# ConnectOnion 1.8.4 — stable release

Stable release, 8 September 2026. This promotes the 1.8.4 preview and the
reviewed fixes in #1467, #1468, #1469 and #1470. Publication is verified by
the immutable-tag workflow before the stable docs site is deployed.

```bash
python -m pip install --upgrade connectonion==1.8.4
co --version
co env
```

## Changes

- Global settings and provider credential records follow the explicitly selected
  source across authentication, refresh and diagnostics. Working directory no
  longer silently selects a project `.env` or changes accounts.
- `co env` shows, sets and removes settings in the selected env file, redacts
  all values by default, says which values the shell overrides, and refuses to edit provider
  account records field by field. A broken line in `keys.env` now stops other
  commands with `Next: co env` and a line number instead of `co --help`;
  `co doctor` and the provider commands name `co env set …` / `co env` as the
  fix instead of describing the file.
- Gmail lists have frozen account-bound row contexts. Mailbox actions and incoming
  attachments use bounded JSON, truthful failures and private, collision-safe
  downloads. `unanswered` means the latest non-draft message is incoming.
- Gmail draft review binds confirmation to the exact account, thread and MIME
  content. Managed local/Drive source records survive edits and reloads; uncertain
  sends have durable recovery instead of a blind retry.
- Synology has the approved twenty-command core: explicit verified profiles,
  bounded inspections, safe transfers, durable copy/move task IDs and sharing.
  Optional SNMP/SSH monitoring is configured explicitly; unavailable data stays
  unavailable instead of appearing healthy.
- Synology sharing reads back password protection and expiry before reporting
  success. A mismatch revokes only the newly identified link; uncertain cleanup
  remains explicit. QuickConnect discovery supports regional relay addresses.
- Outlook credential failures name the correct login. Replies support CC/BCC;
  calendar writes preview by default. Teams creation without a confirmed join URL
  exits nonzero and names the existing event to inspect, avoiding duplicate creation.
- Background task shutdown terminates owned process trees and retires their
  output readers before cleanup completes.
- Full Control Center apps share the current conversation through a scoped browser
  connection. Immutable builds pass runtime-owned review before activation;
  blocked updates preserve the approved app. Code/diff, history, rollback and
  manual, periodic or internal-event updates use the same review path.
- Agent identity diagnostics use the selected configuration and backend. The
  optional subagent registry cleanup preserves project overrides.

## Migration

Settings default to `$AGENT_CONFIG_PATH/keys.env`, normally `~/.co/keys.env`.
Applications that relied on automatic project `.env` loading must select it
explicitly. CLI selection is a root option:

```bash
co --env-file ./project.env gmail inbox
```

Plain `co init` initializes global configuration. Use explicit project creation
when you want project files. Inherited process variables remain an explicit
configuration boundary; partial provider records are not mixed across accounts.

Gmail and Drive numeric rows now require the listing token printed by their
listing command. Full provider IDs remain available. Re-list after expiry or an
account change. Use `co gmail draft review DRAFT_ID` before sending; noninteractive
sending requires the returned exact confirmation token. Re-review after an edit.

Synology `download`/`upload` are canonical. The `get`/`put`/`shares` compatibility
aliases retain their documented restrictions, including frozen listing tokens
for numeric references. Review profile/TLS setup and partial monitoring coverage
in the [Synology guide](/cli/synology.md).

O Chat uses published SDK rc.2. Hosting acceptance for this candidate is local:
loopback GCS emulator, concurrency/quota, immutable serving and cleanup all pass.
A future production deployment needs the separate static service and domain
configuration documented in [oo-api #235](https://github.com/openonion/oo-api/pull/235).
No cloud resource was created for this test run.

## Evidence and publication status

The merged code passed 8,666 offline tests, with 21 skipped, and 79.79% coverage
against a 78% floor. Eleven installed-wheel tests passed. The final release PR
records the versioned artifact checks. The [visual manifest](https://github.com/openonion/connectonion/blob/v1.8.4/docs/releases/assets/v1.8.4/manifest.yml)
includes installed CLI captures and separately identified companion UI evidence.

Real Gmail/Drive acceptance covered reviewed send, lost-receipt recovery, mailbox
operations and attachment bytes. One physical NAS passed file operations, recursive
transfers, durable receipts and sharing checks. Browser tests verified a password
gate, rejection of a wrong password, access with the correct password, an already
expired link and revocation after prior access. Synthetic fixtures were cleaned up.
These are combined focused runs, not a claim of one uninterrupted full harness run.

Limits: Microsoft reply/Teams contracts have mocked coverage, with no live tenant
acceptance. NAS evidence does not cover a hardware matrix, the midnight expiry
transition or an already issued download URL/in-flight download. Optional SNMP/SSH
monitoring was unconfigured. Companion hosting was tested locally; its production
service and O Chat deployment are separate from this Python package release.
No cloud resource was provisioned. Private device/account records remain local.

New Gmail scheduling, Personal Wiki, Sync Knowledge, TikTok, new messaging adapters
and inbound automatic replies are outside 1.8.4. Existing Google and Gemini
releases are preserved; deferred code from the old combined Google/TikTok branch
is not included.