restrictions, including frozen listing tokens for numeric references. Review profile/TLS setup and partial monitoring coverage in the Synology guide.

O Chat uses published SDK rc.2. Hosting acceptance for this candidate is local: loopback GCS emulator, concurrency/quota, immutable serving and cleanup all pass. A future production deployment needs the separate static service and domain configuration documented in oo-api #235. No cloud resource was created for this test run.

Evidence and publication status

The merged code passed 8,666 offline tests, with 21 skipped, and 79.79% coverage against a 78% floor. Eleven installed-wheel tests passed. The final release PR records the versioned artifact checks. The visual manifest includes installed CLI captures and separately identified companion UI evidence.

Real Gmail/Drive acceptance covered reviewed send, lost-receipt recovery, mailbox operations and attachment bytes. One physical NAS passed file operations, recursive transfers, durable receipts and sharing checks. Browser tests verified a password gate, rejection of a wrong password, access with the correct password, an already expired link and revocation after prior access. Synthetic fixtures were cleaned up. These are combined focused runs, not a claim of one uninterrupted full harness run.

Limits: Microsoft reply/Teams contracts have mocked coverage, with no live tenant acceptance. NAS evidence does not cover a hardware matrix, the midnight expiry transition or an already issued download URL/in-flight download. Optional SNMP/SSH monitoring was unconfigured. Companion hosting was tested locally; its production service and O Chat deployment are separate from this Python package release. No cloud resource was provisioned. Private device/account records remain local.

New Gmail scheduling, Personal Wiki, Sync Knowledge, TikTok, new messaging adapters and inbound automatic replies are outside 1.8.4. Existing Google and Gemini releases are preserved; deferred code from the old combined Google/TikTok branch is not included.