v0.44.0

Minor Changes

• Serve your knowledge base's MCP endpoint to your other devices through any HTTPS tunnel — ngrok, Cloudflare Tunnel, Tailscale, or a reverse proxy: run the tunnel against the stable remote port (default 24550, remote.port to change) and start the server with ok start --remote <url> (or set remote.url in .ok/config.yml and pass a bare --remote). The model is trust-the-tunnel: OpenKnowledge does not authenticate remote callers — anyone who can reach the tunnel URL has full read-write access, and restricting reach is the tunnel's job (private tailnet, ngrok OAuth, Cloudflare Access). The trade is always explicit: remote access is armed only by the --remote flag (never by config alone), every remote start prints a warning banner, and a server started without the flag refuses tunneled requests with a fix-it hint instead of serving them. The web UI is served from the same tunnel URL (/ = editor, /mcp = MCP — one port, one tunnel; browse and edit from your phone). Its collaborative surfaces work over the tunnel too: live editing and the Ask AI panel, which runs an agent on the machine hosting the server (using that host's own agent and credentials). Wrong-Host requests (DNS rebinding) are refused everywhere. Local loopback behavior is unchanged.