v0.67.0

Minor Changes

• Embed an Excalidraw board in a document.

  A new <Excalidraw src="board.excalidraw" /> block embeds a board by reference: it renders a live snapshot of the scene (dark-mode aware) that follows edits made on the board without a reload, expands to a full-screen viewer with pan and zoom from the block's chrome, and carries a control that opens the board's own collaborative canvas editor. The scene JSON stays in the .excalidraw file — nothing bulky lands in the document source. The block sits in the slash menu's Embeds group.

• OpenKnowledge Desktop's built-in terminal now works on Windows 10 version 1809 or later, Windows 11, and Windows Server 2019 or later. The Windows terminal includes automatic Windows PowerShell, PowerShell 7, and cmd.exe discovery, Git Bash support through an explicit terminal.shell override, agent CLI and managed-command launching, clipboard shortcuts, packaged ConPTY support, and update-time cleanup for console hosts owned by the installed app. Agent-launch prompts are pasted without being submitted automatically, so review the prompt and press Enter to send it. Existing absolute overrides outside the supported shell families remain usable for plain terminal tabs, with a capability notice explaining their launch and dropped-file limits.

Patch Changes

• Renaming an open document to a different kind — .excalidraw, .mmd, or a plain text extension — now drops straight to the new surface's loading skeleton instead of flashing the old markdown text while the new editor loads.

• Checkboxes now appear when you type them. Start a line with [] , [ ] , [x] , or [X] and it becomes a task item, the shorthand other markdown editors share.

  The hyphenated spellings work too. - [ ] , * [x] and friends previously left the brackets sitting in the list item as literal text: the - had already turned the line into a bullet by the time you reached the [, so the rule that was meant to catch a checkbox no longer had a marker to match against. Between that and the missing bare shorthand, no sequence of keystrokes produced a checkbox at all — only the slash command and Cmd+Shift+9 could.

  Empty brackets are a convenience on the way in, not a change to what gets written: every unchecked box saves as - [ ] , and only the uppercase - [X] keeps its capital. Backspace right after a box appears on its own line dissolves it back to plain text, the same as it does for a bullet you did not mean to start. After - [ ] , where the bullet and the box are two separate autocorrections, Backspace undoes the box and leaves the bullet.

• Refuse writes routed into .ok/.git through the upload API, and stop blaming the caller for a missing content directory.

  /api/upload now rejects a destination inside a reserved subtree: a parentDocName that names or symlinks into .ok/.git, and a configured content.attachmentFolderPath that points there, both return 400 urn:ok:error:reserved-doc-name where they previously wrote agent-loaded content into .ok/skills/ with no validation. The check runs on the resolved destination directory, so a directory symlink planted in a cloned tree cannot route around it. The same canonical check now also covers the source path of a rename and the create-folder/duplicate-path/delete-path routes, and a .ok/templates directory that is itself a symlink is skipped when building the templates menu. The same canonical check now also gates GET/PUT /api/folder-config, the /api/template family including /api/template/import, and the folder-mode GET /api/history?folder=.

  Separately, a content directory that is missing at request time (deleted under a running server, unmounted volume) now surfaces as a 500 server error instead of a 400 path-escape blaming the request, and symlink escapes on create-folder, duplicate-path and delete-path return the documented 400 urn:ok:error:path-escape instead of a generic 500.