ConnectOnion 1.6.0

This release is the result of a security and reliability pass across the Python package, hosted-agent backend, TypeScript client, React SDK, and documentation.

Remote control is authenticated more consistently

Host identity and temporary session-status probes now use the same signed-command model. Relay profile updates also reject stale state and conflicting updates instead of silently accepting whichever request arrives last.

Microsoft credentials stay local

Microsoft OAuth access tokens, refresh tokens, and token rotation now remain on the CLI machine. ConnectOnion's backend does not store Microsoft credentials. This is a deliberate design boundary: the CLI refreshes locally when it needs to make a Microsoft API call.

Safer onboarding and email delivery

• New projects use private invite credentials; the old shared default invite code is gone.
• Email retries use traceable, tenant-scoped idempotency keys to prevent duplicate sends.
• Provider failures return stable errors without hiding the underlying server trace.
• Mailbox upgrades charge and apply the new quota atomically, and can keep the existing address.

Release artifacts are exercised as users install them

The release gate covers Python 3.10–3.13, native Windows browser behavior, dependency audits, and installation from the built wheel. PyPI and GitHub carry the same verified wheel and source archive.

Upgrade

pip install --upgrade connectonion==1.6.0

React applications should use @connectonion/react@0.3.3. The standalone TypeScript client remains available for non-React consumers as connectonion@0.3.4.